400,000 infected phones is enough to take down America’s 911 system

Attackers could severely disrupt America’s 911 system, a new report suggests. A botnet of 400,000 infected phones could basically disable 911 nationwide. All the infected phones would have to do is call 911, constantly, and eventually wait times would get so bad most people with legitimate emergencies would hang up rather than wait.

Emergency phone services don’t currently have a blacklist system, meaning that if a phone calls 911 constantly there’s no way for emergency services to block that caller. In a way, this makes sense: you don’t want to cut anyone off from an essential service, and people with infected phones could still need 911 for real someday. But this simple fact makes the 911 system vulnerable, which is a problem.

A paper from the Ben-Gurion Univerisity of the Negev outlines the sceneario:

In 2015 over 90% of American adults owned a cell phone, and 64% of the devices were smartphones. An attacker that recruits even a fraction of these devices to a botnet would give
this attacker has the potential to deny 911 services to an entire state, or possibly the entire country.

The report makes clear the importance of mobile security. Infected phones don’t just put individual users at risk: they potentially threaten the safety of an entire state, or even country.

And if attackers only want to disable 911 in a single state, it’s even easier. 6,000 phones is enough to take out emergency services in a state like North Carolina.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!

The paper outlines a few ways to make such attacks less likely. The first is for 911 services to stop accepting calls from cell phones that don’t have a phone plan associated with them, though this could harm people who rely on such phones for emergencies. Another plan is to implement systems that detect humans, though the stakes for false positives here would be really high, so it’s essential the system be flawless. Other options include making a blocklist of callers, or for police to round up and seize infected phones. You can see why none of these plans would be easy to implement, or popular politically.

Meanwhile most Android users are running an out-of-date version of their operating system because carriers don’t support phones for longer than a year or two. If someone wants to cause trouble, that’s a wide open gate. Someone needs to start thinking about this.