All the 4G Modules Could be Hacked

The presentation discusses the security vulnerabilities in 4G modules and provides suggestions for defending against attacks.

• Command injection vulnerability found in passing SMS 80 command
• Various successful cases of attack discussed
• Suggestions for defending against attacks provided
• Importance of using a firewall emphasized

The presenter mentions that they found a command injection vulnerability in passing SMS 80 command, which allowed them to remotely hack into the system. They also discuss various other successful cases of attack, such as using Jama to attack the 4G module and using main in the middle and the browser. The presenter emphasizes the importance of using a firewall to defend against these attacks.

Nowadays more and more 4G modules are built into IoT devices around the world, such as vending machines, car entertainment systems, laptops, advertising screens, urban cameras etc. But no one has conducted comprehensive security research on the 4G modules. We carried out this initiative and tested all the major brand 4G modules in the market (more than 15 different types). The results show all of them have similar vulnerabilities, including remote access with weak passwords, command injection of AT Command/listening services, OTA upgrade spoofing, command injection by SMS, and web vulnerability. Through these vulnerabilities we were able to get to the shell of these devices. In addition to using wifi to exploit these vulnerabilities, we created a new way to attack through fake base station system, triggered by accessing the intranet of cellular network, and successfully run remote command execution without any requisites. In this talk, we will first give an overview on the hardware structure of these modules. Then we will present the specific methods we use in vulnerability probe. In the final section we will demonstrate how to use these vulnerabilities to attack car entertainment systems of various brands and get remote control of cars.