Collin Mulliner

Background and education

Collin Mulliner is a German computer scientist and security researcher whose work centers on systems, embedded, and mobile security. He earned a B.Sc. in computer science from FH-Darmstadt (University of Applied Sciences) in Germany, and an M.Sc. in computer science from the University of California, Santa Barbara, where his 2006 master's thesis addressed the security of smart phones. He completed a Dr.-Ing. degree at Technische Universitat Berlin in December 2011 with a dissertation titled On the Impact of the Cellular Modem on the Security of Mobile Phones.

His research affiliations span several laboratories: the COSEDA project at Fraunhofer IGD, the Secure Mobile Systems group at Fraunhofer SIT, the Security Lab at UC Santa Barbara, the Security in Telecommunications (SecT) group at TU Berlin and Telekom Innovation Laboratories, and later the Systems Security Lab at Northeastern University in Boston. He was also active in the trifinite.group, a loose association of Bluetooth security researchers, and played periodically on the UC Santa Barbara capture-the-flag team Shellphish.

Early mobile messaging research

Mulliner's earliest published security work targeted mobile messaging and cross-service attacks on smart phones. With Giovanni Vigna, David Dagon, and Wenke Lee, he published "Using Labeling to Prevent Cross-Service Attacks Against Smart Phones" at DIMVA in 2006, and with Vigna he published "Vulnerability Analysis of MMS User Agents" at ACSAC the same year. He presented "Advanced Attacks Against PocketPC Phones" at DEF CON 14 in August 2006 and at the 23rd Chaos Communication Congress that December, and later worked on Symbian OS exploitation, which he presented at Black Hat Japan in October 2008 and at the 25th Chaos Communication Congress.

NFC phone security

In 2008 Mulliner turned to Near Field Communication, then being introduced into consumer handsets. He presented "Attacking NFC Mobile Phones" at EuSecWest in London in May 2008 and again at the 25th Chaos Communication Congress in December 2008, and published "Vulnerability Analysis and Attacks on NFC-enabled Mobile Phones" at the 1st International Workshop on Sensor Security at ARES in 2009. The work showed that NFC tag data, which phones parsed and acted upon automatically, could be abused to trigger unwanted actions and to reach parsing code that had received little scrutiny. Contemporary coverage described it as among the first published attacks against NFC handsets.

SMS fuzzing and the iPhone

Mulliner's best-known research concerns SMS. Rather than sending messages over a live carrier network, he developed a technique for injecting SMS messages directly into a handset from the device side, between the modem and the telephony stack, which made large-scale fuzzing fast, cheap, and free of carrier interference. He and Charlie Miller published the approach as "Injecting SMS Messages into Smart Phones for Security Analysis" at the 3rd USENIX Workshop on Offensive Technologies (WOOT) in Montreal in August 2009.

The pair applied the technique to the iPhone and presented the results at Black Hat USA in Las Vegas in July 2009 in a talk titled "Fuzzing the Phone in your Phone." The research identified a memory-corruption flaw in the iPhone's SMS handling that could be triggered remotely by a sequence of specially crafted messages, giving an attacker control of the device with little or no user interaction. The disclosure attracted wide press attention, including a July 2009 Forbes article headlined "How To Hijack 'Every iPhone In The World'." Mulliner repeated the talk at SEC-T, at Recurity Labs' security symposium, and at the 26th Chaos Communication Congress in December 2009.

SMS of Death and telephony-layer attacks

At TU Berlin, Mulliner extended the messaging work from smartphones to ordinary feature phones. With Nico Golde and Jean-Pierre Seifert he published "SMS of Death: from analyzing to attacking mobile phones on a large scale" at the 20th USENIX Security Symposium in San Francisco in August 2011, after presenting earlier versions at the 27th Chaos Communication Congress in December 2010 and at CanSecWest in March 2011. Using a small self-operated GSM network and second-hand handsets, the researchers found malformed messages that would crash phones from multiple major manufacturers; because networks retry undelivered messages, a crash could recur and keep a device off the network. The work was covered by outlets including Wired, MIT Technology Review, and The Register.

Related work followed on the security consequences of the cellular modem itself. "Taming Mr Hayes: Mitigating Signaling Based Attacks on Smartphones," written with Steffen Liebergeld, Matthias Lange, and Jean-Pierre Seifert, appeared at the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) in Boston in June 2012 and received the William C. Carter Award. With Ravishankar Borgaonkar, Patrick Stewin, and Seifert he published "SMS-based One-Time Passwords: Attacks and Defense" at DIMVA in 2013, examining the weaknesses of SMS as an authentication channel. He also studied privacy leakage in mobile internet access; his 2010 ICIN paper "Privacy Leaks in Mobile Phone Internet Access" received a best paper award, and the underlying issue of operator-injected HTTP headers carrying subscriber phone numbers drew news coverage in 2012.

Android and platform security

At Northeastern University's Systems Security Lab, working with William Robertson and Engin Kirda, Mulliner published a series of papers on Android and operating-system security. "PatchDroid: Scalable Third-Party Security Patches for Android Devices" (ACSAC 2013) addressed the problem of unpatched Android handsets by distributing in-memory patches independent of vendor updates. "Hidden GEMs: Automated Discovery of Access Control Vulnerabilities in Graphical User Interfaces" (IEEE Symposium on Security and Privacy, 2014) examined security controls implemented in GUI logic, and "VirtualSwindle: An Automated Attack Against In-App Billing on Android" appeared at ASIACCS in 2014. He also contributed to PrivExec (Oakland 2013), CuriousDroid (Financial Cryptography 2016), and UNVEIL, a large-scale automated ransomware detection system published at USENIX Security in 2016. His Android instrumentation work was presented as "Android DDI: Dynamic Dalvik Instrumentation" at Hack in the Box and at the 30th Chaos Communication Congress in 2013.

In 2014 he was one of six co-authors of the Android Hacker's Handbook, published by Wiley alongside Joshua J. Drake, Zach Lanier, Pau Oliva, Stephen A. Ridley, and Georg Wicherski. In 2017 he and John Kozyrakis presented "Inside Android's SafetyNet Attestation" at Black Hat Europe in London and at the 34th Chaos Communication Congress, analyzing the attestation service Google used to judge device integrity. He later worked on firmware security automation, releasing the open-source FwAnalyzer tool and presenting "Come Join the CAFSA: Continuous Automated Firmware Security Analysis" at Black Hat USA in August 2019.

Significance

Mulliner's contribution to the history of hacking lies in opening up the telephony stack as a research target. The SMS injection technique removed the practical barriers that had kept researchers from fuzzing messaging code at scale, and the vulnerabilities it exposed, on the iPhone and across a wide range of feature phones, showed that a phone could be attacked through the one interface it cannot refuse. His subsequent work applied the same pattern to NFC, Android runtimes, attestation services, and device firmware, and much of it was released as public tooling rather than kept private, which allowed other researchers to reproduce and extend the findings.

Timeline

• 2003Completed a B.Sc. in computer science at FH-Darmstadt, Germany.
• 2006-06Completed an M.Sc. in computer science at the University of California, Santa Barbara, with a thesis on smart phone security.
• 2006-08Presented "Advanced Attacks Against PocketPC Phones" at DEF CON 14 in Las Vegas.
• 2006-12Published "Vulnerability Analysis of MMS User Agents" with Giovanni Vigna at ACSAC.
• 2008-05Presented "Attacking NFC Mobile Phones" at EuSecWest in London, among the first public attacks on NFC-enabled handsets.
• 2008-10Presented "Exploiting Symbian" at Black Hat Japan in Tokyo.
• 2009-07Presented "Fuzzing the Phone in your Phone" with Charlie Miller at Black Hat USA, disclosing a remotely triggerable SMS vulnerability in the iPhone.
• 2009-08Published "Injecting SMS Messages into Smart Phones for Security Analysis" with Charlie Miller at USENIX WOOT.
• 2010-12Presented the "SMS-o-Death" research with Nico Golde at the 27th Chaos Communication Congress in Berlin.
• 2011-08Published "SMS of Death: from analyzing to attacking mobile phones on a large scale" with Nico Golde and Jean-Pierre Seifert at the 20th USENIX Security Symposium.
• 2011-12Completed a Dr.-Ing. at Technische Universitat Berlin with the thesis "On the Impact of the Cellular Modem on the Security of Mobile Phones".
• 2012-06Received the William C. Carter Award at DSN for "Taming Mr Hayes: Mitigating Signaling Based Attacks on Smartphones".
• 2013-12Published "PatchDroid: Scalable Third-Party Security Patches for Android Devices" at ACSAC with Jon Oberheide, William Robertson, and Engin Kirda.
• 2014-04Co-authored the Android Hacker's Handbook, published by Wiley.
• 2014-05Published "Hidden GEMs: Automated Discovery of Access Control Vulnerabilities in Graphical User Interfaces" at the IEEE Symposium on Security and Privacy.
• 2017-12Presented "Inside Android's SafetyNet Attestation" with John Kozyrakis at Black Hat Europe in London.
• 2019-08Presented "Come Join the CAFSA: Continuous Automated Firmware Security Analysis" at Black Hat USA, covering the FwAnalyzer tool.