Computer Security Applications Conference, Annual (2006)
Miami Beach, Florida, USA
Dec. 11, 2006 to Dec. 15, 2006
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ACSAC.2006.55
Collin Mulliner , University of California, Santa Barbara, USA
Giovanni Vigna , University of California, Santa Barbara, USA
The Multimedia Messaging Service (MMS) is becoming more popular, as mobile phones integrate audio and video recording functionality. Multimedia messages are delivered to users through a multi-step process, whose end-points are the MMS User Agents that reside on the users mobile phones. The security of these components is critical, because they might have access to private information and, if compromised, could be leveraged to spread an MMS-based worm. Unfortunately, the vulnerability analysis of these components is made more difficult by the fact that they are mostly closed-source and the testing has to be performed through the mobile phone network, which makes the testing time-consuming and costly. This paper presents a novel approach to the security testing of MMS User Agents. Our approach takes into account the effects of the infrastructure on the delivery of MMS messages and then uses a virtual infrastructure to speed up the testing process. Our testing approach was able to identify a number of previously unknown vulnerabilities, which, in one case, allowed for the execution of arbitrary code.
Mobile handsets, Testing, Message service, Performance evaluation, Application software, Viruses (medical), Video recording, Information security, Computer worms, Performance analysis
C. Mulliner and G. Vigna, "Vulnerability Analysis of MMS User Agents," 2006 22nd Computer Security Applications Conference(ACSAC), Miami Beach, FL, , pp. 77-88.