AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. NLAB INC.AHNLAB INC.AHNLAB

AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC.

AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC.

NLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC. AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB NLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC. AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLABNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC. AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB NLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC. AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB INC.AHNLAB


NEW THREATS NEW THREATS ON MOBILE ENVIRONMENT IN KOREAON MOBILE ENVIRONMENT IN KOREA

KYU-BEOM HWANG ([email protected])KYU-BEOM HWANG ([email protected])

ANDAND

DEOK-YOUNG JUNG ([email protected])DEOK-YOUNG JUNG ([email protected])


AVAR2005AVAR2005 2




AGENDA

KOREAN MOBILE ENVIRONMENTKOREAN MOBILE ENVIRONMENT

TYPE OF PROBLEMSTYPE OF PROBLEMS

WHAT IS THE PROBLEM ?WHAT IS THE PROBLEM ?

EXPECTED FORM OF ATTACKEXPECTED FORM OF ATTACK

COUNTER MEASURESCOUNTER MEASURES

CONCLUSIONSCONCLUSIONS


AVAR2005AVAR2005 3




KOREAN MOBILE ENVIRONMENTUSED AROUND 81%(39.4million) FOR SEPTEMBER 2005.USED AROUND 81%(39.4million) FOR SEPTEMBER 2005.

SERVICED BY SK TELECOM, KT FREETEL, LG TELECOMSERVICED BY SK TELECOM, KT FREETEL, LG TELECOM

POPULARIZE GAMES, MOVIE CLIPS ON THE MOBILE PHONEPOPULARIZE GAMES, MOVIE CLIPS ON THE MOBILE PHONE

Number of mobile phone Number of mobile phone usersusers


AVAR2005AVAR2005 4




KOREAN MOBILE ENVIRONMENT

MORE THAN JUST FOR MORE THAN JUST FOR TELEPHONETELEPHONE

Digital EntertainmentDigital Entertainment Digital Mobile Broadcasting Digital Mobile Broadcasting MP3 PlayerMP3 Player Movie PlayerMovie Player Digital CAMERADigital CAMERA Mobile GAME Device ( 3D Mobile GAME Device ( 3D

Support )Support )

PIMPIM ContactsContacts CalendarCalendar

WAP Browsing / Web BrowsingWAP Browsing / Web Browsing

File Storage / ExchangeFile Storage / Exchange

And more…And more…

Satellite DMB (Digital Multimedia Broadcasting) Satellite DMB (Digital Multimedia Broadcasting)


AVAR2005AVAR2005 5




KOREAN MOBILE ENVIRONMENTSMS HAS BECOME MORE POPULAR THAN VOICESMS HAS BECOME MORE POPULAR THAN VOICEGETTING INFORMATION VIA MOBILE PHONE ;.e.g.GETTING INFORMATION VIA MOBILE PHONE ;.e.g.

CAR NAVIGATION SYSTEMSCAR NAVIGATION SYSTEMSBUS TRACKING and etc.BUS TRACKING and etc.

WITH PC TO EXCHANGE MASSIVE DATAWITH PC TO EXCHANGE MASSIVE DATAMP3MP3GamesGamesMovie ClipsMovie ClipsPicturesPictures

USING USB CABLE TO CONNECT PCUSING USB CABLE TO CONNECT PCProvide the modem driver for mobile phoneProvide the modem driver for mobile phoneProvide the software ;i.e.Provide the software ;i.e.

Exchange dataExchange data Edit phone numbersEdit phone numbers


AVAR2005AVAR2005 6




CAUSES OF THE PROBLEM

EBOOKMAKER QPST

BITPIM PHONEMANAGER


AVAR2005AVAR2005 7




CAUSES OF THE PROBLEMSTOOLS USED BY UNTHINKING USERSTOOLS USED BY UNTHINKING USERS

Many communities which share tools and informationMany communities which share tools and informationCauses error on the phoneCauses error on the phone

USING QPST, BITPIM TO EXCHANGE COMMERCIAL DATA USING QPST, BITPIM TO EXCHANGE COMMERCIAL DATA WITHOUT PERMISSIONWITHOUT PERMISSION

To copy disallowed contentsTo copy disallowed contents Commercial contents (e.g. games)Commercial contents (e.g. games) Movie clipsMovie clips E-BooksE-Books Any other filesAny other files

To analyze unauthorized data on mobile phonesTo analyze unauthorized data on mobile phones


AVAR2005AVAR2005 8




CAUSES OF THE PROBLEMSACCESSING FILES ON EFSACCESSING FILES ON EFS

Deleting system files ;i.e.Deleting system files ;i.e. The mobile phone could be out of serviceThe mobile phone could be out of service

Copying too many filesCopying too many files Short of memory resulting in errorShort of memory resulting in error

REVEALED DOCUMENT ABOUT EXTERNAL INTERFACE OF REVEALED DOCUMENT ABOUT EXTERNAL INTERFACE OF MOBILE PHONE LEADING TOMOBILE PHONE LEADING TO

Unwanted, unnoticed dialing (i.e. International calls )Unwanted, unnoticed dialing (i.e. International calls )

Sending junk messages ( by SMS )Sending junk messages ( by SMS )

Simulating user actionsSimulating user actions


AVAR2005AVAR2005 9




WHAT IS THE PROBLEMS?

COMPLEX FIRMWARECOMPLEX FIRMWAREMore functionsMore functionsHigh complexityHigh complexityLarge sizeLarge size

DOWNLOADING FIRMWAREDOWNLOADING FIRMWAREDownloading the firmware via internetDownloading the firmware via internetProblem can happen on the mobile phoneProblem can happen on the mobile phone

By wrong firmwareBy wrong firmware By incomplete DownloadsBy incomplete Downloads

DISCLOSED IMPORTANT INFORMATIONDISCLOSED IMPORTANT INFORMATIONSPC (System Programming Code) number ;i.e.SPC (System Programming Code) number ;i.e.

The setting of a mobile phone can be changedThe setting of a mobile phone can be changedESN (Electronic Serial Number)ESN (Electronic Serial Number)

Can clone phoneCan clone phone


AVAR2005AVAR2005 10




CLONED MOBILE PHONES

Confiscating 4718 cloned mobile phones Between Jan and Confiscating 4718 cloned mobile phones Between Jan and Aug in 2005Aug in 2005


AVAR2005AVAR2005 11





Explosive increase of cloned mobile phone this yearExplosive increase of cloned mobile phone this year


AVAR2005AVAR2005 12





Article about illegal electronic payment by cloned phone Article about illegal electronic payment by cloned phone using stolen ESN codesusing stolen ESN codes


AVAR2005AVAR2005 13





The Korean government intends to prevent cloning of The Korean government intends to prevent cloning of phones by rewarding citizensphones by rewarding citizens


AVAR2005AVAR2005 14





EASY ACCESS TO PHONE CLONNINGEASY ACCESS TO PHONE CLONNING


AVAR2005AVAR2005 15





Tools for cloning phonesTools for cloning phones


AVAR2005AVAR2005 16





Tools for accessing system filesTools for accessing system files


AVAR2005AVAR2005 17





Tools for uploading contentsTools for uploading contents


AVAR2005AVAR2005 18





Information and tools are exposed to the InternetInformation and tools are exposed to the Internet


AVAR2005AVAR2005 19




EXPECTED TYPE OF ATTACKSCHANGING SERVICE SETTING INFORMATIONCHANGING SERVICE SETTING INFORMATION

DELETING, MODIFYING FILES ON EFS ;.i.e.DELETING, MODIFYING FILES ON EFS ;.i.e.

UPLOADING UNWANTED CONTENTS ;.i.e.UPLOADING UNWANTED CONTENTS ;.i.e.

Obscene games, picture, movie clipsObscene games, picture, movie clips

Replacing contentsReplacing contents

Spam advertisingSpam advertising

UNNOTICED DIALING ( .e.g. international calls )UNNOTICED DIALING ( .e.g. international calls )

UNNOTICED SENDING JUNK MESSAGES via SMSUNNOTICED SENDING JUNK MESSAGES via SMS

DELETING, DISCLOSING INFORMATION ;.e.g.DELETING, DISCLOSING INFORMATION ;.e.g.

Silent unnoticed retrieval of information to PCSilent unnoticed retrieval of information to PC E.g.) the telephone number, Email, ESNE.g.) the telephone number, Email, ESN

Silent unnoticed Changing of phones numbersSilent unnoticed Changing of phones numbers


AVAR2005AVAR2005 20




EXPECTED TYPE OF ATTACKS


AVAR2005AVAR2005 21






AVAR2005AVAR2005 22






AVAR2005AVAR2005 23






AVAR2005AVAR2005 24




COUNTER MEASURES

PROTECTING CONTENTS WITH DRM, but still;PROTECTING CONTENTS WITH DRM, but still;Attempts to use time limited MP3sAttempts to use time limited MP3sAttempts to use commercial contentsAttempts to use commercial contents

PREVENTION OF USING CLONED PHONEPREVENTION OF USING CLONED PHONEThe new mobile phone with another authentication in addition to ESN The new mobile phone with another authentication in addition to ESN and MINand MINBut the mobile phones produced before Aug 2004 still have a problemBut the mobile phones produced before Aug 2004 still have a problem

PHONE MANUFACTURESPHONE MANUFACTURESPatching firmware to disallow tools in usePatching firmware to disallow tools in useDifferent ways to encrypt data for each manufacturer’s phoneDifferent ways to encrypt data for each manufacturer’s phoneRepairing the phone only at service centersRepairing the phone only at service centersAdditional tracking services of mobile phone connection to Service PIN Additional tracking services of mobile phone connection to Service PIN NumbersNumbers


AVAR2005AVAR2005 25




COUNTER MEASURESMALICIOUS ATTACKSMALICIOUS ATTACKS

The malicious code itself is hard to spread on CDMA environmentThe malicious code itself is hard to spread on CDMA environmentThe attack so far is possible, but it needs a lot of conditionsThe attack so far is possible, but it needs a lot of conditionsThe possibility can be higher if a user still miss behaviorsThe possibility can be higher if a user still miss behaviors

MEASURES TO FIGHT THE EXPECTED PC MALICIOUS CODEMEASURES TO FIGHT THE EXPECTED PC MALICIOUS CODEDisabling dialing and sending SMS without user’s consentDisabling dialing and sending SMS without user’s consentDisabling sending system files such as ESN through Serial port, USBDisabling sending system files such as ESN through Serial port, USB

MEASURES TO FIGHT THE EXPECTED MOBILE CODEMEASURES TO FIGHT THE EXPECTED MOBILE CODEDisabling unwanted payment on games without user’s consentDisabling unwanted payment on games without user’s consent


AVAR2005AVAR2005 26




CONCLUSIONSMOBILE ENVIRONMENT IN KOREA IS RAPIDLY CHANGINGMOBILE ENVIRONMENT IN KOREA IS RAPIDLY CHANGING

The threats so far are partially under control, but it needs more The threats so far are partially under control, but it needs more developmentdevelopmentThreats will increase as there are more servicesThreats will increase as there are more services

TO GET RID OF CURRENT THREATS, MUST UPDATE FIRMWARETO GET RID OF CURRENT THREATS, MUST UPDATE FIRMWAREThe damage could be extensive if the problems happensThe damage could be extensive if the problems happensMobiles connected to PCs realistically have low possibility of attacksMobiles connected to PCs realistically have low possibility of attacksIt’s difficult to spread to aroundIt’s difficult to spread to around

USERS, SERVICE PROVIDERS AND PHONE MANUFACTURES USERS, SERVICE PROVIDERS AND PHONE MANUFACTURES HAVE TO THINK TOGETHER ABOUT THREATS AND COUNT HAVE TO THINK TOGETHER ABOUT THREATS AND COUNT MEASURESMEASURES

Documents

AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. AHNLAB INC. NLAB INC.AHNLAB INC.AHNLAB