your cellular network for the very first time, your carrier service
automatically configures or sends you a message containing
network-specific settings required to connect to data services.
While manually installing it on your device, have you ever
noticed what configurations these messages, technically known as
OMA CP messages, include?
Well, believe me, most users never bother about it if their
mobile Internet services work smoothly.
But you should worry about these settings, as installing
untrusted settings can put your data privacy at risk, allowing
remote attackers to spy on your data communications, a team of
cybersecurity researchers told The Hacker News.
Mobile carriers send OMA CP (Open Mobile Alliance Client
Provisioning) messages containing APN settings, which your phone
needs to set up a connection to the gateway between your carrier’s
mobile network and the public Internet.
These settings include an optional field to configure HTTP proxy
that can route your web traffic through it, but many carriers use
transparent proxies that don’t even require this field to be
set.
Check Point shared with The Hacker News, weakly-authenticated
provisioning messages implemented by some device
manufacturers—including Samsung, Huawei, LG, and Sony—can allow
remote hackers to trick users into updating their device APN
settings with malicious attacker-controlled proxy servers.
This, in turn, could allow attackers to easily intercept some
network connections a targeted device makes through its data
carrier service, including web browsers and built-in email
clients.
“It takes only a single SMS message to gain full access to your
emails,” the researchers say.
“In these attacks, a remote agent can trick users into accepting
new phone settings that, for example, route all their Internet
traffic to steal emails through a proxy controlled by the
attacker.”
“Furthermore, anyone connected to a cellular network may be the
target of this class of phishing attacks, meaning you don’t have to
be connected to a Wi-Fi network to get your private email data
maliciously extracted by cyber attackers.”
connection, proxy settings for mobile data network are not used by
every app installed a targeted device. Instead, it depends upon
which app has been designed to accept the user-configured
proxy.
Moreover, the proxy server would not be able to decrypt HTTPS
connections; thus, this technique is suitable only for intercepting
insecure connections.
“This is an entirely new classification of phishing attacks on our
emails,” said Slava Makkaveev, a security researcher at Check Point
told The Hacker News. “It was difficult to classify the
vulnerability at first because it’s a deep specificity problem.
It’s probably the most advanced phishing attack on our emails I’ve
seen to date.”
the authentication of provisioning messages, specifications the
industry-standard recommends to make OTA provisioning secure
doesn’t mandate carriers to properly authenticate CP messages using
USERPIN, NETWPIN, or other methods.
As a result, a message recipient (targeted user) cannot verify
whether the OMA CP message with new settings has been originated
from his network operator or an imposter, leaving an opportunity
for attackers to exploit this weakness.
“More dangerously, anyone can buy a $10 USB dongle [send fake OMA
CP messages] and execute a large-scale phishing attack. Special
equipment is not required to carry out the attack,” researchers
explain.
“The phishing CP messages can either be narrowly targeted, e.g.,
preceded with a custom text message tailored to deceive a
particular recipient, or sent out in bulk, assuming that at least
some of the recipients are gullible enough to accept a CP without
challenging its authenticity.”
vendors in March 2019. Samsung and LG have addressed the issue in
their Security Maintenance Release for May and July respectively.
Huawei is planning to fix the issue in the next generation of
Mate series or P series smartphones, while Sony refused to
acknowledge the issue, stating that their mobile phone devices
follow the OMA CP specification.
Even after getting patches, researchers recommended users not to
blindly trust messages from your mobile carriers or APN settings
available on the Internet claiming to help users with
troubleshooting issues in data carrier services.
References
- ^
new report
(research.checkpoint.com)