Researchers from mobile security firm Zimperium have discovered three serious security vulnerabilities in BTS stations that could allow would-be hackers to compromise the entire cell tower.
Zimperium researchers say the flaw is so critical that it could allow hackers to abuse, compromise, and crash cell phone towers.
BTS (Base Transceiver Station) is the technical term used to describe the mobile phone towers that we see in cities and villages and are located everywhere, on hills and mountains. These towers basically consist of software radio equipment that allows mobiles to connect to GSM, UMTS and LTE networks. The stations are used by service providers to pass our SMS messages, transmit calls and data packets from our mobiles to the mobile phone company's data center, which in turn relays the SMS messages to the destination and sends data packets over the Internet to the servers we are trying to reach.
Zimperium says it discovered three serious flaws in many of the software packages running on BTS stations. According to Zimperium, other software packages not included could also have affected its tests, since they all appear to work in the same way, with a similar design.
Currently, there are three issues that mobile operators and BTS software vendors need to take care of in their equipment.
The first is a bug in a BTS core software service that exposes the device to external connections, which allows an attacker to reach the station's transceiver over the Internet. Attackers can take advantage of built-in features of the device by sending UDP packets to certain management ports. This allows hackers to take control of the BTS station and do any damage.
In this case, Zimperium suggests that companies restrict sockets used for control and data exchange to local interface only (127.0.0.1), or install a firewall that stops external traffic.
The second issue is a memory overflow caused by huge UDP packets. This is a classic code execution flaw (CEF) that allows hackers to remotely log into the device.
The third problem is related to the first. An attacker can execute commands on the BTS transceiver module if he can send UDB to the BTS, as the control channel has no authentication. The transceiver is the key hardware component in a BTS, which transmits and receives data between the BTS software core and the radio antenna.
Zimperium says that an attacker with access to the control channel can turn off the BTSs, change their identity or jam the antenna's radio frequencies, making it behave like another BTS station from the same network, or eliminate the BTSs from the mobile operator's network.
