Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Cellphones Privacy Security

All GSM Phones Open To Attack, Tracking 119

Trailrunner7 writes "A pair of security researchers has discovered a number of new attack vectors that give them the ability not only to locate any GSM mobile handset anywhere in the world, but also to find the name of the subscriber associated with virtually any cellular phone number, raising serious privacy and security concerns for customers of all of the major mobile providers. The research builds upon earlier work on geolocation of GSM handsets and exposes a number of fundamental weaknesses in the architecture of mobile providers' networks. However, these are not software or hardware vulnerabilities that can be patched or mitigated with workarounds. Rather, they are features and functionality built into the networks and back-end systems that Bailey and DePetrillo have found ways to abuse in order to discover information that most cell users assume is private and known only to the cell provider."
This discussion has been archived. No new comments can be posted.

All GSM Phones Open To Attack, Tracking

Comments Filter:
  • by ravenspear ( 756059 ) on Monday April 26, 2010 @02:52PM (#31987402)
    Our attorneys will be contacting you shortly for exposing these methods and invalidating our security through obscurity SOP.

    Because you just couldn't allow these methods to remain hidden, you are now responsible for any attacks that take place as a result.

    We take our customers security very seriously. As an example, we've ensured these holes have stayed well hidden. Now, you've ruined that. You idiot.
    • Please stand over there up against and facing the wall with your hands on the back of your head. Our Lawyers will make every effort to make this as timely and efficient as possible.

    • > Because you just couldn't allow these methods to remain hidden, you are now responsible for any attacks that take place as a result.

      You are also financially responsible for any lawsuits we may lose because we failed to protect our customers information in a secure fashion.

    • by poetmatt ( 793785 ) on Monday April 26, 2010 @03:21PM (#31987850) Journal

      Sadly, I could absolutely agree that such a message is very likely.

      I love how all of it hides the fact that if this is public information, obviously the government and other groups which people are concerned even more about, know this information as well.

    • by sznupi ( 719324 ) on Monday April 26, 2010 @03:42PM (#31988172) Homepage

      Or it was one of the compromises, hidden...remember, some countries participating in the creation of GSM wanted it be more safe, some wanted less safety.

      Anyway, at least one part of what TFS says is obviously bullshit - my network doesn't even know my name (prepaid in a place where registration is not required...so nobody does it; not because of some paranoia but because it's the most straightforward thing to (not) do)

      • Maybe you purchased it anonymously. When you turned it on and first used it, you initiated data for a profile. Unless you used the phone at random locations, not the residence where you live, then there's no geolocation data. Instead, maybe a camera perched up on a building saw you. That in turn, was cross-matched with other information about you, like when you used your debit card across the street a few minutes later.

        What part of lack of privacy didn't you understand?

        • Re: (Score:3, Informative)

          by sznupi ( 719324 )

          That would be paranoia for you right there... And not something simply under "name" position in mobile carrier profile.

          BTW, as is typical you missed the most straightforward method...tracing web of contacts. A phone is usually used to communicate with people, you know.

          • Do you not understand data mining?
            The people you phone crossed against the people on your social networking and email lists that you access through your cellular connection/home PC, crossed against the people in your local pub/bar or restaurant and your wifi connection against your unique browser signature against your proxy IP against your username and passwords and against the exact profile of your typing habits. Then against your friends' unique browser signatures and their home/proxy IPs. Then their al
  • by Anonymous Coward

    About time someone found one of the many government backdoors they build in years ago. Do you expect government worker #84772 to be able to use a complicated secure backdoor? I know I don't, so I expect all the newest routers that the US made firmware updates with backdoors, cell phones everything has stupid obscure easy to use backdoors built into them now. Its a danger and we need to stem and turn this shit around NOW!

    • by zill ( 1690130 )
      I give this thread 2 more minutes before it gets deleted through the Slashdot backdo{#`%${%&`+'${`%&NO CARRIER
    • You realize that GSM is not the dominant Cell phone system in the US, like it is in the rest of the world?
    • Its a danger and we need to stem and turn this shit around NOW!

      Turn this shit around? With stems? Isn't that called shit-stirring?

  • They're following me and reading my thoughts. They're in it with the Scientologists and Starbucks and Major League Baseball. And the Freemasons. And Goo

    ^%$&^#$&^%$&^% NO CARRIER
    • You laugh, but little brother is tossing and turning in his sleep.

      • Re: (Score:3, Funny)

        I'm not trying to be funny, I'm trying to warn everyone about the real danger that Goo

        ^%$&^#$&^%$&^% NO CARRIER
    • by Monkeedude1212 ( 1560403 ) on Monday April 26, 2010 @03:24PM (#31987898) Journal

      Let this be a lesson to all you would-be "in-the-know"ers out there. Tin foil hats do not cut it anymore. As soon as that became public knowledge, they started putting carbon-nano-fiber-tube-microphones inside any and all newly manufactured tin foil. Here is what you have to do:

      Step 1: Throw away your cell phone. That thing is useless.

      Step 2: Steal a friend's cell phone. Put tape over any cameras, and take out the battery, and for good measure, disassemble the audio input.

      Step 3: Grab a Pickaxe if you have one, but if not, don't sweat it. Don't go out and buy one, that will only leave a trail for them to find you.

      Step 4: Start driving to the mountains. Your newly acquired cell phone will let you know once you are out of the 3G network, secretly known as the Government Geological Guidance network. They will think it is your friend visitting the mountains. Only then will you know that they cannot track you.

      Step 5: If you don't have a pickaxe, fashion one out of stone and wood. Start mining. Keep going until you get a rather large amount of Nickel. You can go into town to eat and make shipments of nickel. You'll need about 1.6 KG if you're about 6 feet tall.

      Step 6: Go and take your nickel to the local blacksmith. He can be trusted, he didn't upgrade like the rest of the world. Have him help you smelt the Nickel. Submerge yourself in liquid Nickel in order to create a faraday cage around yourself.

      And there you go, they won't be able to track you anymore.

  • I seem to recall a discussion some time ago involving a carrier - I think it was T-Mobile - who did not want to do business with anyone who wouldn't give them their SSN. Now we find that information is carried openly on the network?
  • Scary shit (Score:1, Troll)

    by wurp ( 51446 )

    This is some scary shit. How long until some celebrity or world leader is abducted, raped, or shot based on this vulnerability?

    • Re:Scary shit (Score:5, Insightful)

      by bugi ( 8479 ) on Monday April 26, 2010 @03:04PM (#31987584)

      Raise your hand if you think this wasn't already known to and in use by one or more government agencies.

      • by PPH ( 736903 ) on Monday April 26, 2010 @03:32PM (#31988030)

        Sorry. My hand is busy a the moment.

        By government agencies, you mean both domestic and foreign. Right? If you think the Russians, Chinese, and North Koreans don't have a complete and up to date list of all cell phones that regularly contact certain towers in Langley, Virginia, please turn in your low Slashdot UIDs.

        • by bugi ( 8479 )

          Yes, as you observe, Iceland doesn't have a monopoly on smart people with a motive.

      • by yerM)M ( 720808 )
        I'm not worried, given the speed at which my battery drains, this should reduce the attack vector considerably.
      • How could it not be known yet used by one or more government agencies?

        Regardless, now I want to go and have a chat with the writers of CSI and Numb3rs, because apparently they have some schweet inside info.
    • Re: (Score:1, Troll)

      by wurp ( 51446 )

      Troll. Huh?

      • Yeah, you got fucked on that one
  • by kju ( 327 ) on Monday April 26, 2010 @03:03PM (#31987572)

    The article does not sound credible but like a lot of Bullshit. For example they claim that they are able to lookup the customer name for a given mobile number ("also find the name of the subscriber associated with virtually any cellular phone number"). But they don't explain how they do this. The article just states: "At the heart of the work the pair did is their ability to access the caller ID database mobile providers use to match the names of subscribers to mobile numbers. Then they claim: "This is the same database that contains the subscriber information for landlines", which is simply untrue for many mobile operators who do not even operate landlines. They somewhat suggest that the database in question is the Home Location Register HLR ("Once they accessed the database, known as the Home Location Register (HLR),"), but as you can easily lookup, the HLR does NOT contain the name of a subscriber: http://en.wikipedia.org/wiki/Network_switching_subsystem#Home_Location_Register_.28HLR.29 [wikipedia.org] Now there might be networks where you can lookup the name of a customer given the number, but this is not standard, so claiming they can find the subscribe for "virtually any cellular phone number" is just BS on a great scale. The whole article is loads of gibberish making no much sense. I don't believe any of their sensational claims.

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      Clearly, you weren't at Source Boston or Quahogcon over the last week to see it in action. Thanks for the FUD.

      • by kju ( 327 ) on Monday April 26, 2010 @03:13PM (#31987722)

        So what? The claims are still untrue for at least most GSM networks in the world. This is not FUD but a fact.

        The HLR can not be used to lookup the name of a subscriber. Also while the HLR can be queried by operators around the world (as this is needed for roaming), they query it by using the IMSI of the SIM-Card. Wikipedia claims that the MSISDN is another lookup key, but there is no need to make a lookup by MSISDN possible to other operators. When they handle a roaming customer, all they have is their IMSI and they use this to contact the HLR of the operator in charge.

        So STFU.

        • by igy ( 908081 )
          That's not strictly true; for SMS delivery the message sent to the HLR is routed via the MSISDN, because the other network will only have the MSISDN at this point (i.e they only know what they typed into your phone when sending the message, it's up to the HLR to provide the recipient's MSC address and IMSI so the message can be delivered)
    • Re: (Score:1, Interesting)

      by Anonymous Coward

      Actually it's pretty clear in other articles (and this one) that it's just the CallerID database that they're using to get the Cell numbers and the person associated with the cell number. Makes perfect sense to me. I imagine these articles sometimes get things wrong too. The conference they spoke at (Source Boston I believe mentioned in the article) should probably post the slides sooner or later and then you'll know for sure.

      • Re: (Score:3, Insightful)

        by kju ( 327 )

        Actually it's pretty clear in other articles (and this one) that it's just the CallerID database that they're using to get the Cell numbers and the person associated with the cell number.

        Their sensational claim is that they are able to "also find the name of the subscriber associated with virtually any cellular phone number". This is a strong claim and it is a false one. They can find the name of the subscriber if such a CallerID database exists for the network in question and is available for access. This

    • Re: (Score:3, Informative)

      Well, I didn't read this article, but I did read the article LAST week when /. posted this same story. My understanding was these folks spoof the number in question and use that to access 'xyz' database with the name info. Once you've got the name and phone number info, you can use the small European telcos to use the location service and determine roughly where someone is.

      It all makes total sense to me, and as a tech person is actually one of those things I figured was probably the case (the routing
    • They tried to pull a Star Trek, thats all.

    • The article is BS and overblown. The talk itself was interesting.

      The "find the name of the subscriber" bit has to do with the fact that a lot of carriers register the mobile phone subscribers name with the caller ID database. Since most cellphones don't use caller ID and only pair the number with their local address book, you wouldn't notice this unless the cellphone is calling your landline.

      They demonstrated a technique to use a VOIP line to call another VOIP line spoofing the calling number (say 555-555

      • I should say that I think a lot of the confusion comes in because it was a long talk covering a lot of different related topics, some related some not. There were bits covering calling IMSI info by acting as a tower, determining a phone's carrier by the block of numbers, the caller ID piece and more.

    • by MobyDisk ( 75490 )

      There was an article earlier today about an attack where they used caller-ID-spoofing techniques to call themselves with a different number. The system then identified the caller, thus revealing their information. I can't seem to find it though. I assume this is a dupe of the same article.

  • by sexconker ( 1179573 ) on Monday April 26, 2010 @03:04PM (#31987578)

    My network isn't vulnerable because it's never fucking working.

  • Looks like this can be broken into three parts. First

    Once they accessed the database, known as the Home Location Register (HLR), the researchers are able to determine which mobile provider a given subscriber uses, and then combine that with the caller ID data, giving them a profile of the subscriber.

    But no details are given about how they got in. But really, this isn't that much more scary then a phonebook.

    They can spoof someone's mobile number, dial that same number using this dialing technique, a

  • by DutchUncle ( 826473 ) on Monday April 26, 2010 @03:09PM (#31987664)
    >>>This is a correlation that most mobile subscribers think isn't possible because there isn't a public white pages directory of mobile numbers.

    I think even the average user understands that the providers have and share such information to manage calls themselves, whether or not it's easily available. And security through obscurity that worked just fine in a landline-only era is wide open when you can listen to the challenge-response over the air. The only question is why anyone other than a telco can get to the databases; OTOH since anyone can be a telco nowadays, that wouldn't help much.

    This does demonstrate how a difference of degree becomes a difference of kind, as is so often the case with data mining. When there was noticeable cost to get each piece of information and/or to correlate one set of information against another, it was only worthwhile for a targeted attack. Now when one can get millions of pieces of information and correlate them with minimal effort, scattershot attacks are economically productive. It was never worthwhile to just dial numbers sequentially, because you had to pay living people to do it, until robodialers were created (and permitted to be attached to the phone lines); then suddenly it became an industry.
  • CDMA (Score:2, Interesting)

    by teknopurge ( 199509 )
    well well, how the tables have turned!
  • If this get wide actively exploited we will see how will be built Babel Tower 2.0, using only social engineering.

    In fact, don't think on God...think in terrorists, or in the children. Always will be a worse application of this than what you tought.
  • I like how they list GSM and imply all carriers in the US when the largest GSM providers are AT&T, T-Mobile, Sprint and Cricket. The CDMA networks are Verizon and Alltel. Of course, the're now one in the same since Verizon bought Alltel a year or so ago.
    • by hoxford ( 94613 )

      Sprint and Cricket are CDMA carriers.

    • Sprint and Cricket are both CDMA.

    • by PRMan ( 959735 )
      I like how you imply that Sprint is GSM when they are CDMA...
      • The Nextel portion of Sprint is actually GSM.

        • Re:GSM != iDEN (Score:4, Informative)

          by Christophotron ( 812632 ) on Monday April 26, 2010 @04:17PM (#31988562)

          The Nextel portion of Sprint is actually GSM.

          Wrong again.. Nextel is actually iDEN [wikipedia.org], which is yet another different technology that happens to use a SIM card. Having a SIM card does not make it GSM.

          • by he-sk ( 103163 )

            That's news to me.

            Wait a minute? You guys actually have THREE competing mobile carrier technologies in the US?

            • by anss123 ( 985305 )

              Wait a minute? You guys actually have THREE competing mobile carrier technologies in the US?

              "Mr. President. The hackers may have cracked GSM and CDMA!"

              Smug smile: "Don't worry, there's is another."

            • by Macrat ( 638047 )
              Yeah, the US is pretty screwed up.
            • by adolf ( 21054 )

              Four, at least: GSM, CDMA, PCS, iDen. Interestingly, the latter two are provided by the same company. And there's still AMPS floating around in the more thinly-populated parts that still haven't been kicked to some digital format or other yet.

          • The differences between iDEN and GSM are primarily on the access side. The network side is GSM, as is most of the access side messaging. The "attack" being described here is on the network side, so that would make Sprint susceptible to the same thing, at least its Nextel customers.

        • no the nextel part of sprint is its own separate standard (called Iden) it just uses a "sim card" similar to a GSM phone.

          so yes a Nextel World Phone would have 3 different networks builtin (CDMA GSM and Iden)

      • Correct...and Sprint has a true 4G network [cnn.com].

        "The No. 3 wireless carrier, Sprint Nextel (S, Fortune 500), claims to have a 4G network in place based on a different technology called WiMAX, though WiMAX is actually just an enhanced 3G technology. With more than 50 global carriers pledging to unveil LTE networks, some analysts have speculated that Sprint will likely commit to building its own LTE network in the near future."

    • Re: (Score:1, Informative)

      by Montezumaa ( 1674080 )

      Sprint does not operate a GSM network any longer; well, not to the general public. They use CDMA, where as GSM is based off of TDMA. I am not sure if Sprint still uses PCS, but PCS can operate on GSM(TDMA), CDMA, and D-AMPS and I believe that Sprint had their PCS network operating on GSM in some areas.

      Some people might think that Verizon is included because they are switching to UMTS for their "4G" network. The fact is that the version of UMTS AT&T uses is based off of CDMA(W-CDMA is most common). I

  • If anyone using a cellphone doesn't understand Caller-ID, or that the entire system is based on knowing where your phone is (to wtihin the range of a given tower), then they're probably not worthy of having privacy.

    Being able to find someone's name and location is not exactly a privacy issue.

    Next thing you know, the nuffers will be posting stories about the privacy implications of the Marauder's Map.

    • by sjames ( 1099 )

      No, it's a security issue. Just ask anyone who has ever been stalked or had a crazy homicidal ex if they would like to have their stalker know where they are 24/7.

  • Because the article basically says that they will, and now presumably have, presented the details at SOURCE Boston, and the papers/slides from there haven't been released yet.
    Found an interview with some more details here, though: http://news.cnet.com/8301-27080_3-20002986-245.html [cnet.com]
    • All this article is pretty unclear about the attack method described.

      All it says is that they supposedly find ways to tap in APIs that associate GSM phone numbers with names. I am not sure that such API are standardized.

      Then they say that IF you have direct access to SS7 network and you are able to query the HLR, you are able to track down people (because you are able to get the attachement MSC and possibily the Cell ID using the MAP protocol).

      This IF is a big IF. They did not demonstre haw you may break in

      • In the interview, they explicitly state that they got access:
        "Only telecom providers are supposed to have access to the location register, but small telcos in the EU are offering online access to it for a fee, mostly to companies using it for marketing data and cost projections, according to DePetrillo."
      • by sjames ( 1099 )

        The interview stated QUITE CLEARLY that many smaller European telcos are selling access to the HLR. There you go.

        Failing that, it's not NEARLY as hard as you might think to be granted legal access to the SS7 network these days. All you have to do is get into the calling card business (consider all those calling cards from companies you've never heard of) VoIP business, or get a PBX. It's not something every individual would do, but it's well within the reach of a private detective or slimeball marketing fir

  • ...are belong to us.

  • If you carry a cell phone - you're carrying a radio transmitter that broadcasts its serial number to any interested receiver. That serial number is directly tied to your account at the cell service provider; name, address, bank info, you name it. This is just the way things are.

    So what's with the dog and pony show from some writer that doesn't know what he's talking about? And finding the name that goes with a phone number isn't what you should be worried about - consider instead that your friendly governm

    • Again, I've got to make the point, but... duh. How did you think these things worked? (I'm assuming you're a technical person)

      I'm not trolling, I'm just saying this is the way things are designed and in fact, I've heard at least a couple stories where 911 operators have had and exercised the option to triangulate a cell signal to determine someone's whereabouts (could be urban legend, I dunno). Doing all that in the time needed for emergency service? Location info sounds pretty freely accessible to go
  • Just buy a prepaid cell phone with cash and top up the minutes with cash. No ID required.
  • The Killer: Do you know where I am? [Feet are sticking out from behind couch, and are kicking up and down] Cindy Campbell: Um, you're behind the couch, I can see your feet. The Killer: [Killer sticks head up and sees his feet. He grabs his head] D'oh! The Killer: Okay,okay close your eyes! [Cindy closes her eyes, and the killer tries to hide under the carpet, but then goes behind the curtains] The Killer: Now do you know where I am? [Cindy opens her eyes] everyone chuck your cellphone into a river! actuall

"You can have my Unix system when you pry it from my cold, dead fingers." -- Cal Keegan