Can-You-Infect-Me-Now-Malware-Propagation-in-Mobile-Phone-你能感染我现在的手机恶意软件的传播课件

MobileMalwareLikenormalmalware,butonmobilephones(smartphonesanddumbonestoo)‏Whyworryaboutmobilemalware?“combinationofvulnerableplatforms(symbian),unsuspectingusers,andexplosivegrowthinpotentialvictimswillinevitablyattractpropagatingmalware”MobileMalwareLikenormalmalwWhatMakesThisPaperDifferent?Previousmalwarepropagationresearch:ProximityPropagationBluetooth,etcThisresearch:FocusesonpropagationviathetelecommunicationsnetworkWhatMakesThisPaperDifferenWhyMobleMalware?

(fromthebadguy'sperspective)‏SmartphonesarealotlikePCs:marketshareperOS(72%symbian)‏softwarevulnerabilitiesexistExploitedsmartphonescouldprovideanattackerwithmeansto:stealprivatedata/users'identitiesspammakefreecallsexecute(D)DoSWhyMobleMalware?

(fromthebMainPaperGoal(s)‏SimulatetheeffectsofmobilemalwarepropagationviathetelecommunicationsnetworkSimulatedbothVoIPmalwareandMMSmalwareDrawsomeconclusionsfordefendingMainPaperGoal(s)‏SimulatethSimulatorEventDriven,CustomCode.(sotheycouldbetteradaptfortheirneeds)‏1secondstepsize,stepping12hoursInfectionbeginningatasinglephoneTelecomNetworkUMTSTopologyBostonMetroAreaSimulatorEventDriven,CustomNetwork:UMTSUMTSisthe3GsuccessortoGSM(2.5G/GPRS,2.75G/EDGE)‏NetworksideisverysimilartoGSM,airinterfacesidechangedtosupporthigherdatarates.Signalingandcontrolarenegligible(ignoredinthemodel)‏Network:UMTSUMTSisthe3GsuTopology:BostonMetroArea100sqmiles,dividedinto1sqmilecellsMobileStationDistributionfromUSCensusdatascaledby78%(bycellphonepenetration)‏MobilityisnotmodeledAuthorsspeculatethebottleneckwillbeinthenetwork,notattheairinterfaceTopology:BostonMetroArea100SimplifiedUTMSNetworkSimplifiedUTMSNetworkSimulationConstructionAssumenormalMMSusageisbasedonachargepermessageMMSServerCapacityServerhandles100msg/sec,althoughhigherratesweresimulatedwith“aqualitativelysimilarresult”Authorsexplanation:MMSserverwillnotbedimensionedtohandleusersbehavinglikeanaggressiveworm(i.e.,sendinglargenumbersofmessagesasquicklyaspossible).Bottom-updesignoftheUMTSNetworkSimulationConstructionAssumeSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkModeledUTMSNetworkModeledUTMSNetworkSimulationParameters1singleserverserving100msg/sec49serversserving10kuserseach49servers9616NodeB's2Mbps100Mbps1GbpslinksbetweenSGSNsSimulationParameters1singleSimulationNotes“ThegranularityofourNodeBplacementwasalimitingfactorofourinitialpopulationdata.Afinergranularitywould,nodoubt,offeramoredetailedandaccuratepictureofmalwarepropagation.”SimulationNotes“ThegranulariSpreadingviaPhonebooks/ContactListsNopublishedstudiesofaddressbookcharacteristicsfound,so:1-1000contacts(upperlimitfromempiricaldataonphonebookmaximums)‏Phonebook/contactdegreedistributionsbasedonstatisticalanalysisSpreadingviaPhonebooks/ContPhonebook/contactdegreedistributions

(forcontactlistsize)‏Power-Law:fromyahooemailgroups,andotherauthors'research.Log-Normal:fromsocialnetworkingwebsites'statistics.ErlangDist:fromauthors'experiment(butverysmallsamplesizeof73)‏Phonebook/contactdegreedistrNodeAttachment...youdontcalleverybodyinyouraddressbookProbabilisticallyrandomlyassignaddressbooksizebasedondistribution,then...70%-“Theprobabilitythattwouserswerefriendswasproportionaltotheinverseofthenumberofpeoplebetweenthem.”(fromLiveJournalstudy)‏30%uniformlyrandomlyassignedNodeAttachment...youdontcAttackVector:VoIPAssumesvulnerableserviceonthemobilephonewhichdoesnotrequireuserinteractionAssumeallphonesarevulnerable.(Authorsnotethatinrealityafractionwouldbevulnerable,andtheystateaqualitativelysimilarresult)‏AttackVector:VoIPAssumesvulSimulatedPropagationofVoIPMalware“...constrainedbandwidthshouldalsobeconsidered;butdoingsorequiresestimatingtypicaltrafficcharacteristics,andwelackedmeaningfuldataonwhichtobasesuchestimates.”---?????SimulatedPropagationofVoIPTechniquesforFasterPropagationofVoIPMalware(andSimulationResults)‏Divideanddistribute(transfer)contactsfromaddressbookCongestionbackoff(wait)10sTechniquesforFasterPropagatAttackVector:MMSHandledbycentralMMSserverRequiresuserinteractiononlyapercentage“F”actonmessageCanbedonewhilephoneisoffSothereisawaittimetoanswermessages.MixtureoftwoGaussiandistributionscenteredat20s&45mAttackVector:MMSHandledbycSimulatedPropagationofMMSMalwareSimulatedPropagationofMMSMTechniquesforFasterPropagationofMMSMalwareCongestionbackoff(10s)‏Notverymuchadvantage,duetoMMScentralserverconstraint.DivideanddistributecontactsfromaddressbookSameasaboveGlobalcontactbookmethodInfectedhalfthepopulationin12hrs.(whatFvalue?)‏TechniquesforFasterPropagatFasterMMSMalwarePropagationFasterMMSMalwarePropagationDefendingAgainstMobileMalwarePropagationinTelecom.Networks(Thissectioniswaytoosmallinthepaper,wouldhavelikedtoseemoreonthis.)‏RateLimitingACCELLERATESinfection!(sameascongestionavoidance)‏BlacklistingContainmentlargenumberstillgetinfectedmoreslowly(nodetailsgivenon%).removingphonesleadstoalesscongestednetworkforthoseinfectedbutnon-blacklistedphonesContentFiltering“Seemspromisingduetocentralizedtopology.”"Investigatingwhetherit'spracticalremainsfuturework."(andtheydidntprovideanyinformationonhowpromisingorwhy)‏DefendingAgainstMobileMalwaQuestions?Questions?MobileMalwareLikenormalmalware,butonmobilephones(smartphonesanddumbonestoo)‏Whyworryaboutmobilemalware?“combinationofvulnerableplatforms(symbian),unsuspectingusers,andexplosivegrowthinpotentialvictimswillinevitablyattractpropagatingmalware”MobileMalwareLikenormalmalwWhatMakesThisPaperDifferent?Previousmalwarepropagationresearch:ProximityPropagationBluetooth,etcThisresearch:FocusesonpropagationviathetelecommunicationsnetworkWhatMakesThisPaperDifferenWhyMobleMalware?

(fromthebadguy'sperspective)‏SmartphonesarealotlikePCs:marketshareperOS(72%symbian)‏softwarevulnerabilitiesexistExploitedsmartphonescouldprovideanattackerwithmeansto:stealprivatedata/users'identitiesspammakefreecallsexecute(D)DoSWhyMobleMalware?

(fromthebMainPaperGoal(s)‏SimulatetheeffectsofmobilemalwarepropagationviathetelecommunicationsnetworkSimulatedbothVoIPmalwareandMMSmalwareDrawsomeconclusionsfordefendingMainPaperGoal(s)‏SimulatethSimulatorEventDriven,CustomCode.(sotheycouldbetteradaptfortheirneeds)‏1secondstepsize,stepping12hoursInfectionbeginningatasinglephoneTelecomNetworkUMTSTopologyBostonMetroAreaSimulatorEventDriven,CustomNetwork:UMTSUMTSisthe3GsuccessortoGSM(2.5G/GPRS,2.75G/EDGE)‏NetworksideisverysimilartoGSM,airinterfacesidechangedtosupporthigherdatarates.Signalingandcontrolarenegligible(ignoredinthemodel)‏Network:UMTSUMTSisthe3GsuTopology:BostonMetroArea100sqmiles,dividedinto1sqmilecellsMobileStationDistributionfromUSCensusdatascaledby78%(bycellphonepenetration)‏MobilityisnotmodeledAuthorsspeculatethebottleneckwillbeinthenetwork,notattheairinterfaceTopology:BostonMetroArea100SimplifiedUTMSNetworkSimplifiedUTMSNetworkSimulationConstructionAssumenormalMMSusageisbasedonachargepermessageMMSServerCapacityServerhandles100msg/sec,althoughhigherratesweresimulatedwith“aqualitativelysimilarresult”Authorsexplanation:MMSserverwillnotbedimensionedtohandleusersbehavinglikeanaggressiveworm(i.e.,sendinglargenumbersofmessagesasquicklyaspossible).Bottom-updesignoftheUMTSNetworkSimulationConstructionAssumeSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkSimplifiedUTMSNetworkModeledUTMSNetworkModeledUTMSNetworkSimulationParameters1singleserverserving100msg/sec49serversserving10kuserseach49servers9616NodeB's2Mbps100Mbps1GbpslinksbetweenSGSNsSimulationParameters1singleSimulationNotes“ThegranularityofourNodeBplacementwasalimitingfactorofourinitialpopulationdata.Afinergranularitywould,nodoubt,offeramoredetailedandaccuratepictureofmalwarepropagation.”SimulationNotes“ThegranulariSpreadingviaPhonebooks/ContactListsNopublishedstudiesofaddressbookcharacteristicsfound,so:1-1000contacts(upperlimitfromempiricaldataonphonebookmaximums)‏Phonebook/contactdegreedistributionsbasedonstatisticalanalysisSpreadingviaPhonebooks/ContPhonebook/contactdegreedistributions

(forcontactlistsize)‏Power-Law:fromyahooemailgroups,andotherauthors'research.Log-Normal:fromsocialnetworkingwebsites'statistics.ErlangDist:fromauthors'experiment(butverysmallsamplesizeof73)‏Phonebook/contactdegreedistrNodeAttachment...youdontcalleverybodyinyouraddressbookProbabilisticallyrandomlyassignaddressbooksizebasedondistribution,then...70%-“Theprobabilitythattwouserswerefriendswasproportionaltotheinverseofthenumberofpeoplebetweenthem.”(fromLiveJournalstudy)‏30%uniformlyrandomlyassignedNodeAttachment...youdontcAttackVector:VoIPAssumesvulnerableserviceonthemobilephonewhichdoesnotrequireuserinteractionAssumeallphonesarevulnerable.(Authorsnotethatinrealityafractionwouldbevulnerable,andtheystateaqualitativelysimilarresult)‏AttackVector:VoIPAssumesvulSimulatedPropagationofVoIPMalware“...constrainedbandwidthshouldalsobeconsidered;butdoingsorequiresestimatingtypicaltrafficcharacteristics,andwelackedmeaningfuldataonwhichtobasesuchestimates.”---?????SimulatedPropagationofVoIPTechniquesforFasterPropagationofVoIPMalware(andSimulationResults)‏Divideanddistribute(transfer)contactsfromaddressbookCongestionbackoff(wait)10sTechniquesforFasterPropagatAttackVector:MMSHandledbycentralMMSserverRequiresuserinteractiononlyapercentage“F”actonmessageCanbedonewhilephoneisof