Researchers hack Verizon device

Two security experts say they have figured out how to spy on Verizon Wireless mobile phone customers by hacking into devices the US carrier sells to boost wireless signals indoors.

The finding, which the experts will further detail at two hacking conferences this summer, comes at a time of intense global debate about electronic privacy, after top-secret US surveillance programs were leaked by a former National Security Agency contractor, Edward Snowden, last month.

"This is not about how the NSA would attack ordinary people. This is about how ordinary people would attack ordinary people," said Tom Ritter, a senior consultant with the security firm iSEC Partners.

Verizon said it has updated the software on its signal-boosting devices, known as femtocells or network extenders, to prevent hackers from copying the technique of the two experts.

But Ritter said motivated hackers can still find other ways to hack the femtocells of Verizon, as well as those offered by some 30 carriers worldwide to their customers.

Ritter and his colleague, Doug DePerry, demonstrated how they can eavesdrop on text messages, photos and phone calls made with an Android phone and an iPhone by using a Verizon femtocell that they had previously hacked.

They declined to disclose how they had modified the software on the device, saying they do not want to make it any easier for criminals to figure out similar ways to hack femtocells.

The two said they plan to give more elaborate demonstrations two weeks from now at the Black Hat and Def Con hacking conferences in Las Vegas. 

Verizon Wireless released a Linux software update in March that prevents its network extenders from being compromised in the manner reported by Ritter and DePerry, according to company spokesman David Samberg.

"The Verizon Wireless Network Extender remains a very secure and effective solution for our customers," Samberg said in a statement.

He said there have been no reports of customers being impacted by the bug that the researchers had identified. The company is a joint venture between Verizon Communications and Vodafone Group.

Samberg said his company uses an internal security team as well as outside firms to look for vulnerabilities in the devices it sells, before and after they are released.

The two researchers said they are able to use the hacked femtocell to spy on Verizon phones even after Verizon released that update because they had modified the device before the company pushed out the software fix.

The researchers built their proof of concept system with femtocells manufactured by Samsung and a US$50 antenna from Wilson Electronics.

They said that with a little more work, they could have weaponised it for stealth attacks by packaging all equipment needed for a surveillance operation into a backpack that could be dropped near a target they wanted to monitor.

The iSEC researchers are not the first to warn of vulnerabilities in femtocells, but claim to be the first to hack the femtocells of a US carrier and also the first running on a wireless standard known as CDMA.

Other hacking experts have previously uncovered security bugs in femtocells used by carriers in Europe.

CTIA, a wireless industry group based in Washington, in February released a report that identified femtocells as a potential point of attack.

John Marinho, CTIA's vice president for cybersecurity and technology, said that the group is more concerned about other potential cyber threats, such as malicious apps. He is not aware of any case where attacks were launched via femtocells.

Still, he said, the industry is monitoring the issue: "Threats change every day."