While the application installer itself cannot be directly modified to load malware because it's a signed executable, there are some entries in its configuration file that can be used for this purpose.
For example, many configuration files had paths to antivirus installers and an option of whether to install those programs or not, Tarakanov said. The researcher said that he never found an antivirus installer shipped with the USB modems he tested, but the feature was there.
An attacker could create a custom image with a modified configuration file that enables this feature and installs a malicious file stored on the modem instead of an antivirus program. If the image is written on a USB modem, every time the user would install the modem application, the malware would also be installed, Tarakanov said.
The researchers also found a possible mass attack vector. Once installed on a computer, the modem application -- at least the one from Huawei -- checks periodically for updates from a single server, Tarakanov said. Software branded for a specific operator searchers for updates in a server directory specific to that operator.
An attacker who manages to compromise this update server, can launch mass attacks against users from many operators, Tarakanov said. Huawei 3G modems from several different Russian operators used the same server, but there might be other update servers for other countries, he said.
Tarakanov said that he didn't look for vulnerabilities in the actual modem drivers installed in the OS, but he expects them to have vulnerabilities. The vast majority of third-party drivers in general have vulnerabilities, he said.
Tarakanov specializes in exploit writing and finding vulnerabilities in the Windows kernel mode drivers. However, Oleg Kupreev was the leader for this particular research project concerning 3G/4G modems.
Research in this area is just at the beginning and there's more to investigate, Tarakanov said. Someone has to do it because many new laptops come with 3G/4G modems directly built in and people should know if they're a security threat.