14 DAY TRIAL // A new research published last week reveals that a malicious attacker would only need 6,000 smartphones to launch a distributed denial of service (DDoS) attack against a US state's 911 service.
The attacker can knock the 911 service offline by placing simultaneous calls from the botnet's devices to emergency numbers.
The researchers that came up with this scenario say this can be done by infecting smartphones with malware, or by buying the smartphones needed to carry out the attack, which would only cost $100,000, a small sum for state-sponsored attackers.
Attack can be scaled to shut down 911 services across the US
The attack can also be scaled to target the entire US 911 service, but the attacker would need to control a botnet of 200,000 devices, which is hard to accomplish in a small time period, but doable. This would also cost the attacker around $3.4 million, if he decides to buy the devices instead of infecting them.
Attacking 911 call centers is possible because mobile carriers reroute these calls to a nearby Public Safety Answering Point (PSAP) without verifying the caller's identity or subscriber status.
An attacker can place calls to specific PSAP centers with spoofed identities and flood the emergency center with what's called a TDoS, or a telephony denial of service attack.
TDoS attacks during national emergencies would be easy to carry out
The attack can be more effective if coordinated during the time of day when 911 call centers are usually under stress, or during real world disasters.
Call redialing means that devices can be reused until the attack is detected and attacking bots blacklisted. This countermeasure on behalf of 911 services can be skirted by hiding IMEI and IMSI information. Researchers say this can be done by placing malware within the baseband firmware of a mobile device.
The hardest part of the attack would be to map all PSAP centers across the US. At the end of December 2015, the FCC listed minimal information on 7,227 PSAP centers across the US.
The researcher paper titled 9-1-1 DDoS: Threat, Analysis and Mitigation offers more information about the attack and possible mitigation procedures for US authorities. The study was put together by scientists from the Cyber-Security Research Center at the Ben-Gurion University of the Negev in Israel.