All GSM Phones Open To Attack, Tracking 119
Trailrunner7 writes "A pair of security researchers has discovered a number of new attack vectors that give them the ability not only to locate any GSM mobile handset anywhere in the world, but also to find the name of the subscriber associated with virtually any cellular phone number, raising serious privacy and security concerns for customers of all of the major mobile providers. The research builds upon earlier work on geolocation of GSM handsets and exposes a number of fundamental weaknesses in the architecture of mobile providers' networks. However, these are not software or hardware vulnerabilities that can be patched or mitigated with workarounds. Rather, they are features and functionality built into the networks and back-end systems that Bailey and DePetrillo have found ways to abuse in order to discover information that most cell users assume is private and known only to the cell provider."
Cue the standard industry response in 321.... (Score:5, Insightful)
Because you just couldn't allow these methods to remain hidden, you are now responsible for any attacks that take place as a result.
We take our customers security very seriously. As an example, we've ensured these holes have stayed well hidden. Now, you've ruined that. You idiot.
Re: (Score:2)
Please stand over there up against and facing the wall with your hands on the back of your head. Our Lawyers will make every effort to make this as timely and efficient as possible.
Re: (Score:1)
> Because you just couldn't allow these methods to remain hidden, you are now responsible for any attacks that take place as a result.
You are also financially responsible for any lawsuits we may lose because we failed to protect our customers information in a secure fashion.
Re:Cue the standard industry response in 321.... (Score:4, Interesting)
Sadly, I could absolutely agree that such a message is very likely.
I love how all of it hides the fact that if this is public information, obviously the government and other groups which people are concerned even more about, know this information as well.
Re:Cue the standard industry response in 321.... (Score:4, Informative)
Or it was one of the compromises, hidden...remember, some countries participating in the creation of GSM wanted it be more safe, some wanted less safety.
Anyway, at least one part of what TFS says is obviously bullshit - my network doesn't even know my name (prepaid in a place where registration is not required...so nobody does it; not because of some paranoia but because it's the most straightforward thing to (not) do)
Re: (Score:1)
Maybe you purchased it anonymously. When you turned it on and first used it, you initiated data for a profile. Unless you used the phone at random locations, not the residence where you live, then there's no geolocation data. Instead, maybe a camera perched up on a building saw you. That in turn, was cross-matched with other information about you, like when you used your debit card across the street a few minutes later.
What part of lack of privacy didn't you understand?
Re: (Score:3, Informative)
That would be paranoia for you right there... And not something simply under "name" position in mobile carrier profile.
BTW, as is typical you missed the most straightforward method...tracing web of contacts. A phone is usually used to communicate with people, you know.
Re: (Score:2)
The people you phone crossed against the people on your social networking and email lists that you access through your cellular connection/home PC, crossed against the people in your local pub/bar or restaurant and your wifi connection against your unique browser signature against your proxy IP against your username and passwords and against the exact profile of your typing habits. Then against your friends' unique browser signatures and their home/proxy IPs. Then their al
FBI backdoors etc (Score:1, Funny)
About time someone found one of the many government backdoors they build in years ago. Do you expect government worker #84772 to be able to use a complicated secure backdoor? I know I don't, so I expect all the newest routers that the US made firmware updates with backdoors, cell phones everything has stupid obscure easy to use backdoors built into them now. Its a danger and we need to stem and turn this shit around NOW!
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Turn this shit around? With stems? Isn't that called shit-stirring?
I told you they've been tracking me (Score:2)
^%$&^#$&^%$&^% NO CARRIER
Re: (Score:1)
You laugh, but little brother is tossing and turning in his sleep.
Re: (Score:3, Funny)
^%$&^#$&^%$&^% NO CARRIER
Re:I told you they've been tracking me (Score:5, Insightful)
Let this be a lesson to all you would-be "in-the-know"ers out there. Tin foil hats do not cut it anymore. As soon as that became public knowledge, they started putting carbon-nano-fiber-tube-microphones inside any and all newly manufactured tin foil. Here is what you have to do:
Step 1: Throw away your cell phone. That thing is useless.
Step 2: Steal a friend's cell phone. Put tape over any cameras, and take out the battery, and for good measure, disassemble the audio input.
Step 3: Grab a Pickaxe if you have one, but if not, don't sweat it. Don't go out and buy one, that will only leave a trail for them to find you.
Step 4: Start driving to the mountains. Your newly acquired cell phone will let you know once you are out of the 3G network, secretly known as the Government Geological Guidance network. They will think it is your friend visitting the mountains. Only then will you know that they cannot track you.
Step 5: If you don't have a pickaxe, fashion one out of stone and wood. Start mining. Keep going until you get a rather large amount of Nickel. You can go into town to eat and make shipments of nickel. You'll need about 1.6 KG if you're about 6 feet tall.
Step 6: Go and take your nickel to the local blacksmith. He can be trusted, he didn't upgrade like the rest of the world. Have him help you smelt the Nickel. Submerge yourself in liquid Nickel in order to create a faraday cage around yourself.
And there you go, they won't be able to track you anymore.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
feature, not a bug (Score:1)
...
Wasn't it a GSM provider in the US requiring SSN? (Score:1, Offtopic)
Nope (Score:1, Informative)
I've got a T-Mobile prepay card.
Even T-Mobile doesn't know my name, so perhaps these uber-hackers are a bit exaggerating?
Re: (Score:3, Informative)
How in the world did you get from "here's how caller ID maps numbers to name" to "they're transmitting SSNs over the network"?
"Insightful"? Did the moderators not read the story either?
Re:Wasn't it a GSM provider in the US requiring SS (Score:5, Funny)
You must be ne..
tgd (2822)
Er. You must not come around very often.
Scary shit (Score:1, Troll)
This is some scary shit. How long until some celebrity or world leader is abducted, raped, or shot based on this vulnerability?
Re:Scary shit (Score:5, Insightful)
Raise your hand if you think this wasn't already known to and in use by one or more government agencies.
Re:Scary shit (Score:4, Funny)
Sorry. My hand is busy a the moment.
By government agencies, you mean both domestic and foreign. Right? If you think the Russians, Chinese, and North Koreans don't have a complete and up to date list of all cell phones that regularly contact certain towers in Langley, Virginia, please turn in your low Slashdot UIDs.
Re: (Score:2)
Yes, as you observe, Iceland doesn't have a monopoly on smart people with a motive.
Re: (Score:2)
Re: (Score:2)
Regardless, now I want to go and have a chat with the writers of CSI and Numb3rs, because apparently they have some schweet inside info.
Re: (Score:1, Troll)
Troll. Huh?
Re: (Score:2)
Re: (Score:2)
Let's hope the meta-mods straighten this out. Watching this unfold is as creepy as thinking about the original GSM issue.
I have nothing against the iPhone ... I still use my Newton Message Pad 2100, so my 3G phone is an Android. Sort of spreading the goodness around.
(Silently invoking an ancient oriental troll repellent spell.)
Re: (Score:1, Offtopic)
Thanks for the good vibes, and risking your karma by posting with your True Name in response to one of the damned.
BTW, someone is definite removing my karma bonus in addition to slapping troll mods on me. Either that or there's some automatic removal of karma bonuses when two troll mods are given.
One wonders about the shitty ways people use power, then you find someone abusing petty powers like this in your own back yard.
Disappointing.
Sounds like a lot of BS (Score:3, Informative)
The article does not sound credible but like a lot of Bullshit. For example they claim that they are able to lookup the customer name for a given mobile number ("also find the name of the subscriber associated with virtually any cellular phone number"). But they don't explain how they do this. The article just states: "At the heart of the work the pair did is their ability to access the caller ID database mobile providers use to match the names of subscribers to mobile numbers. Then they claim: "This is the same database that contains the subscriber information for landlines", which is simply untrue for many mobile operators who do not even operate landlines. They somewhat suggest that the database in question is the Home Location Register HLR ("Once they accessed the database, known as the Home Location Register (HLR),"), but as you can easily lookup, the HLR does NOT contain the name of a subscriber: http://en.wikipedia.org/wiki/Network_switching_subsystem#Home_Location_Register_.28HLR.29 [wikipedia.org] Now there might be networks where you can lookup the name of a customer given the number, but this is not standard, so claiming they can find the subscribe for "virtually any cellular phone number" is just BS on a great scale. The whole article is loads of gibberish making no much sense. I don't believe any of their sensational claims.
Re: (Score:1, Insightful)
Clearly, you weren't at Source Boston or Quahogcon over the last week to see it in action. Thanks for the FUD.
Re:Sounds like a lot of BS (Score:5, Informative)
So what? The claims are still untrue for at least most GSM networks in the world. This is not FUD but a fact.
The HLR can not be used to lookup the name of a subscriber. Also while the HLR can be queried by operators around the world (as this is needed for roaming), they query it by using the IMSI of the SIM-Card. Wikipedia claims that the MSISDN is another lookup key, but there is no need to make a lookup by MSISDN possible to other operators. When they handle a roaming customer, all they have is their IMSI and they use this to contact the HLR of the operator in charge.
So STFU.
Re:Sounds like a lot of BS (Score:5, Informative)
Why i have such a big problem with this? Because the article makes the reader believe that this is a problem for any GSM user around the world, while it is apparently restricted to countries/networks where such a accessible database exists. The title of the slashdot article also claims "All GSM Phone" which is untrue given this additional information.
Re: (Score:1)
Because everyone knows that the USofA is the entire world :-)
MSISDN is mandatory for 2G (not sure about roaming) but it becomes an optional field in the HLR in LTE/4G
I read the linked article and scratched my head, too - it seems that their attack vector requires access to the HLR for a start, and I can't see that being trivial. Maybe I should go look for the other, more informed articles.
Re: (Score:1)
Re: (Score:1, Interesting)
Actually it's pretty clear in other articles (and this one) that it's just the CallerID database that they're using to get the Cell numbers and the person associated with the cell number. Makes perfect sense to me. I imagine these articles sometimes get things wrong too. The conference they spoke at (Source Boston I believe mentioned in the article) should probably post the slides sooner or later and then you'll know for sure.
Re: (Score:3, Insightful)
Their sensational claim is that they are able to "also find the name of the subscriber associated with virtually any cellular phone number". This is a strong claim and it is a false one. They can find the name of the subscriber if such a CallerID database exists for the network in question and is available for access. This
Re: (Score:3, Informative)
It all makes total sense to me, and as a tech person is actually one of those things I figured was probably the case (the routing
Re: (Score:2)
They tried to pull a Star Trek, thats all.
Re: (Score:2)
The article is BS and overblown. The talk itself was interesting.
The "find the name of the subscriber" bit has to do with the fact that a lot of carriers register the mobile phone subscribers name with the caller ID database. Since most cellphones don't use caller ID and only pair the number with their local address book, you wouldn't notice this unless the cellphone is calling your landline.
They demonstrated a technique to use a VOIP line to call another VOIP line spoofing the calling number (say 555-555
Re: (Score:2)
I should say that I think a lot of the confusion comes in because it was a long talk covering a lot of different related topics, some related some not. There were bits covering calling IMSI info by acting as a tower, determining a phone's carrier by the block of numbers, the caller ID piece and more.
Re: (Score:2)
There was an article earlier today about an attack where they used caller-ID-spoofing techniques to call themselves with a different number. The system then identified the caller, thus revealing their information. I can't seem to find it though. I assume this is a dupe of the same article.
I Have AT&T - Joke's On Them (Score:5, Funny)
My network isn't vulnerable because it's never fucking working.
Re: (Score:1)
I believe that's Denial of Service attack (on your patience :) )
Not really that big of an issue (Score:2)
But no details are given about how they got in. But really, this isn't that much more scary then a phonebook.
Second
Obviously *someone* has to know this stuff (Score:5, Interesting)
I think even the average user understands that the providers have and share such information to manage calls themselves, whether or not it's easily available. And security through obscurity that worked just fine in a landline-only era is wide open when you can listen to the challenge-response over the air. The only question is why anyone other than a telco can get to the databases; OTOH since anyone can be a telco nowadays, that wouldn't help much.
This does demonstrate how a difference of degree becomes a difference of kind, as is so often the case with data mining. When there was noticeable cost to get each piece of information and/or to correlate one set of information against another, it was only worthwhile for a targeted attack. Now when one can get millions of pieces of information and correlate them with minimal effort, scattershot attacks are economically productive. It was never worthwhile to just dial numbers sequentially, because you had to pay living people to do it, until robodialers were created (and permitted to be attached to the phone lines); then suddenly it became an industry.
CDMA (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2, Informative)
In my experience, 3G GSM phones don't do the crazy speaker thing you speak of.
This is God calling... (Score:2)
In fact, don't think on God...think in terrorists, or in the children. Always will be a worse application of this than what you tought.
Re: (Score:2)
The first part of the operation involves getting a target's cell phone number from a public database that links names to numbers for caller ID purposes. DePetrillo used open-source PBX software to spoof the outgoing caller ID and then automated phone calls to himself, triggering the system to force a name lookup.
"We log that information and associate it with a phone number in a (caller ID) database," DePetrillo said. "We c
Re: (Score:2)
"If your phone number is stored in a publically accessible database, along with your real name, people can look it up!"
No shit. And then they threw in a bunch of semi-relevant and a lot of completely bogus technical mumbo-jumbo to make it sound like some breakthrough.
Re: (Score:2)
GSM != CDMA (Score:1)
Re: (Score:1)
Sprint and Cricket are CDMA carriers.
Re: (Score:2)
Don't forget BOOST! and Revol, two pay-as-you-go carriers.
Re: (Score:2)
Sprint and Cricket are both CDMA.
Re: (Score:2)
Re: (Score:1)
The Nextel portion of Sprint is actually GSM.
Re:GSM != iDEN (Score:4, Informative)
The Nextel portion of Sprint is actually GSM.
Wrong again.. Nextel is actually iDEN [wikipedia.org], which is yet another different technology that happens to use a SIM card. Having a SIM card does not make it GSM.
Re: (Score:2)
That's news to me.
Wait a minute? You guys actually have THREE competing mobile carrier technologies in the US?
Re: (Score:2)
Wait a minute? You guys actually have THREE competing mobile carrier technologies in the US?
"Mr. President. The hackers may have cracked GSM and CDMA!"
Smug smile: "Don't worry, there's is another."
Re: (Score:2)
Re: (Score:2)
Four, at least: GSM, CDMA, PCS, iDen. Interestingly, the latter two are provided by the same company. And there's still AMPS floating around in the more thinly-populated parts that still haven't been kicked to some digital format or other yet.
Re: (Score:2)
The differences between iDEN and GSM are primarily on the access side. The network side is GSM, as is most of the access side messaging. The "attack" being described here is on the network side, so that would make Sprint susceptible to the same thing, at least its Nextel customers.
Re: (Score:2)
no the nextel part of sprint is its own separate standard (called Iden) it just uses a "sim card" similar to a GSM phone.
so yes a Nextel World Phone would have 3 different networks builtin (CDMA GSM and Iden)
Re: (Score:1)
Correct...and Sprint has a true 4G network [cnn.com].
"The No. 3 wireless carrier, Sprint Nextel (S, Fortune 500), claims to have a 4G network in place based on a different technology called WiMAX, though WiMAX is actually just an enhanced 3G technology. With more than 50 global carriers pledging to unveil LTE networks, some analysts have speculated that Sprint will likely commit to building its own LTE network in the near future."
Re: (Score:1, Informative)
Sprint does not operate a GSM network any longer; well, not to the general public. They use CDMA, where as GSM is based off of TDMA. I am not sure if Sprint still uses PCS, but PCS can operate on GSM(TDMA), CDMA, and D-AMPS and I believe that Sprint had their PCS network operating on GSM in some areas.
Some people might think that Verizon is included because they are switching to UMTS for their "4G" network. The fact is that the version of UMTS AT&T uses is based off of CDMA(W-CDMA is most common). I
Most? (Score:2)
If anyone using a cellphone doesn't understand Caller-ID, or that the entire system is based on knowing where your phone is (to wtihin the range of a given tower), then they're probably not worthy of having privacy.
Being able to find someone's name and location is not exactly a privacy issue.
Next thing you know, the nuffers will be posting stories about the privacy implications of the Marauder's Map.
Re: (Score:2)
No, it's a security issue. Just ask anyone who has ever been stalked or had a crazy homicidal ex if they would like to have their stalker know where they are 24/7.
This Astroturfing Article broght to you by... (Score:2)
Discussing this isn't really constructive. (Score:2)
Found an interview with some more details here, though: http://news.cnet.com/8301-27080_3-20002986-245.html [cnet.com]
Re:No details on the attack (Score:2)
All this article is pretty unclear about the attack method described.
All it says is that they supposedly find ways to tap in APIs that associate GSM phone numbers with names. I am not sure that such API are standardized.
Then they say that IF you have direct access to SS7 network and you are able to query the HLR, you are able to track down people (because you are able to get the attachement MSC and possibily the Cell ID using the MAP protocol).
This IF is a big IF. They did not demonstre haw you may break in
Re: (Score:2)
"Only telecom providers are supposed to have access to the location register, but small telcos in the EU are offering online access to it for a fee, mostly to companies using it for marketing data and cost projections, according to DePetrillo."
Re: (Score:2)
The interview stated QUITE CLEARLY that many smaller European telcos are selling access to the HLR. There you go.
Failing that, it's not NEARLY as hard as you might think to be granted legal access to the SS7 network these days. All you have to do is get into the calling card business (consider all those calling cards from companies you've never heard of) VoIP business, or get a PBX. It's not something every individual would do, but it's well within the reach of a private detective or slimeball marketing fir
All your phones... (Score:1)
...are belong to us.
Sometimes I've got to wonder (Score:2)
If you carry a cell phone - you're carrying a radio transmitter that broadcasts its serial number to any interested receiver. That serial number is directly tied to your account at the cell service provider; name, address, bank info, you name it. This is just the way things are.
So what's with the dog and pony show from some writer that doesn't know what he's talking about? And finding the name that goes with a phone number isn't what you should be worried about - consider instead that your friendly governm
Re: (Score:2)
I'm not trolling, I'm just saying this is the way things are designed and in fact, I've heard at least a couple stories where 911 operators have had and exercised the option to triangulate a cell signal to determine someone's whereabouts (could be urban legend, I dunno). Doing all that in the time needed for emergency service? Location info sounds pretty freely accessible to go
it's trivial to have an untraceable GSM phone (Score:1)
OMFG they are goingto find you... (Score:1)
Re: (Score:1, Informative)
Good for you!
A warning, though. Those burgers are someday going to be flipped by a machine.