  Mobile Internet is becoming the norm. With more personalized mobile devices
in hand, many services choose to offer alternative, usually more convenient,
approaches to authenticating and delivering the content between mobile users
and service providers. One main option is to use SMS (i.e., short messaging
service). Such carrier-grade text service has been widely used to assist
versatile mobile services, including social networking, banking, to name a few.
Though the text service can be spoofed via certain Internet text service
providers which cooperated with carriers, such attacks haven well studied and
defended by industry due to the efforts of research community. However, as
cellular network technology advances to the latest IP-based 4G LTE, we find
that these mobile services are somehow exposed to new threats raised by this
change, particularly on 4G LTE Text service (via brand-new distributed
Mobile-Initiated Spoofed SMS attack which is not available in legacy 2G/3G
systems). The reason is that messaging service over LTE shifts from the
circuit-switched (CS) design to the packet-switched (PS) paradigm as 4G LTE
supports PS only. Due to this change, 4G LTE Text Service becomes open to
access. However, its shields to messaging integrity and user authentication are
not in place. As a consequence, such weaknesses can be exploited to launch
attacks (e.g., hijack Facebook accounts) against a targeted individual, a large
scale of mobile users and even service providers, from mobile devices. Current
defenses for Internet-Initiated Spoofed SMS attacks cannot defend the
unprecedented attack. Our study shows that 53 of 64 mobile services over 27
industries are vulnerable to at least one threat. We validate these
proof-of-concept attacks in one major US carrier which supports more than 100
million users. We finally propose quick fixes and discuss security insights and
lessons we have learnt.
