Preventing messaging attacks

Patent metadata

Field	Value
Publication number	US-9860266-B2
Application number	US-201514922875-A
Country	US
Kind code	B2
Filing date	Oct 26, 2015
Priority date	Oct 26, 2015
Publication date	Jan 2, 2018
Grant date	Jan 2, 2018

Abstract

Systems, methods, and software can be used to prevent messaging attacks. In some aspects, a scanning short message is sent to a UICC associated with a mobile device. A response short message is received in response to the scanning short message. The UICC is determined to be at risk to attacks based on the response short message. In response to determining that the UICC is at risk to attacks, a notification is generated. In some cases, the notification is sent to a DMS. Alternatively or in combination, the notification is displayed on the mobile device. In response to determining that the UICC is at risk to attacks, a firewall application is installed on the mobile device. The firewall application is configured to process an incoming short message addressed to the UICC.

First claim

What is claimed is:

1. A method, comprising:
sending a scanning short message to a Universal Integrated Circuit Card (UICC) associated with a mobile device;
receiving a response short message in response to the scanning short message;
determining that the UICC is at risk to attacks based on the response short message, wherein determining that the UICC is at risk to attacks comprises determining a type of attack that the mobile device is at risk to, and the type of attack is at least one of a premium rate attack or a key compromise attack; and
in response to determining that the UICC is at risk to attacks, generating a notification, wherein generating the notification comprises at least one of sending the notification to a device management system or outputting the notification on the mobile device.

2. The method of claim 1 , further comprising:
in response to determining that the UICC is at risk to attacks, installing a firewall application on the mobile device, wherein the firewall application is configured to process an incoming short message addressed to the UICC.

3. The method of claim 1 , wherein the scanning short message is sent from a device management system.

4. The method of claim 1 , wherein the scanning short message is sent from the mobile device.

5. The method of claim 1 , further comprising:
determining that the response message includes a first non-zero value in a first cryptographic checksum field of the response message;
in response to determining that the response message includes the first non-zero value, sending a second scanning short message to the UICC;
receiving a second response message in response to the second scanning short message; and
determining that the UICC is at risk to a key compromise attack based on the second response message.

6. The method of claim 1 , wherein determining that the UICC is at risk to attacks comprises determining that the UICC is at risk to a premium rate attack, and the scanning short message includes a proof of receipt (PoR) field, wherein the PoR field is set to at least one of ‘01’ or ‘10’.

7. A communication device, comprising:
a memory; and
at least one hardware processor communicatively coupled with the memory and configured to:
send a scanning short message to a Universal Integrated Circuit Card (UICC) associated with a mobile device;
receive a response short message in response to the scanning short message;
determine that the UICC is at risk to attacks based on the response short message, wherein determining that the UICC is at risk to attacks comprises determining a type of attack that the mobile device is at risk to, and the type of attack is at least one of a premium rate attack or a key compromise attack; and
in response to determining that the UICC is at risk to attacks, generate a notification, wherein generating the notification comprises at least one of sending the notification to a device management system or outputting the notification on the mobile device.

8. The communication device of claim 7 , wherein the at least one hardware processor is further configured to:
in response to determining that the UICC is at risk to attacks, install a firewall application on the mobile device, wherein the firewall application is configured to process an incoming short message addressed to the UICC.

9. The communication device of claim 7 , wherein the scanning short message is sent from a device management system.

10. The communication device of claim 7 , wherein the scanning short message is sent from the mobile device.

11. The communication device of claim 7 , wherein the at least one hardware processor is further configured to:
determine that the response message includes a first non-zero value in a first cryptographic checksum field of the response message;
in response to determining that the response message includes the first non-zero value, send a second scanning short message to the UICC;
receive a second response message in response to the second scanning short message; and
determining that the UICC is at risk to a key compromise attack based on the second response message.

12. The communication device of claim 7 , wherein determining that the UICC is at risk to attacks comprises determining that the UICC is at risk to a premium rate attack, and the scanning short message includes a proof of receipt (PoR) field, wherein the PoR field is set to at least one of ‘01’ or ‘10’.

13. A tangible, non-transitory computer-readable medium containing instructions which, when executed, cause a computing device to perform operations comprising:
sending a scanning short message to a Universal Integrated Circuit Card (UICC) associated with a mobile device;
receiving a response short message in response to the scanning short message;
determining that the UICC is at risk to attacks based on the response short message, wherein determining that the UICC is at risk to attacks comprises determining a type of attack that the mobile device is at risk to, and the type of attack is at least one of a premium rate attack or a key compromise attack; and
in response to determining that the UICC is at risk to attacks, generating a notification, wherein generating the notification comprises at least one of sending the notification to a device management system or outputting the notification on the mobile device.

14. The tangible, non-transitory computer-readable medium of claim 13 , the operations further comprising:
in response to determining that the UICC is at risk to attacks, installing a firewall application on the mobile device, wherein the firewall application is configured to process an incoming short message addressed to the UICC.

15. The tangible, non-transitory computer-readable medium of claim 13 , wherein the scanning short message is sent from at least one of a device management system or the mobile device.

16. The tangible, non-transitory computer-readable medium of claim 13 , the operations further comprising:
determining that the response message includes a first non-zero value in a first cryptographic checksum field of the response message;
in response to determining that the response message includes the first non-zero value, sending a second scanning short message to the UICC;
receiving a second response message in response to the second scanning short message; and
determining that the UICC is at risk to a key compromise attack based on the second response message.

17. The tangible, non-transitory computer-readable medium of claim 13 , wherein determining that the UICC is at risk to attacks comprises determining that the UICC is at risk to a premium rate attack, and the scanning short message includes a proof of receipt (PoR) field, wherein the PoR field is set to at least one of ‘01’ or ‘10’.

Assignees

• Blackberry Ltd

Inventors

• Chen Shu-Lin
• Buckley Michael Eoin
• Ali Shirook M
• Anthwal Paritosh

Classifications

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04W88/02

  Terminal devices · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title