Ghost Traffic: ICMP Tunneling-Based Billing Bypass in LTE Networks

• URL: http://arxiv.org/abs/2607.04783v1
• Date: Mon, 06 Jul 2026 08:12:53 GMT
• Title: Ghost Traffic: ICMP Tunneling-Based Billing Bypass in LTE Networks
• Abstract summary: Some cellular ISPs treat ICMP echo traffic as control traffic rather than user data and exclude it from billing.<n>Android allows ordinary applications to create ICMP echo sockets without root privileges because of an unsafe default configuration.<n>This paper proposes Ghost Traffic, an end-to-end system that uses Android's VpnService to encapsulate all application traffic into ICMP echo payloads without root privileges.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Cellular data billing is a core operational mechanism for mobile Internet service providers (ISPs), and a policy gap that excludes a specific protocol from usage accounting can lead to a practical security threat. Some cellular ISPs treat ICMP echo traffic as control traffic rather than user data and exclude it from billing. At the same time, Android allows ordinary applications to create ICMP echo sockets without root privileges because of an unsafe default configuration, and the combination of these two conditions forms a vulnerability that can bypass data billing. Existing billing-bypass attacks either require root privileges to create raw sockets and modify routing tables, or do not provide an end-to-end implementation that works in a non-rooted environment, which limits the threat to a small group of experts. This paper proposes Ghost Traffic, an end-to-end system that uses Android's VpnService to encapsulate all application traffic into ICMP echo payloads without root privileges and route it through an external proxy server. The proposed system targets both public IPv4 environments and IPv6-only LTE environments through two variants: IPv4 ICMP tunneling and IPv4-over-IPv6 ICMP tunneling. We evaluated its applicability in seven ISP environments in South Korea, Japan, and the United States, and observed end-to-end tunneling in six of them. We observed that billing bypass occurred in multiple environments and quantitatively showed this effect by measuring that Quality of Service (QoS) throttling was not applied even after the data cap was exhausted. Finally, we propose layered countermeasures across the device, platform, and network levels, performed responsible disclosure, and show that the operational practice of not billing ICMP traffic can lead to practical billing bypass.

Related papers

• QUIC-TRIP: A Triple-Redundant Journey Toward Secure Substation Communications [1.9906945320988176]
  This paper introduces QUIC-TRIP, a transparent security methodology for low-latency IP-based industrial communications.<n>We evaluate the resilience of QUIC-TRIP multipath communication under DoS flooding by securing R-GOOSE communications.
  arXiv  Detail & Related papers  (2026-07-29T01:28:36Z)
• Deploying and validating a metropolitan QKD secure network: architecture and field performance [76.02413102965598]
  Quantum Key Distribution provides information-theoretic security for key establishment.<n>A metropolitan-scale quantum-secure network between data centers in Milan is reported.<n>Results establish the technical and operational readiness of metropolitan QKD networks for production deployment.
  arXiv  Detail & Related papers  (2026-07-13T15:51:26Z)
• ShieldShare: Building a VPN-backed Android Hotspot for Secure Internet Sharing with Per-User Traffic Accounting [1.3318960669670048]
  ShieldShare is a proxy-based Android application that enables secure VPN-backed hotspot sharing with per-user traffic accounting.<n>This enables affordable, community-controlled secure access in censored or high-surveillance environments.
  arXiv  Detail & Related papers  (2026-05-02T18:40:37Z)
• PrismWF: A Multi-Granularity Patch-Based Transformer for Robust Website Fingerprinting Attack [45.608550871415]
  Tor is a low-latency anonymous communication network that protects user privacy by encrypting website traffic.<n>Recent website fingerprinting (WF) attacks have shown that encrypted traffic can still leak users' visited websites by exploiting statistical features such as packet size, direction, and inter-arrival time.<n>We propose PrismWF, a multi-granularity patch-based Transformer for multi-tab WF attack.
  arXiv  Detail & Related papers  (2026-03-22T08:17:03Z)
• ChamaleoNet: Programmable Passive Probe for Enhanced Visibility on Erroneous Traffic [48.87214752144106]
  ChamaleoNet transforms any production network into a transparent monitor to let administrators collect unsolicited and erroneous traffic directed to hosts.<n>ChamaleoNet is programmed to ignore well-formed traffic and collect only erroneous packets.<n>Simple analytics unveil internal and infected hosts, identify temporary failures, and enhance visibility on external radiation produced by attackers looking for vulnerable services.
  arXiv  Detail & Related papers  (2025-08-17T20:54:41Z)
• QUIC-Exfil: Exploiting QUIC's Server Preferred Address Feature to Perform Data Exfiltration Attacks [0.259990372084357]
  We show the feasibility of a QUIC-based data exfiltration attack using the server preferred address feature of the QUIC protocol.<n>A novel method leveraging the server preferred address feature of the QUIC protocol allows an attacker to exfiltrate sensitive data from an infected machine to a malicious server.<n>The attack is implemented as a proof of concept tool in Rust.
  arXiv  Detail & Related papers  (2025-05-08T14:31:28Z)
• Intelligent Detection of Non-Essential IoT Traffic on the Home Gateway [45.70482328441101]
  This work presents ML-IoTrim, a system for detecting and mitigating non-essential IoT traffic by analyzing network behavior at the edge.<n>We test our framework in a consumer smart home setup with IoT devices from five categories, demonstrating that the model can accurately identify and block non-essential traffic.<n>This research advances privacy-aware traffic control in smart homes, paving the way for future developments in IoT device privacy.
  arXiv  Detail & Related papers  (2025-04-22T09:40:05Z)
• Saflo: eBPF-Based MPTCP Scheduler for Mitigating Traffic Analysis Attacks in Cellular Networks [5.449956884943377]
  Saflo scheduler employs multipath communication combined with additional security-related tasks.<n>It significantly reduces the accuracy of video identification and user identification attacks in cellular networks.
  arXiv  Detail & Related papers  (2025-02-06T17:20:07Z)
• Toward Mixture-of-Experts Enabled Trustworthy Semantic Communication for 6G Networks [82.3753728955968]
  We introduce a novel Mixture-of-Experts (MoE)-based SemCom system. This system comprises a gating network and multiple experts, each specializing in different security challenges. The gating network adaptively selects suitable experts to counter heterogeneous attacks based on user-defined security requirements. A case study in vehicular networks demonstrates the efficacy of the MoE-based SemCom system.
  arXiv  Detail & Related papers  (2024-09-24T03:17:51Z)
• SISSA: Real-time Monitoring of Hardware Functional Safety and Cybersecurity with In-vehicle SOME/IP Ethernet Traffic [49.549771439609046]
  We propose SISSA, a SOME/IP communication traffic-based approach for modeling and analyzing in-vehicle functional safety and cyber security. Specifically, SISSA models hardware failures with the Weibull distribution and addresses five potential attacks on SOME/IP communication. Extensive experimental results show the effectiveness and efficiency of SISSA.
  arXiv  Detail & Related papers  (2024-02-21T03:31:40Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)
• Tamper-Evident Pairing [55.2480439325792]
  Tamper-Evident Pairing (TEP) is an improvement of the Push-Button configuration (PBC) standard. TEP relies on the Tamper-Evident Announcement (TEA), which guarantees that an adversary can neither tamper a transmitted message without being detected, nor hide the fact that the message has been sent. This paper provides a comprehensive overview of the TEP protocol, including all information needed to understand how it works.
  arXiv  Detail & Related papers  (2023-11-24T18:54:00Z)
• Breaking On-Chip Communication Anonymity using Flow Correlation Attacks [2.977255700811213]
  We develop and perform a machine learning (ML)-based flow correlation attack on existing anonymous routing techniques in Network-on-Chip (NoC) systems.<n>We propose a novel, lightweight anonymous routing protocol featuring outbound traffic tunneling and traffic obfuscation.<n>This protocol is designed to provide robust defense against ML-based flow correlation attacks, ensuring both packet-level and flow-level anonymity.
  arXiv  Detail & Related papers  (2023-09-27T14:32:39Z)
• SoS-RPL: Securing Internet of Things Against Sinkhole Attack Using RPL Protocol-Based Node Rating and Ranking Mechanism [1.2691047660244335]
  IoTs are endowed with particular routing disobedience called sinkhole attack owing to their distributed features. In these attacks, a malicious node broadcasts illusive information regarding the routings to impose itself as a route towards specific nodes for the neighboring nodes and thus, attract data traffic. In this paper, the technique is assessed through wide simulations performed within the NS-3 environment. Based on the results of the simulation, it is indicated that the IoT network behavior metrics are enhanced based on the detection rate, false-negative rate, false-positive rate, packet delivery rate, maximum throughput, and packet loss rate.
  arXiv  Detail & Related papers  (2020-05-17T09:26:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.