Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
US researchers have developed a cheap and simple method for tracking the location of GSM mobile phones.
Mobile carriers typically transmit unencrypted signals between GSM towers and phones to determine location. This is required for phone services to be provisioned.
But the new research has revealed that anyone running the open source Osmocom GSM software could use the same functionality to determine whether or not a mobile phone is in an area of between one and 100 square kilometers.
“Agents from an oppressive regime may no longer require cooperation from reluctant service providers to determine if dissidents are at a protest location,” Denis Foo Kune, computer science PhD student with the University of Minnesota, wrote in a paper.
“Another example could be thieves testing if a user’s cell phone is absent from a specific area and therefore deduce the risk level associated with a physical break-in of the victim’s residence.”
Researchers from the university’s science and engineering college tracked the location of a test subject within 800 metres as they walked through a CBD, without help from a phone provider.
To do this, attackers would dial a target’s mobile phone number from a mobile phone connected to a laptop.
Osmocom software on the laptop would monitor the relevant GSM network tracking signals and reveal the Location Area Code (LAC) of the target phone.
An attacker then re-dials the phone from within the LAC to pinpoint the base station which the user is connected to.
Provided the attacker hangs up within five seconds, the tracking will complete without the target’s phone ringing.
Foo Kune explained that GSM networks needed to "loosly track" phones in a similar fashion to CB radio.
“An incoming voice call requires the network to locate that device so it can allocate the appropriate resources to handle the call," he said.
"Your cell phone network has to at least loosely track your phone within large regions in order to make it easy to find it.”
The research was described in the paper “Location Leaks on the GSM Air Interface” presented at the Network & Distributed System Security Symposium in California.
The research group informed US carrier AT&T and Nokia about cheap mitigation techniques that do not require hardware changes.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.