Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Gaining Root Access On Linux-Based Femtocells

Soulskill posted more than 4 years ago | from the feel-free-to-listen-in dept.

Security 102

viralMeme writes "According to the Register, 'Security researchers have turned their attention to femtocells, and have discovered that gaining root on the tiny mobile base stations isn't as hard as one might hope.' One of the researchers said, 'After hours of sniffing traffic, changing IP address ranges, guessing passwords and investigating hardware pinouts, we had obtained root access on these Linux-based cellular-based devices, which piqued our curiosity [about] the security implications.' Whoever designed these devices should be sent back to computer school. An authentication device that can be bypassed is a contradiction in terms. Or, as some pen-pusher would put it in a report: an unantipicated security excursion.

cancel ×

102 comments

Sorry! There are no comments related to the filter you selected.

Goatse (-1, Troll)

Anonymous Coward | more than 4 years ago | (#30998082)

Time to goatse [goatse.fr] then.

Trouble (0, Funny)

Anonymous Coward | more than 4 years ago | (#30998090)

That's trouble o' some kind, George.

Re:Trouble (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30998156)

I hate it when my anon posts get modded up.

Re:Trouble (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30998272)

If that shit becomes a running /. meme, I'm out of here.

Gases (0)

Anonymous Coward | more than 4 years ago | (#30998570)

They're using the wrong gasses, thats what the problem was last time, and is this time as well.

but it should be open (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#30998120)

but the iphone should be open for tinkeri... oh wait.

Jedi Mind Trick, actually (4, Funny)

Monkeedude1212 (1560403) | more than 4 years ago | (#30998138)

An authentication device that can be bypassed is a contradiction in terms.

You don't need to see his identification.

Re:Jedi Mind Trick, actually (5, Insightful)

davester666 (731373) | more than 4 years ago | (#30999082)

The very concept of Femtocell's is bass-ackwards. You pay a carrier for wireless access, then pay again for a device to actually provide you with the wireless access, along with monthly fee's for the device and also pay for internet access so the device can connect to the carrier over the internet.

It's like "we couldn't be bothered to actually provide you with coverage at your home/office, so would you mind building out our network for us, and pay us extra for the privilege of doing so".

Re:Jedi Mind Trick, actually (4, Informative)

jeffmeden (135043) | more than 4 years ago | (#30999310)

You pay for the hardware, and the 'minutes' at the normal rate, but no carrier I have seen charges you per month for owning the cell. It isn't nearly as sinister as you describe, since their network still has to haul the call where it's going, even if you do in fact bring it to them via the Internet.

You are right that it's 'their job' to provide you with coverage, but no carrier asserts that they will go to any length necessary to cover 100% of the earth with 100% usable signal. Verizon's ad campaign featuring an army of tower workers following customers around was hyperbolic. Sorry if you got confused.

Re:Jedi Mind Trick, actually (3, Insightful)

Foolicious (895952) | more than 4 years ago | (#30999854)

Sorry if you got confused.

Yeah. I was thinking that by me living in an area that is shown as having coverage on their coverage maps meant that I would...wait for it, wait for it...actually have coverage. How silly of me.

Re:Jedi Mind Trick, actually (5, Funny)

140Mandak262Jamuna (970587) | more than 4 years ago | (#31000084)

Verizon's ad campaign featuring an army of tower workers following customers around was hyperbolic. Sorry if you got confused.

The joke's on you pal. All those cell towers use Yagi dipole antennae. They are neither parabolic not hyperbolic.

Re:Jedi Mind Trick, actually (3, Insightful)

dgatwood (11270) | more than 4 years ago | (#31001042)

You also pay for the power needed to operate the cell, which presumably their other customers benefit from. If they put a full cell site on your property, they'd typically pay you between $10-25,000 per year to lease the right to do so (even if it is just putting it on top of an existing structure). Why should they get to place a femtocell at your house for free merely because it runs at a lower power? At a minimum, they should give you a discount on your monthly charge and free service on that cell. Anything less is outright taking advantage of you.

Re:Jedi Mind Trick, actually (1)

Bad Ad (729117) | more than 4 years ago | (#31007536)

Vodafone in the UK were charging £5 a month to use a femtocell plus price of the equipment. This only changed within the last couple of weeks.

Re:Jedi Mind Trick, actually (1, Insightful)

Anonymous Coward | more than 4 years ago | (#30999346)

The very concept of Femtocell's is bass-ackwards.

The technical concept is fine. Its implementation at the billing level by American companies is not. The same can be said for SMS.

Re:Jedi Mind Trick, actually (5, Informative)

ScentCone (795499) | more than 4 years ago | (#30999504)

so would you mind building out our network for us, and pay us extra for the privilege of doing so

Nonsense. I bought a unit to extend Verizon's coverage into the areas of my house that the local tower just can't handle. Like, down in the basement - a level of service that no carrier is going to say they'll promise. Verizon doesn't charge me anything for using it, other than the cost of the hardware - a one-time purchase that I gladly, gladly made. And I can sell the unit any time I want, and any other Verizon customer can use it - and there's no account-related paperwork involved. The devices just work. They look for a DHCP server on your LAN, and off you go. You do need to fire them up near a window until they get their GPS bearings, though. But they don't have to stay there.

You know what else is nice? The household mobile phones now only have to talk to a transciever that's a stone's throw away, instead of a quarter of a mile or more away. That means much better battery life when they're not tethered to a charger.

Re:Jedi Mind Trick, actually (1)

AaronW (33736) | more than 4 years ago | (#31002016)

I have the same device for Verizon. My house is basically a Faraday cage since I have a steel roof and chicken wire in the outside walls.

My only issue is that the location based services on my Droid get all screwed up and think I'm a couple hundred miles from where I'm at. I just got a callback from Verizon on this about 30 minutes ago. Apparently this is due to the fact that the network extender only does 1x and not EVDO, but he also said they're looking into enhancing the firmware so that it will support EVDO as well (crosses fingers) which would be nice.

A full nmap scan of my extender does not report any responding ports.

Re:Jedi Mind Trick, actually (1)

mirix (1649853) | more than 4 years ago | (#31002310)

Microwave should fly right through chicken wire, no problem.

Re:Jedi Mind Trick, actually (1)

AaronW (33736) | more than 4 years ago | (#31002394)

It should, but the signal in my house is almost useless with many dead spots. Outdoors I have no problems. Having a steel roof might be part of the problem.

Anyway, the network extender solved that problem. It's also nice in that I can take it with me if I travel to places where I know I'll get poor to no cell coverage and have Internet access.

Re:Jedi Mind Trick, actually (1)

adolf (21054) | more than 4 years ago | (#31006176)

Perhaps you're barking up the wrong tree...

My house also has a steel roof, and many (not all) walls are plaster with metal lath. My Droid usually locates me just fine indoors, usually within a hundred feet or so. Worst case I've seen is when it can't get GPS at all, and seems to fall back on the location of the current tower a few blocks away -- which is also "close enough" for most things that location data is useful for indoors (searching for local restaurants, for instance).

However: I have, on one occasion, been shown to be about 300 miles northeast of where I was, when I was outside with a clear view of the sky. This persisted (with permutations like it showing me traveling northeast at a fast speed, even though I was stationary) until I rebooted the phone, and was consistent between different applications.

So. Please allow me to submit that your problem might be your femptocell, or it might be something else entirely.

Re:Jedi Mind Trick, actually (1)

AaronW (33736) | more than 4 years ago | (#31006330)

According to Verizon this is a known problem of the femptocell and the cell phone. It shows my location to be almost 400 miles north. Verizon claims it is due to the fact that the femptocell does not handle EVDO and that my Droid is also picking up an EVDO signal. The engineer said that they are working on adding EVDO support to the femptocell, possibly with a firmware upgrade, which would solve that problem (and give the advantage of EVDO as well). Weatherbug, for example, will often show that I'm in Crescent City. Surprisingly when I used my femptocell 15 miles south of my home it still showed Crescent City. Again, at that location I could pick up EVDO as well.

Re:Jedi Mind Trick, actually (0)

Anonymous Coward | more than 4 years ago | (#31002066)

>The household mobile phones

Why use a mobile at home? Isn't the landline cheaper in your country?

Re:Jedi Mind Trick, actually (1)

AaronW (33736) | more than 4 years ago | (#31002224)

If you already have a cell phone, why have a land line at all? It can be cheaper to add another cell phone to a plan rather than add a land line.

In my case I like having a land line as well since the voice quality is much better.

Re:Jedi Mind Trick, actually (1)

nextekcarl (1402899) | more than 4 years ago | (#31004700)

I had a land line years ago, but as well as almost never using it since I got my cell, it was notorious for going out. I actually called from my cell to cancel the service and the person at the phone company tried to get me to keep it at a low level of service since cell phones are unreliable. I reminded her I was calling from my cell because I picked up the land line and had no dial tone, and averaged that level of outage about once per 6 months that I was aware of which, since as I said I didn't hardly ever use that phone since I got my cell, is rather unlikely to have been the only times it was out of service for hours at a time. She didn't have an answer for that.

Re:Jedi Mind Trick, actually (0)

Anonymous Coward | more than 4 years ago | (#30999786)

isn't that "ass-backwards"?

Re:Jedi Mind Trick, actually (1)

Foolicious (895952) | more than 4 years ago | (#30999822)

Not sure why that was modded interesting. Interesting? Probably not. Insightful. Definitely.

Re:Jedi Mind Trick, actually (1)

flatrock (79357) | more than 4 years ago | (#31002544)

Say the carrier provides 95% coverage. Getting that last 5% is prohibitively expensive, and only a small portion of possible customers will benefit. It just doesn't make sense carrier to saturate every place with cell towers to the point where they have 100% coverage.

If you are a consumer living in a dead spot, you can rant and rave, but if the amount they can earn from you and others that want coverage there you doesn't cover the cost of an additional tower, it makes little sense for them to build one.

So if you live in a dead spot you can ask yourself if whatever additional amount the femtocell costs you is worth it to you. If it is, pay for it, if not then I guess you can continue to complain.

Femtocells provide some people an option they wouldn't otherwise have. They can decide if the cost is worth it to them.

Oh my... so that's what's going on. (4, Funny)

Petersko (564140) | more than 4 years ago | (#30999698)

I had no idea linux proponents were all Jedi. That explains everything.

"You don't NEED the extra features in Photoshop."

"You don't NEED integrated audio processing software."

"You don't NEED anything OpenOffice doesn't have."

"You don't NEED..."

Now those Jedi need to start using their powers for good.

"You NEED to write documentation for non-technical users..."

Re:Oh my... so that's what's going on. (0)

Anonymous Coward | more than 4 years ago | (#31000726)

When have you ever seen a non-technical user read documentation? Might as well write it into /dev/null

Re:Oh my... so that's what's going on. (0)

Anonymous Coward | more than 4 years ago | (#31000786)

Ouch. Modded as "funny", but probably the most apt thing I've read on /. in months.

Re:Oh my... so that's what's going on. (1)

jedidiah (1196) | more than 4 years ago | (#31000962)

You think you're funny but all of the Apple fanboys are holding up the iPad and saying the same thing times 10.

Most people either don't need the features of $300+ software or are simply unwilling to pay for it.

Re:Oh my... so that's what's going on. (0)

Anonymous Coward | more than 4 years ago | (#31004436)

You NEED to write documentation for non-technical users...

no, non technical users need to become literate.

Re:Jedi Mind Trick, actually (0)

Anonymous Coward | more than 4 years ago | (#31002844)

Any idiot (or group of idiots), can 'do' Linux insecurely.

Same as with WinCE, or other OS, or standalone embedded app-of-your-choice.

So fix it (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#30998164)

No details about the attack yet (not until ShmooCon, this weekend). But, if an attacker can get control, then so can the owner, which means the owner can fix the security hole. Unfortunately, there's no way to ensure that your phone is not connected to someone else malicious femtocell. I want a phone that shows the the hash of the public key of the femtocell I'm using.

Re:So fix it (2, Funny)

Sir_Lewk (967686) | more than 4 years ago | (#30998236)

Huh? Public keys are just that... public. A hash of a public key demonstrates nothing. ...wait a second. You were on the dev team of these femtocell things weren't you?

Re:So fix it (3, Informative)

FrangoAssado (561740) | more than 4 years ago | (#30999128)

If you're encrypting stuff with X's public key, then only whoever has X's private key can decrypt it. So, in essence, you're certain you're talking to X and not someone pretending to be X.

So, by displaying the hash of the public key of the device you're talking to, you're effectively showing the true identity of who you're talking to.

I think the OP's idea is that you can use this information to be sure you're connecting to your own femtocell (on which you have fixed the vulnerability) and not you neighbor's (possibly hacked) femtocell.

Re:So fix it (1)

characterZer0 (138196) | more than 4 years ago | (#30999288)

If the public key is public, I can stick it in another femtocell.

If I have physical access to the femtocell, I can copy anything from it and stick it in another femtocell.

You cannot trust a device that untrusted people have physical access to.

Re:So fix it (2, Informative)

FrangoAssado (561740) | more than 4 years ago | (#30999562)

If the public key is public, I can stick it in another femtocell.

You surely can stick it into another femtocell, but that will do you no good. This new femtocell can't use this key to communicate, because it doesn't have the corresponding private key.

To give another example: I can get the public key from any bank site and stick it into my own web server. This doesn't mean I can trick people into thinking my web server is the bank's -- I won't be able to decrypt anything they send me!

Re:So fix it (1)

Sir_Lewk (967686) | more than 4 years ago | (#30999358)

Well sure, but this would only be an exceptable solution to the most paranoid of technically minded people. Nobody wants to manually confirm a public key each time they make a phonecall. It's also quite worthless if you are not controlling the femtocell in question, which would be the vast majority of the time.

Re:So fix it (1)

FrangoAssado (561740) | more than 4 years ago | (#30999618)

Agreed. I just mentioned that in some sense the OP's post was not completely bogus.

Re:So fix it (2, Interesting)

amicusNYCL (1538833) | more than 4 years ago | (#30998294)

But, if an attacker can get control, then so can the owner, which means the owner can fix the security hole.

Not really.. you're assuming the flaw exists in software. Regardless though, I'm interested to see a "fix" for a vulnerability get published which requires people to hack their phone and gives them a list of memory addresses and values that need to be changed. That would go over well.

Re:So fix it (2, Insightful)

Sir_Lewk (967686) | more than 4 years ago | (#30998556)

He also seems to be assuming that the attacker and the owner are two seperate people.

Re:So fix it (1)

wolrahnaes (632574) | more than 4 years ago | (#31002748)

Hell, even the OP seems to;

gaining root on the tiny mobile base stations isn't as hard as one might hope

Wha? I bought the thing, I might hope I'd have root right off the bat. I know not to expect that, but I'd still hope.

I want it to be hard for everyone else to gain root.

Re:So fix it (2, Interesting)

eleuthero (812560) | more than 4 years ago | (#30998638)

I believe we usually call "fixes" requiring people to "hack" their phones "firmware upgrades" - The fact that many of us hack our phones with other firmware / software doesn't change what the company is going to call it. It would seem to me to be fairly easy to set up even cheap phones for such a firmware upgrade. Any old phone would need to be replaced at end of contract or it simply would stop functioning. While this won't immediately solve the privacy issues, it would provide for a workable solution. For those with smartphones, firmware upgrades can be pushed or dl'ed via itunes/whatever.

But...but... (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#30998172)

I thought all one had to do was install Loonix on something and it was magically secure without any additional work. At least that's what freetards would have you believe.

Impossible (-1, Troll)

Anonymous Coward | more than 4 years ago | (#30998290)

Lunix doesn't have exploits.

it still comes down to one thing (3, Insightful)

prgrmr (568806) | more than 4 years ago | (#30998338)

changing IP address ranges, guessing passwords

Better passwords would have made all the difference in the world. 16 character, mixed case and symbol types would have been enough of a roadblock to prevent them from gaining access. Too many companies are still shipping products that have no intended user access to the command shell with passwords like "Admin", "12345", and the ever-popular "password". It's not like it costs more to have a longer, more complex password.

Re:it still comes down to one thing (3, Insightful)

Nos. (179609) | more than 4 years ago | (#30998500)

The problem is not what the default password is. It could be blank and still not significantly affect the security of the device. Its the admins that don't change the default password that are to blame. Lets face it, even if they ship the next device with a 16 char mixed case, special character, number containing, sufficiently random password, it will still be the default password. A simple google search of "Device model default password" will get you the default password pretty much as soon as its released.

As an alternative, they could force a password change on first login.

Re:it still comes down to one thing (1)

Archangel Michael (180766) | more than 4 years ago | (#30998808)

Nope.

First login should require two things, new user name / password combo, and disabling the default username / password combo.

Seriously, the first half of an attack is trying to guess a username, which if in the open, cuts the amount of work needed to crack the device.

Nothing says "insecure" like default user names ... IMHO

Re:it still comes down to one thing (1)

Rich0 (548339) | more than 4 years ago | (#31000526)

I can't say that I agree. Yes, having to guess both the username and the password does improve security, but no more than simply making the password that many characters longer. Essentially you're just making the username part of the password.

The only reason that your approach would add value is if the password length were somehow artificially limited, and the username were protected like a password and assigned using strong password conventions.

Otherwise it just adds inconvenience, and no real additional security.

Re:it still comes down to one thing (1)

jedidiah (1196) | more than 4 years ago | (#31001010)

Why hasn't anyone suggested that devices like these need to have something like
fail2ban built in? Lock people out who are trying to brute force the internal
ssh server. This exploit probably doesn't represent anything terribly interesting
from a server or desktop perspective. It's likely that the device just isn't put
together terribly well and no one ever considered someone trying to hack it like
a server.

Re:it still comes down to one thing (1)

Rich0 (548339) | more than 4 years ago | (#31002118)

That would allow for a DOS attack - unless the ban were only temporary. Just connect to a device and give it x wrong passwords, and now even the owner can't get into it.

The solution is what I think is already employed for things like ssh - connection throttling. If the ssh server does not allow a given IP to attempt more than one login per second or two that won't impact legitimate users at all but it pretty-much eliminates brute force attacks against all but the weakest passwords.

And if you set up fail2ban or whatever with a timeout that re-enables the account, that is just a really SLOW connection throttle under another name.

Re:it still comes down to one thing (1)

mirix (1649853) | more than 4 years ago | (#31002448)

Fail2ban only bans the attacking IP, not all traffic... how would that cause a DoS?

You can change how many attempts, how long to ban, things like that.

Re:it still comes down to one thing (2, Interesting)

CastrTroy (595695) | more than 4 years ago | (#30998830)

Maybe they could give a custom password to each device, and then have their assembly line print out the default password on the bottom of the device. They already print a serial number. Why not print a password? Each device would have a different default password. You may want to keep a highly guarded list of passwords/serial numbers for customer support issues, but if it's printed on the bottom of the device, I would say even that is unnecessary.

Re:it still comes down to one thing (1)

Jesus_666 (702802) | more than 4 years ago | (#30999140)

You can go one step further and just use the S/N. Not quite as secure but the attacker still needs to have at least brief physical access to the device.

Re:it still comes down to one thing (1)

jeffmeden (135043) | more than 4 years ago | (#30999378)

Using the SN severely limits the possible space unless the SN is itself highly unique from device to device. This is a good place to start but make sure it's a significant portion of the SN and the SN itself is very long and non sequential. Better yet, make it a hashed password only based on the SN; using a private key so it can't be reversed. Going from a trillion possibilities to a million may sound like a trivial problem but it really hurts the depth of security, all the attacker needs is a sufficiently fast way to test each password, if your tar pit fails for some reason you are going to be up the creek.

Re:it still comes down to one thing (1)

SilverJets (131916) | more than 4 years ago | (#30999466)

Or, you could force the first login to change the username and password like another poster wrote further up. Why go at this backasswards at the manufacturing level?

Re:it still comes down to one thing (2, Informative)

jeffmeden (135043) | more than 4 years ago | (#30999692)

Simple, some devices require no log-in to make use of them (such as the femtocell, or almost every other firewall-router) since the default settings are sufficient for 99% of users. In this case, you don't want to burden the user with setting (and then forgetting) the password to the device just to make use of it. Set it to something strong and unique, and give it to the user in a form that is secure (a sticker on the box which can be clipped and saved, or a sticker on the unit). The final effect is that if the user doesn't change it and loses track of it, they can call support and instead of a lengthy password reset and reconfiguration process, the support line can simply look up the serial number and derive the password.

Re:it still comes down to one thing (1)

mlts (1038732) | more than 4 years ago | (#30999912)

Even better might be having a cryptographic token, either something like a SecurID card except with a replacable battery, or a USB smart card that stores a private key on board. This way, an authorized user just needs to dig out the keyfob, jam it in a port or type in the 6-8 digit number plus the password as mentioned above, and access is granted. A remote attacker most likely would not have physical access to the cryptographic token, so that slams the door on a lot of attacks right there, forcing the blackhat to do a brute force attack, which can be mitigated by adding delays, or locking out the incoming IP for a period of time.

Re:it still comes down to one thing (1)

suomynonAyletamitlU (1618513) | more than 4 years ago | (#30999784)

Better yet, make it a hashed password only based on the SN; using a private key so it can't be reversed.

That would defeat the purpose of it being the SN. At that point you could just make the password entirely random, of the same length, because have to print the password separately.

End users--especially noob users--are not going to read the SN, download a custom application to turn that into a password, and then use that.

Re:it still comes down to one thing (1)

Jesus_666 (702802) | more than 4 years ago | (#30999874)

I was thinking about the entire S/N, which should be 20-40 alphanumeric characters (and, of course, nonsequential; maybe an MD5 hash of the order the device was built in prefixed by model information). Provides a nice incentive for the user to change the password, as well. 36^20 is a nice, big search space and 36^40 should be enough to keep any naive attacker at bay until the device has been replaced.

Maybe, if you want to be particularly user-friendly, you could use shorter S/Ns but I wouldn't go below 10 characters, which offers a mere three quadrillion possible passwords.

Re:it still comes down to one thing (1)

owlstead (636356) | more than 4 years ago | (#31000086)

That's not a good idea, since the serial number normally is - eh - serial in nature. You can easily scan the range. The other option is to use a random "serial" number but then you need to make changes to the organization. If you are going that way, just print a random number after the serial number (starting with "PW" to distinguish it from the serial number, svp, we've got enough "anonymous" numbers as it is).

Re:it still comes down to one thing (1)

afidel (530433) | more than 4 years ago | (#30999602)

That's exactly what HP does for the iLo boards on their Proliant servers.

Re:it still comes down to one thing (1)

mlts (1038732) | more than 4 years ago | (#30999850)

Easy way to relate serial numbers to passwords: Append a secret value to the S/N, hash the value (SHA-512 comes to mind), take the first x number of characters (preferably more than 20, 64 would be best). This way, the serial number doesn't really matter because without the nonce added, it won't give meaningful information.

Of course, the machine that has the secret value (and I hope this is something that changes with each model), is going to be heavily locked down.

Another good method is just to use a 1:1 hash mapping. The serial gets mapped to a random value, and that mapping is stored in a database. This way, there is absolutely no way to calculate one value from the other.

Re:it still comes down to one thing (1)

emt377 (610337) | more than 4 years ago | (#30999042)

The problem is not what the default password is. It could be blank and still not significantly affect the security of the device. Its the admins that don't change the default password that are to blame. Lets face it, even if they ship the next device with a 16 char mixed case, special character, number containing, sufficiently random password, it will still be the default password.

It could have a randomly generated password printed on the same sticker as the serial number and phy mac.

Re:it still comes down to one thing (1)

dgatwood (11270) | more than 4 years ago | (#31001106)

Or you could use the serial number as the initial password and require the administrator to change it at first login, thus making it impossible to configure the device without first setting a password. Include a convenient physical reset button to reset it to factory configuration (including password) if you screw up, but make sure that this forces you to reconfigure everything before the device is usable.

Of course, this assumes that it is necessary to do at least some configuration in order to use the device. If that's not the case, then the right answer is to not use a password at all, and require that the telco connect to the device using a private key to update it.

Re:it still comes down to one thing (1)

toastar (573882) | more than 4 years ago | (#30998582)

It's not like it costs more to have a longer, more complex password.

What are you smoking?

Simple Passwords have to be reset less often, Which means less cost on the Customer/Luser Support calls. Not By a lot but not entirely Negligible.

Also having a complex password also means it usually has to be written down or requested often leaves room for Social engineering,
So therefore Having a Stronger Password Unnecessarily can actually reduce overall security by increasing other attack vectors.

Any system that lets a user bruteforce the password is inherently flawed, Hell even windows locks you out after a certain number of guesses.

Re:it still comes down to one thing (3, Insightful)

blair1q (305137) | more than 4 years ago | (#30998766)

On the other hand, a 20-digit randomized Product Key for registering your purchase is no big deal.

Print the password on the box and make it mandatory to enter it before use. Users will get the clue and online h4xx0rs won't have a backdoor into 99% of links.

Re:it still comes down to one thing (2, Interesting)

Leolo (568145) | more than 4 years ago | (#30998670)

Yes there is a cost; a company installs a plug-n-play device A. It works for a while (months, years). Then it stops working or they want something changed or it doesn't work with some new device B. So then they call me to figure out the integration. Now, I need to log in and find out as much as I can about the device in as short a time as possible. I'm over 100 km from the device, have never used one before. The person who originaly installed device A has retired and is now snorkeling in the Solomon islands. So, what is root password? Either "123456" or I Google up a list of default passwords for the device. If I can't, that's a support call to the company that made the device (cost to maker) or the company that deployed it has to ditch the device and find something else (large cost to user).

So yes, complex passwords have a cost.

Re:it still comes down to one thing (2, Insightful)

jeffmeden (135043) | more than 4 years ago | (#30998908)

Oh, for the love of documentation!

I think what you meant to say is there is an inherent cost to being forgetful (forgetting the password before writing it down in a safe place) or lazy (not writing it down in an safe/perpetual place.) Yes, if the alternative is leaving a password susceptible to casual attack, feel free to write the password down and lock it in your desk drawer with the IP of the device on it, and leave that post-it around for the next guy.

Not that there aren't a ton of secure, effective tools to manage passwords out there.

Re:it still comes down to one thing (1)

billcopc (196330) | more than 4 years ago | (#30999568)

That's real nice if everyone cooperates, but it is all too easy for a disgruntled admin to change either the password or the password database, and lock the next guy out. Wasn't there such a psycho last year, who was screwing with CA utilities or some ISP long after he'd been fired (for being a psycho) ?

Re:it still comes down to one thing (0)

Anonymous Coward | more than 4 years ago | (#31003624)

The person who originaly installed device A has retired and is now snorkeling in the Solomon islands. So, what is root password? Either "123456" or I Google up a list of default passwords for the device. If I can't, that's a support call to the company that made the device (cost to maker) or the company that deployed it has to ditch the device and find something else (large cost to user).

So yes, complex passwords have a cost.

Well, we all know that companies fail to document necessary account or password records for their techs and also that it's hard to "hide" information once it's out onto google. The problem is that they even get out to google in the first place. In other words, that we we made default passwords a customer standard without considering alternatives, allowing 1 router or special device to have a 'back door' that becomes a front door to anyone else for attack purposes. I mean, the adequate industry standard should have been hashing. Even rot13 'encryption' would keep the average nobody's attempts from trying to log into his neighbors router if he can't remember what "admin" and "password" read like once rot13'd.

It's now too late, and we need something better, but cleaning up the mess will be optional. We are still weak security wise. We can't even force a firmware upgrade on all those insecure WEP access points out there to bring up to WAP or WAP2. It's too late because there's a whole industry depending on them, like older cellphones portable videogame consoles, laptops and USB wireless sticks. What to do, what to do...

Re:it still comes down to one thing (4, Insightful)

mcrbids (148650) | more than 4 years ago | (#30999120)

Too many companies are still shipping products that have no intended user access to the command shell with passwords like "Admin", "12345", and the ever-popular "password". It's not like it costs more to have a longer, more complex password.

You think longer, complex setup doesn't cost the company money? I gather that you haven't considered support costs?

The best solution I've seen so far is to have a strong password printed on a sticker on the outside of the box. That's a pretty good compromise because if the attacker has physical access to the box, he/she could hit the "Reset" button on the device anyway. Thus, putting the password on the bottom of the device on a sticker really isn't any less secure than other solutions, and this can be done fairly cheaply.

But it still costs - each router has to be given its own unique password, and a process has to be set up to match up the passwords given with the stickers, and there are still more support costs from the clueless dolts who have to be told to look on the bottom of the device for the default password.

If you assume any intelligence on the part of the end user, your support costs will quickly challenge that assumption!

Re:it still comes down to one thing (0)

Anonymous Coward | more than 4 years ago | (#30999678)

And what happens when the sticker comes off, becomes unreadable due to scratches, and/or otherwise lost?

No, stickers are not an answer. Proper administration is.

Re:it still comes down to one thing (2, Interesting)

lukas84 (912874) | more than 4 years ago | (#30999974)

A good concept that i've seen in use on an embedded device.

The device ships with it's user interface completely locked. There's no possibility to login. Press a button on the device, and you can logon using default credentials - doing this will prompt you to change user and password. After doing this, the button can be used to perform a full reset of the device.

Basically, the device is secure out of the box - when logging in for the first time, you need to provide physical authentication, and afterwards you have your own user and password.

I haven't seen any downsides to this approach yet.

Re:it still comes down to one thing (1)

ComputerGeek01 (1182793) | more than 4 years ago | (#30999252)

Better passwords would have made all the difference in the world. 16 character, mixed case and symbol types would have been enough of a roadblock to prevent them from gaining access. Too many companies are still shipping products that have no intended user access to the command shell with passwords like "Admin", "12345", and the ever-popular "password". It's not like it costs more to have a longer, more complex password.

Neither is it anymore secure. Having the same 16 char password on every unit of a product only makes it frustrating to use; not any more secure. What is needed is a individual password for every unit based on something unique like the serial number of the unit, and this WOULD cost more money for production AND support costs. Also you would alienate a portion of the market because this seemingly simple thing will be well beyond their ability. Stupid people will always exist, it is the burden of society to tolerate them and evidently to make exceptions for them. We cannot blast every manufactorer who wants to sell stuff to stupid people for brining things like security down to a level that the morons with money can use.

Re:it still comes down to one thing (1)

LaminatorX (410794) | more than 4 years ago | (#30999654)

It's not like it costs more to have a longer, more complex password.

Only if you have an unlimited data plan. ;)

inb4 (0)

Anonymous Coward | more than 4 years ago | (#30998512)

All your femtocell are belong to us!

Wow, (1)

tomhudson (43916) | more than 4 years ago | (#30998524)

an unantipicated (sic) security excursion (sic).

1. "unanticipated", not "unantipicated".
2. "privilege escalation" [wikipedia.org] or "privilege elevation", not "security excursion."

Let me guess ... you went to Simon Fraser. University [slashdot.org] ...

Re:Wow, (2, Informative)

idontgno (624372) | more than 4 years ago | (#30998896)

"Security Excursion" gets 50 Google hits, most of which seem to be talking about boondoggles and outings. ("Excursion" about "security".)

One google hit [gcps-ocs.com] supports GFP's use of the phrase, though:

Security Vulnerability Threat Assessment Audit: The scope of Gulf Coast Project Services audit process goes beyond Public Safety. It encompasses Business Interruption and Corporate Survivability. The objective of this audit is to leverage existing work processes and standard guidelines in order to determine gaps in a particular Security Vulnerability threat analysis. GCPS's Security Vulnerability Threat Assessment audit is organized into three sections. The three sections are; Security Excursion Protection, Security Excursion Remediation and Security Excursion Mitigation.

(emphasis mine)

Sounds like someone's bureaucratese euphemism for "Security screwup". Other than being bafflegab and needlessly obscure, it's consistent with the usage.

That qualifies as damning with faint praise, but there you go.

Re:Wow, (1)

HTH NE1 (675604) | more than 4 years ago | (#31012328)

Sounds like someone's bureaucratese euphemism for "Security screwup".

To borrow terminology from another source, it sounds like a Foothold Situation to me.

Re:Wow, (0)

Anonymous Coward | more than 4 years ago | (#30999086)

You do realize the part about the "security excursion" was a joke, right?

I noticed that the Register article... (3, Interesting)

idontgno (624372) | more than 4 years ago | (#30998576)

(Yes, I read TFAs)

The Reg article kinda brushed off the risks of a cell-tower MITM attack, relegating it to a mere "loss of privacy" because the 3G cryptosystem is strong.

I assume it means that the cryptosystem is too strong for a realtime attack. It's a damn rare cryptosystem that can't be broken using enough stored ciphertext, so if the modified femtocell is storing and forwarding all traffic, traffic analysis + theoretical weaknesses in the algo + massive compute power == recovered clear material at some point in the future. Depending on the use case, there may be a lot of value in that.

Re:I noticed that the Register article... (2, Informative)

owlstead (636356) | more than 4 years ago | (#31000138)

"I assume it means that the cryptosystem is too strong for a realtime attack. It's a damn rare cryptosystem that can't be broken using enough stored ciphertext, so if the modified femtocell is storing and forwarding all traffic, traffic analysis + theoretical weaknesses in the algo + massive compute power == recovered clear material at some point in the future."

It's not such a rare cryptosystem that can't be broken given enough stored ciphertext,. And it is definitely not hard to construct nowadays (especially with good counters, session key renewal through key agreement algorithms). The question is is if the aging, proprietary GSM crypto that is in use actually falls within that definition. What I've heard, that's quite a definite "NO".

Encrypt everything (2, Insightful)

Anonymous Coward | more than 4 years ago | (#30998626)

Don't use the regular 3G voicecalls, use only encrypted VoiP. Preferebly with a microSD card filled with one-time pad

  Of course its not actually a bad thign that these are hacked, people just need to realise that their communications are not secure. just like when I use my Nokia's SIP client now I know full well that it would be easy for the person who'se WiFi i'm using to intercept my calls but I take the chance anyway.

Femtocells rely on 'security against the user' much like DRM does, in fact a large part of the 3G/GSM network relies on people not being able to fuck around with their own equipment too much, so I am actually surprised it took this long since that client-side security model is doomed anyway

Re:Encrypt everything (2, Insightful)

Sir_Lewk (967686) | more than 4 years ago | (#30998840)

use only encrypted VoiP. Preferebly with a microSD card filled with one-time pad

Say what? Either you don't know what a one-time pad is and are just pulling cryto terms out your ass, or you have really weird telephone habits. OTPs never make sense, unless you are a spy deep in enemy territory and you need to transmit a handful of words with perfect security to a single receiver. The logistical issues with a system like the one you are proposing are absurd.

Re:Encrypt everything (1)

mlts (1038732) | more than 4 years ago | (#31000100)

One time pads are truly secure, but the hard part is getting a copy of the OTP from Alice to Bob via a secured route, as anyone who intercepts it has full and unfettered access. Also, depending on the amount of data transferred, the amount of bytes stored on the OTP might run out.

Instead, if you are designing a cryptosystem where the two endpoints are "introduced" to each other, and essentially only talk to each other, so public key cryptography isn't needed, there is one method you can do:

Each device "knows" about the other and has 1024 bits that only it and the other device has. (This can be copied manually via a USB flash drive, or the devices could be temporarily connected and they negotiate this info.)

Then, the devices can do a basic Diffie-Hellman handshake, except encrypted with the first 256 bits, and another 256 bits used for the initialization vector (if needed). Once both sides negotiate a session key, before that key is used, it is encrypted using the last 512 bits as a key/IV. This way, even if someone is able to figure out the first key used to encrypt the D-H handshake, the session key is still unguessable without a major break in the cryptographic algorithm, or a compromise of one of the endpoints.

The advantage of this setup is that it is quick -- public key cryptography is computationally intensive. The disadvantage is that this system only works with a small amount of devices before it becomes unwieldy, similar to hosts files.

Be not afraid (2, Funny)

blair1q (305137) | more than 4 years ago | (#30998718)

I for one welcome our easily-rooted overlords.

It was the business school (2, Insightful)

kiehlster (844523) | more than 4 years ago | (#30998950)

Their computer schooling isn't the problem, it's that they've probably also gone to business school. Rule #1, always cut corners to finish the product on time.

A couple of points ... (4, Interesting)

PPH (736903) | more than 4 years ago | (#30999028)

The summary mentions "investigating hardware pinouts". This makes me think that the attack is, in part, on the hardware. If one has access to hardware, they've pwned the system. Period. So this is a non-issue.

Second; cell phones trusting the base station has always been a security issue. And "exploits" based upon this weakness are already in use by law enforcement as well as criminals. The whole inmates sneaking cell phones into prisons has been made a non-issue based upon this very approach. Prisons are beginning to cover their facilities with femtocells which give them the ability to monitor all illicit cell traffic on their property. Any truly secure system will assume that the network carrying its traffic is insecure.

Re:A couple of points ... (3, Insightful)

pr0nbot (313417) | more than 4 years ago | (#30999226)

I'd presume (without having RTFA of course) that what is meant is that they bought a femtocell, looked at its hardware pinouts, and this helped them devise an attack that would work on any instance of that model of femtocell (without physical access).

Seriously? (2, Interesting)

IceCreamGuy (904648) | more than 4 years ago | (#30999174)

Whoever designed these devices should be sent back to computer school. An authentication device that can be bypassed is a contradiction in terms.

First of all, this is not an authentication device, it's a cell network extender, which obviously requires some kind of authentication for any measure of security. What "Authentication device" (I think they mean "authentication mechanism") has never had a vulnerability exposed? Are all devices with a privilege escalation vulnerability designed by people who "should be sent back to computer school?" ("computer school?" ...seriously?). How many privilege escalation vulnerabilities were found in the Linux kernel last year? I empathize with the fact that an escalation exploit this serious in a device that is designed to be used by the public is not a trivial matter, but the poster is being sensationalist here, and, honestly, comes across as undereducated in the subject matter. I wouldn't consider myself an expert, but this person doesn't seem to have a clear understanding of the issue. It's a security vulnerability in a device that runs Linux because the designers were lazy when picking a password.

The real issue here is the fact that security is sometimes not taken as seriously with hardware and firmware design in commodity devices as it is with software.

Re:Seriously? (2, Insightful)

owlstead (636356) | more than 4 years ago | (#31000320)

"The real issue here is the fact that security is sometimes not taken as seriously with hardware and firmware design in commodity devices as it is with software."

I love that last statement. It's not only not taken seriously, it is rarely programmed by someone educated on the subject. And the users of these systems are also to "blame". Even I, when browsing for a new ADSL modem, don't look at the state of the security in a device. I'll look if a router has WPA2 but that's about the extend of it. This is not strange, since it is simply not the prime use of the device. For these kind of Femto cells, no manager will select on security, but rather at cost, signal strength and manageability.

About 3 years ago I looked at the security of an Enterprise Service Bus and literally on the last page it was stated that the software used AES 168 bit encryption (including screen shot, no less). It's not just commodity devices, it is all products that are not primarily designed with security in mind.

investigating hardware pinouts (1)

bl8n8r (649187) | more than 4 years ago | (#30999236)

Just what is that supposed to mean exactly? Does this crack require physical access in order to be executed?

"We've sniffed for hours, and nothing."
"Try a different BOOTP request!"
"Damn orinoco firmware..."
"This sucks, how are we gonna get a publication out of this?"
"Fine, gimme the bolt cutters"
    *snip* *clink* ...
"Hmm.. those are intersting pinouts.. they look like.."
"Yeah, dude that's SATA !!" ... *knoppix cd spins up*

"We got root! we got root!"

Been there, done that. (3, Informative)

marcansoft (727665) | more than 4 years ago | (#30999744)

I've been working on hacking the Vodafone femtocells for fun. They have an internal serial port and the bootloader has no security, not to mention the Linux image uses short default passwords that are easy to crack given the shadow file. So far we don't know of a way to get root given only network control, but it might be possible depending on how their IPSEC tunnel is set up. Our goal would be to use these for our own network, via OpenBSC.

It's worth noting that it's early and we're not entirely sure about the security implications and just how much you can do with these things (e.g. I don't know yet if voice traffic is decrypted inside the femtocell or if it is passed on encrypted to the servers). Chances are there will be some interesting exploits and chances are they will be presented at this year's Chaos Community Congress if they're interesting enough. Unless we get bored and work on something else, which happens sometimes.

Computer School (1)

kuzb (724081) | more than 4 years ago | (#31000920)

Whoever used the term "computer school" should be sent back to university.

Re:Computer School (1)

haderytn (1232484) | more than 4 years ago | (#31002762)

You just did.

embedded != security (0)

Anonymous Coward | more than 4 years ago | (#31001158)

Embedded devices and security don't mix. The people who design the devices and software have very different goals. Most embedded guys are just trying to hack some abortion of a CPU+board to work at all for their needs. No one gives security a second thought, beyond setting a password (or not).

The guys who care about security are usually working on bank software etc, where nothing is embedded, mostly working on VM languages on VM OSes, and the simplest feature is thousands of lines of triple-checked code with hundreds of tests against it.

Not surprising at all.

Sprint's Airave gets it precisely backwards (1)

gelfling (6534) | more than 4 years ago | (#31001384)

There are two modes: 'anyone' or 'from a list'. Now 'anyone' means that any Sprint customer in range can use the device up to the preprogrammed maximum of 3 simultaneous calls. 'From a list' means that only the phone numbers from a pre selected list are allowed to access the box. The problem is that is if you are a Sprint customer and your # is not on the list you can't have ANY service at all. You are in a 'private network' and therefore excluded from BOTH the Airave and connections to a local tower.

Which is stupid.

At a minimum you should be required to log onto the Airave using a PIN code which expires after "X" hours. And anyone else, who happens to be a Sprint customer is simply ignored by the Airave and ignores it so that they can access a tower.

Nothing new, not the first to do this (1)

kju (327) | more than 4 years ago | (#31003618)

I spoke with Harald Welte (of OpenBSC etc. fame) on ELC Europe back in October. He told me that he successfully gained root access to one of those Femtocells sold in the UK. As far as i remember he said that it was not very difficult to get access, also that he found some of the builtin features (e.g. check if operated in the correct location) nonworking.

On the other hand: This was bound to happen. Most embedded linux systems which have at least some remote hack-value tend to get opened up some day.

Re:Nothing new, not the first to do this (1)

marcansoft (727665) | more than 4 years ago | (#31004054)

We tested one of those at 26C3 using a simple VPN to the UK, so we had a Vodafone UK network in Germany (and successfully placed a call). This is Not Supposed To Work (and at this point we hadn't made any changes to the software yet). It seems beyond nonexistent physical security, the location determination features and other measures in place to prevent use in the wrong place/country aren't working very well or at all.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?