Two security experts at the last Def Con hacking conference have demonstrated how Internal LTE/3G modems can be hacked to help malware survive OS reinstalls
Many users totally ignore that LTE/3G modems built into new business laptops and tablets have a dedicated processor and operating system that could be exploited by threat actors to maintain persistent access to a compromised device.
The expert explained that Huawei LTE modem runs a Linux-based OS, a modification of the Android OS, and is connected to the host system through an internal USB interface. The use of an internal USB interface means that the module could be used by attackers to emulate a number of devices connected to the primary OS, including keyboard, mouse, CD-ROM drive, network card, or other USB device.
The researchers were able to rewrite the firmware because the update process is weak, in fact, the updates aren’t protected by digital signature neither by encryption mechanisms. The two researchers developed their malicious firmware and served it through the Windows update utility provided by the vendor.
The updates could be served in various ways, by exploiting malicious programs already running on the target machine, or by tricking victims into thinking that they are legitimate security patches.
Once the attacker has rewritten the firmware running on the modem it will be able to maintain the infection even if the host OS is reinstalled. The experts also explained that the malicious firmware could be also instructed to ignore any subsequent firmware update, in this case, the unique way to restore the infected PC is to remove the infected modem module.
Huawei promptly fixed the issue, introducing a secure boot that blocks the flashing of unauthorized firmware images.
The presentation made by the security experts raises the question about the possible exploitation of dedicated processors and operating systems that equip any device connected to a system. Malware authors can exploit them to ensure persistence of their malicious code.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.