SILENT SMISHING: THE HIDDEN ABUSE OF CELLULAR ROUTER APIS

Summary from the TLDR InfoSec newsletter

Threat actors have been exploiting APIs on over 572 Milesight industrial cellular routers to send smishing campaigns targeting European users since February 2022, with a primary focus on Belgium. The messages impersonate government services, including CSAM (the central system for identity and access management for the government's online services) and eBox. The attackers leverage CVE-2023-43261 and exposed APIs to remotely send SMS messages without authentication, utilizing routers as a distributed infrastructure across multiple countries to evade detection and enable mass phishing campaigns, with over 40,000 messages sent to Swedish and Italian numbers in a single campaign. Security professionals should audit cellular router configurations for exposed SMS APIs, implement authentication requirements, update firmware to versions beyond the vulnerable 32.x and 41.x versions, and monitor for unusual POST requests to /cgi endpoints. Additionally, they should educate users to scrutinize unsolicited SMS messages that contain shortened URLs or use urgent language.