US researchers have developed a cheap and simple method for tracking the location of GSM mobile phones.
Mobile carriers typically transmit unencrypted signals between GSM towers and phones to determine location. This is required for phone services to be provisioned.
But the new research has revealed that anyone running the open source Osmocom GSM software could use the same functionality to determine whether or not a mobile phone is in an area of between one and 100 square kilometers.
“Agents from an oppressive regime may no longer require cooperation from reluctant service providers to determine if dissidents are at a protest location,” Denis Foo Kune, computer science PhD student with the University of Minnesota, wrote in a paper.
“Another example could be thieves testing if a user’s cell phone is absent from a specific area and therefore deduce the risk level associated with a physical break-in of the victim’s residence.”
Researchers from the university’s science and engineering college tracked the location of a test subject within 800 metres as they walked through a CBD, without help from a phone provider.
To do this, attackers would dial a target’s mobile phone number from a mobile phone connected to a laptop.
Osmocom software on the laptop would monitor the relevant GSM network tracking signals and reveal the Location Area Code (LAC) of the target phone.
An attacker then re-dials the phone from within the LAC to pinpoint the base station which the user is connected to.
Provided the attacker hangs up within five seconds, the tracking will complete without the target’s phone ringing.
Foo Kune explained that GSM networks needed to "loosly track" phones in a similar fashion to CB radio.
“An incoming voice call requires the network to locate that device so it can allocate the appropriate resources to handle the call," he said.
"Your cell phone network has to at least loosely track your phone within large regions in order to make it easy to find it.”
The research was described in the paper “Location Leaks on the GSM Air Interface” presented at the Network & Distributed System Security Symposium in California.
The research group informed US carrier AT&T and Nokia about cheap mitigation techniques that do not require hardware changes.
