AT&T's 3G MicroCell 'full of fail' thanks to wide open root access, claims fail0verflow

36

Most AT&T customers don't have to worry about the 3G MicroCell — it's a femtocell, a device designed specifically to create a small cloud of 3G cellular coverage using your wired internet connection, which means you only need it if your home or office doesn't have enough signal to reliably hold calls. For those who do need it, though, it can be a lifesaver and the only thing stopping customers from leaving for another network.

Hacker group fail0verflow — best known for unveiling the PlayStation 3's private key, allowing arbitrary programs to be run by users — has turned its attention to the MicroCell, detailing its findings in a recent blog post. In a word, Cisco (which makes the MicroCell for AT&T) seems to have done some sloppy work securing the device, if fail0verflow's claims are to be believed: it appears that users can connect to the WAN port and run Linux commands with root access without any authentication required whatsoever. Output is automatically directed to a fixed IP (presumably controlled by AT&T), but it's a simple matter to redirect those packets to another computer of the user's choosing. Amazingly, Cisco's command execution operation is said to be called "BackdoorPacketCmdLine."

If you use the MicroCell behind a firewalled router, it's not necessarily a big deal since malicious hackers wouldn't have an easy way to connect to the device remotely. If you use it connected directly to your modem, though, and let the MicroCell pass packets through to your home network — the configuration AT&T recommends for optimal call quality — it could be a bigger concern. fail0verflow hasn't yet detailed what they've been able to do with the capability, but regardless, Cisco and AT&T should be looking to get it patched as quickly as possible.

More from The Verge

Back to top ^
X
Log In Sign Up

forgot?
forgot?
Log In Sign Up

Forgot password?

We'll email you a reset link.

If you signed up using a 3rd party account like Facebook or Twitter, please login with it instead.

Forgot username?

We'll email it to you.

If you signed up using a 3rd party account like Facebook or Twitter, please login with it instead.

Forgot password?

If you signed up using a 3rd party account like Facebook or Twitter, please login with it instead.

Try another email?

Forgot username?

If you signed up using a 3rd party account like Facebook or Twitter, please login with it instead.

Try another email?

Almost done,

By becoming a registered user, you are also agreeing to our Terms and confirming that you have read our Privacy Policy.
Spinner.vc97ec6e

Authenticating

Great!

Choose an available username to complete sign up.

In order to provide our users with a better overall experience, we ask for more information from Facebook when using it to login so that we can learn more about our audience and provide you with the best possible experience. We do not store specific user data and the sharing of it is not required to login with Facebook.

tracking_pixel_5345_tracker