DEF CON 33 - Pre-Auth RCE, Arbitrary SMS & Adjacent Attacks on 5G and 4G_LTE Routers - Edward Warren

The speaker reveals widespread, systemic security flaws in 5G and 4G routers, particularly due to insecure firmware and poor coding practices like unvalidated input and default credentials, enabling remote code execution and arbitrary SMS sending. 1:00

Key Takeaways:
• Insecure firmware with exposed API endpoints and default credentials (admin/admin!) enables unauthorized access in 5G and 4G routers 1:30.
• The use of Go form in router SDKs is a recurring vulnerability across manufacturers, leading to command injection and remote code execution 2:48.
• Devices allow unauthenticated access to critical functions like SMS sending via AT commands, enabling information disclosure and potential misuse 23:33.
• A lack of input sanitization in parameters like Wi-Fi name and APN settings allows command injection and buffer overflow vulnerabilities 18:48.
• The research highlights that these devices are reachable over the internet despite being designed for private networks, exposing users to remote attacks 13:00.

The presentation underscores the urgent need for manufacturers to adopt secure software development practices and maintain transparent software bills of materials to prevent exploitable flaws in IoT devices. 26:54

Sources:

• 1:00 Overview of research focus on insecure 5G/4G routers and pre-authentication code execution.
• 1:30 Discussion of insecure default credentials and access control flaws in routers.
• 2:48