4G Pocket WiFi - IMSI Catcher?

Question

Nearly all mobile phones are vulnerable to IMSI catcher attack's fake mobile networks. They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN in use. Conduct MITM attacks.

They all have bad modem isolation, allow IMSI catcher direct access to hardware components that allow for compromise. Some phones have good modem isolation there all old phones.

This explains it: https://replicant.us/freedom-privacy-security-issues.php

Just to be clear the phones with good modem isolation prevent remote attacks on phones IMSI catchers can do. Or there wouldn't be a threat model for it. So the phones on that site prevent it.

I want to no about 4G portable hotspots separate from phones, since there seems some doubt about IMSI catchers. Here's an article from electronic frontier foundation about them, why phones in general have bad security.

https://ssd.eff.org/en/module/problem-mobile-phones

I'm considering if buying a portable 4G portable hotspot would be safe from IMSI catcher if a phone with no sim cards at all was connected to the portable 4G hotspot.

What effects could a IMSI catcher have? I'm thinking as its separate from the phone itself it obviously stops access to phones hardware components. But what hardware it can see and access on the portable 4G hotspot itself is a question? it might be able to backdoor, compromise it's security.

I don't know if there are any 4G portable hotspots that have good modem isolation. The article explains if you use a VPN on a phone with bad modem isolation, then an IMSI catcher can see the all traffic unencrypted.

So if using a VPN on a phone with no sim cards at all that's connected to a portable 4G hotspot, will the IMSI catcher get unencrypted access to all traffic? or is good modem isolation needed for the portable 4G hotspot itself, to prevent that as it is on a phone?

Maybe this would be the same for home wireless mobile broadband? They plug into power source but are also 4G but closer to a traditional router.

Answer 1

IMSI catchers essentially simulate cell towers. Nearby phones will try to use these fake towers in order to provide connectivity. But while normal cell towers usually act in the interest of their users fake cell towers might in theory misuse protocol features or send malformed protocol data in order to trigger bugs in the phones modem. Given that the modem driver usually runs with kernel permissions in current mobile OS a bug in the modem firmware and driver might give the attacker kernel level privileges which effectively would allow to control the whole phone.

With 4G hotspots the situation is not much different, only that the initial attack target would be the hotspot and not the phone. Once the attacker has taken over the hotspot it can intercept any connections and unless these connections are specifically protected with HTTPS or by using a VPN the attacker could also modify the traffic. But even if the phone protects itself well against such traffic MITM with a VPN or HTTPS it still leaves communication at the lower level, for example attacking the phone with malformed DHCP or attacking it through malformed Wifi.

Note that all of these attacks require bugs in the phones and hotspots software and firmware. But specifically at the lower network layers (i.e. 4G modem, Wifi firmware, Bluetooth firmware, DHCP) attacks are less expected and thus the software/firmware is usually not designed to be robust against attacks. And 4G hotspots usually have a similar shoddy security as known from cheap (and sometimes expensive) WiFi routers.

To summarize: using a 4G hotspot will make it harder for an attacker since there are more protections to bypass. But, if there are vulnerabilities at the various stages then attacking the phone connected to the hotspot can be done too. Note that most of the attacks would need a very knowledgeable attacker though which makes it less likely to get attacked unless specifically targeted. And if one is specifically targeted then the attacker might also choose a completely different path for attacks since this might be easier, so don't just try to protect the phone communication.