Boxed Out: Blocking Cellular Interconnect Bypass Fraud at the Network Edge

Bradley Reaves, Ethan Shernan, Adam Bates, Henry Carter, and Patrick Traynor

Proceedings of the USENIX Security Symposium, 2015

Audio degradation signatures left by VoIP-to-GSM gateways enable network-edge detection of SIMbox interconnect bypass fraud, which costs operators over $2 billion annually.

Abstract

Patrick Traynor University of Florida traynor@cise.ufl.edu these networks requires billions of dollars in capital by providers, and often necessitates government subsidies in poorer nations where such investments may not produce returns for many decades. As a means of maintaining these systems, international calls destined for such networks are often charged a significant tariff, which distributes the costs of critical but expensive cellular infrastructure to callers from around the world. Many individuals seek to avoid such tariffs by any means necessary through a class of attacks known as interconnect bypass fraud. Specifically, by avoiding the regulated network interconnects and instead finding unintended entrances to the provider network, a caller can be connected while dramatically lowering his or her costs. Such fraud constitutes a “free rider” problem, a term from economics in which some participants enjoy the benefits of expensive infrastructure without paying to support it. The most common implementation of interconnect bypass fraud is known as simboxing. Enabled by VoIP GSM gateways (i.e., “simboxes”), simboxing connects incoming VoIP calls to local cellular voice network via a collection of SIM cards and cellular radios. Such calls appear to originate from a customer phone to the network provider and are delivered at the subsidized domestic rate, free of international call tariffs. Interconnection bypass fraud negatively impacts availability, reliability and quality for legitimate consumers by creating network hotspots through the injection of huge volumes of tunneled calls into underprovisioned cells, and costs operators over $2 Billion annually [28]. In this paper, we present Ammit1 , a system for detecting simboxing designed to be deployed in a cellular network. Our solution relies on the fact that audio transmitted over the Internet before being delivered to the GSM network will be degraded in measurable, distinctive ways. We develop novel techniques and build

Citation (IEEE)

B. Reaves, E. Shernan, A. Bates, H. Carter, and P. Traynor, “Boxed Out: Blocking Cellular Interconnect Bypass Fraud at the Network Edge,” in Proceedings of the USENIX Security Symposium, 2015.

BibTeX

@inproceedings{simbox15,
  author = {{Bradley Reaves} and Shernan, Ethan and Bates, Adam and Carter, Henry and Traynor, Patrick},
  booktitle = {Proceedings of the {USENIX} Security Symposium},
  date = {2015-08},
  title = {Boxed Out: Blocking Cellular Interconnect Bypass Fraud at the Network Edge},
}