Shinjo Park's research while affiliated with Technische Universität Berlin and other places

Publications (9)

Preprint
Full-text available
Rogue base stations are an effective attack vector. Cellular basebands represent a critical part of the smartphone's security: they parse large amounts of data even before authentication. They can, therefore, grant an attacker a very stealthy way to gather information about calls placed and even to escalate to the main operating system, over-the-ai...
Conference Paper
IMSI catchers threaten the privacy of mobile phone users by identifying and tracking them. Commercial IMSI catcher products exploit vulnerabilities in cellular network security standards to lure nearby mobile devices. Commercial IMSI catcher's technical capabilities and operational details are still kept as a secret and unclearly presented due to t...
Article
Full-text available
Mobile communications are used by more than two-thirds of the world population who expect security and privacy guarantees. The 3rd Generation Partnership Project (3GPP) responsible for the worldwide standardization of mobile communication has designed and mandated the use of the AKA protocol to protect the subscribers’ mobile services. Even though...
Conference Paper
Cellular devices support various technical features and services for 2G, 3G, 4G and upcoming 5G networks. For example, these technical features contain physical layer throughput categories, radio protocol information, security algorithm, carrier aggregation bands and type of services such as GSM-R, Voice over LTE etc. In the cellular security stand...
Conference Paper
Mobile network operators choose Self Organizing Network (SON) concept as a cost-effective method to deploy LTE/4G networks and meet user expectations for high quality of service and bandwidth. The main objective of SON is to introduce automation into network management activities and reduce human intervention. SON enabled LTE networks heavily rely...
Conference Paper
With its high penetration rate and relatively good clock accuracy, smartphones are replacing watches in several market segments. Modern smartphones have more than one clock source to complement each other: NITZ (Network Identity and Time Zone), NTP (Network Time Protocol), and GNSS (Global Navigation Satellite System) including GPS. NITZ informatio...

Citations

... In 5G, the user also obtains the public key of the home network (pk(HN k )), which we also leverage to use Elliptic Curve Integrated Encryption Scheme (ECIES) and the Elliptic Curve Digital Signature Algorithm (ECDSA). Recent research has discussed post-quantum cryptography in the context of mobile networks[145,70,43], and our solution should be compatible by replacing ECIES and ECDSA with the chosen post-quantum algorithms, however, we consider this to be out of the scope of this thesis. ...
... Tools like DoLTEst [25] improve the detection of implementation flaws by concentrating on negative testing with a deterministic oracle derived from specification analysis. BaseSAFE [24] and FIRMWIRE [15] use fuzzing against LTE firmware to discover vulnerabilities, such as buffer overflows, which can then be verified through over-the-air testing. ...
... Library Fuzzing. Fuzzing [6,7,15,16,33,53] is a popular technique for evaluating the security of software and hardware components [14,36] and finding critical vulnerabilities. Different approaches are needed to fuzz complex targets that require wellstructured data types [5,22,25,27,60]. ...
... The main goal of illegal radio base station or IMS catchers is to obtain the IMS information of UEs [201]. So far, there is no mechanism for UE to confirm the legitimacy of a BS in the first connection [202]. Lack of authentication in the first connection of UE to a high power quality BS allows the attacker to create an illegal BS for UE and make UE connect to that BS [203]. ...
... It has also been shown recently that an active attacker may correlate two authentication requests by the same user [25,150]. ...
... 4G/5G Technology: The authors of [22], [23], [5] found missing integrity checks in some network configurations of 4G and early 5G protocols, and demonstrated the feasibility of a MiM. In these attacks, the MiM relays modified information between the mobile and the base station. ...
... Shaik et al. [83] have studied that Self-Organizing Network (SON) to build LTE / 4G lines and meet people's expectations for high service and performance. There is a belief in this region that social media will automatically contribute and address human suffering. ...
... Other activities potentially leading to mobile phone exploitation include the use of smartwatches and wearable accessories, which expose mobile devices to vulnerabilities [101,112]. Furthermore, people frequently hold mobile phone devices with essential data assets [107]. Apparently, users are inclined to download attachments from unknown sources, share their location through social networking sites, and browse the web while monitoring their devices' most recent downloads and interests [92,93,109]. ...