Can you infect me now?: malware propagation in mobile phone networks

ABSTRACT

In this paper we evaluate the effects of malware propagating usingcommunication services in mobile phone networks. Although self-propagating malware is well understood in the Internet, mobile phone networks have very different characteristics in terms of topologies, services, provisioning and capacity, devices, and communication patterns. To investigate malware in this new environment, we have developed an event-driver simulator that captures the characteristics and constraints of mobile phone networks. In particular, the simulator models realistic topologies and provisioned capacities of the network infrastructure, as well as the contactgraphs determined by cell phone address books. We evaluate the speedand severity of random contact worms in mobile phone networks, characterize the denial-of-service effects such worms could have on the network, investigate approaches to accelerate malware propagation, and discuss the implications of defending networks against such attacks.

REFERENCES

• 1: BergInsight. Smartphone operating systems, May 2007. http://www.berginsight.com/ReportPDF/Summary/BI-SOS-SUM.pdf.
• 2: Gwenael Le Bodic, Mobile Messaging Technologies and Services: SMS, EMS and MMS, John Wiley & Sons, Inc., New York, NY, 2002
• 3: Bose, A., and Shin, K. On mobile viruses exploiting messaging and bluetooth services. In Internat'l Conf. on Security and Privacy in Comm. Networks (SecureComm'06) (Sept. 2006).
• 4: Abhijit Bose , Kang G. Shin, Proactive security for mobile messaging networks, Proceedings of the 5th ACM workshop on Wireless security, September 29-29, 2006, Los Angeles, California [doi>10.1145/1161289.1161307]
• 5: David Dagon , Tom Martin , Thad Starner, Mobile Phones as Computing Devices: The Viruses are Coming!, IEEE Pervasive Computing, v.3 n.4, p.11-15, October 2004 [doi>10.1109/MPRV.2004.21]
• 6: F-Secure. F-Secure Trojan Information Pages: RedBrowser. http://www.f-secure.com/v-descs/redbrowser_a.shtml.
• 7: F-Secure. F-Secure Virus Information Pages: Cabir. http://www.f-secure.com/v-descs/cabir.shtml.
• 8: F-Secure. F-Secure Virus Information Pages: Commwarrior. http://www.f-secure.com/v-descs/commwarrior.shtml.
• 9: Fleizach, CB. Can You Infect Me Now? A Treatise on the Propagation of Malware in a Cellular Phone Network. Tech. Rep. CS2007--0894, UCSD, June 2007.
• 10: Ganesh, AJ., Massoulie, L., and Towsley, D. The effect of network topology on the spread of epidemics. In Proc. IEEE Infocom (2005).
• 11: Hypponen, M. Malware goes mobile. Scientific American 295, 5 (Nov. 2006).
• 12: Kostakos, V. Experiences with urban deployment of Bluetooth (given at {CSD), Mar. 2007. http://www.cs.bath.ac.uk/~vk/files/pres_ucsd.pdf.
• 13: David Liben-Nowell , Erik D. Demaine, An algorithmic approach to social networks, Massachusetts Institute of Technology, Cambridge, MA, 2005
• 14: Liben-Nowell, D., Novak, J., Kumar, R., Raghavan, P., and Tomkins, A. Geographic routing in social networks. Proc. of the Nat'l Academy of Sciences 102, 33 (Aug. 2005).
• 15: James W. Mickens , Brian D. Noble, Modeling epidemic spreading in mobile environments, Proceedings of the 4th ACM workshop on Wireless security, September 02-02, 2005, Cologne, Germany [doi>10.1145/1080793.1080806]
• 16: Mobile World. The Mobile World Briefing, October 2006. http://www.themobileword.com/tmwdev.objects/documents/pdf/TMWBriefingIssue40.pdf.
• 17: Mobiledia. LG enV (VX9900) Specifications. http://www.mobiledia.com/phones/lg/env.html.
• 18: David Moore , Vern Paxson , Stefan Savage , Colleen Shannon , Stuart Staniford , Nicholas Weaver, Inside the Slammer Worm, IEEE Security and Privacy, v.1 n.4, p.33-39, July 2003 [doi>10.1109/MSECP.2003.1219056]
• 19: Moore, D., Shannon, C., Voelker, GM., and Savage, S. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of the 2003 IEEE Infocom Conference (Apr. 2003).
• 20: Mulliner, C., Vigna, G., and Lee, W. Using labeling to prevent cross-service attacks against smart phones. In Proc. of DIMVA'06 (July 2006).
• 21: Newman, M., Forrest, S., and Balthrop, J. Email networks and the spread of computer viruses. Phys. Rev.E 66, 3 (Sept. 2002).
• 22: Elizabeth Van Ruitenbeek , Tod Courtney , William H. Sanders , Fabrice Stevens, Quantifying the Effectiveness of Mobile Phone Virus Response Mechanisms, Proceedings of the 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, p.790-800, June 25-28, 2007 [doi>10.1109/DSN.2007.78]
• 23: Serazzi, G., and Zanero, S. Computer virus propagation models. In Tutorials of the 11th IEEE/ACM International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunications Systems (MASCOTS'03) (Oct. 2003).
• 24: Sumeet Singh , Cristian Estan , George Varghese , Stefan Savage, Automated worm fingerprinting, Proceedings of the 6th conference on Symposium on Opearting Systems Design & Implementation, p.4-4, December 06-08, 2004, San Francisco, CA
• 25: Stuart Staniford , Vern Paxson , Nicholas Weaver, How to Own the Internet in Your Spare Time, Proceedings of the 11th USENIX Security Symposium, p.149-167, August 05-09, 2002
• 26: Jing Su , Kelvin K. W. Chan , Andrew G. Miklas , Kenneth Po , Ali Akhavan , Stefan Saroiu , Eyal de Lara , Ashvin Goel, A preliminary investigation of worm infections in a bluetooth environment, Proceedings of the 4th ACM workshop on Recurring malcode, November 03-03, 2006, Alexandria, Virginia, USA [doi>10.1145/1179542.1179545]
• 27: Symbian. Symbian fast facts, Mar. 2007. http://www.symbian.com/about/fastfacts/fastfacts.html.
• 28: Wang, RX. Symbian OS -- Mysterious playground for new malware. Virus Bulletin (Sept. 2005).
• 29: Waxman, BM. Routing of multipoint connections. IEEE Journal on Selected Areas in Communications (Dec. 1988).
• 30: Wikipedia. Erlang distribution -- Wikipedia, The Free Encyclopedia, 2007. {Online; accessed 7-April-2007}.
• 31: Wong, C., Bielski, S., Studer, A., and Wang, C. Empirical analysis of rate limiting mechanisms. In Internat'l Symp. on RAID'05 (Sept. 2005).
• 32: Zheng, H., Li, D., and Gao, Z. An epidemic model of mobile phone virus. In Proc. of Internat'l SPCA'06 (Jan. 2006).
• 33: Zou, C., Towsley, D., and Gong, W. Email worm modeling and defense. In Proc. of Internat'l Conf. on Computer Comm. and Networks (Oct. 2004).
• 34: Cliff Changchun Zou , Weibo Gong , Don Towsley, Code red worm propagation modeling and analysis, Proceedings of the 9th ACM conference on Computer and communications security, November 18-22, 2002, Washington, DC, USA [doi>10.1145/586110.586130]

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

  I. Computing Methodologies
  I.6 SIMULATION AND MODELING
      I.6.8 Types of Simulation
          Subjects: Discrete event

General Terms:
Experimentation, Measurement, Security

Keywords:
cellular phone networks, defenses, epidemiology, measurement, simulation, worms