Rise of the iBots: Owning a telco network

Mulliner, Collin; Seifert, Jean-Pierre

doi:10.1109/malware.2010.5665790

Cited by 62 publications

(27 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Hua et al [8] analyzed the impact of network topology on dissemination cost of bot commands over SMS-based mobile botnets. Mulliner et al [9] and Anagnostopoulos et al [10] proposed mobile botnets that use a hybrid of SMS, HTTP, and/or Bluetooth as a C&C medium. There also exists an SMS-based Trojan [11] that causes financial loss to users by sending messages to premium rate numbers without the users' recognition.…”

Section: Related Workmentioning

confidence: 99%

Design and Analysis of Push Notification-Based Malware on Android

Hyun

Cho

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

Establishing secret command and control (C&C) channels from attackers is important in malware design. This paper presents design and analysis of malware architecture exploiting push notification services as C&C channels. The key feature of the push notification-based malware design is remote triggering, which allows attackers to trigger and execute their malware by push notifications. The use of push notification services as covert channels makes it difficult to distinguish this type of malware from other normal applications also using the same services. We implemented a backdoor prototype on Android devices as a proofof-concept of the push notification-based malware and evaluated its stealthiness and feasibility. Our malware implementation effectively evaded the existing malware analysis tools such as 55 antimalware scanners from VirusTotal and SandDroid. In addition, our backdoor implementation successfully cracked about 98% of all the tested unlock secrets (either PINs or unlock patterns) in 5 seconds with only a fraction (less than 0.01%) of the total power consumption of the device. Finally, we proposed several defense strategies to mitigate push notification-based malware by carefully analyzing its attack process. Our defense strategies include filtering subscription requests for push notifications from suspicious applications, providing centralized management and access control of registration tokens of applications, detecting malicious push messages by analyzing message contents and characteristic patterns demonstrated by malicious push messages, and detecting malware by analyzing the behaviors of applications after receiving push messages.

show abstract

Section: Related Workmentioning

confidence: 99%

Design and Analysis of Push Notification-Based Malware on Android

Hyun

Cho

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…The second issue with mobile botnets is their use of SMS messages for their Command and Control (C&C) communication, as demonstrated by Mulliner et al in [19]. Their proofof-concept bot uses SMS messages for delivering the C&C messages between the nodes of the botnet.…”

Section: A Hijacked Phones and Mobile Botnetsmentioning

confidence: 99%

“…SMS controlled botnets such as [19], [33] send and receive SMS messages for their command and control channel. Since this work focuses on outgoing signaling traffic we decided to only look at outgoing traffic, from the phone to the network.…”

Section: E Sms Controlled Botnetsmentioning

confidence: 99%

Taming Mr Hayes: Mitigating signaling based attacks on smartphones

Mulliner

Liebergeld

Lange

et al. 2012

IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2012)

Self Cite

View full text Add to dashboard Cite

Abstract-Malicious injection of cellular signaling traffic from mobile phones is an emerging security issue. The respective attacks can be performed by hijacked smartphones and by malware resident on mobile phones. Until today there are no protection mechanisms in place to prevent signaling based attacks other than implementing expensive additions to the cellular core network. In this work we present a protection system that resides on the mobile phone. Our solution works by partitioning the phone software stack into the application operating system and the communication partition. The application system is a standard fully featured Android system. On the other side, communication to the cellular network is mediated by a flexible monitoring and enforcement system running on the communication partition. We implemented and evaluated our protection system on a real smartphone. Our evaluation shows that it can mitigate all currently known signaling based attacks and in addition can protect users from cellular Trojans.

show abstract

“…There have also been several research efforts to design advanced C&C protocols for mobile botnets. Singh et al [12] evaluated the feasibility of using Bluetooth as a medium for botnet C&C. Muliner [8] proposed SMS and SMS-HTTP hybrid C&C protocols to facilitate the communication between compromised smartphones. Taking a different angle, Traynor et al [11] demonstrated the impact of DDoS attacks against the core of cellular networks utilizing compromised mobile phones.…”

Section: Related Workmentioning

confidence: 99%

Open WiFi networks: Lethal weapons for botnets?

Knysz

Zeng

et al. 2012

2012 Proceedings IEEE INFOCOM

View full text Add to dashboard Cite

Abstract-This paper assesses the potential for highly mobile botnets to communicate and perform nefarious actions using only open WiFi networks, which we term mobile WiFi botnets. We design and evaluate a proof-of-concept mobile WiFi botnet using real-world mobility traces and actual open WiFi network locations for the urban environment of San Francisco. Our extensive simulation results demonstrate that mobile WiFi botnets can support rapid command propagation, with commands typically reaching over 75% of the botnet only 2 hours after injectionsometimes, within as little as 30 minutes. Moreover, those bots able to receive commands usually have ≈40-50% probability of being able to do so within a minute of the command being issued. Our evaluation results also indicate that even a small mobile WiFi botnet of only 536 bots can launch an effective DDoS attack against poorly protected systems. Furthermore, mobile WiFi botnet traffic is sufficiently distributed across multiple open WiFi networks-with no single network being over-utilized at any given moment-to make detection difficult.

show abstract

Rise of the iBots: Owning a telco network

Cited by 62 publications

References 5 publications

Design and Analysis of Push Notification-Based Malware on Android

Design and Analysis of Push Notification-Based Malware on Android

Taming Mr Hayes: Mitigating signaling based attacks on smartphones

Open WiFi networks: Lethal weapons for botnets?

Contact Info

Product

Resources

About