6 ms·

So I was at DEFCON 19 and I'm 90% sure my Sprint 4G Android was hacked. When I make calls there is a beep on the line every few minutes so I'm guessing someone

by dotBen 15y ago

So I was at DEFCON 19 and I'm 90% sure my Sprint 4G Android was hacked. When I make calls there is a beep on the line every few minutes so I'm guessing someone managed to set up some recording of my calls. I've changed all my passwords and reflashed the phone back to factory defaults + latest copy of the firmware from HTC's website. Also, I only realized AFTER a few minutes of (failed) use that my Verizon 4G card was being MiTM'd as I had full strength but no connectivity. What I don't understand is how this vector occurred (on the Android phone) given it is no different to connecting over public (open) wifi - anyone can read packets and so the connections between Google Apps (for example) are supposed to be encrypted. My only guess is that my phone auto-downloaded a patch that was poisoned and the security failure here is that the phone assumes any patch fed to it over the mobile network must be trustworthy. :/

shoota 15y ago
No they always check the signature before applying the patch.
- Domenic_S 15y ago
  Check it against what? A pwned digest?
  - shoota 15y ago
    Unless you're rooted the updates are checked with the public key to make sure they are signed with the correct private key. Unless Google lost their set of private keys it wouldn't be possible to modify the update. It's entirely possible there are other exploits but a modified update.zip is not a likely vector.
    - avree 15y ago
      I'd be willing to bet that 90% of people at Defcon with Androids had them rooted. Many were probably running custom ROMs.
      - shoota 15y ago
        Then you'd be even more suspicious if a carrier OTA popped up on your phone.
mirkules 15y ago
"What I don't understand is how this vector occurred (on the Android phone) given it is no different to connecting over public (open) wifi" See the talk from BlackHat titled "Femtocells: a poisonous needle in the operator's haystack" http://femto.sec.t-labs.tu-berlin.de/bh2011.pdf http://femto.sec.t-labs.tu-berlin.de/bh2011.pdf Basically, they set up a rogue femtocell, you connected to it as you walked by and voila. It would also explain why you sometimes couldn't make calls (you need to be within 15 feet of most femtos to make a call, but you still have signal strength up to 40 feet).
- dotBen 15y ago
  Sure, but my point is more to do with the fact you can MiTM Wifi base-stations and poison DNS the urls to updates... the point is why was the phone more susceptible via 4G than Wifi? Also, from what I can tell this wasn't a femto-cell but a significant antenna, perhaps even telco industry-grade.
mrsebastian 15y ago
For what it's worth, a fellow hacker/attendee of DEF CON has contacted me to confirm Coderman's reports. He wasn't willing to say much else, only that the attack was very sophisticated and likely to be the work of top-notch professionals.

by dotBen 15y ago

shoota 15y ago

No they always check the signature before applying the patch.

Domenic_S 15y ago
Check it against what? A pwned digest?
- shoota 15y ago
  Unless you're rooted the updates are checked with the public key to make sure they are signed with the correct private key. Unless Google lost their set of private keys it wouldn't be possible to modify the update. It's entirely possible there are other exploits but a modified update.zip is not a likely vector.
  - avree 15y ago
    I'd be willing to bet that 90% of people at Defcon with Androids had them rooted. Many were probably running custom ROMs.
    - shoota 15y ago
      Then you'd be even more suspicious if a carrier OTA popped up on your phone.

mirkules 15y ago

"What I don't understand is how this vector occurred (on the Android phone) given it is no different to connecting over public (open) wifi" See the talk from BlackHat titled "Femtocells: a poisonous needle in the operator's haystack" http://femto.sec.t-labs.tu-berlin.de/bh2011.pdf http://femto.sec.t-labs.tu-berlin.de/bh2011.pdf Basically, they set up a rogue femtocell, you connected to it as you walked by and voila. It would also explain why you sometimes couldn't make calls (you need to be within 15 feet of most femtos to make a call, but you still have signal strength up to 40 feet).

dotBen 15y ago
Sure, but my point is more to do with the fact you can MiTM Wifi base-stations and poison DNS the urls to updates... the point is why was the phone more susceptible via 4G than Wifi? Also, from what I can tell this wasn't a femto-cell but a significant antenna, perhaps even telco industry-grade.

mrsebastian 15y ago

For what it's worth, a fellow hacker/attendee of DEF CON has contacted me to confirm Coderman's reports. He wasn't willing to say much else, only that the attack was very sophisticated and likely to be the work of top-notch professionals.