Last checked at 
* Researchers hack into Verizon Wireless network extender
* Use hacked device to spy on Verizon mobile communications
* Verizon says fixed bug so that others cannot repeat hack
* Researchers say Verizon vulnerable to other hacks
* Say equipment of some 30 other carriers also vulnerable
By Jim Finkle
NEW YORK, July 15 (Reuters) - Two security experts said theyhave figured out how to spy on Verizon Wireless mobile phonecustomers by hacking into devices the U.S. carrier sells toboost wireless signals indoors.
The finding, which the experts demonstrated to Reuters andwill further detail at two hacking conferences this summer,comes at a time of intense global debate about electronicprivacy, after top-secret U.S. surveillance programs were leakedby a former National Security Agency contractor, Edward Snowden,last month.
"This is not about how the NSA would attack ordinary people.This is about how ordinary people would attack ordinary people,"said Tom Ritter, a senior consultant with the security firm iSECPartners.
Verizon said it has updated the software on itssignal-boosting devices, known as femtocells or networkextenders, to prevent hackers from copying the technique of thetwo experts.
But Ritter said motivated hackers can still find other waysto hack the femtocells of Verizon, as well as those offered bysome 30 carriers worldwide to their customers.
Femtocells, which act as tiny cellphone towers, can bepurchased directly from Verizon for $250. Used models can beobtained online for about $150.
Ritter and his colleague, Doug DePerry, demonstrated forReuters how they can eavesdrop on text messages, photos andphone calls made with an Android phone and an iPhone by using aVerizon femtocell that they had previously hacked.
(Reuters video showing part of demonstration:)
They declined to disclose how they had modified the softwareon the device, saying they do not want to make it any easier forcriminals to figure out similar ways to hack femtocells.
The two said they plan to give more elaborate demonstrationstwo weeks from now at the Black Hat and Def Con hackingconferences in Las Vegas. More than 15,000 securityprofessionals and hackers are expected to attend thoseconferences, which feature talks on newly found bugs incommunications systems, smart TVs, mobile devices and computersthat run facilities from factories to oil rigs.
Verizon Wireless released a Linux software update in Marchthat prevents its network extenders from being compromised inthe manner reported by Ritter and DePerry, according to companyspokesman David Samberg.
"The Verizon Wireless Network Extender remains a very secureand effective solution for our customers," Samberg said in astatement. He said there have been no reports of customers beingimpacted by the bug that the researchers had identified. Thecompany is a joint venture between Verizon Communications Inc and Vodafone Group Plc.
Samberg said his company uses an internal security team aswell as outside firms to look for vulnerabilities in the devicesit sells, before and after they are released.
Still, the two researchers said they are able to use thehacked femtocell to spy on Verizon phones even after Verizonreleased that update because they had modified the device beforethe company pushed out the software fix.
The researchers built their "proof of concept" system thatthey will demonstrate in Las Vegas with femtocells manufacturedby Samsung Electronics Co and a $50 antenna fromWilson Electronics Inc.
They said that with a little more work, they could haveweaponized it for stealth attacks by packaging all equipmentneeded for a surveillance operation into a backpack that couldbe dropped near a target they wanted to monitor.
For example, a group interested in potential mergers mightplace such a backpack in Manhattan restaurants frequented byinvestment bankers. Verizon's website said the device has a40-foot range, but the researchers believe that could beexpanded by adding specialized antennas.
The iSEC researchers are not the first to warn ofvulnerabilities in femtocells, but claim to be the first to hackthe femtocells of a U.S. carrier and also the first running on awireless standard known as CDMA.
Other hacking experts have previously uncovered securitybugs in femtocells used by carriers in Europe.
CTIA, a wireless industry group based in Washington, inFebruary released a report that identified femtocells as apotential point of attack.
John Marinho, CTIA's vice president for cybersecurity andTechnology, said that the group is more concerned about otherpotential cyber threats, such as malicious apps. He is not awareof any case where attacks were launched via femtocells.
Still, he said, the industry is monitoring the issue:"Threats change every day."
