Attacking Mobile Broadband Modems Like a Criminal Would
summary
Shows concrete, web-based attacks that let an attacker reroute traffic and push firmware updates without code signing: a simple DNS profile CSRF can add a read‑only profile, set attacker DNS, and spoof HTTP firmware files to install a backdoor. Targets include Huawei and CT devices (QA E3276 and CT MF821D) and 130 million shipped units are cited. Demonstrated abuses include SMS SCA redirect to intercept texts, sending premium SMS for revenue, and language-parameter persistent XSS that uses the modem SMS inbox as a remote command channel.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:30About me
- 1:03Agenda
- 1:42Introduction
- 3:01Why
- 3:59Targets
- 5:19Overview
- 7:10Network topology
- 7:47The attacks
- 8:01Objectives
- 8:40Configuration
- 9:12DNS Poisoning
- 10:08Connection Profiles
- 10:35Crosssite request forgery
- 11:23Firmware spoofing
- 13:38CSRF
- 16:14Persistence
- 17:04Configuration Parameters
- 17:59Web Interface
- 18:56Language
- 20:08Demo
- 22:51What to expect
- 23:25Vendor response
related talks
49mAll the 4G Modules Could be Hacked
44mExposing Critical Threats In Millions Of Connected Devices
38mModems (and telecoms) are also not as secure - 6 0-days to 4 million modems within a week
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
40mWeaponizing Mobile Infrastructure: Are Politically Motivated Cyber Attacks a Threat to Democracy?
45mExploiting Qualcomm WLAN and Modem Over The Air
54mExposing device features on 4G & 5G networks