Leaking Beeps: Are Pagers Leaking Confidential Information?

“Leaking Beeps” is a series of studies by Trend Micro that aims to highlight a weakness in pager technology and how it can put critical activities of affected companies at risk.

Pager technology has been on the market for more than 60 years. Despite the role of smartphones in our everyday lives, there are still some industries that are dependent on pager technology such as restaurants, hospitals, and places that can't be reached by a cellular signal. Unfortunately, modern technology has caught up with this legacy solution. Through software-defined radio and cheap equipment, third parties can read unencrypted pager messages (pages) in the clear even tens of kilometers away from their source.

We look at different industries that still use pagers for their day-to-day operations and what that means for security and privacy. In three separate reports, we discuss the findings made over a lengthy observation period and highlight to the industries concerned what the fallacies of pager use can be, what attack scenarios could be carried out by ill-minded actors and how to best protect their operations and confidential data.

1. Leaking Beeps: Unencrypted Pager Messages in the Healthcare Industry

This report looks at the implications of pager use on the healthcare sector in the US, an industry governed by HIPAA (the Health Insurance Portability and Accountability Act). HIPAA regulates how patients’ personal data should be kept private. During the course of our research, we were able to see pages coming from healthcare facilities that contain a range of protected health information (PHI)—e.g., email, phone numbers, date of birth, syndromes, and diagnosis. The transmitted information would also allow an attacker to track a patient’s interaction with a hospital, from the time of entry to diagnosis and treatment up to the patient’s discharge.

View report: Are Pagers Leaking Your Patients' PHI?

2. Leaking Beeps: Unencrypted Pager Messages in Industrial Environments

This report focuses on the use of pagers in different industrial environments. Our analysis of unencrypted pager messages in countries like the US and Canada revealed that critical infrastructure sectors like nuclear power plants, substations, power generation plants, chemical plants, defense contractors, and other industrial environments like semiconductor and commercial manufacturers, and heating, ventilation and air conditioning (HVAC) companies are still using pagers to this day. We found that a concerning amount of information that enterprises typically consider confidential can easily be obtained through unencrypted pager messages: information related to business and plant operations, such as alarm notifications, diagnostics information, email addresses, officer names, and project codes—types of information that a motivated attacker can use to craft extremely effective social engineering attacks. In this report we not only describe the different types of leaks we have seen but also the different ways in which an attacker can misuse these bits of information for malicious purposes.

View report: Are Your Industrial Plant Beepers Leaking Secrets?

3. Leaking Beeps: A Closer Look at IT Systems that Leak Pages

The third report looks into certain IT systems that are connected to pagers and are prone to leaking information. In the course of this research, we witnessed that these specific IT systems are used in various industries and organizations, including healthcare organizations, industrial environments, critical infrastructure, universities, and business enterprises. We found that passcodes for email clients and conference bridges were being sent through pagers. If this type of data falls in the hands of malicious actors, they can get insider information through emails, and with that information create a list of names within the target organization for future use in phishing attacks. Looking at the leaked information allowed us to again identify two major concerns: 1) the privacy of employees because of personal information being communicated in the clear and 2) the possibility of an attacker using the information found in the pages to bypass security and infiltrate an enterprise or organization.

View report: Are the IT Systems Used with Your Pagers Leaking Company Intel?