Exploiting MMS Vulnerabilities to Stealthily Exhaust Mobile Phone's Battery

As cellular data services and applications are being widely deployed, they become attractive targets for attackers, who could exploit unique vulnerabilities in cellular networks, mobile devices, and the interaction between cellular data networks and the Internet. Furthermore, as mobile phones become more powerful with more bandwidth, cellular end hosts will become the next target for attacks that are widely deployed on the Internet.

We demonstrate an attack, which surreptitiously drains mobile devices' battery power up to 22 times faster and therefore could render these devices useless before the end of business hours. This attack targets a unique resource bottleneck in mobile devices (the battery power) by exploiting an insecure cellular data service, Multimedia Messaging Service (MMS), and the insecure interaction between cellular data networks and the Internet, Packet Data Protocol (PDP) context retention and the paging channel. The attack proceeds in two stages. In the first stage, the attacker compiles a hit list of mobile devices—including their cellular numbers, IP addresses, and model information—by exploiting MMS notification messages. In the second stage, the attacker drains mobile devices' battery power by sending periodical UDP packets and exploiting PDP context retention and the paging channel. When a packet is sent to a phone, the network will deliver the packet if the phone's location is known, or attempt to locate the phone by sending a page request to it. However, since cellular phones spend most of their time in the dormant, battery-saving mode, the page on the paging channel will awaken the phone to the ready state and force it to perform a location update. The sine qua non of this attack is to keep the phone in this ready, high battery consumption state, therefore disabling its ability to preserve battery life, or to let the phone temporarily go into the battery-saving state only to be immediately awakened with a page and forced to perform a location update; both of which consume a lot of energy. This attack is unique in that the victims are unaware when their batteries are being drained, and that the attack exploits vulnerable cellular services to target mobile devices. We will identify two key vulnerable components in cellular networks and propose mitigation strategies for protecting cellular devices from such attacks from the Internet.

Accepted at the IEEE/CreateNet International Conference on Security and Privacy in Communication Networks (SECURECOMM '06)