How much more or less secure is using a mobile (3G/4G) router to connect to the internet?

I know using tor over the internet should render eavesdropping useless, but excluding physical access, what kinds of attacks or exploits are possible on mobile routers?

Besides downgrading, what kinds of attacks are possible using IMSI-catchers? Since IMSI-catchers are usually computers or run on computers, can an attacker with an IMSI-catcher use it to somehow leverage the SIM module and gain access to the router?

I'm interested in exploits or attacks similar to this but launched from the mobile network/IMSI-catcher instead of breaking in through WiFi.

UPDATE: I found this pretty recent article which seems to describe what I'm asking about. The article mentions

These AT commands are all exposed via the phone's USB interface, meaning an attacker would have to either gain access to a user's device, or hide a malicious component inside USB docks, chargers, or charging stations. . . .

. . . They also plan on testing Apple devices, but also if AT commands are available via remote access vectors such as a phone's WiFi or Bluetooth connections.

which, if I'm not mistaken, means that the AT commands are executed from a (possibly infected or compromised) computer that the phone is connected to,

and also that

Once an attacker is connected via the USB to a target's phone, he can use one of the phone's secret AT commands to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, or even inject touch events solely through the use of AT commands.

which what I'm concerned about.

The attack at the moment seems only to target phones, now I'm wondering if something like this should be possible for mobile routers, too.

closed as unclear what you're asking by Marcus Müller, ThoriumBR, Tobi Nary, Teun Vink, Royce Williams Sep 10 '18 at 3:44

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • "How much more or less secure..." - compared to what? Do you want to compare the router hardware and software (which is often similar insecure as the one for DSL and cable routers), do you want to compare the trust in the carrier (i.e. trust in mobile ISP vs. DSL/cable provider - usually similar problems) or do you ask about possible ways of intercepting and manipulating the data between router and peer - compared to DSL, cable, WiFi, ethernet ... or what? – Steffen Ullrich Aug 26 '18 at 17:12
  • Intercepting and manipulating data. Since the mobile network is the means of connecting to the internet, an attacker with an IMSI-catcher can directly connect to it. I'm wondering what kinds of exploits or attacks can be carried out besides 3G/4G downgrading. – user942937 Aug 26 '18 at 17:24
  • So your question is not really about mobile routers but about mobile devices (including phones - which can also act as a router by enabling tethering) and asks against attacks which allow sniffing and/or modification and are specific to data exchange via mobile networks? If I understood this correctly then please adjust your question to make this more clear. – Steffen Ullrich Aug 26 '18 at 17:40
  • Since the question mentions IMSI-catchers, I would have no doubt that sniffing and/or modification are definitely happening. I'm interested in attacks possibly from the mobile network or using the IMSI-catcher, if any, that will allow the attacker to gain access to the router's internals and probably install some sort of rootkit or backdoor. – user942937 Aug 26 '18 at 18:22
  • @user942937 the same as for every internet-connected device. There's nothing special about mobile routers here, really. OK, they do have baseband firmware that can be upgraded over the air, but exploits that would allow the firmware supplier to modify anything on the router itself would belong in the category "backdoor installed by a secret service-type adversary at the side of the router chipset manufacturer"; not quite sure what the threat scenario is here, at all, because these could just, you know, sniff the traffic going through the network, if you're the one exchanging the firmware OTA – Marcus Müller Aug 26 '18 at 19:40

Browse other questions tagged or ask your own question.