Penetration testing for a US Telco leader

The ever-growing tech security risks require mobile service providers to adapt constantly. One such provider reached out to improve the security of their mobile devices. Being experts on all things mobile, we were the right team for the task.

SHORT
summary

Industry

Telecommunications

Location

United States

Timeline

7 months

Services

Penetration testing

Team

1 R&D engineer

Our client has over 150 million network subscribers, making them a market leader in their field. They wanted to ensure top-of-the-line security for their mobile devices and protect their users from both hardware and software attacks.

The challenge

There are roughly 100+ mobile phone models across the most notable mobile manufacturers (Samsung, Apple, Huawei..). If you’re a mobile provider, making sure all of those phones are secure is a challenge, to say the least.

The sheer number of potential security scenarios could be a nightmare to deal with.

So they needed proven experts to give their mobile devices a green security light.

The solution

We’ve planned a series of penetration tests to test out the defenses of various devices. Only until we’ve rigorously tested each device, could it be fit for further use.

How we got there

We’ve received the phones in batches from halfway across the world, starting with the easiest batch, and ending with what the client deemed the hardest. And here’s how that went:

1st batch — It consisted of their old mobile devices already in use. We’ve managed to break into more than 90% of them. That’s bad news.

2nd batch — This was a harder nut to crack since the devices had less obvious vulnerabilities and we had less time due to deadlines.

3rd batch — Here, we saw a lot of new prototypes which we could barely break due to a lack of firmware for the prototypes and no active fastboot mode.

4th batch — The final prototype batch was also the strongest in terms of security. We couldn’t find a way to break them, which meant the client was moving in the right direction.

We communicated with the client regularly, with weekly reports and meetings every 5 days.

Our impact

OS penetration testing

We’ve used methods such as Man-in-the-middle and bypassing certificate pinning to test out the defenses of each mobile device.

Hardware penetration testing

By identifying specific pins on the phone motherboard, we would create a short circuit, sending the phone into debug mode.

This meant all defenses were down and a potential attacker could do whatever they wanted.

Security consulting

When all of our meticulous testing was said and done, we prepared a detailed report with our findings while also consulting them on which security practices they should implement.

Outcome

Our findings on the strengths and weaknesses of different mobile phone brands helped the client make decisions that directly impacted their bottom line.

On top of that, we’ve found many vulnerabilities that potential attackers could exploit. But thankfully, we’ve found them first and guided the client toward the right solutions.

10

Phone models tested

4

models passed our tests

WANT A SERVICE JUST LIKE THIS? — LET’S TALK

Just fill in the short form below, or skip to the bottom to arrange a chat directly with our client strategy specialist. Either way, we’ll be back in touch as soon as we can to arrange an informal call.

Don’t worry, any information you give us will only be stored for business purposes. Find out more in our Privacy Policy.

or