RealthreatstoyourdataBills资源-CSDN文库

需积分: 5 27 浏览量 2019-09-12 13:11:55 上传评论收藏 4.77MB PDF 举报

资源推荐

资源详情

资源评论

Real Threats to Your Data Bills

– Security Loopholes and Defenses in Mobile Data Charging

Chunyi Peng

The Ohio State University

chunyi@cse.ohio-state.edu

Chi-Yu Li, Hongyi Wang, Guan-Hua Tu, Songwu Lu

University of California, Los Angeles

{lichiyu,hywang,ghtu,slu}@cs.ucla.edu

ABSTRACT

Secure mobile data charging (MDC) is critical to cellular network

operations. It must charge the right user for the right volume that

(s)he authorizes to consume (i.e., requirements of authentication,

authorization, and accounting (AAA)). In this work, we conduct

security analysis of the MDC system in cellular networks. We ﬁnd

that all three can be breached in both design and practice, and iden-

tify three concrete vulnerabilities: authentication bypass, autho-

rization fraud and accounting volume inaccuracy. The root causes

lie in technology fundamentals of cellular networks and the Internet

IP design, as well as imprudent implementations. We devise three

showcase attacks to demonstrate that, even simple attacks can eas-

ily penetrate the operational 3G/4G cellular networks. We further

propose and evaluate defense solutions.

Categories and Subject Descriptors

C.2.0 [Computer-Communication Networks]: General—Se-

curity and protection; C.2.1 [Computer-Communication Net-

works]: Network Architecture and Design—Wireless Communi-

cation

Keywords

Cellular Networks; Mobile Data Services; Authentication, Autho-

rization, Accounting (AAA); attack; defense

1. INTRODUCTION

Mobile data services are getting increasingly popular, thanks to

the proliferation of smartphones and tablets, as well as the rapid

deployment of the third-generation/fourth-generation (3G/4G) cel-

lular networks. Global mobile data trafﬁc grew 81% in 2013 and is

projected to increase 11-fold in the following ﬁve-year span [16].

This is contributed by 2.1 billion mobile Internet users world-

wide (by 2013 June), including 299 million 3G/4G broadband sub-

scribers (95% of inhabitants) in the US [25].

Convenient mobile data access does come with cost for users.

Most cellular operators charge mobile users based on their con-

sumed data volume [8, 32]. Mobile users pay for the data usage

Permission to make digital or hard copies of all or part of this work for personal or

classroom use is granted without fee provided that copies are not made or distributed

for proﬁt or commercial advantage and that copies bear this notice and the full cita-

tion on the ﬁrst page. Copyrights for components of this work owned by others than

ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re-

publish, to post on servers or to redistribute to lists, requires prior speciﬁc permission

and/or a fee. Request permissions from permissions@acm.org.

CCS’14, November 3–7, 2014, Scottsdale, Arizona, USA.

http://dx.doi.org/10.1145/2660267.2660346 .

at a preset price within certain volume cap, or in the pay-per-use

manner. For example, AT&T, a Tier-1 US carrier, charges $20 for

300MB per month for domestic access and about 2¢ per KB during

international travels [10]. This volume-based charging scheme is

not adopted without rationale. The radio spectrum is scarce and ex-

pensive (in spectrum licensing [20]), and wireless speed is bounded

by Shannon channel capacity. The explosive growth of mobile data

trafﬁc further justiﬁes the metered charging.

Undoubtedly, a well-designed and properly-operated mobile data

charging (MDC) system is critical to cellular networks. It not only

safeguards the multi-trillion revenue of global operators, but also

protects the monetary rights of billions of mobile users. To enable

metered charging, the key is to collect how much data is actually

used by which mobile user when (s)he agrees to. A secure MDC

should meet three requirements:

1. [Authentication] The user being billed for the given data

transfer must be the one who actually does the transfer.

MDC must authenticate the user who consumes the actual

data usage.

2. [Authorization] The data usage and its associated charge

should be with the user’s consent. A user should only pay

for those authorized data services, but not the spam from at-

tackers.

3. [Accounting volume] The volume should be accurate. The

recorded volume should be identical to that transferred at the

user device.

At ﬁrst glance, it appears straightforward to meet the above re-

quirements. The MDC method is ofﬁcially stipulated by the 3GPP

speciﬁcation [3]. It is performed inside the cellular core network.

Whenever a data session is initiated with the mobile device, the

trafﬁc from/to the mobile device traverses the cellular gateways

(akin to edge routers or switches in the Internet) to reach the des-

tination. The gateway counts the payload of observed data packets

for each mobile data session as the volume. It further associates

this volume with the user who initializes and uses this data ses-

sion. Given user authentication, the network is capable of inferring

who uses this data session. To prevent unauthorized access, cellu-

lar operators also deploy ﬁrewalls and network address translators

(NATs) to shield mobile devices from the trafﬁc types of no inter-

est. While recent studies [21, 22, 27, 28, 36] have reported various

cases on accounting volume inaccuracy, the two aspects of authen-

tication and authorization still look bullet-proof. They seem almost

impossible to go wrong. Anyway, authentication and authorization

have been well studied in the security community, and their solu-

tions to cellular networks have been generally successful to date.

However, MDC is not as secure as anticipated. We discover that,

it is also vulnerable in authentication and authorization. Charging

actions may be taken upon the wrong user, or on data that the cellu-

Dimension Threat Loophole Attack Root Cause Defense solution

Authenti-

cation(§3.1)

A user is billed for

other’s data trafﬁc.

Authentication

Bypass

Free-uplink-attack via IP

spooﬁng

No cross-layer secure

binding (§3.4)

Cross-layer secure binding

in the data plane(§4.1)

Authori-

zation(§3.2)

Unwanted data is

allowed and billed.

Authorization

Fraud

Cloak-and-dagger attacks

via MMS and IP spooﬁng

Network-based authorization; Explicit de-authorization on

demand in the control plane(§4.2)

IP push model (§3.4)

Accounting

volume(§3.3)

A user is billed for

data never received.

Accounting

Vol. Inaccuracy

Hit-but-no-touch

TTL-based attack

open-loop accounting; Feedback from the end/network;

Independent PS delivery(§3.4) explicit de-authorization(§4.2,§4.3)

Table 1: Summary of results.

lar user does not want. Consequently, all AAA components can be

breached in both technology and practice. The deployed defense

measures fail to protect them. Speciﬁcally, we identify three loop-

holes: authentication bypass, authorization fraud, and accounting

volume inaccuracy. All threats may impose real monetary loss to

the victim user(s).

Moreover, to our surprise, no sophisticated attack models are

needed. Simple attacks may work in operational 3G/4G cellular

networks! By signiﬁcantly limiting the capability of the adver-

sary and applying variations of well-known attack methods (e.g., IP

spooﬁng), we have devised a few showcase attacks to test all three

AAA dimensions. All can pass the defense measures deployed by

cellular operators. The attacks can be against an individual or a

group of victims of any size, without requiring control or access to

the victim phone or the carrier. Our experiments further indicate

that the incurred charging damage exhibits no sign of limit.

We further analyze their root causes. They are beyond our initial

thoughts of being induced by implementation bugs from vendors

and imprudent practice by operators. Factors rooted in the technol-

ogy basics stipulated in the 3G/4G standards also share the respon-

sibility. They include lack of cross-layer secure binding in authen-

tication, network-based decision in authorization, and open-loop

operation and IP push delivery model in accounting. To ﬁx these

loopholes, we further propose defense solutions, which apply three

guidelines of cross-layer security binding, coordinated control-

plane and data-plane operations for security, and infrastructure-

assisted end-user feedback.

Table 1 summarizes our main results. Before we delve into the

details, we rush to clarify what this work is not about. We exam-

ine the technical side of MDC security, but have not looked into

the issue of attack incentives. We focus on how (rather than why)

adversaries attack the system. While our proposed solution offers

one feasible approach, other alternatives (e.g., deterrence by detect-

ing and punishing attackers) are also possible as elaborated later.

Speciﬁcally, we make four following contributions:

• We uncover security threats in the MDC system, and conﬁrm

that mobile users are vulnerable to unconstrained monetary loss.

• We expose and validate security loopholes in all three AAA

dimensions. We show that all AAA components can be breached

in both technology and operations. The deployed security mea-

sures fail to protect them.

• We further sketch novel attacks that exploit such loopholes

and validate them through experiments in operational 3G/4G cel-

lular networks.

• We deduce direct causes rooted in both the technology basics

and imprudent practice by operators. We propose and evaluate

defense solutions.

The rest of the paper is organized as follows. §2 introduces the

MDC background, the threat model and the experimental method-

ology. §3 elaborates our security analysis on each AAA dimension.

§4 proposes defense solutions and §5 evaluates them. §6 compares

with related work and §7 concludes the paper.

HSS!

P-GW!

Internet!

Data plane!

Control plane!

4G Network!

(1) User authentication!

(2) Bearer setup!

(3) Data transfer!

(4) Accounting!

Figure 1: Main operations for mobile data transfer and charg-

ing in 4G LTE networks.

§3 elaborate our security analysis on each AAA dimension. §4

proposes defense solutions and §5 evaluates them. §6 compares

with related work and §7 concludes the paper.

2. MOBILE DATA CHARGING IN 4G/3G

Figure 1 illustrates major operations for mobile data delivery and

its charging in cellular networks. We use 4G Long Term Evolution

(LTE) as the default network setting. The case for 3G networks is

similar. Speciﬁcally, there are four main steps. The ﬁrst step is to

verify whether the user equipment (UE) is legitimate to use cellular

networks. It is mandatory except for dialing 911 calls. This is done

through user authentication when the UE initially attaches to cellu-

lar networks (e.g., the phone powers on). Second, the authenticated

UE establishes data bearers for subsequent transfer. It is a prereq-

uisite to obtain granted data access (i.e., IP connectivity) from the

cellular carrier before running data services.

Afterwards, it is ready to start any data service (e.g., web brows-

ing and video streaming) (Step 3). The data packets are delivered

from the UE to the base station, and then forwarded to the gateway

(i.e., P-GW in LTE), and ﬁnally to the external host, or vice verse.

At the border to the Internet, cellular operators deploy border gate-

ways and middleboxes, including ﬁrewalls and NATs [5, 38].

Volume accounting (Step 4) is performed in parallel with data

transfer. Usage volume is collected when data packets traverse the

gateway along both inbound (i.e., phone-destined) and outbound

(i.e., phone-originated) directions. To infer who should pay the

bill, the gateway uses a unique charging ID on a per-ﬂow basis, or

on a per-IP basis. Each charging ID is correlated with a registered

user via the ﬁrst two steps, as elaborated later.

2.1 Threat Model

We expose security vulnerabilities of the MDC system without

giving the adversary too much attack power. This is done by assum-

ing that all other components in the cellular networks and mobile

phone victims are not compromised and via limiting the exploits to

be used by the adversary.

Speciﬁcally, the adversary can be a mobile user or a static host

on the Internet, whereas the victim is typically another mobile user

and loses money due to attacks from the adversary. The victim user

can be chosen on purpose (given a speciﬁc phone number) or at

random. In some scenarios, the operator might become the victim

剩余11页未读，继续阅读

评论收藏

内容反馈

mylyes

粉丝: 0
资源: 1

Real threats to your data Bills

最新资源

Real threats to your data Bills

Blackjacking Security Threats to BlackBerry Devices PDAs& Cell Phones in the Enterprise

Security threats to automotive CAN networks—Practical examples a

[6]Security threats to automotive CAN networks.pdf

Security Threats in the Data Plane of Software-Defined Networks

USB Disk Security 6.2.0.18

Hacking.Android.1785883143

ISO15764-2004 Road vehicles extended data link security firstedition

Data Structures and Transmission

Hacking Android(PACKT,2016)

论文研究-Threats to IM and Security Mechanism Analysis of XMPP.pdf

IObit Malware Fighter 4.2 + Keys（秘钥许可可用）

「数据安全」Evolution_of_Security_Threats_to_Telecommunications_Inf

信息安全_数据安全_Hunting_Threats_in_Your_Enterprise.pdf

McAfee VirusScan Enterprise

Data_Governance_in_Digital_Transformation.pdf

Securing Your Business with Cisco ASA and PIX Firewalls

Syngree Press:Managing Catastrophic Loss of Sensitive Data A Guide for IT and Security Professionals(Mar 2008).pdf

Firewalls Don't Stop Dragons, 3rd Edition.pdf

英文原版-Going IT Alone The Handbook for Freelance 1st Edition

Personal.Cybersecurity.epub

The_Inside_Threat_-_as_important_as_profits_.pdf

Building Virtual Pentesting Labs for Advanced Penetration Testing(PACKT,2014)

NATIONAL_KEY_INFORMATION_INFRASTRUCTURE_EMERGENCY_RESPONSE_MODEL.pdf

www-project-automated-threats-to-web-applications:OWASP Foundation Web存储库

Practical Linux Security Cookbook 2nd Edition

信息安全_数据安全_Evolution_of_Security_Threats_to.pdf

第四届网鼎杯赛前训练(20241019)

BurpLoaderKeygen.jar.zip

最新资源