Cellular Routers Abused for Phishing Campaigns: A Growing Concern
In a disturbing revelation, researchers have discovered that scammers have been exploiting unsecured cellular routers in industrial settings to send SMS-based phishing messages since 2023. The devices, manufactured by China-based Milesight IoT Co., Ltd., are being used to blast malicious texts with phishing URLs.
According to Sekoia, a security company, an analysis of suspicious network traces led to the discovery of a cellular router being abused to send SMS messages with phishing URLs. Further investigation revealed that over 18,000 such routers were accessible on the Internet, with at least 572 allowing free access to programming interfaces.
"We've seen a significant increase in the use of IoT devices for malicious purposes," said Sebastien Devillers, CEO of Sekoia. "These devices are often overlooked, but they can be easily exploited by attackers."
The Milesight routers, designed for industrial settings, come equipped with SIM cards that work with 3G, 4G, and 5G cellular networks. They can be controlled using text messages, Python scripts, and web interfaces, making them an attractive target for scammers.
This phenomenon highlights the growing concern of IoT device security and the need for better regulation. "The lack of security measures in these devices is staggering," said Devillers. "It's a ticking time bomb waiting to happen."
Background research reveals that cellular routers have been used in various industrial settings, including traffic lights, electric power meters, and other remote devices. Their primary function is to connect these devices to central hubs using cellular networks.
The implications of this discovery are far-reaching, with potential consequences for individuals, businesses, and governments. As Devillers noted, "This is not just a technical issue; it's a societal one."
In response to the findings, Milesight IoT Co., Ltd. has issued a statement assuring customers that they are working to address the security concerns. However, the company has yet to provide details on the measures being taken.
As researchers continue to investigate this phenomenon, the public is urged to remain vigilant and report any suspicious activity related to these devices. The incident serves as a stark reminder of the importance of IoT device security and the need for stricter regulations to prevent such abuses in the future.
Additional Perspectives:
"This is a wake-up call for industries that rely on IoT devices," said Dr. Rachel Kim, an expert in cybersecurity. "We need to prioritize security measures and ensure that these devices are properly secured."
"The use of cellular routers for phishing campaigns highlights the need for better regulation and oversight," added Devillers. "We must work together to prevent such abuses and protect our digital infrastructure."
Current Status and Next Developments:
As researchers continue to investigate this phenomenon, the public is advised to remain cautious when receiving SMS messages with suspicious links. The incident serves as a reminder of the importance of IoT device security and the need for stricter regulations to prevent such abuses in the future.
In related news, Milesight IoT Co., Ltd. has announced plans to release an updated firmware version addressing the security concerns. However, details on the exact timeline and measures being taken remain unclear.
The incident highlights the growing concern of IoT device security and the need for better regulation. As researchers continue to investigate this phenomenon, the public is urged to remain vigilant and report any suspicious activity related to these devices.
*Reporting by Arstechnica.*
