g richter - Reverse Engineering 4G Hotspots for Fun, Bugs, and Net Financial Loss
Reverse engineers the firmware of commercial 4G hotspot devices to find authentication bypasses and persistent backdoor injection points.
Summary
4G Hotspot Firmware Reversing
g richter presents research into popular commercial 4G mobile hotspot devices used by millions for personal and enterprise connectivity.
Firmware Extraction
Using UART serial ports exposed on the PCB and JTAG probing, the researcher extracts full firmware images from multiple hotspot models including devices from major US carriers.
Vulnerability Discovery
Static analysis of extracted firmware reveals hardcoded administrative credentials, unauthenticated web management interfaces accessible from the LTE network, and command injection vulnerabilities in the device management daemon.
LTE Network-Side Attacks
Beyond local attacks, the talk examines the AT command interface exposed over USB and vulnerabilities in the device's PPP and DHCP implementations that could be exploited by a malicious carrier network.
Related talks
Main Stage·47 min
XiaoHuiHui
Discovers systemic vulnerabilities across 4G LTE modem modules from major manufacturers used in billions of IoT devices.
Red Team Village·23 min
Ali Abdollahi
Ali Abdollahi analyzes cellular core network security mechanisms, reviewing IMSI catchers, diameter routing flaws, and protocol bypasses from a red team perspective.
Main Stage·53 min
Adam Bresson
Adam Bresson explores palm os security at DEF CON 8, examining palm-os and practical defenses.