Patrick Traynor, Michael Lin, Machigar Ongtang, Vikhyath Rao, Trent Jaeger, Patrick McDaniel, and Thomas La Porta 2/29/2012

 Objectives  Cellular Networks  Describing the Attack  Quantifying the Attack  Mitigating the Attack  Conclusions 22/29/2012

 Characterize an attack on cellular network core  Test the attack  Optimize it  Propose defenses 2/29/20123

 Cellular networks have  Home Location Register (HLR)  Mobile Switching Centers (MSC)  Visiting Location Register (VLR)  Serving GPRS Support Node (SGSN)  Base Station Subsystem (BSS) 2/29/20124

 DDoS using a cellular botnet  Target part that will cause most disruption  HLR is necessary for most actions  Authentication  Phone calls  Text messages  Billing  Etc.  HLR most effective target 2/29/20125

 Only ‘legitimate’ transactions reach HLR 2/29/20126

 Write transactions use more HLR resources per transaction than reads  Which one the best?  Update Location utilizes caching  Update Subscriber Data averages 2.5 seconds  Insert Call Forwarding averages 2.7 seconds  Delete Call Forwarding averages 2.5 seconds  Insert/Delete Call Forwarding must alternate  Best to use combination of Insert and Delete Call Forwarding 2/29/20127

8

9

 Why most resource usage per message?  Why not just send more messages?  When sending that many messages, will clog up communications channels and never reach HLR  Deny service for base station, not whole network  Need to distribute attack across multiple base stations 2/29/201210

 Testbed system dropped 93% of traffic under a simulated call-forwarding attack with 5000 messages/sec  Need to be distributed evenly across 21 base stations to not DDoS the random access channel before getting to HLR  Need 375 base stations to not DDoS control channels 2/29/201211

 Tried and true (Internet coordination)  Easy to identify/snoop  Clogs communication channels  Local Wireless Coordination  Short range  Indirect Local Coordination  Using exponential backoff? 2/29/201212

 Filtering  Can be aggressive because call forwarding is not critical  What if call forwarding is not the transaction used?  Shedding  How to deploy effective rules during an attack?  Make phone security better 2/29/201213

 Cellular network are vulnerable to DDoS attacks  Single points of failure are bad  Botnet must be fairly sophisticated  Is there a way to distribute HLR data? 2/29/201214