Korean telco failed at femtocell security, exposed customers to snooping and fraud

South Korea’s carrier Korea Telecom deployed thousands of poorly secured femtocells that shared a single certificate and had weak device security; attackers cloned these femtocells to intercept customers’ SMS/call data and perform micropayments fraud (reported $169,000 affecting 368 customers) while investigations uncovered multiple cloned devices, arrests, links to a prior BPFDoor data leak, and indications of possible large-scale surveillance.