4 ms·
Many mobile devices (especially those connected to a MVNO) are on one big giant subnet with "L2" style connectivity to each other. This is how Charlie Miller a
by xfitm3 7y ago
Many mobile devices (especially those connected to a MVNO) are on one big giant subnet with "L2" style connectivity to each other.
This is how Charlie Miller and Chris Valasek were able to remotely compromise vehicles with a vulnerable infotainment system via a pwned femtocell.
"To find vulnerable vehicles you just need to scan on port 6667 from a Sprint device on the IP addresses
21.0.0.0/8 and 25.0.0.0/8."[0]
[0] http://illmatics.com/Remote%20Car%20Hacking.pdf http://illmatics.com/Remote%20Car%20Hacking.pdf, pdf page 46.
- mirimir 7y agoOK, so they used a femtocell (miniature cell tower) that had been exploited to allow console access. In particular, a Sprint Airave. Basically that gave them direct access to Sprint's WAN. And this is mind-blowing: > It turns out that any Sprint device anywhere in the country can communicate [as in telnet] with any other Sprint device anywhere in the country. So remote devices do have network connectivity to cellular baseband. At least on Sprint. Do other cellular networks work like that?