Insecurity of operational cellular IoT service: new vulnerabilities, attacks, and countermeasures

Sihan Wang, Guanhua Tu, Xinyu Lei, Tian Xie, Chi-Yu Li, Poyi Chou, Fucheng Hsieh, Yiwen Hu, Li Xiao, Chunyi Peng

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

7 Scopus citations


More than 150 cellular networks worldwide have rolled out massive IoT services such as smart metering and environmental monitoring. Such cellular IoT services share the existing cellular network architecture with non-IoT (e.g., smartphone) ones. When they are newly integrated into the cellular network, new security vulnerabilities may happen from imprudent integration. In this work, we explore the security vulnerabilities of the cellular IoT from both system-integrated and service-integrated aspects. We discover five vulnerabilities spanning cellular standard design defects, network operation slips, and IoT device implementation flaws. Threateningly, they allow an adversary to remotely identify IP addresses and phone numbers assigned to cellular IoT devices and launch data/text spamming attacks against them. We experimentally validate these vulnerabilities and attacks with three major U.S. IoT carriers. The attack evaluation result shows that the adversary can raise an IoT data bill by up to $226 with less than 120 MB spam traffic and increase an IoT text bill at a rate of $5 per second; moreover, cellular IoT devices may suffer from denial of IoT services. We finally propose, prototype, and evaluate recommended solutions.
Original languageEnglish
Title of host publicationACM MobiCom '21: The 27th Annual International Conference on Mobile Computing and Networking
PublisherAssociation for Computing Machinery
ISBN (Electronic) 9781450383424
StatePublished - Oct 2021


Dive into the research topics of 'Insecurity of operational cellular IoT service: new vulnerabilities, attacks, and countermeasures'. Together they form a unique fingerprint.

Cite this