Zombies Variant
Geo Location Based DDoS on Mobile Networks - Is it Possible?
Geo Location Based DDoS on Mobile Operators is a very interesting concept. The concept is based on the ability of using software on mobile phones located in one geographic area to generate large amount of traffic. This traffic can possibly create DDoS on the mobile operator.
We decided to delve deeper, and performed a basic analysis of the possible impacts of Geo Location based DDoS
ITU has published that there are 4.6 billion mobile phones worldwide. That is a truly formidable number, and quite capable of performing a DDoS attack on any mobile network.
But creating a DDoS attack isn't as simple as it looks - especially a Geo Location based DDoS. In order to make a DDoS attack, you need the following ingredients
Software that will make the attack - The software will have to use the geo location function (to know where the phone is) and telco function (to create the DoS) of the mobile phone. Variants of s software are available and can be developed with relative ease for any smartphone platform. Example of apps that use Geo Location and telco functions are GPS tracking apps (for child tracking, or employee tracking) as well as 'Cheating Spouse Spy' apps. They enable access to the geolocation and send out data streams or SMS messages. Some of them are even remotely controllable via SMS. They can be easily modified to create a DOS via SMS or data stream swamping.
Means of distribution of the attack software - In order for a DDoS attack to succeed, you need a high volume of attack ('zombie') devices. In a Geo Location DDoS you attack something which is at one geographic location, so zombie phones need to be at or around the target location. This means that you need to persuade a lot of people to install the attacking app needs on their phones. There would be two options for this task:
- An App that everyone will like - This is very hard to achieve, since whatever your App is - even a game, the percentage of people that will like the game can be very limited. Also, you need to develop this App for a lot of platforms, since there are a lot of phone manufacturers and everyone has several different OS platforms.
- A self-distributing (virus like) application - poses a whole set of challenges: A virus can self-distribute either through a vulnerability of the Operating System, or through user action (like sending an SMS with instructions to install an app). Phone users do not readily install new apps simply because an SMS instructed them to, and good luck finding vulnerabilities in a sufficient amount of platforms and versions of phone OS.
Sufficient concentration of Geo Location enabled zombie phones in the targeted areas - Now this is a real numbers game with a lot of interesting results. Targeted areas will be large metropolitan areas which are focus of large businesses - which will have the highest concentration of zombie phones, and where most damage to the reputation of the mobile provider can be done.
To estimate the number of zombie phones in any given area, we need some starting parameters. We'll use worst case scenarios for every parameter
- Geo Location enabled phone percentage in total phone population (between 24% and 95%) - Gartner estimates that smart phones take up 18% of the total number of mobile phones. We'll assume that every smart phone has Geo Location ability, and we'll use percentages higher then 18%, since the target area is going to have a greater population with the means and needs to have a smart phone. For US, we'll use 95% simply because of the FCC E911 phase 2 directive, which mandates that 95% of all subscribers of the US mobile networks to have some form of Geo Location.
- Percentage of phones that will be targeted by the attack app (51%) - since there are multiple manufacturers and platforms, the attacker needs to attack the population with the highest probability of success - the largest phone population with similar characteristics. We'll use the percentage of penetration of platform - Symbian, which according to Gartner had 51% market share of all smart phone platforms.
- Successfully zombified phones (20%) - the target population of mobile phones cannot be fully controlled. The widest penetration of a virus infection was the Melissa virus, for which it is estimated that it infected between 15% and 20% of all computers worldwide. We'll use 20% for good measure.
- Area where most attack phones will reside (4 million square meters) - on a business day most Geo Location based phones will be within the city business area. For a city of over a million inhabitants, this area is at least a 4 kilometer by 4 kilometer square (2.49x2.49 miles). That is 4 million square meters.
- Concentration of zombified phones (50% within the attack area) - on a business day we will assume that 50% of zombie phones will be within the attack area
Based on these parameters, we created a table which calculates the number of zombified phones in large metropolitan areas throughout the world. (click for full size)
Analysis of the table
Assuming the the parameters of the analysis can be met (especially the number of phones that are zombified), here are the results of the numbers
Overwhelming the network - highly unlikely: The maximal number of zombie phones represent from 2.41 to 9.7 percent of the total phone population for urban areas. The mobile network switches are designed to handle traffic spikes, so they'll will be able to handle the increase of maximum 10% of the total city population.
Overwhelming the central area - possible : Long before the DDoS attack can overwhelm the network switches, it will hit a bottleneck: the mobile radio cells have a technical limit of number of active calls, so in a DDoS scenario the mobile cells where most zombified phones reside will be affected.
Overwhelming Hot spots - very likely: Even within the attack target area, there are hot spots with huge concentrations of mobile phones - large office buildings and business parks. These hot spots are rarely treated with a dedicated set of cells, and the DDoS attack will most likely overwhelm the available cells.
In simpler terms, on a business day, the cells in the business area of the city will be have more requests for service then available channels, so there will be a lot of No Service or No Network within the central attack area.
Detection and remedy - at least several hours: The mobile network operator will immediately identify the overwhelmed cells, but it will take hours to identify the pattern of who is creating the congestion. Even then, the remedy will not be simple, and will come down to disabling service for every identified zombie phone. This will take several hours the first time around. But once this particular type of attack is identified, a lot of effort will be put into creating automatic or semi-automatic detection and disabling systems, so after several attacks this correction will be brought down to a maximum of several tens of minutes. Also, mobile operators have the financial means to go after the initiator of the DDoS with every available investigative and legal tool
Conclusion
The parameters in this table are based on a worst case scenario, but based on current numbers of phones and estimated Geo Location ability
The estimation assumed that the attacker can actually install the attack app into 20% of Geo Location enabled devices. This assumption is very far fetched, and therefore, the entire scenario is not very realistic.
The future may be darker - if we start using a common mobile platform, similar to the Windows prevalence in the PC world, and with the Geo Location function becoming either a commodity or even a mandate, the parameters of the analysis can change dramatically - and make the mobile networks vulnerable to DDoS attacks
About the Author
Spirovski Bozidar is Information Security and IT expert. .
Mr. Spirovski has worked in information technology and information security
since 1999. His has contributed his knowledge and experience in the Telco
and Finance industries as manager of systems and security, consultant and
information security officer.
He is the founder and main author of the ShortInfosec Portal (http://
www.shortinfosec.net) which strives to assist IT professionals in improving
their operational posture and improve security of operations.
Mr. Spirovski is also involved as a speaker at regional conferences on issues
of information security and IT management. Mr. Spirovski also publishes
articles on Information Management in relevant publications like CTO Forum
and The Business Issues.
You can contact him through the Shortinfosec Portal
Deck Profile: Chaos Zombies
 |
 MS MARVEL 20 ZOMBIE VARIANT VF NM MARVEL $2.99 Time Remaining: 29d 13h 31m Buy It Now for only: $2.99 Buy It Now |
 Huge IDW Zombie comic lot with variant covers in vf nm $51.00 (38 Bids) Time Remaining: 1h 3m |
 FANBOYS VS ZOMBIES 1 ABCD + 115 + 125 + CGC 98 1100 VARIANT COVER $54.99 Time Remaining: 1h 25m |
 Walking Dead costume card M12 walker zombie variant $30.00 Time Remaining: 29d 20h 35m Buy It Now for only: $30.00 Buy It Now |
 Dawn of the Dead VARIANT poster print Jeff Proctor Mondo Mystery Movie zombies $99.99 (1 Bid) Time Remaining: 1d 1h 53m |
 AMAZING SPIDER MAN 573 ZOMBIE VARIANT 110 MARVEL 2008 NM $9.50 Time Remaining: 29d 4h 20m Buy It Now for only: $9.50 Buy It Now |
 MAN WITH NO NAME 1 DYNAMITE ZOMBIE VARIANT RARE HTF SEE OTHER LOTS VARIANTS $1.55 (2 Bids) Time Remaining: 3d 20h 43m |
 Fanboys VS Zombies 1 CGC 98 1100 SUYDAM VARIANT INCENTIVE $45.99 Time Remaining: 22h 16m Buy It Now for only: $53.99 Buy It Now |
 Fanboys Vs Zombies 2 Garza Virgin Variant $8.99 Time Remaining: 4d 22h 46m Buy It Now for only: $8.99 Buy It Now |
 CGC 98 MARVEL ZOMBIES 3 VARIANTDAREDEVIL 179BY KIRKMAN FROM WALKING DEAD1 $29.99 Time Remaining: 16h 17m Buy It Now for only: $39.99 Buy It Now |
 MS MARVEL 20 ZOMBIE VARIANT NM MARVEL $3.49 Time Remaining: 29d 13h 30m Buy It Now for only: $3.49 Buy It Now |
 1CGC 98 ULTIMATE FANTASTIC FOUR 31 VARIANTFANTASTIC FOUR 51MARVEL ZOMBIES $39.99 Time Remaining: 16h 32m Buy It Now for only: $44.99 Buy It Now |
 MARVEL ZOMBIES 1 CGC 98 SIGNATURE SERIES ARTHUR SUYDAM VARIANT EDITION $99.00 Time Remaining: 3d 21h 49m |
 MS MARVEL 20 ZOMBIE VARIANT VF MARVEL $2.19 Time Remaining: 29d 13h 32m Buy It Now for only: $2.19 Buy It Now |
 Wolverine Origins 29 Original Sin Pt 3 Zombie Variant Cover NM $0.95 Time Remaining: 1d 4h 21m Buy It Now for only: $2.95 Buy It Now |
 MS MARVEL 20 ZOMBIE VARIANT VF MARVEL $2.49 Time Remaining: 29d 13h 31m Buy It Now for only: $2.49 Buy It Now |
 ZENESCOPE THE WAKING 4 EBAS ZOMBIE VARIANT PHOENIX CON $39.99 (1 Bid) Time Remaining: 3d 3h 11m |
 WEB OF SPIDER MAN 1 MARVEL ZOMBIES VARIANT $8.99 Time Remaining: 8d 4h 42m Buy It Now for only: $8.99 Buy It Now |
 Army of Darkness 13 Blood Red Variant NM Prequel to Marvel Zombies VS Army of $2.50 Time Remaining: 1d 1h 44m Buy It Now for only: $4.50 Buy It Now |
 MARVEL COMICS ULTIMATE X MEN 87 ZOMBIE VARIANT 1ST PRINT NM $0.99 Time Remaining: 23h 37m |
 WAKING 2 D TALENT CALDWELL FRIENDS DONT LET FRIENDS BECOME ZOMBIES VARIANT $13.99 Time Remaining: 28d 22h 40m Buy It Now for only: $13.99 Buy It Now |
 WEB OF SPIDER MAN 1 ZOMBIE VARIANT VG FINE $0.99 (2 Bids) Time Remaining: 4d 2h 15m |
 Comics Book Marvel Zombies 4 2nd Print Variant 1st Series Nm $29.94 Time Remaining: 29d 20h 34m Buy It Now for only: $29.94 Buy It Now |
 Marvel Zombies 1 4th print Variant CGC SS 96 signed by Robert Kirkman $2.25 (3 Bids) Time Remaining: 5d 23h 51m |
 Wolverine Origins 29 Zombie Variant Dakan Original Sin part 3 Daniel Way $9.99 Time Remaining: 3d 16h 9m |
 Comics Book Marvel Zombies 1 3rd Print Variant 1st Series Nm $24.94 Time Remaining: 29d 20h 34m Buy It Now for only: $24.94 Buy It Now |
 Fanboys Vs Zombies 1 125 Ale Garza Variant NM Michonne 19 The Walking Dead $7.90 Time Remaining: 18h 51m |
 Fanboys vs Zombies 2 Humberto Ramos BW Virgin Art Variant $20.00 Time Remaining: 23d 29m Buy It Now for only: $20.00 Buy It Now |
 Incredible Hulk 111 Zombie Variant $1.50 Time Remaining: 2d 20h 38m |
 2008 Cable 7 Zombie Variant Dead Walking undead Hope Bishop Phoenix $9.99 Time Remaining: 3d 16h 9m |
 Fanboys vs Zombies 2 Ale Garza Color Virgin Art Variant $10.00 Time Remaining: 23d 26m Buy It Now for only: $10.00 Buy It Now |
 FANBOYS VS ZOMBIES 1 1st PRINT VARIANT Cover D BOOM Comics SOLD OUT $3.99 Time Remaining: 4d 21h 50m |
 MARVEL ZOMBIES 3 NM 2006 VARIANT EDITION LOW PRINTED SOLD OUT $14.99 Time Remaining: 24d 4h 12m Buy It Now for only: $14.99 Buy It Now |
 Marvel Zombies Massaker German Variant New Avengers 1 Zombie Cover 999 Made $15.00 Time Remaining: 14h 55m |
 INCREDIBLE HULK 603 MARVEL ZOMBIES VARIANT 2009 by Greg Pak $3.00 Time Remaining: 17d 21h 15m Buy It Now for only: $3.00 Buy It Now |
 ULTIMATE SPIDER MAN 115 ZOMBIE COVER VARIANT COMIC BOOK Stuart Immonen marvel $9.99 Time Remaining: 21h 7m Buy It Now for only: $12.99 Buy It Now |
 Army Of Darkness 13 Set Red Retail Variant First Marvel Zombies NM 5 Books $13.49 Time Remaining: 1d 3h 58m Buy It Now for only: $14.99 Buy It Now |
 Fanboys vs Zombies 2 Ale Garza BW Virgin Art Variant $20.00 Time Remaining: 23d 27m Buy It Now for only: $20.00 Buy It Now |
 Ultimate Fantastic Four 2004 series 30 Zombie variant near mint comic book $2.50 Time Remaining: 1d 2h 28m |
 MARVEL ZOMBIES 5 OF 5 LIMITED MARVEL SERIESNM 2006 VARIANTLOW PRINTED COVER $9.99 Time Remaining: 6d 4h 14m Buy It Now for only: $9.99 Buy It Now |
 THE WALKING DEAD 1 KIRKMAN MINT IMAGE FIRSTS SOLD OUT VARIANT AMC TV ZOMBIES $2.00 (1 Bid) Time Remaining: 1d 37m |
 Fanboys vs Zombies 1 Bundle 4 Reg3 Variant 1 CGC 98 $79.99 Time Remaining: 23h 36m Buy It Now for only: $99.99 Buy It Now |
 X BABIES 1 125 MARVEL ZOMBIES VARIANT X MEN $14.99 Time Remaining: 8d 4h 42m Buy It Now for only: $14.99 Buy It Now |
 AMAZING SPIDERMAN COMIC 592 VARIANT ZOMBIE $2.99 Time Remaining: 5d 1h 2m |
 MARVEL ZOMBIES RETURN 1 VARIANT COVER by SUYDAM FILLS NEEDS $3.00 Time Remaining: 1d 18h 37m Buy It Now for only: $3.00 Buy It Now |
 Palisades RE Code Veronica Soldier Zombie Exclusive Camo Variant MOC $64.99 Time Remaining: 4d 6m |
 walking dead weekly lot 3 8 11 30 X MEN 87 ZOMBIE VARIANT kirkman AMC wolverine $12.00 (1 Bid) Time Remaining: 4d 17h 13m |
 Zombies vs Robots 1E Ultra Rare Variant Signed by Bill McKay LMT 200 NM $59.99 Time Remaining: 3d 22h 48m Buy It Now for only: $59.99 Buy It Now |
 Thor 1 Zombie Variant Cover Marvel Avengers $0.99 Time Remaining: 2d 6h 55m |
 ULTIMATES 3 5 Cool zombie VARIANT by Joe Maduriera NEW $4.00 Time Remaining: 25d 2h 1m Buy It Now for only: $4.00 Buy It Now |
 Amazing Spider Girl 13 Marvel Zombie Variant Lot of 2 Marvel Comics 2007 $4.99 Time Remaining: 5d 1h 32m |
 Howard the Duck #1 Marvel Zombies Variant Cover Sale Price: $3.70 See Reviews For This Product DescriptionFrom Marvel Comics. A zombie-fied version of the series debut issue! Grab your guns and camcorders and start shooting, it's DUCK SEASON! Marvel's favorite furious fowl, Howard, and his faithful friend with benefits, Beverly, begin their journey to destroy the internet, radio and television...  |
 Attack of the Living Dead (Afterlife) Mezco Toyz Zombie Action Figure Earl Dark Skin Eyeball Popping Out Variant Sale Price: $9.88  Eligible for free shipping!Availability: Usually ships in 1-2 business days See Reviews For This Product DescriptionThe Armageddon Epidemic has spread out of control. The breach of the After Life matter has infected the majority of mankind. The attack of the living dead is seemingly unstoppable. All hope is lost for the world we once knew... |
 ULTIMATE SPIDER-MAN #115 ZOMBIE VARIANT Sale Price: $1.25 See Reviews For This Product Descriptionby Brian Michael Bendis & Stuart Immonen From Marvel Comics. Zombie Variant Cover by Stuart Immonen! "DEATH OF A GOBLIN" Part (4 of 6)-Norman Osborn-the Green Goblin-has escaped the Triskelion and is headed toward Trump Tower! A team of federal agents is on his tail, determined to take Norman down once and for all! And leading that team is none other than-Spider-Man: Agent of S... |
 Thor # 1 Arthur Suydam Zombie Variant Sale Price: $2.99 Eligible for free shipping!Availability: Usually ships in 1-2 business days See Reviews For This Product |
 My Chemical Romance Figure Frank Iero Zombie Variant Sale Price: $129.99 Eligible for free shipping!Availability: Usually ships in 1-2 business days See Reviews For This Product Description |
 ULTIMATE X-MEN ZOMBIE VARIANT #87 Sale Price: $2.54 See Reviews For This Product DescriptionFrom Marvel Comics. "Sentinels" Part 4 (of 5): Things get deadly as Dazzler and Pyro infiltrate the Mutant Liberation Front - only to find a dark secret about the organization! Meanwhile, the rest of the team are left to discover just how advanced these new Sentinels are... |
 Incredible Hulk #111 / "Zombie" Variant cover / World War Hulk Sale Price: $3.93 See Reviews For This Product DescriptionThis is the "ZOMBIE" Variant cover of Hulk #111 - part of the WORLD WAR HULK storyline. This Variant cover was printed in substantial smaller quantities than the regular cover edition. |
 My Chemical Romance Figure Mikey Way Zombie Variant Sale Price: $69.99 Eligible for free shipping!Availability: Usually ships in 1-2 business days See Reviews For This Product Description |
 Amazing Spider-man #552 "Zombie Variant Ed." Cvr (Brand New Day) Sale Price: $9.49 See Reviews For This Product |
 My Chemical Romance Figure Gerard Way Zombie Variant Sale Price: $99.99 Eligible for free shipping!Availability: Usually ships in 1-2 business days See Reviews For This Product Description |
