Browsing by Author "Tu, Guan-Hua"

Now showing 1 - 6 of 6

Exploring the Insecurity of Google Account Registration Protocol via Model Checking
(2019-01-01)
Xie, Tian
;
Wang, Sihan
;
Tu, Guan-Hua
;
Li, Chi-Yu
;
Lei, Xinyu
People nowadays use online service accounts (e.g., Gongle, Facebook, Twitter) to access certain services. Among them, Google accounts have become increasingly important for users. Not only do many Google services (e.g., Gmail, Google Voice, Google Play, etc.) require them, but many online services also trust and rely on them for operational needs (e.g., login based on Google accounts). This trend introduces a new type of attacks that create a large number of fake, but valid, Google accounts. The fake Google accounts allow the adversary to launch various cyber attacks towards Google account-related services. It motivates us to conduct an empirical security study on the Google account registration service. In this paper, we apply model checking techniques to systematically analyze the insecurity of Google account registration service. We develop a model-checking tool, GAcctAnalyzer, which consists of two phases: (1) service screening phase, which generates counterexamples from the violation of desired properties, and (2) experimental validation phase, which validates the counterexamples through real experiments. We use GAcctAnalyzer to discover four security vulnerabilities including design defects, operational slips. etc. Based on the discovered vulnerabilities, we devise two practical attacks against mobile users and Google: fake Google account generation and Google text/voice spamming attack. They can not only threaten the security of mobile applications and online services, but also cause the Google company to receive user complaints and lawsuits. We finally confirm the feasibility of these attacks through experiments, assess the real-world impact, and propose recommended solutions.
How Voice Service Threatens Cellular-Connected IoT Devices in the Operational 4G LTE Networks
(2018-01-01)
Xie, Tian
;
Li, Chi-Yu
;
Tang, Jiliang
;
Tu, Guan-Hua
;
資訊工程學系
LTE networks are rolling out cellular Internetof-Things (IoT) services. Cellular-connected IoT devices are becoming increasingly popular and the number is forecasted to grow almost fourfold from 2015 to 2021. Since they share the same infrastructure with non-IoT devices such as smartphones, we may expect no big differences between them in terms of voice/data service accounting/charging (e.g., paying for what you get) and security risks. However, our study shows that cellular IoT users may pay more than what they get, as well as are vulnerable to voice signaling spams and thus suffer from an overcharging attack which leads to financial loss or denial of service. We validate our proof-of-concept attack in a major U.S. cellular network operator which takes higher than 35% market share. We finally propose a solution to address the identified security vulnerabilities.
New Security Threats Caused by IMS-based SMS Service in 4G LTE Networks
(2016)
Tu, Guan-Hua
;
Li, Chi-Yu
;
Peng, Chunyi
;
Li, Yuanjie
;
Lu, Songwu
SMS (Short Messaging Service) is a text messaging service for mobile users to exchange short text messages. It is also widely used to provide SMS-powered services (e.g., mobile banking). With the rapid deployment of all-IP 4G mobile networks, the underlying technology of SMS evolves from the legacy circuit-switched network to the IMS (IP Multimedia Subsystem) system over packet-switched network. In this work, we study the insecurity of the IMS-based SMS. We uncover its security vulnerabilities and exploit them to devise four SMS attacks: silent SMS abuse, SMS spoofing, SMS client DoS, and SMS spamming. We further discover that those SMS threats can propagate towards SMS-powered services, thereby leading to three malicious attacks: social network account hijacking, unauthorized donation, and unauthorized subscription. Our analysis reveals that the problems stem from the loose security regulations among mobile phones, carrier networks, and SMS-powered services. We finally propose remedies to the identified security issues.
The Dark Side of Operational Wi-Fi Calling Services
(2018-01-01)
Xie, Tian
;
Tu, Guan-Hua
;
Li, Chi-Yu
;
Peng, Chunyi
;
Li, Jiawei
All of four major U.S. operators have rolled out nationwide Wi-Fi calling services. They are projected to surpass VoLTE (Voice over LTE) and other VoIP services in terms of mobile IP voice usage minutes in 2018. They enable mobile users to place cellular calls over Wi-Fi networks based on the 3GPP IMS (IP Multimedia Subsystem) technology. Compared with conventional cellular voice solutions, the major difference lies in that their traffic traverses untrustful Wi-Fi networks and the Internet. This exposure to insecure networks may cause the Wi-Fi calling users to suffer from security threats. Its security mechanisms are similar to the VoLTE, because both of them are supported by the IMS. They include SIM-based security, 3GPP AKA (Authentication and Key Agreement), IPSec (Internet Protocol Security), etc. However, are they sufficient to secure Wi-Fi calling services? Unfortunately, our study yields a negative answer. In this work, we explore security issues of the operational Wi-Fi calling services in three major U.S. operators' networks using commodity devices. We disclose that current Wi-Fi calling security is not bullet-proof. We uncover four vulnerabilities which stem from improper standard designs, device implementation issues and network operation slips. By exploiting them, we devise two proof-of-concept attacks: user privacy leakage and telephony harassment or denial of voice service (THDoS); they can bypass the security defenses deployed on both mobile devices and network infrastructure. We have confirmed their feasibility and simplicity using real-world experiments, as well as assessed their potential damages and proposed recommended solutions.
The Insecurity of Home Digital Voice Assistants - Vulnerabilities, Attacks and Countermeasures
(2018-01-01)
Lei, Xinyu
;
Tu, Guan-Hua
;
Liu, Alex X.
;
Li, Chi-Yu
;
Xie, Tian
Home Digital Voice Assistants (HDVAs) are getting popular in recent years. Users can control smart devices and get living assistance through those HDVAs (e.g., Amazon Alexa, Google Home) using voice. In this work, we study the insecurity of HDVA services by using Amazon Alexa and Google Home as case studies. We disclose three security vulnerabilities which root in their insecure access control. We then exploit them to devise two proof-of-concept attacks, home burglary and fake order, where the adversary can remotely command the victim's HDVA device to open a door or place an order from Amazon.com or Google Express. The insecure access control is that IIDVA devices not only rely on a single-factor authentication but also take voice commands even if no people are around them. We thus argue that HDVAs should have another authentication factor, a physical presence based access control; that is, they can accept voice commands only when any person is detected nearby. To this end, we devise a Virtual Security Button (VsButton), which leverages the WiFi technology to detect indoor human motions. Once any indoor human motion is detected, the IllY111 device is enabled to accept voice commands. Our evaluation results show that it can effectively differentiate indoor motions from the cases of no motion and outdoor motions in both laboratory and real world settings.
V2PSense: Enabling Cellular-based V2P Collision Warning Service Through Mobile Sensing
(2018-01-01)
Li, Chi-Yu
;
Salinas, Giovanni
;
Huang, Po-Hao
;
Tu, Guan-Hua
;
Hsu, Guo-Huang
The C-V2X (Cellular Vehicle-to-Everything) technology is developing in full swing. One of its mainstream services can be the Vehicle-to-Pedestrian (V2P) service. It can protect pedestrians who are mostly vulnerable on the road. In this work, we seek to enable a V2P service that can identify which pedestrians may be nearby a dangerous driving event and then notify them of warning messages. To enable this V2P service, there are two major challenges. First, a low-latency V2P message transport is required for this infrastructure-based service. Second, the pedestrian's smartphone requires an energy-efficient outdoor positioning method instead of power-hungry GPS due to its limited battery life. We thus propose a novel solution, V2PSense, which trades off positioning precision for energy savings while achieving low-latency message transport with LTE high-priority bearers. It does a coarse-grained positioning by leveraging intermittent GPS information and mobile sensing data, which includes step count from the pedometer and cellular signal strength changes. Though the V2PSense's positioning is not as precise as the GPS, it can still ensure that all the pedestrians nearby dangerous spots can be notified. Our results show that it can achieve the average precision ratio 92.6% for estimating where the pedestrian is while saving 20.8% energy, compared with the GPS always-on case.