2023/12/13 Council Agenda Packet

Battery Life For Different Smartphones Verizon Touch ATTTat Phone Yak. and Model ■Normal Idle ()peahen EAU Peripherals DeofreeRunne Figure 3: Sequence of steps followed in location privacy attack. is achieved by modifying the corresponding entries in the system call table to point to rootkit code. Consequently, the rootkit identi- fies when user -space applications are accessing the GSM device by checking the file descriptor that is passed into read and write. difference is that the rootkit achieves this goal by directly modify - When this occurs, our rootkit scans the GSM for certain incoming ing the smart phone's operating system. AT commands. Attack Description. The GPS and Bluetooth devices can be tog - When an incoming message arrives, the rootkit will check whether gled on and off by writing a "1" or a ' 0," respectively, to their cor- responding power device files. The rootkit therefore turns on the GPS and Bluetooth devices by writing a `1" to their corresponding power device files. To remain stealthy, the rootkit ensures that the original state of these devices is displayed when a user attempts to view their status. Most users typically turn these devices off when they are not in active use because they are power -intensive. When a user checks the status of a GPS or Bluetooth device, the user -space application checks the power device file for a "1" or "0". To do this, it calls the open system call on the file and then reads it. The rootkit monitors the open calls by overwriting kernel function pointer for the open system call in the system call table, making it point to rootkit code. When an open system call is executed, the rootkit examines if the file being opened corresponds to the power device files of the GPS or Bluetooth devices If so, it ensures that the original states of the devices are displayed to the user. The rootkit continuously checks the status of these devices* if the devices are turned off by the user, the rootkit turns them back on. Consequently, the devices are always on, except when the user actively queries the status of these devices. Social Impact. This attack quickly depletes the battery on the smart phone. In ow experiments, the rootkit depleted the battery of a fully charged and infected Neo Freerunner phone in approximately two hours (the phone was not in active use for the duration of this ex- periment). In contrast, the battery life of an uninfected phone run- ning the same services as the infected phone was approximately 44 hours (see Figure 4). We also simulated the effect of such a rootkit on the Verizon Touch and A'IT Tilt phones by powering their GPS and Bluetooth devices. In both cases, battery lifetime reduced al- most ten -fold Because users have come to rely on their phones in emergency situations, this attack results in denial of service when a user needs his/her phone the most. Although our prototype rootkit employs mechanisms to hide it- self from an end user, this attack is less stealthy than Attacks 1 and 2. For example, a user with access to other Bluetooth-enabled devices may notice his smart phone is "discoverable,' causing him to suspect foul play Nevertheless, we hypothesize that the vast majority of users will suspect that their phone's battery is defective and replace the phone or its battery 3.4 Rootkit Delivery and Persistence To effectively infect a smart phone using the rootkits discussed above, attackers must also develop techmques to deliver rootkits and ensure that their functionality persists on the phone for an ex - this is a query from the attacker. This is done by sending the AT command to read messages. An attacker's message will be a certain phrase or set of words that the rootkit can check for. If the message is a query from the attacker, the rootkit's malicious operation is ex- ecuted. The rootkit can be written to enable different functionality for different messages 1 The attacker can also enable/disable the rootkit's malicious functionality via text messages, in effect allow- ing the attacker to remotely control the rootkit. Importantly, the rookit, must also suppress the notification of the attacker's message, to ensure that the user does not learn about it. The rootkit deletes the message from the SIM card by sending an- other AT command to the GSM device. Once the rootkit mtercepts a message to query a user's current location, it attempts to obtain location information from the GPS device. As before, the rootkit can easily obtain location information from the buffer of the GPS device. The rootkit can obtain location information even if the user has disabled the GPS. This is because the rootkit operates in kernel mode, and can therefore enable the device to obtain location information, and disable the device once it has this information. If the user checks to see if the GPS is enabled during this tune, it will appear that the GPS device is off. Having obtained location information, the rootkit constructs a text message and sends the message by sendmg an AT command to the GSM device. The attacker will now receive a user's current location. Social' Impact. Protecting location privacy is an important problem that has received considerable recent attention in the research com- munity. By compromising the kernel to obtain user location via GPS, this rootkit defeats most existing defenses to protect location privacy. Further the attack is stealthy. Text messages received from and sent to the attacker are not displayed immediately to the victim. The only visible trace of the attack is the record of text messages sent by the victim's phone, as recorded by the service provider. • 3.3 Denial of Service via Battery Exhaustion Goal. This attack exploits power -intensive smart phone services, such as GPS and Bluetooth, to exhaust the battery on the phone. This rootkit was motivated by and is similar in its intent to a previ- ously proposed attack that stealthily drains a smart phone's battery by exploiting bugs in the MMS interface [22] However, the key IL This mechanism is also useful in Attack 1—instead of hard - coding the number that the rootkit must dial, an attacker can trans- mit the number that the infected phone must dial via a text message. Figure 4: Denial of service via battery exhaustion. This figure shows how the battery life d des in t erent phone models when the GPS and Bluetooth devices are powered on. 4