Threat modeling framework for mobile communication systems

Abstract

Due to the complex nature of mobile communication systems, most of the security e orts in its domain are isolated and sca ered across underlying technologies. is has resulted in an obscure view of the overall security. In this work, we a empt to x this problem by proposing a domain-speci c threat modeling framework. By gleaning from a diverse and large body of security literature, we systematically organize the a acks on mobile communications into various tactics and techniques. Our framework is designed to model adversarial behavior in terms of its a ack phases and to be used as a common taxonomy matrix. We also provide concrete examples of using the framework for modeling the a acks individually and comparing them with similar ones. CCS CONCEPTS•Security and privacy → Security requirements; Mobile and wireless security; •Networks → Mobile networks;

Implementation of a Malicious Traffic Filter Using Snort and Wireshark as a Proof of Concept to Enhance Mobile Network Security

“…The emergence of numerous entry points to the SS7 network has become a major source of weakness. This helps attackers write, intercept and change SS7 posts via multiple mobile network and subscriber attacks [1], [2].…”

“…His most significant contribution to SS7 research was the development of an open-source simulator called "SS7 Attack Simulator" that generates simulated SS7 regular and abnormal traffic. Similarly, experts at Positive Security explained the entry points to SS7 and explained or demonstrated some attack plots [2]. A white paper released by the SANS Institute gives an insight into potential SS7 attacks.…”

“…A white paper released by the SANS Institute gives an insight into potential SS7 attacks. It also proposes how essential security monitoring may be deployed to secure the SS7 network more effectively [2]. Exploiting MAP messages can lead to several security attacks and research done by Rao et al explains the methods relied upon to accomplish such attacks [11].…”

“…An attacker who is a subscriber of network operator C will imitate the attacks. In this research, the two most debated and critical attacks, namely location tracking and interception attacks [2], are simulated. To demonstrate these attacks, one type of a message request from each category of SS7 MAP messages has been selected.…”

“…SS7 was designed five decades ago, in the 1970s, when only a few operators were providing telecommunication services and had access to the core network [1]. Since then, SS7 has been used for call establishment/termination, mobility management, user security information, billing information, and access/service authorization [2]. As it was considered that mutual trust existed between operators, no inherent security controls were incorporated in the SS7 core network.…”