Data traffic flowing through the network may be hijacked and may become vehicles for malicious content abusing the operator’s network.

The operator’s connections to data sources both external (public and private internet) and internal (handset device on the carrier’s network, hosted content servers) need to be monitored, as a threat can arise from both fronts.

Threats could be attacks on gateway/proxy servers, further leading to cache poisoning attacks, hijacking attacks and redirection attacks. Attacks can also be in the form of flooding DoS with malicious streams of data attacking a mobile from an attached network interface (eg. wireless) and Flooding Multi-Media Messaging (MMS) attacks.