Peeking Over the Cellular Walled Gardens - A Method for Closed Network Diagnosis -

Hong, Byeongdo; Park, Shinjo; Kim, Hongil; Kim, Dongkwan; Hong, Hyunwook; Choi, Hyunwoo; Seifert, Jean-Pierre; Lee, Sung-Ju; Kim, Yong‐Dae

doi:10.1109/tmc.2018.2804913

Cited by 19 publications

(12 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We envision that OSes can expose the modem information by requesting the permission from the user similar to how other high privilege permissions can be granted to user level applications. Additionally, in the future we aim to extend this for other OSes and baseband processors [28]. False positives and the quality of signatures.…”

Section: Discussionmentioning

confidence: 99%

“…For doing so, following the prior work [36], [52], [30], [29], [47], [42] we changed srsENB and srsEPC libraries in srsLTE [25] to set up the rogue base station. To collect the traces from the UE's perspective, we utilize SCAT [28]. () Once we have collected the concrete traces, we create skeletons of these traces akin to to the benign trace generation process (i.e., capturing message types and relevant predicates).…”

Section: Trace Generation For Evaluationmentioning

confidence: 99%

See 1 more Smart Citation

PHOENIX: Device-Centric Cellular Network Protocol Monitoring using Runtime Verification

Echeverria¹,

Ahmed²,

Wang³

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

End-user-devices in the current cellular ecosystem are prone to many different vulnerabilities across different generations and protocol layers. Fixing these vulnerabilities retrospectively can be expensive, challenging, or just infeasible. A pragmatic approach for dealing with such a diverse set of vulnerabilities would be to identify attack attempts at runtime on the device side, and thwart them with mitigating and corrective actions. Towards this goal, in the paper we propose a general and extendable approach called PHOENIX for identifying nday cellular network control-plane vulnerabilities as well as dangerous practices of network operators from the device vantage point. PHOENIX monitors the device-side cellular network traffic for performing signature-based unexpected behavior detection through lightweight runtime verification techniques. Signatures in PHOENIX can be manually-crafted by a cellular network security expert or can be automatically synthesized using an optional component of PHOENIX, which reduces the signature synthesis problem to the language learning from the informant problem. Based on the corrective actions that are available to PHOENIX when an undesired behavior is detected, different instantiations of PHOENIX are possible: a full-fledged defense when deployed inside a baseband processor; a user warning system when deployed as a mobile application; a probe for identifying attacks in the wild. One such instantiation of PHOENIX was able to identify all 15 representative n-day vulnerabilities and unsafe practices of 4G LTE networks considered in our evaluation with a high packet processing speed (∼68000 packets/second) while inducing only a moderate amount of energy overhead (∼4mW).

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Trace Generation For Evaluationmentioning

confidence: 99%

PHOENIX: Device-Centric Cellular Network Protocol Monitoring using Runtime Verification

Echeverria¹,

Ahmed²,

Wang³

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Although Bayesian network works well for fault diagnosis even for complex industrial systems, it has drawbacks for nonpermanent faults that provides only weak signals and for online fault diagnosis which are very slow. In line with the above, Hong et al [21] investigated fault diagnosis for the circuit-switched fall-back service. Although the investigation used detailed data of the signalling procedures from different mobile operators, the problem finding mechanism was manual and not subscriber-oriented.…”

Section: Root Cause Analysis (Rca) In Telecommunicationmentioning

confidence: 92%

A quadri-dimensional approach for poor performance prioritization in mobile networks using Big Data

Mampaka

Sumbwanyambe

2019

J Big Data

View full text Add to dashboard Cite

IntroductionCommunication service providers (CSPs) have reached the ceiling in terms of new customer acquisitions. Therefore, acquiring new customers is much difficult than it is for existing customers to churn. Traditional network operation centres (NOC) have been very inefficient in terms of problem finding, handling and resolution. Within this ambit, and driven by the need for fast service, the NOC approach of managing network incidents has changed to the new paradigm of service quality management (SQM) and customer experience management (CEM). This requires mobile network operators to be more service-oriented and customer-oriented by using the service operation centre (SOC) approach.While the traditional approach of mobile network monitoring follows a bottom-up approach, i.e. Starting with the network elements management, network alarming and quality of service (QoS) issues through historical key performance indicators (KPI) AbstractThe Management of mobile networks has become so complex due to a huge number of devices, technologies and services involved. Network optimization and incidents management in mobile networks determine the level of the quality of service provided by the communication service providers (CSPs). Generally, the down time of a system and the time taken to repair [mean time to repair (MTTR)] has a direct impact on the revenue, especially on the operational expenditure (OPEX). A fast root cause analysis (RCA) mechanism is therefore crucial to improve the efficiency of the operational team within the CSPs. This paper proposes a quadri-dimensional approach (i.e. services, subscribers, handsets and cells) to build a service quality management (SQM) tree in a Big Data platform. This is meant to speed up the root cause analysis and prioritize the elements impacting the performance of the network. Two algorithms have been proposed; the first one, to normalize the performance indicators and the second one to build the SQM tree by aggregating the performance indicators for different dimensions to allow ranking and detection of tree paths with the worst performance. Additionally, the proposed approach will allow CSPs to detect the mobile network dimensions causing network issues in a faster way and protect their revenue while improving the quality of the service delivered. which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.

show abstract

“…Fang et al [15] analyze the implementation security of mobile basebands permuting the input with the support of reinforcement learning. Hong et al [23], [22] passively analyze the reallocation behavior of temporary identifiers and found that the reallocation is not sufficiently random, which allows the tracking of users. In our analysis, we focus on the cross-layer specification issues rather than the implementation security.…”

Section: Related Workmentioning

confidence: 99%

IMP4GT: IMPersonation Attacks in 4G NeTworks

Rupprecht

Kohls

Holz

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Long Term Evolution (LTE/4G) establishes mutual authentication with a provably secure Authentication and Key Agreement (AKA) protocol on layer three of the network stack. Permanent integrity protection of the control plane safeguards the traffic against manipulations. However, missing integrity protection of the user plane still allows an adversary to manipulate and redirect IP packets, as recently demonstrated. In this work, we introduce a novel cross-layer attack that exploits the existing vulnerability on layer two and extends it with an attack mechanism on layer three. More precisely, we take advantage of the default IP stack behavior of operating systems and show that combining it with the layer-two vulnerability allows an active attacker to impersonate a user towards the network and vice versa; we name these attacks IMP4GT (IMPersonation attacks in 4G neTworks). In contrast to a simple redirection attack as demonstrated in prior work, our attack dramatically extends the possible attack scenarios and thus emphasizes the need for user-plane integrity protection in mobile communication standards. The results of our work imply that providers can no longer rely on mutual authentication for billing, access control, and legal prosecution. On the other hand, users are exposed to any incoming IP connection as an adversary can bypass the provider's firewall. To demonstrate the practical impact of our attack, we conduct two IMP4GT attack variants in a live, commercial network, which-for the first time-completely break the mutual authentication aim of LTE on the user plane in a realworld setting.

show abstract

Peeking Over the Cellular Walled Gardens - A Method for Closed Network Diagnosis -

Cited by 19 publications

References 10 publications

PHOENIX: Device-Centric Cellular Network Protocol Monitoring using Runtime Verification

PHOENIX: Device-Centric Cellular Network Protocol Monitoring using Runtime Verification

A quadri-dimensional approach for poor performance prioritization in mobile networks using Big Data

IMP4GT: IMPersonation Attacks in 4G NeTworks

Contact Info

Product

Resources

About