I'm thinking about whether or not to get a mobile(3G/4G) broadband router, but I need to know a few things about them.

How secure are they?

If an attacker were to put up a femtocell/rogue cell tower close by, what kind of attacks are possible? How much of the internet traffic can they view and/or modify?

Is it possbile for the SIM module itself to be attacked through some combination of AT commands?

Would using tor over mobile broadband be reasonably secure?

What kind of attacks on the the mobile broadband router's DNS/ARP are possible and what ways are possible to secure or defend against them?

  • 1
    This is an incredibly broad question. In general, 3G and 4G use rather weak crypto (KASUMI and SNOW ciphers, respectively). Authentication is poor, and downgrade attacks are common. A rogue tower would be able to MITM the connection and mess with any internet traffic. Tor would be reasonably secure as it is designed to be safe even over an untrusted network. – forest Feb 3 '18 at 4:15
  • Would it be correct to assume that the downgrade shouldn't worry me if I'll be using tor and that traffic will be well protected from MITM and being modified by tor? – newb54 Feb 3 '18 at 5:11
  • Correct. As long as you have a genuine Tor binary, it will ensure that your connection to the Tor network are encrypted and authenticated. If your network connection is MITMed, the attacker will not be able to modify the traffic in any meaningful way. – forest Feb 3 '18 at 5:14
  • Thanks. I understand there's a risk of DNS spoof with tor, but at the exit node. Is there anything I should be concerned about in the case of a DNS spoof or ARP cache poisoning being done on the router? – newb54 Feb 3 '18 at 5:24
  • No. DNS poisoning and such do not affect Tor's connection to your guard node. ARP cache poisoning is only relevant to your LAN (so it doesn't matter if you get internet through DSL, dial-up, cable, or 3G). – forest Feb 3 '18 at 5:26