DDoSing a Cell Phone Network

Yikes!

Originally posted by bruce_schneier at DDoSing a Cell Phone Network

https://www.schneier.com/blog/archives/2014/02/ddosing_a_cell.html

Interesting research:

Abstract: The HLR/AuC is considered to be one of the most important network elements of a 3G network. It can serve up to five million subscribers and at least one transaction with HLR/AuC is required for every single phone call or data session. This paper presents experimental results and observations that can be exploited to perform a novel distributed denial of service attack in 3G networks that targets the availability of the HLR/AuC. More specifically, first we present an experiment in which we identified and proved some zero-day vulnerabilities of the 3G network that can be exploited by malicious actors to mount various attacks. For the purpose of our experiment, we have used off-the-shelf infrastructure and software, without any specialized modification. Based on the observations of the experiment, we reveal an Advanced Persistent Threat (APT) in 3G networks that aims to flood an HLR/AuC of a mobile operator. We also prove that the discovered APT can be performed in a trivial manner using commodity hardware and software, which is widely and affordably available.

The attack involves cloning SIM cards, then making multiple calls from different handsets in different locations with the same SIM card. This confuses the network into thinking that the same phone is in multiple places at once.

Note that this has not been tested in the field, but there seems no reason why it wouldn't work.

There's a lot of insecurity in the fact that cell phones and towers largely trust each other. The NSA and FBI use that fact for eavesdropping, and here it's used for a denial-of-service attack.

Wednesday Miscellany!

So much to talk about....

• The fight between the US/EU and Russia over Ukraine continues, with both NATO and Russia rattling sabers.


• Texas's gay marriage ban has been stricken, meaning that Texas now joins Utah and Oklahoma on the list of deep red states with gay marriage bans on the ropes.


• Guess who's on the front lines with Al Qaeda?


• Dear President Obama: do it! DOOOOOOO IIIIIIIT!


• Note to nice guys: you might think you're not getting laid because you're too nice. You're actually not getting laid because you act like this. Come on.

LA Times: Jan Brewer to Deliver Speech on SB 1062 Tonight

Quoting the LA Times:

Arizona Gov. Jan Brewer will make a statement Wednesday evening about a controversial piece of legislation that would give more protection to businesses who cite religious beliefs in refusing to serve gays and others, she announced.

There's enough weasel words there so that one might expect Brewer to make no announcement whether she'll veto the bill or not. Nonetheless, I'd expect her to announce that she'll veto. Pretty much the entire GOP establishment has given her barely enough cover to veto the bill and survive a primary challenge.