The transformation of telecommunications networks from homogeneous closed systems providing only voice services to Internetconnected open networks that provide voice and data services presents significant security challenges. For example, recent research illustrated that a carefully crafted DoS attack via text messaging could incapacitate all voice communications in a metropolitan area with little more than a cable modem. This attack highlights a growing threat to these systems; namely, cellular networks are increasingly exposed to adversaries both in and outside the network. In this paper, we use a combination of modeling and simulation to demonstrate the feasibility of targeted text messaging attacks. Under realistic network conditions, we show that adversaries can achieve blocking rates of more than 70 % with only limited resources. We then develop and characterize five techniques from within two broad classes of countermeasures- queue management and resource provisioning. Our analysis demonstrates that these techniques can eliminate or extensively mitigate even the most intense targeted text messaging attacks. We conclude by considering the tradeoffs inherent to the application of these techniques in current and next generation telecommunications networks.

Abstract — As cellular data services and applications are being widely deployed, they become attractive targets for attackers, who could exploit unique vulnerabilities in cellular networks, mobile devices, and the interaction between cellular data networks and the Internet. In this paper, we demonstrate such an attack, which surreptitiously drains mobile devices ’ battery power up to 22 times faster and therefore could render these devices useless before the end of business hours. This attack targets a unique resource bottleneck in mobile devices (the battery power) by exploiting an insecure cellular data service (MMS) and the insecure interaction between cellular data networks and the Internet (PDP context retention and the paging channel). The attack proceeds in two stages. In the first stage, the attacker compiles a hit list of mobile devices — including their cellular numbers, IP addresses, and model information — by exploiting MMS notification messages. In the second stage, the attacker drains mobile devices ’ battery power by sending periodical UDP packets and exploiting PDP context retention and the paging channel. This attack is unique not only because it exploits vulnerable cellular services to target mobile devices but also because the victim mobile users are unaware when their batteries are being drained. Furthermore, we identify two key vulnerable components in cellular networks and propose mitigation strategies for protecting cellular devices from such attacks from the Internet. I.

Smartphones have recently become increasingly popular because they provide “all-in-one ” convenience by integrating traditional mobile phones with handheld computing devices. However, the flexibility of running third-party softwares also leaves the smartphones open to malicious viruses. In fact, hundreds of smartphone viruses have emerged in the past two years, which can quickly spread through various means such as SMS/MMS, Bluetooth and traditional IP-based applications. Our own implementations of two proof-of-concept viruses on Windows Mobile have confirmed the vulnerability of this popular smartphone platform. In this paper, we present SmartSiren, a collaborative virus detection and alert system for smartphones. In order to detect viruses, SmartSiren collects the communication activity information from the smartphones, and performs joint analysis to detect both single-device and system-wide abnormal behaviors. We use a proxy-based architecture to offload the processing burden from resource-constrained smartphones and simplify the collaboration among smartphones. When a potential virus is detected, the proxy quarantines the outbreak by sending targeted alerts to those immediately threatened smartphones. We have demonstrated the feasibility of SmartSiren through implementations on a Dopod 577w smartphone, and evaluated its effectiveness using simulations driven by 3-week SMS traces from a national cellular carrier. Our results show that SmartSiren can effectively prevent wide-area virus outbreaks with affordable overhead.

Mobile users of computation and communication services have been rapidly adopting battery-powered mobile handhelds, such as PocketPCs and SmartPhones, for their work. However, the limited battery-lifetime of these devices restricts their portability and applicability, and this weakness can be exacerbated by mobile malware targeting depletion of battery energy. Such malware are usually difficult to detect and prevent, and frequent outbreaks of new malware variants also reduce the effectiveness of commonlyseen signature-based detection. To alleviate these problems, we propose a power-aware malware-detection framework that monitors, detects, and analyzes previously unknown energy-depletion threats. The framework is composed of (1) a power monitor which collects power samples and builds a power consumption history from the collected samples, and (2) a data analyzer which generates a power signature from the constructed history. To generate a power signature, simple and effective noise-filtering and data-compression are applied, thus reducing the detection overhead. Similarities between power signatures are measured by the χ 2-distance, reducing both false-positive and false-negative detection rates. According to our experimental results on an HP iPAQ running a Windows Mobile OS, the proposed framework achieves significant (up to 95%) storage-savings without losing the detection accuracy, and a 99 % true-positive rate in classifying mobile malware.

Abstract—Recently, cellular phone networks have begun allowing third-party applications to run over certain open-API phone operating systems such as Windows Mobile, Iphone and Google’s Android platform. However, with this increased openness, the fear of rogue programs written to propagate from one phone to another becomes ever more real. This paper proposes a countermechanism to contain the propagation of a mobile worm at the earliest stage by patching an optimal set of selected phones. The counter-mechanism continually extracts a social relationship graph between mobile phones via an analysis of the network traffic. As people are more likely to open and download content that they receive from friends, this social relationship graph is representative of the most likely propagation path of a mobile worm. The counter mechanism partitions the social relationship graph via two different algorithms, balanced and clustered partitioning and selects an optimal set of phones to be patched first as those which have the capability to infect the most number of other phones. The performance of these partitioning algorithms is compared against a benchmark random partitioning scheme. Through extensive trace-driven experiments using real IP packet traces from one of the largest cellular networks in the US, we demonstrate the efficacy of our proposed counter-mechanism in containing a mobile worm. I.

The emergence of connections between telecommunications networks and the Internet creates significant avenues for exploitation. For example, through the use of small volumes of targeted traffic, researchers have demonstrated a number of attacks capable of denying service to users in major metropolitan areas. While such investigations have explored the impact of specific vulnerabilities, they neglect to address a larger issue- how the architecture of cellular networks makes these systems susceptible to denial of service attacks. As we show in this paper, these problems have little to do with a mismatch of available bandwidth. Instead, they are the result of the pairing of two networks built on fundamentally opposing design philosophies. We support this a claim by presenting two new attacks on cellular data services. These attacks are capable of preventing the use of high-bandwidth cellular data services throughout an area the size of Manhattan with less than 200Kbps of malicious traffic. We then examine the characteristics common to these and previous attacks as a means of explaining why such vulnerabilites are artifacts of design rigidity. Specifically, we show that the shoehorning of data communications protocols onto a network rigorously optimized for the delivery of voice causes that network to fail under modest loads. 1

Locating mobile users and devices efficiently is a critical operation in cellular networks. This is done using a combination of location update (by the mobile) and paging (by the network). The paging scheme determines how and where to search for a mobile user given the latest location update information from that user. In this paper, we consider how to increase the efficiency of the paging scheme. Much previous work has relied on simulation or modeling to design and evaluate the performance of proposed paging schemes. We take a different, data-driven approach in how we design and evaluate our solution. Specifically, we mine more than 300 million call records from a large cellular operator to characterize user mobility and create mobility profiles. We then develop a family of profile-based paging techniques, considering both static schemes and dynamic schemes which adapt as user profiles continuously get updated. We find that our paging techniques can dramatically reduce signaling load (up to 80%) with minimal increase in paging delay (usually less than 10%).

Voice communication is fundamental to the normal operation of our society. The general public have put a lot of trust in voice communication and they have been relying on it for many critical and sensitive information exchange (e.g., emergency 911 calls, calls to customer service of financial institutions). Now more and more voice calls are carried, at least partially, over the public Internet rather than traditional Public Switched Telephone Network (PSTN). The security ramifications of using VoIP, however, have not been fully recognized. It is not clear how secure and trustworthy the currently deployed VoIP systems are, and there exists a substantial gap in the understanding of the potential impact of VoIP exploits on the VoIP users. In this paper, we seek to fill this gap by investigating the trust issues of currently

Since the first distributed attack networks were seen in 1999, computer misuse enabled by botnets, worms, and other vectors has steadily grown. This rapid growth has given rise to a variety of ethical challenges for researchers seeking to combat these threats. For example, if someone has the ability to take control of a botnet, can they just clean up all the infected hosts? Can we deceive users, if our goal is to better understand how they are deceived by attackers? Can we demonstrate the need for better methods, by breaking something that people rely on today? When one considers the implications of something like botnet cleanup – the blind modification and possible rebooting of thousands of computers without their owners ’ knowledge or consent – this complexity becomes all the more obvious. To be effective, we must find ways to balance societal needs and the ethical issues surrounding our efforts, lest we drift to the extremes— becoming the very thing we deplore, or ceding the Internet to the miscreants because we fear to act. In this paper, we endeavor to create a dialogue on the ethical issues in computer security and the ethical standards that we intend to enforce as a community. 1.

IP and cellular networks used to be isolated from each other. In recent years however, the two networks have started to overlap with the emergence of devices that access the Internet using cellular infrastructures. One important question then is whether actions or threats on the Internet side can impact the telecom or cellular side. We address this problem in the paper and specifically consider the paging channel, which is a key conduit shared by both Internet and cellular traffic. Our contributions are as follows: we illustrate through experiments on a CDMA2000 cellular network that attacks launched from the Internet can significantly increase the paging load and increase the delay of paging messages including cellular call setup requests; we derive a simple but accurate queuing model for the paging system in a CDMA2000 network and use this model to demonstrate that the paging channel exhibits sharp rather than graceful degradation under load; and through this model, we identify critical parameters that impact paging performance. Although our study is focused on CDMA2000 networks, we believe that similar problems exist in other types of cellular networks that employ a single control channel with limited bandwidth for both voice and data services.