1

What are the risks associated with the use of portable USB modems, specifically uncontrolled BYOD USB modems as opposed to secure managed USB modems?

I plan on allowing multiple users to plug their own portable USB modems into an organization's laptop.

I have found some vulnerabilities associated with particular types of USB modems.

I.e,

  1. Corrupted USB Modem plugged into the laptop infects the laptop?

  2. USB Modem is switched with a malicious USB Modem and a malicious external user is able to intercept and inspect Internet traffic.

Improve this question

1 Answer 1

Reset to default
2

I plan on allowing multiple users to plug their own portable USB modems into an organization's laptop.

Does this mean you allow your users to use a network different from the company network on their laptops and later use the company network again on the same laptop? This would effectively make any network wide security you are (hopefully) using useless, because malware could infect your company network from the external (modem based) network to the company network by using the laptop as a step in the exploitation and thus bypass any network wide protection like firewalls.

Corrupted USB Modem plugged into the laptop infects the laptop?

Possible, but it's less the modem itself but the driver. See also Vulnerability in USB modems allows hacker to access millions of computers remotly or Hacking 4G USB modems and SIM Card via SMS.

Anyway, whenever you give up control about a computer by allowing the user to use different networks, install their own software, use their own drivers etc you must assume afterwards that the system might be compromised and not allow it back into your internal network, in order to protect the rest of the network.

Improve this answer
2
  • @Steffan Ullrich 'Does this mean you allow your users to use a network different from the company network on their laptops and later use the company network again on the same laptop?' I am referring to portable organisation laptops which do not physically, or wirelessly, connect to the corporate network.
    – KimberleyK
    Sep 15, 2015 at 4:57
  • 1
    @KimberleyK - it's still a vulnerability if those laptops have any company data on them. Users will need to share that data with other users meaning bad things could easily be passed around if an attacker wanted. Plus the devices are unmanaged, which is a significant problem in it's own right..
    – James Snell
    Sep 15, 2015 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .