Are there known hacks or security problems on broadband USB dongles?

Question

USB broadband dongles seem to be common everywhere now though I'm not sure what the most widely accepted name for them is. In case I'm using poor terminology I'm referring to USB sticks which contain a modem able to connect to telephone carriers mobile networks, generally prepaid in myriad varieties.

So I'm wondering if there are any known exploits, vulnerabilities, hacks, that I should know about.

(I have a Digi stick given to me by a friend here in Romania, I don't know much about it but it was free and it works great but won't work outside Romania of course)

^{P.S. I wasn't sure how best to tag this question.}

Answer 1

I would say that cellular networks are more secure than almost any other wireless network.

The answer is probably.. "No less secure than a home broadband connection."

Other answers mention things that are issues with ISP's in general and aren't really a problem with the dongle.

Answer 2

The following presentation from Blackhat, is exploiting the Intel Centrino drivers in Microsoft Windows.

Remote and Local Exploitation of Network Drivers

Attacking a USB modem in the similar way, in contrast to the Intel Centrino attack, is much more unlikely. The attacker is most likely stuck at the TCP/IP layer, where in the wireless case, the attacker sent malformed wireless frames.

I would imagine the attacker would perform a man-in-the-middle attack on your ISP's (ADSL?) wiring. Pretty unfeasible, even if a modem was vulnerable, it would involve lot of hardware, physical presence and effort.

But lets not forget the old ATH modem hangup vulnerability... something interesting might appear soon.

Answer 3

To answer your exact question, to the best of my knowledge no security vulnerabilities from USB dongles have gotten any attention in the past years. I guess that was what you're looking for?

However, there are known cases of rogue USB devices that are used to backdoor computers. Some security companies doing penetration testing and social engineering combined, even leave behind USB sticks with malware on them at the offices of targets. And of course, there's Stuxnet, which reached the nuclear facility by USB stick. So in general, I'd be reluctant to plug unknown USB devices into my computer.

Also, one often needs to install crappy drivers from the telco in order for the dongle to work. I usually don't really trust those :-)

And don't forget that the broadband connection itself is probably being monitored by the telco. Sometimes all HTTP requests are pushed through a transparent proxy. I'd recommend to VPN out of the telco's network first, and do al your interwebsing over that VPN.