0

Nearly all mobile phones are vulnerable to IMSI catcher attack's fake mobile networks. They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN in use. Conduct MITM attacks.

They all have bad modem isolation, allow IMSI catcher direct access to hardware components that allow for compromise. Some phones have good modem isolation there all old phones.

This explains it: https://replicant.us/freedom-privacy-security-issues.php

Just to be clear the phones with good modem isolation prevent remote attacks on phones IMSI catchers can do. Or there wouldn't be a threat model for it. So the phones on that site prevent it.

I want to no about 4G portable hotspots separate from phones, since there seems some doubt about IMSI catchers. Here's an article from electronic frontier foundation about them, why phones in general have bad security.

https://ssd.eff.org/en/module/problem-mobile-phones

I'm considering if buying a portable 4G portable hotspot would be safe from IMSI catcher if a phone with no sim cards at all was connected to the portable 4G hotspot.

What effects could a IMSI catcher have? I'm thinking as its separate from the phone itself it obviously stops access to phones hardware components. But what hardware it can see and access on the portable 4G hotspot itself is a question? it might be able to backdoor, compromise it's security.

I don't know if there are any 4G portable hotspots that have good modem isolation. The article explains if you use a VPN on a phone with bad modem isolation, then an IMSI catcher can see the all traffic unencrypted.

So if using a VPN on a phone with no sim cards at all that's connected to a portable 4G hotspot, will the IMSI catcher get unencrypted access to all traffic? or is good modem isolation needed for the portable 4G hotspot itself, to prevent that as it is on a phone?

Maybe this would be the same for home wireless mobile broadband? They plug into power source but are also 4G but closer to a traditional router.

  • 3
    The article you point to has nothing about IMSI catchers or VPN in it. An IMSI catcher basically just simulates a cell tower. "They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN in use." - they could trigger code execution into the mobile stack of your phone if your phone has a bug - but otherwise these things are not possible. And none of this is claimed in the article you refer to. – Steffen Ullrich Nov 10 '18 at 21:01
  • No it doesn't directly say IMSI catchers, it does clearly explain why all phones are insecure, phone modems, basebands are written in 1990's code insecure can't be audited has bugs closed source. All phones inherently trust whatever network there connected to, like a fake cell tower that article shows what can happen with bad isolation that's exactly the types of things a IMSI catcher will do why there so effective. It is talking about IMSI catchers anything remotely turning microphone on is that. – Alister Nov 10 '18 at 21:27
  • replicant.us/about.php#faq – Alister Nov 10 '18 at 21:28
  • Is my data safe when stored on a device running Replicant? Are my communications safe when using a device running Replicant? Read those it doesn't say VPN does say unencrypted traffic you can find videos on YouTube of people attacking baseband, modem security researchers ect – Alister Nov 10 '18 at 21:33
  • Attacking the Baseband Modem of Mobile Phones to Breach the Users’ Privacy and Network Security: youtube.com/watch?v=I99VHVi0mXs&pbjreload=10 plenty of others on there. – Alister Nov 10 '18 at 21:44
1

IMSI catchers essentially simulate cell towers. Nearby phones will try to use these fake towers in order to provide connectivity. But while normal cell towers usually act in the interest of their users fake cell towers might in theory misuse protocol features or send malformed protocol data in order to trigger bugs in the phones modem. Given that the modem driver usually runs with kernel permissions in current mobile OS a bug in the modem firmware and driver might give the attacker kernel level privileges which effectively would allow to control the whole phone.

With 4G hotspots the situation is not much different, only that the initial attack target would be the hotspot and not the phone. Once the attacker has taken over the hotspot it can intercept any connections and unless these connections are specifically protected with HTTPS or by using a VPN the attacker could also modify the traffic. But even if the phone protects itself well against such traffic MITM with a VPN or HTTPS it still leaves communication at the lower level, for example attacking the phone with malformed DHCP or attacking it through malformed Wifi.

Note that all of these attacks require bugs in the phones and hotspots software and firmware. But specifically at the lower network layers (i.e. 4G modem, Wifi firmware, Bluetooth firmware, DHCP) attacks are less expected and thus the software/firmware is usually not designed to be robust against attacks. And 4G hotspots usually have a similar shoddy security as known from cheap (and sometimes expensive) WiFi routers.

To summarize: using a 4G hotspot will make it harder for an attacker since there are more protections to bypass. But, if there are vulnerabilities at the various stages then attacking the phone connected to the hotspot can be done too. Note that most of the attacks would need a very knowledgeable attacker though which makes it less likely to get attacked unless specifically targeted. And if one is specifically targeted then the attacker might also choose a completely different path for attacks since this might be easier, so don't just try to protect the phone communication.

  • article about IMSI in my post now, so do you agree good modem isolation on phones protects them? if yes does simply using a portable separate hotspot not a phone achieve the same thing? so long as a device connected to it doesn't use sim cards and a VPN is been used? would specific hardware for portable 4G hotspot matter? Brands would good bad isolation matter for a portable hotspot as it doesn't have access to as much private hardware that a phone does. Microphone, camera storage ect an IMSI targets everyone close to one you don't need to be targeted as an individual not my concern. – Alister Nov 11 '18 at 8:02
  • @Alister: current phones provide no real isolation of the modem: the driver is run inside the kernel and thus exploits result in gaining kernel privileges - which ultimately might allow full control of the device (Microphone, Storage, apps...) . Using a G4 hotspot adds some isolation since kernel privileges on the hotspot don't mean kernel privileges at the phone but additional attacks would be required to attack the phone from the hotspot. – Steffen Ullrich Nov 11 '18 at 8:10
  • Is a g4 hotspot just a portable one? Haven't heard of g4 don't no if its any different or if just means pocket 4G WiFi? A g4 hotspot data internet could be seen via fake cell tower so VPN would help. But... can a kernel exploit against it infect it with a backdoor, rootkit in which case VPN would be defeated? Why a phone with poor modem isolation and VPN isn't good if a rootkit is on the phone. I saw an article IMSI catcher exploit can make phone crash restart and installs a rootkit to the phone. My plan is to use one of those phones, with good modem isolation, VPN on that will be fine. – Alister Nov 11 '18 at 9:44
  • Plan to use second phone with no sim cards with g4 hotspot and laptop ect I currently use a phone with poor isolation, and use it as a hotspot and that hotspot is a VPN so all would be protected in theory, except an IMSI could still see the VPN unencrypted? I'm not sure if that's accurate, but if it access's the phones storage or rootkit ect could get the keys to decrypt the VPN data or just monitor phone itself directly. – Alister Nov 11 '18 at 9:48
  • @Alister: G4 was a typo, meaning 4G (i.e. LTE). An exploit against this hotspot could not be used directly to compromise a VPN starting from the phone, but it would affect a VPN where the endpoint is the hotspot. But like I said, other attacks (which do not involve the modem in the phone) might be used to compromise the phone from the hotspot and then the VPN from the phone is not much help anymore. – Steffen Ullrich Nov 11 '18 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.