Friday, April 17, 2009

Hijacking Mobile-Phone Data

Researchers claim to be able to hijack cell-phone data connections.

By Erica Naone

In a presentation today at Black Hat Europe, a computer-security conference in Amsterdam, a group of researchers claimed to have found a way to hijack the data sent to and from mobile phones. The researchers say that the attack might be used to glean passwords or to inject malicious software onto a device.

Mobile phones are becoming ever more useful for transmitting data in addition to making voice calls, and they're increasingly being used for sensitive activities such as online banking, as well as for searching the Internet and downloading mobile games.

The new attack relies on a protocol that allows mobile operators to give a device the proper settings for sending data via text message, according to Roberto Gassira, Cristofaro Mune, and Roberto Piccirillo, security researchers for Mobile Security Lab, a consulting firm based in Italy. By faking this type of text message, according to the protocol an attacker can create his own settings for the victim's device. This would allow him to, for example, reroute data sent from the phone via a server that he controls. The researchers say that the technique should work on any handset that supports the protocol, as long as the attacker knows which network the victim belongs to and the network does not block this kind of message.

Some trickery is required to make the attack work, however. Ordinarily, to transfer settings to a device remotely, a mobile operator will first send a text message containing a PIN code. The operator will then send the message to reconfigure the phone. In order to install the new settings, the user must first enter the PIN.

So an attacker would need to convince a victim to enter a PIN and accept the malicious settings sent to the phone. But Gassira, Mune and Piccirillo believe that this shouldn't be too difficult. The attacker could send text messages from a name such as "service provider" or "message configuration," suggesting that changes to the device's settings are needed due to a network error. For many handsets, they say, the results of the configuration aren't shown to the user, giving the victim little chance to notice that anything is amiss.

Once a phone has been configured to route data through the attacker's server, this could reveal the user's login credentials or cookies. The researchers say that it may also be possible for an attacker to add unwanted content, such as unsolicited advertisements, to the Web pages that a user views on her phone. By combining this technique with other vulnerabilities, they say that an attacker might even be able to use the mobile device to target resources normally protected within the carrier's network.

David Wagner, an associate professor of computer science at the University of California, Berkeley, who has studied wireless security, cautions that more work needs to be done to identify what conditions are required to exploit the vulnerability and how widespread the problem may be. "I did see in the paper a number of caveats that raised questions in my mind about the degree to which this vulnerability would affect consumers, even if the vulnerability can be exploited," Wagner says. In particular, he notes, it is unclear whether some cell-phone providers may block fake messages or if others would stop an attacker from redirecting Internet traffic. Also, many users may not be fooled by the attack. "If any of these conditions are not met, the attack might be blocked," Wagner says.

The researchers concede that mobile operators could prevent the attack by implementing proper security measures. For example, operators could watch for text messages that show telltale signs of a configuration protocol and check that they originate from an authorized source. Other measures, such as showing the user how her device has been adjusted or monitoring Internet traffic that's being directed out of the carrier's network, might also help.

Mune says that the attack "could be feasible on quite a large number of networks and handsets," and that his team has successfully tested it with a variety of common handsets on large networks in Europe. Although the researchers aren't working with any mobile operators to resolve the vulnerability, they say that they have given notice to relevant parties and are open to helping with the issue if needed.