Exploiting MMS Vulnerabilities to Stealthily Exhaust Mobile Phone's Battery
- 1 August 2006
- conference paper
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
Abstract
As cellular data services and applications are being widely deployed, they become attractive targets for attackers, who could exploit unique vulnerabilities in cellular networks, mobile devices, and the interaction between cellular data networks and the Internet. In this paper, we demonstrate such an attack, which surreptitiously drains mobile devices' battery power up to 22 times faster and therefore could render these devices useless before the end of business hours. This attack targets a unique resource bottleneck in mobile devices (the battery power) by exploiting an insecure cellular data service (MMS) and the insecure interaction between cellular data networks and the Internet (PDP context retention and the paging channel). The attack proceeds in two stages. In the first stage, the attacker compiles a hit list of mobile devices - including their cellular numbers, IP addresses, and model information - by exploiting MMS notification messages. In the second stage, the attacker drains mobile devices' battery power by sending periodical UDP packets and exploiting PDP context retention and the paging channel. This attack is unique not only because it exploits vulnerable cellular services to target mobile devices hut also because the victim mobile users are unaware when their batteries are being drained. Furthermore, we identify two key vulnerable components in cellular networks and propose mitigation strategies for protecting cellular devices from such attacks from the InternetKeywords
This publication has 8 references indexed in Scilit:
- Using The GSM/UMTS SIM to Secure Web ServicesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2006
- Modeling epidemic spreading in mobile environmentsPublished by Association for Computing Machinery (ACM) ,2005
- Towards securing 3G mobile phonesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2005
- Security management against cloned cellular telephonesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2005
- Mobility-based anomaly detection in cellular mobile networksPublished by Association for Computing Machinery (ACM) ,2004
- GPRS in PracticePublished by Wiley ,2004
- Behavior-Based Intrusion Detection in Mobile Phone SystemsJournal of Parallel and Distributed Computing, 2002
- Cellular security: better, but foes still lurkIEEE Spectrum, 2000