Vodafone femtocell hack allows call interception on unpatched devices

News that The Hacker’s Choice had revealed a proof-of-concept attack for hacking Vodafone’s Sure Signal femtocells (routers for boosting phone signals) and turning them into call interception devices has hit the Internet yesterday and created quite a sensation.

The researchers claimed that not only could they intercept calls this way, but that they could also gain access to Vodafone’s network and extract user information, and place phone calls and send text messages that will be billed to the SIM card tied to the device.

However, it turns out that the security vulnerabilities that allowed the attack have been patched with a software update pushed out in early 2010. According to The H Security, the idea for the attack wasn’t actually new, as two other researchers have managed to figure out how to gain root access to the femtocells back in February 2010.

Vodafone has moved to disable all the devices whose owners have failed to update the firmware in order to prevent the mounting of attacks misusing the holes. To enable them again, the owners must perform the update.