DENIAL-of-services (DoS) attacks are a common tactic used by 鈥渂lack hats鈥� intent on bringing down a high-profile website, one owned by a bank or political party, say. But what if these hackers now have cellphone networks in their sights?
In a standard DoS attack, a network of infected PCs, a 鈥渂otnet鈥�, would swamp a server with so many requests to view a web page that it would be unable to handle legitimate requests. Now Patrick Traynor of the Georgia Institute of Technology in Atlanta and colleagues have shown how a cellphone network could be the vehicle for an attack that would cut off calls for millions of users.
Traynor and his team used software that simulates a cellular network鈥檚 Home Location Register (HLR) 鈥� a massive database that stores the details of every SIM card an operator issues and would typically contain details on up to 5 million subscribers. Traynor found that a botnet of fewer than 12,000 infected cellphones could disrupt 93 per cent of traffic 鈥� voice calls and SMS messages 鈥� to a hypothetical HLR of 1 million subscribers. In a real-life attack the owners of infected handsets would be unaware that their phone was part of a botnot.
Advertisement
鈥淧hones have evolved so quickly 鈥� we鈥檝e gone from just the ability to make phone calls to many of the things that desktop computers can do,鈥� says Traynor. 鈥淎s utility comes to this platform, we have to expect that malicious behaviour is going to follow pretty quickly.鈥�
Indeed, the first phone botnet is believed to have been assembled earlier this year after an SMS worm called 鈥淪exy Space鈥� cascaded across cellphone networks. Users who clicked on a link in the message had software installed on their handset that was capable of communicating with a central server, making it possible for their phone to be controlled remotely by a third party.
鈥淭he first phone botnet was assembled earlier this year after an SMS worm hit cellphone networks鈥�
鈥淭hese threats are certainly feasible. Whether they will be implemented by an attacker remains to be seen,鈥� says Zulfikar Ramzan of network security company Symantec. Ramzan points out that while smartphones are powerful, they are still not as attractive a target as PCs, which can be hijacked to send large amounts of spam or host malicious websites. He argues that while a mobile botnet might be used to bring down part of a cellular network, it鈥檚 not clear how profitable such an attack would be.
