Warning as 4G Hotspots Are Hacked(pentestpartners.com)
pentestpartners.com
Warning as 4G Hotspots Are Hacked
https://www.pentestpartners.com/security-blog/reverse-engineering-4g-hotspots-for-fun-bugs-and-net-financial-loss/
24 comments
Unfortunately those issues have nothing to do with LTE (or similar). Would have liked some analysis of the radio interface.
Better not to buy ZTE, until they fix their procedures
Here's the original source, it's not linked directly in the article: https://www.pentestpartners.com/security-blog/reverse-engine...
Changed to that from https://www.forbes.com/sites/zakdoffman/2019/08/11/warning-a.... Thanks!
Thanks, this should really be the post. I didn’t find the Forbes article did anything but excessively quote the source material.
People really need to adjust to Forbes being nothing more than a content mill nowadays. They'll publish almost anything.
https://www.nytimes.com/2019/07/21/business/media/jeffrey-ep...
https://www.nytimes.com/2019/07/21/business/media/jeffrey-ep...
I usually read Starts With A Bang [1] and GrrlScientist [2] on Forbes. The former writes well grounded articles on particle physics and cosmology while the latter presents good summaries of recent findings in biology.
[1] https://www.forbes.com/sites/startswithabang/
[2] https://www.forbes.com/sites/grrlscientist/
[1] https://www.forbes.com/sites/startswithabang/
[2] https://www.forbes.com/sites/grrlscientist/
The page with the most technical content is https://www.pentestpartners.com/security-blog/breaking-bad-f... with a title of "Breaking (bad) firmware encryption. Case study on the Netgear Nighthawk M1". Non-technical Forbes summary and headline is good for discovery (e.g. search/bots), technical overview links threads of research, and case study enables replication. Each page has a role.
Submitter submits more than comments, so I wonder where their heart lies.
It's usually not hard to get a root shell on these things from the user-facing web management page, in my experience. It's not surprising to learn that they're remotely-exploitable too.
Well, most of those run Linux (Android, because cheap and easy).
I strictly use my iPhone to tether. I keep it updated with the latest updates but I still worry about it being remotely exploitable but I feel a lot more safe with it than these other devices.
If all your hotspot does, be it iPhone, Linux box or anything else, is forwarding VPN traffic between your devices and your cloud instance (your VPN exit node), why should you care about hotspot vulnerabilities?
The device running the VPN is still exposed to the attacker-controlled device. Now, on a decently-configured system this is probably fine (your workstation doesn't allow password-based SSH, right?), but it's still not great.
Seems silly to care so much about your tethered connection when the average home network has a bunch of computers, random IOT kit, a end-of-lifed smart TV, friends mobile devices and the random MAC addresses in your DHCP lease pool that you can't even account for.
Network security is unmaintaniable. Start caring about defensible boundaries instead.
Network security is unmaintaniable. Start caring about defensible boundaries instead.
To some extent, sure; seriously, you should be okay exposing your laptop to an attacker-controlled hotspot. I'm actually pretty sure my machines would be fine exposed like that. But that doesn't mean that you shouldn't minimize that exposure if possible:)
Also, I really do question the premise; it is possible to be selective with what you let on your network. You shouldn't rely on it, of course, but again, better to minimize exposure.
Also, I really do question the premise; it is possible to be selective with what you let on your network. You shouldn't rely on it, of course, but again, better to minimize exposure.
I guess that's a reason you need a 5G hotspot
Yeah, because nobody would ship a cheap 5G hotspot with a known exploitable 2.7 kernel vintage linux on it, right? /s
"IoT": The Internet of Unpatched Linux Devices...
"IoT": The Internet of Unpatched Linux Devices...
Two benefits:
1. I get many security holes patched.
2. I get a hotspot on a phone plan, which is usually cheaper and can be used as a second phone.