Glitch opens T-Mobile user to hacker probes

Computerworld - Mike Palmer, technology director at The Associated Press news agency's broadcast division, learned a lesson this month: Mobile wireless data services need to be carefully monitored for hacker probes that could create security risks as well as cost issues.

Palmer works in Washington for New York-based AP. He said he discovered 25 probes from hackers when he checked inbound traffic to a laptop PC that's used to send video and text files over T-Mobile USA Inc.'s General Packet Radio Service (GPRS) mobile data network.

Palmer said he wasn't worried about security problems because he uses Atlanta-based Internet Security Systems Inc.'s BlackICE personal firewall technology. But what did bother him was the possibility that AP could end up paying for the probes if they pushed him over the 10MB monthly data transmission limit he has with T-Mobile.

Like other major cellular network operators, T-Mobile, a subsidiary of Bonn-based Deutsche Telekom AG, charges for its data service on a per-megabyte basis that includes both incoming and outgoing transmissions.

Kim Thompson, a spokeswoman for Bellevue, Wash.-based T-Mobile, acknowledged the problem that Palmer experienced. But she described it as an isolated incident and promised a fix by week's end.

Thompson said T-Mobile has firewalled its network to prevent such probes and put mechanisms in place to ensure that customers don't have to pay for unsolicited inbound traffic. The probes of AP's systems stemmed from a recent upgrade of T-Mobile's network that resulted in a "glitch," she added. The problem affected fewer than 100 users, Thompson said.

John Pescatore, a security analyst at Gartner Inc. in Stamford, Conn., said this is the first incident he's aware of in which a user of an IP-based mobile data network was subjected to probes that weren't blocked. But once a user opens up an IP connection, hackers can usually discover it "in about 10 minutes," he said.

In such an environment, IT security tools and firewalls are essential, Pescatore said. Both GPRS data circuits and rival Code Division Multiple Access (CDMA) 1x services from carriers such as Sprint PCS Group utilize IP connections, he noted.

Jim Grams, a senior vice president at AT&T Wireless Services Inc., said the Redmond, Wash.-based company helps its wireless data users avoid probes by not assigning static and exposed IP addresses to users. AT&T Wireless has also installed firewalls that stop such traffic before it reaches users, he said.

Cellular Tips Per-megabyte pricing means you pay for inbound traffic. Check GPRS or CDMA 1x clients regularly to ensure they haven't been probed by hackers. Demand rebates if you get billed for unsolicited inbound traffic.

Read more about Mobile and Wireless in Computerworld's Mobile and Wireless Topic Center.