According to researchers Nikita Tarakanov and Oleg Kupree they are.
From Network World:
"For one, it's easy to make an image of the USB modem's file system,
modify it and write it on the modem again. There's a tool
available from Huawei to do modem backup and restore, but there are
also free tools that support modems from other manufacturers,
Malware running on the computer could detect the model and version of
the active 3G modem and could write an image with malicious
customizations to it using such tools. That modem would then
compromise any computer it's used on.
The modem contains the installer for an application that gets installed on the computer, as well as the necessary drivers
for different OSes. The application allows the user to stop, start and manage the Internet connection established through
The configuration files for the installed application, as well as
those of the application installer stored on the modem,
are in plain text and can be easily modified. One setting in the
configuration files defines what DNS servers the modem should
use for the Internet connection.
An attacker could change those entries to servers controlled by the attacker, Tarakanov said. This would give the attacker
the ability to direct users to rogue websites when they're trying to visit legitimate ones using the modem connection.
While the application installer itself cannot be directly modified to load malware because it's a signed executable, there
are some entries in its configuration file that can be used for this purpose.
For example, many configuration files had paths to antivirus installers and an option of whether to install those programs
or not, Tarakanov said. The researcher said that he never found an antivirus installer shipped with the USB modems he tested,
but the feature was there.
An attacker could create a custom image with a modified configuration file that enables this feature and installs a malicious
file stored on the modem instead of an antivirus program. If the image is written on a USB modem, every time the user would
install the modem application, the malware would also be installed, Tarakanov said.
The researchers also found a possible mass attack vector. Once installed on a computer, the modem application -- at least
the one from Huawei -- checks periodically for updates from a single server, Tarakanov said. Software branded for a specific
operator searchers for updates in a server directory specific to that operator.
An attacker who manages to compromise this update server, can launch mass attacks against users from many operators, Tarakanov
said. Huawei 3G modems from several different Russian operators used the same server, but there might be other update servers
for other countries, he said.
Tarakanov said that he didn't look for vulnerabilities in the actual modem drivers installed in the OS, but he expects them
to have vulnerabilities. The vast majority of third-party drivers in general have vulnerabilities, he said.
Tarakanov specializes in exploit writing and finding vulnerabilities in the Windows kernel mode drivers. However, Oleg Kupreev
was the leader for this particular research project concerning 3G/4G modems.
Research in this area is just at the beginning and there's more to investigate, Tarakanov said. Someone has to do it because
many new laptops come with 3G/4G modems directly built in and people should know if they're a security threat"
Let's hope new models will be safe because I use a 3G usb modem on occasion.
Source: Network World