As cellular data services and applications are being widely deployed, they become attractive targets for attackers, who could exploit unique vulnerabilities in cellular networks, mobile devices, and the interaction between cellular data networks and the Internet. Furthermore, as mobile phones become more powerful with more bandwidth, cellular end hosts will become the next target for attacks that are widely deployed on the Internet.

We demonstrate an attack, which surreptitiously drains mobile devices' battery power up to 14 times faster and therefore could render these devices useless before the end of business hours. This attack targets a unique resource bottleneck in mobile devices (the battery power) by exploiting an insecure cellular data service, Multimedia Messaging Service (MMS), and the insecure interaction between cellular data networks and the Internet, Packet Data Protocol (PDP) context retention and the paging channel. The attack proceeds in two stages. In the first stage, the attacker compiles a hit list of mobile devices -- including their cellular numbers, IP addresses, and model information -- by exploiting MMS notification messages. In the second stage, the attacker drains mobile devices' battery power by sending periodical UDP packets and exploiting PDP context retention and the paging channel. When a packet is sent to a phone, the network will deliver the packet if the phone's location is known, or attempt to locate the phone by sending a page request to it. However, since cellular phones spend most of their time in the dormant, battery-saving mode, the page on the paging channel will awaken the phone to the ready state and force it to perform a location update. The sine qua non of this attack is to keep the phone in this ready, high battery consumption state, therefore disabling its ability to preserve battery life, or to let the phone temporarily go into the battery-saving state only to be immediately awakened with a page and forced to perform a location update; both of which consume a lot of energy. This attack is unique in that the victims are unaware when their batteries are being drained, and that the attack exploits vulnerable cellular services to target mobile devices. We will identify two key vulnerable components in cellular networks and propose mitigation strategies for protecting cellular devices from such attacks from the Internet.

We hope to alert the security community of unique security issues in several important areas: cellular networks, mobile devices, and the interaction between cellular data networks and the Internet. In particular, the ability to utilize insecure protocols on the Internet, such as the MMS gateway in our attack, to leverage into a secure network, such as the cellular network. Furthermore, since the cellular networks and the Internet have very different security policies and threat models, the intergration between these two networks must be studied indepth to eliminate inconsistencies. Our attack is one of the many different vulnerabilities that became available when both networks intergrated. More importantly, we also hope to instigate a discussion on future threats against cellular data networks and their mitigation strategies. We hope to develop discussions with security reserachers on securing both currently deployed technologies as well as future developing technologies such as High Speed Downlink Packet Access (HSDPA) and Evolution-Data Optimized (EV-DO) in 3G cellular networks.