3 ms·

Initially, it was by default trusted. And once it expanded beyond academic and military, it became clear how foolish that assumption was. Cellular WANs aren't

Initially, it was by default trusted. And once it expanded beyond academic and military, it became clear how foolish that assumption was. Cellular WANs aren't the Internet. And it seems that at least some devices on them are poorly secured. So what I'm wondering is whether other cellular WANs are as iffy as Sprint's was. And whether they've been better secured.

wmf 7y ago
Cellular WANs aren't the Internet. Why do you say this?
- mirimir 7y ago
  They're private subnets, right? From the paper:[0] > Looking at the network configuration of the Uconnect system we can see that it has several interfaces used for communications. It has an interface for the internal Wi-Fi communications, uap0, and another PPP interface, ppp0, presumably used to communicate with the outside world, via Sprint’s 3G services. # ifconfig lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33192 inet 127.0.0.1 netmask 0xff000000 pflog0: flags=100<PROMISC> mtu 33192 uap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 address: 30:14:4a:ee:a6:f8 media: <unknown type> autoselect inet 192.168.5.1 netmask 0xffffff00 broadcast 192.168.5.255 ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1472 inet 21.28.103.144 -> 68.28.89.85 netmask 0xff000000 > The 192.168.5.1 address is the address of the Uconnect system to any hosts connected to the Wi-Fi access point. The IP address 68.28.89.85 is the one that anyone on the Internet would see if the Uconnect system connected to them. However, port 6667 is not open at that address. The 21.28.103.144 address is the actual address of the interface of the Uconnect facing the Internet, but is only available internally to the Sprint network. > After a little experimentation, it was observed that the PPP interface’s IP address would change each time the car was restarted, but the address space always fell within two class-A address blocks: 21.0.0.0/8 or 25.0.0.0/8, which are presumably the address space Sprint reserves for vehicle IP addresses. So these are basically huge LANs that anyone with a suitably tweaked Sprint baseband modem can access. 0) http://illmatics.com/Remote%20Car%20Hacking.pdf http://illmatics.com/Remote%20Car%20Hacking.pdf

wmf 7y ago

Cellular WANs aren't the Internet. Why do you say this?

mirimir 7y ago
They're private subnets, right? From the paper:[0] > Looking at the network configuration of the Uconnect system we can see that it has several interfaces used for communications. It has an interface for the internal Wi-Fi communications, uap0, and another PPP interface, ppp0, presumably used to communicate with the outside world, via Sprint’s 3G services. # ifconfig lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33192 inet 127.0.0.1 netmask 0xff000000 pflog0: flags=100<PROMISC> mtu 33192 uap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 address: 30:14:4a:ee:a6:f8 media: <unknown type> autoselect inet 192.168.5.1 netmask 0xffffff00 broadcast 192.168.5.255 ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1472 inet 21.28.103.144 -> 68.28.89.85 netmask 0xff000000 > The 192.168.5.1 address is the address of the Uconnect system to any hosts connected to the Wi-Fi access point. The IP address 68.28.89.85 is the one that anyone on the Internet would see if the Uconnect system connected to them. However, port 6667 is not open at that address. The 21.28.103.144 address is the actual address of the interface of the Uconnect facing the Internet, but is only available internally to the Sprint network. > After a little experimentation, it was observed that the PPP interface’s IP address would change each time the car was restarted, but the address space always fell within two class-A address blocks: 21.0.0.0/8 or 25.0.0.0/8, which are presumably the address space Sprint reserves for vehicle IP addresses. So these are basically huge LANs that anyone with a suitably tweaked Sprint baseband modem can access. 0) http://illmatics.com/Remote%20Car%20Hacking.pdf http://illmatics.com/Remote%20Car%20Hacking.pdf