All the 4G Modules Could be Hacked
summary
Over thirty commercial 4G modules test positive for remote takeover: open telnet/ADB ports, default or extractable passwords, hard‑coded private keys and reachable debug ports let attackers get shells; a fake base station built with inexpensive SDRs forces modules to attach and exposes IP traffic; an FTP server with hard-coded creds accepts unsigned firmware uploads and enables mass FOTA compromise in one day; SMS/AT-command injection and replayed MCU commands unlock doors and control infotainment, all demonstrated end‑to‑end with firmware unpacking, flash programmers, GPU cracking and remote exploits.
AI-written summary · about
chapters (13)
- 0:00Start
- 4:1846 Module Scenarios
- 6:334G Module Internal structure
- 12:25Additional Attack Surfaces
- 17:40Attack in the Operator Intranet
- 18:40Attack via Private APN
- 21:19Unpack Firmware Upgrade Program
- 21:47Through Firmware Upgrade Tool
- 23:36Ways to Get a shell
- 25:11Ways to Get Network Traffic
- 38:32Attack FOTA - Server side
- 41:33AT command vulnerability
- 46:28Suggested Simple Defense Practice
related talks
44mExposing Critical Threats In Millions Of Connected Devices
25mAttacking Mobile Broadband Modems Like a Criminal Would
48mSATCOM Terminals: Hacking by Air, Sea, and Land
54mExposing device features on 4G & 5G networks
38mModems (and telecoms) are also not as secure - 6 0-days to 4 million modems within a week
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
33mHacking 5G From Radio Security To The Apis