Analysis of Security Threats and Countermeasures in Mobile Access Network Using openBSC

다국어 초록 (Multilingual Abstract)

According to the Ericsson Mobility Report, the world of smartphone users expect to reach 4.5 billion people in 2018 and the scale of mobile traffic increases 12 times in size. In particular, the video traffic is expected to keep spreading the LTE growth of 60% per year. In accordance with the environmental changes of the mobile communication, smartphone and the mobile communication network must ensure the safety of mobile communications users. In this paper, we describe the threats on the three major security.

First, we describe the security threats of the femtocell in the mobile communication environment. Private Mobile Communication Systems (MCS) can be established with an open project and small MCS base stations are increasingly deployed in experiment environment. They can support not only voice communication, but also Short Message Services (SMS) and GPRS/EDGE services. If a user has a small base station (BS), then establishing a private real-world MCS becomes a clear option. For a private MCS to function properly, the services of private MCSs based on open projects should be configured similarly to those provided by commercial MCSs. In other words, the service should include voice communication, a Short Message Service (SMS), and a GPRS/EDGE service. Also, the subscriber station (SS), likewise, should be configured to support such services. In this paper, we consider attack scenarios using experimental MCSs with small BSs. We experimentally show the feasibility of attacks resulting in the leakage of private information, attacks on openBSC control, and DNS spooffing at the network level, all without subscriber knowledge.

Second, we analysis a Home Location Register(HLR) Lookup service. HLR data is stored in the user profile on the 2G, 3G or 4G mobile communication mobile environment. HLR system is the important components of the core network, and HLR cannot be accessed without authenticated. But we propose a method that how to access HLR or core network from the outside.


Third, we analysis the femtocell firmware produced by Huawei. The Huawei's femtocell was deployed in June 2010. We analysis about the femtocell firmware's booting process, we find out the developer mode during the boot process and send the hidden terminal command. As a result, we propose a method that how to get the administrator's security information.

목차 (Table of Contents)

• 1 Introduction 1
• 1.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
• 1.2 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
• 1.3 Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
• 2 Related Work 7
• 2.1 Security Threats of Femtocells . . . . . . . . . . . . . . . . . 8
• 2.1.1 Introduction to Femtocells . . . . . . . . . . . . . . . . 8
• 2.1.2 Security Threat Classication of Femtocells . . . . . . 11
• 2.1.3 Threat Analysis of Security of Mobile Communications 18
• 2.2 Security Threats of Public Mobile Communications . . . . . . 20
• 3 Establishment of Experimental MCS 23
• 3.1 General Description of Data Transmission between Special
• BSs and SSs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
• 3.2 Conguration of Experimental MCS Environment . . . . . . 25
• 3.3 Installation of Experimental Access Network and Core Network 26
• 3.3.1 Installation of Experimental Mobile Network . . . . . 26
• 3.3.2 Conguration of Experimental Mobile Network . . . . 33
• 4 Security Threats in Experimental MCS 40
• 4.1 Classication of Security Threats . . . . . . . . . . . . . . . . 40
• 4.2 Security Threats from 2G Networks . . . . . . . . . . . . . . 41
• 4.2.1 Scenario 1: Collection of Private User Information . . 41
• 4.2.2 Scenario 2: Security Threats due to Control of openBSC 42
• 4.3 Security Threats from 3G Networks . . . . . . . . . . . . . . 46
• 4.3.1 Scenario 1: DNS Spoong at the Network . . . . . . . 46
• 4.3.2 Scenario 2: Security Threats Utilizing Fake Femtocells 48
• 4.3.3 Scenario 3: IPSec Security Threats in Mobile Networks 54
• 4.3.4 Scenario 4: HLR Information Collection Experiment . 55
• 5 Security Threats of Femtocell Firmware 62
• 5.1 Background of Femtocell Firmware . . . . . . . . . . . . . . . 62
• 5.2 Analysis of Femtocell Firmware . . . . . . . . . . . . . . . . . 64
• 5.3 Femtocells Firmware Extraction Research . . . . . . . . . . . 67
• 6 Conclusion and Future Works 71
• 6.1 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
• 6.2 Future Works . . . . . . . . . . . . . . . . . . . . . . . . . . . 72