You Can Run, but You Can't Hide: Exposing Network Location for Targeted DoS Attacks in Cellular Networks.
Zhiyun Qian, Zhaoguang Wang, Qiang Xu, Z. Morley Mao, Ming Zhang, Yi‐Min Wang · Network and Distributed System Security Symposium · 2012
An important class of attacks against cellular network infrastructures, i.e., signaling DoS attack, paging channel overload, and channel exhaustion attack, operates by sending low rate data traffic to a large number of mobile devices at a particular location to exhaust bottleneck resources such as radio resource and radio resource controller. We term this class of attack targeted DoS attack on cellular networks, given the focus on a specific location. The success of such attacks depends on an important but unvalidated assumption that it is possible to create a relatively accurate hit list of mobile devices associated with the target network location to which attackers can direct traffic. In this study, we take an important first step to validate this assumption by performing a large-scale study on the feasibility of these attacks. In addition, we propose accurate and efficient techniques for generating IP address to network location association in real time for existing commercial UMTS networks. Our technique relies on developing and measuring network signatures consisting of both static and dynamic features of key network elements such as Radio Network Controllers (RNCs) that are stable within the same location but distinct across locations. We find that a single feature in some cases is unique enough to locate a city such as NYC. With as little as 800kbps probe rate, we can identify a sufficient number of IPs to accurately target a network location, after scanning millions of IPs within 1.2 hours to effectively impose 2.5 to 3.5 times the normal load on the network.