Infected Android phones could flood America's 911 with DDoS attacks

>The real problem here is why would it be so difficult to block on device number (IMEI), especially unknown or unregistered device numbers, in an emergency like that, from a telco's point of view? Surely they are doing that all day long from stolen phones or faked IMEI, no?

Checking IMEI slows things down as it's an in-sequence check performed between UE and an EIR. In the case of checking it's stolen or not, that needs to go to the separate register of stolen devices, and even so - why would you be wanting to block a registered stolen phone from dialling the emergency services?

Networks have an obligation to connect all emergency calls, even from phones registered to another network.

The problem here is that a relatively small number of devices can untraceably be used to jam the emergency call centres - although you would need to distribute these phones in quite wide geographic areas to ensure either the cellular network is jammed with the attempts (limited call capacity per cell) and that you hit the target number of emergency call centres.

rules would have to be tweaked to allow dropping emergency calls from unknown subscribers/devices

A more minimal tweak might be to allow calls from "known" & "unknown" s/devices to be queued separately, and in the event of capacity problems, to answer each queue alternately. Then, in an anonymized DDos, the two queues would be very different lengths so that "known" calls would be more likely to be answered, but you wouldn't ignore all "unknown" calls.

Re: Flowchart?

That's no exit, it's a brexit.

Re: Flowchart?

That's because it's not a meteorite!

Oh, wait, wrong website...

Re: In theory

On almost all hardware, it must be signed by the manufacturer. There are exceptions for developer devices (i.e. Nexus devices) where this signing check can be turned off - in the interest of allowing developers to run unsigned OSs. A little padlock is displayed on boot when disabled. The process of disabling the signature check requires physical access to the phone (last I checked).

Re: DDoS 911 infected Android phones

Well, one possible scenario would be someone with deep pockets who, for reasons of his own, wants to disrupt* emergency services in a specific area at a specific time. With a budget large enough, he could procure a couple of thousand cheap phones, install the software and have them switched on. He could even distribute them to the unsuspecting public via a bogus lottery or something like that.

Re: DDoS 911 infected Android phones

Dodgy app in the play store or drive by exploit for a start. Chains of exploits have been used to jailbreak iPhones from a web page before and the same is possible with android phones too. So as well as infecting they have got root access.

As to jumping to the baseband from there is difficult but no doubt it can be done.

Personally I wouldn't mind full access to my baseband to fiddle with the things you can do with the modifications.

Re: Open vs closed source

>(I'm not looking for an argument of open vs closed source....like I say, just pondering out loud)

That was my thought when I was reading the article, I can't see what the Android angle is - malware on any mobile device would surely achieve the same result as I imagine a spurious dialler app or remote desktop type app would without being in the baseband*.

Equally it would surely be the same with a bad VOIP client on a laptop or desktop?

The story is interesting but i'm not sure where the Android reference (except as clickbait) plays into this?

* Disclaimer: This is my layman supposition, if I'm wrong I'm sure y'all will let me know. :o)

Re: Open vs closed source

The baseband is where the cell radio "firmware" is located. That may be closed source. This attack uses the baseband approach to achieve the semi-anonymous IMEI only calls.

It is done on closed source, and possibly may need to be signed. So this is not an easy attack on many levels, but that does not mean impossible. Once the steps are defined, as much as possible can be scripted and it becomes a lot more feasible.