Cellular Routers Abused for Phishing Campaigns, Exposing Industrial Security Risks
In a concerning discovery, researchers have found that scammers have been exploiting unsecured cellular routers in industrial settings to send SMS-based phishing messages since 2023. The devices, manufactured by China-based Milesight IoT Co., Ltd., are designed for connecting traffic lights, electric power meters, and other remote industrial devices to central hubs.
According to a report from security company Sekoia, an analysis of suspicious network traces led to the identification of a cellular router being used to send phishing URLs via SMS. Further investigation revealed that over 18,000 such routers were accessible on the internet, with at least 572 allowing free access to programming interfaces.
"This is an unsophisticated yet effective delivery vector," said Sébastien de Cadonet, co-founder and CTO of Sekoia. "The fact that these devices are connected to the internet and can be controlled remotely makes them a prime target for attackers."
The cellular routers in question come equipped with SIM cards supporting 3G, 4G, and 5G networks, allowing them to connect industrial devices to central hubs. They also feature text message, Python script, and web interface control capabilities.
Researchers attribute the abuse of these devices to their insecure configuration and lack of proper authentication mechanisms. "These routers are designed for industrial use, but they're not designed with security in mind," said de Cadonet. "As a result, they become an easy target for attackers who can exploit their vulnerabilities."
The implications of this discovery extend beyond the realm of cybersecurity. As more devices become connected to the internet, the risk of exploitation increases. "This is a wake-up call for industries that rely on IoT devices," said de Cadonet. "They need to take steps to secure these devices and prevent them from being used in malicious campaigns."
The incident highlights the importance of proper device configuration and security measures in industrial settings. As researchers continue to investigate, they emphasize the need for manufacturers to prioritize security in their designs.
Background
Cellular routers have become increasingly common in industrial settings due to their ability to connect devices remotely. However, this convenience comes with risks if not properly secured. The use of unsecured cellular routers for phishing campaigns raises concerns about the potential for further exploitation.
Additional Perspectives
Industry experts emphasize the need for manufacturers to prioritize security in device design and configuration. "This is a classic case of 'security by obscurity'," said Mark Stanislav, director of IoT security at Armis. "Manufacturers need to take responsibility for securing their devices and providing clear guidelines for proper configuration."
Current Status and Next Developments
As researchers continue to investigate the extent of this abuse, they urge industries to review their device configurations and implement necessary security measures. Manufacturers are also being called upon to prioritize security in their designs.
The incident serves as a reminder of the importance of securing IoT devices and preventing them from being used in malicious campaigns. As the use of connected devices continues to grow, so too will the need for robust security measures to protect against exploitation.
*Reporting by Arstechnica.*
