Kaspersky ICS CERT researchers have detected critical vulnerabilities in Cinterion cellular modems. The discovery showcases flaws that allow a remote unauthorised attacker to execute arbitrary code, constituting a major threat to millions of industrial devices. Kaspersky experts presented details on these vulnerabilities at OffensiveCon in Berlin, on May 11.

Kaspersky ICS CERT identified severe security vulnerabilities in Cinterion cellular modems, widely deployed in millions of devices and vital to global connectivity infrastructure.

These vulnerabilities include critical flaws that permit remote code execution and unauthorised privilege escalation, posing substantial risks to integral communication networks and IoT devices foundational to industrial, healthcare, automotive, financial and telecommunications sectors.

Among the vulnerabilities detected, the most alarming is CVE-2023-47610, a heap overflow vulnerability within the modem’s SUPL message handlers. This flaw enables remote attackers to execute arbitrary code via SMS, granting them unprecedented access to the modem’s operating system.

This access also facilitates the manipulation of RAM and flash memory, increasing the potential to seize complete control over the modem’s functionalities—all without authentication or requiring physical access to the device.

Further investigations exposed significant security lapses in the handling of MIDlets, Java-based applications running on the modems.

Attackers could compromise the integrity of these applications by circumventing digital signature checks, enabling unauthorised code execution with elevated privileges.

This flaw poses significant risks not only to data confidentiality and integrity, but it also escalates the threat to broader network security and device integrity.

“The vulnerabilities we found, coupled with the widespread deployment of these devices in various sectors, highlight the potential for extensive global disruption. These disturbances range from economic and operational impacts to safety issues.

“Since the modems are typically integrated in a matryoshka-style within other solutions, with products from one vendor stacked atop those from another, compiling a list of affected end products is challenging.

“Affected vendors must undertake extensive efforts to manage risks, with mitigation often feasible only on the telecom operators’ side. We hope that our in-depth analysis will help stakeholders implement urgent security measures and establish a valuable reference point for future cybersecurity research,” says Evgeny Goncharov, head of Kaspersky ICS CERT.

To counter the threat posed by the CVE-2023-47610 vulnerability, Kaspersky recommends the only reliable solution: disabling nonessential SMS messaging capabilities and employing private APNs with strict security settings.

Regarding the other zero-day vulnerabilities registered under CVE-2023-47611 through CVE-2023-47616, Kaspersky advises enforcing rigorous digital signature verification for MIDlets, controlling physical access to devices, and conducting regular security audits and updates.

In response to these discoveries, all findings were proactively shared with the manufacturer prior to public disclosure. Cinterion modems, originally developed by Gemalto, are cornerstone components in machine-to-machine (M2M) and IoT communications, supporting a wide array of applications from industrial automation and vehicle telematics to smart metering and healthcare monitoring.

Gemalto, the initial developer, was subsequently acquired by Thales. In 2023, Telit acquired Thales’ cellular IoT products business, including the Cinterion modems.

By Okoko Chidozie Christian

[email protected]; 09025179984.

Epileptic power supply has been a mainstay of Nigerian society and profoundly impacted communities, undermines the access of individuals to electricity and hampered economic growth.

And, a range of factors have been identified by stakeholders as the root causes including energy theft.

Electricity – essential part of our daily lives is used for powering our homes, offices, businesses and industries. Unfortunately, some people choose to illegally tap into it.

Illegal electricity connections, also known as “power theft” refers to the unauthorized tapping of electric from a power grid, often without the knowledge or approval of electricity providers.

According to source, electric theft is the criminal practice of stealing electric power, and it is nearly as old as electricity distribution.

Accomplished through a variety of means, from methods as rudimentary as direct hooking to a power line, to manipulation of computerized electrical meters endangering the environment.

For instance, if the power consumption in a region increases to a level where the average demand exceeds the rating of transformer or other electrical equipment due to power theft, then power quality problem like voltage collapse or transformer overloading may occur.

Frequent power cuts lead to deterioration in the customer-utility relationship. Illegal connections to the electricity network often transverse roads, fields, footpaths and present a safety risk for communities who must go about their normal daily activities into contacts with live cables and wires that have not been properly installed.

However, bypassing an electric meter co-located with fuses, circuit breakers, residual current earth leakage detection will often lead to risk of electrical faults and excessive use within the house may not be detected.

And, the supply will remain live within the house, increasing the risk of electrocution or fire. Cost of electricity is substantially compared with low income flow and credit constraints in most countries. For examples, more than 70% of Nigerians live on less than US2.0dollars per day. Yet, there is need to pay for the cost of power consumed.

So, it would appear illogical to conclude that residential consumers steal electricity thereby contributing to this loss.

According to the new Electricity Act, offenders to electric theft shall be subject to imprisonment for a term exceeding three years, a fine or both. If the load consumed or used or attempted consumption or use, does not exceed 10 kilowatts, the first conviction shall warrant a fine no less than three times the financial gain resulting from the electricity theft.

In Nigeria today, the Power Distribution Companies, DisCos face several challenges of electricity theft which remain one of the major causes of massive revenue losses thereby increases the debt profile in Nigeria Electricity Supply Industry, hence negatively impacting the nation’s economy.

Recently, Adetayo Adegbemle, executive director of Power Up Nigeria,  expressed that the Senators are out of touch with the realities of the power sector and should seek advice from professionals and experts for accurate information. According to him, electricity is also not a public utility anymore, it is now a commodity.

Energy theft is an international problem and globally estimated in 2022 that consumers spent up to 1.4 billion pounds annually. This costs have to be passed to customers in the form of higher energy charges. The annual worldwide financial losses due to power or electricity theft are estimated to be around US 100billion dollars.

In a recent report by the Director of the Power Sector Advocacy Group in Nigeria; one (1) transmission company TCN, twenty-three(23) generation companies, GenCos and eleven (11) electricity distribution Companies, DisCos operates in Nigeria. Moreover, the plants are managed by generating companies (GenCos), independent power providers, and the Niger-Delta Holding Company.

Unfortunately, the twenty-three (23) power-generating plants connected to the national grid with the capacity to generate 11,165.4MWs of electricity has not been feasible. Despite having a capacity of 22,000 MWs, the country’s power generating peaked at 4,594.6 MWs as of November 2022 has been insufficient for the populace. So, the electricity generated is considerably low for over 200million people.

Although, some anti-theft products can help shield the network and consequently reduce power theft. Just like in United Kingdom, their electrification is made under subsurface about 100meters; not so easy for human to access, study confirms.

So, being a complex challenge, there are some ways to combat the illegalities of energy theft in Nigeria, but the consumers-utility relationship is a key determinant. Improvement of this relationship through local participation in development of renewable energy schemes such as rooftop solar photovoltaic, use of biomass and many more could bring benefit. Also, financing, redesigning of the distribution system and utility company codes and standards, competence in post-installation maintenance.

Strengthening of legal and regulatory framework particularly with larger users, and installing high security tampered-resistant metering systems for commercial consumers may have more effect.

Clean Technology Hub, renewable energy and climate change advocacy firm has launched a Climate Change and Youth Movement in FCT secondary schools in collaboration with the Department of Science, Technology, and Innovation of the FCT Education Secretariat.

Ms Ifeoma Malo, founder and CEO of Clean Technology Hub,

The collaborators commenced the Climate and Change Youth Movement recently at the Government Science and Technical College, Bwari, FCT.

The Climate Change and Youth Movement is a platform for students to learn about the environment and contribute to solving challenges linked to climate change starting from their local communities. It aligns with a worldwide effort to raise awareness and educate children and youth about climate change and renewable energy.

Experts say children and youth are potential driving forces in achieving the climate change objectives in the Sustainable Development Goals.

Clean Technology Hubs’ Climate Change and Youth Movement, for public secondary school students and teachers, seeks to support schools in building climate education programs.

CTH says it will implement it by Establishing new environmental clubs (Green Clubs) or partnering with existing ones targeting science and art students and equipping them with a club manual to guide their meetings.

The schools will also participate in the first-ever Nigerian Students Climate Summit billed to commemorate World Environment Day on 6 June 2024.

The program aims to increase awareness, sustainability, and resilience regarding climate change and clean energy, build capacity on the various technical skills required in the clean energy market value chain, and increase understanding of opportunities in the renewable energy sector.

Ms Ifeoma Malo, founder and CEO of Clean Technology Hub, remarked, “The agreement signed with DSTI enables us to launch a pilot program in the Government Science and Technical College, Bwari, which, upon its successful completion, will be replicated in other colleges in Abuja.”