Risk
4/21/2010
12:27 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

New Hack Pinpoints Cell Phone User's Location, Personal And Business Relationships

Researchers demonstrate a technique that exploits the cell phone infrastructure to compromise cell user's privacy

Turns out you don't even need a GPS to track a mobile phone user's whereabouts and glean her movements and interactions: Researchers have discovered a way to use information from the GSM mobile infrastructure to track down someone and even listen in on her voicemail messages and calls.

Click here for more of Dark Reading's Black Hat articles.
Don Bailey, security consultant with iSec Partners, and independent researcher Nick DePetrillo today at the SOURCE Boston conference demonstrated how they were able to use a combination of available GSM data plus their own handmade tools to glean someone's cell phone number, pinpoint where she was located physically, and determine what she was doing, as well as gather intelligence about her relationships -- business or otherwise.

"We create a dossier about someone's life over a period of time," Bailey says. "We're able to infer things about an individual's behavior and interactions with the company they work for [as well]," he says.

The researchers gathered information from the GSM network infrastructure itself: "We're using information we can gather from the GSM network to infer your location. And we've taken GSM geolocation a few steps forward, combined with some tools we developed," DePetrillo says. "This is new and novel and really, really scary."

The research has chilling implications for businesses, as well as the individuals themselves. Bailey and DePetrillo say they were able to glean the identity of a government contractor by sifting through caller IDs and phone numbers they traced to the U.S. Department of Homeland Security, for example.

Bottom line is it demonstrates inherent weaknesses in the way mobile providers interoperate over the GSM infrastructure. "There is a soft underbelly in the cell phone network...it's an interoperability thing," Bailey says. "We are taking advantage of the way these companies are exposing interfaces to each other. That's where it becomes a serious problem."

Tyler Shields -- a senior researcher for Veracode who recently released proof-of-concept code for a spyware app for the BlackBerry that can track the victim's physical location via GPS and grab sensitive information -- says Bailey and DePetrillo's research is novel in that it attacks the GSM infrastructure itself.

"That's akin to attacking the Internet at the router level," Shields says. "This attacks at the infrastructure level versus the application level. If you can compromise the infrastructure's underlying building blocks, the rest of it will tumble. That's what makes their [research] so interesting."

The researchers used the GSM provider caller ID database, the Home Location Registry (HLR), and some voicemail-hacking techniques, along with their own tools. They reverse-engineered the mobile phone caller ID database by scanning blocks of cell phone numbers, creating a white pages of sorts of these numbers. "It comes back with the name of the organization that owns it," DePetrillo says. They also were able to determine the cell number's cell provider, even if that number had been ported to a new provider, he says.

They then leveraged the HLR, a central repository of information mobile phone subscribers, to locate cell phone towers and regional locations, among other information. "We [used] the mobile switching center number, which corresponds with all cell phone towers in a region and calls back to the switching center where data is routed," Bailey says.

The researchers were able to combine this data, as well as from social networks, to glean a victim's comings and goings. "We can make connections between the movements and 50 or so candidates and whittle it down to one or two," for example, he says.

They then sifted through voicemail or grabbed phone records of who the victim had been speaking with. "We can take those numbers and get you and the other phone to call each other" and conference in to listen in on the conversation to grab more intelligence, he says.

With a little caller ID spoofing, they can extract other information about the victim by hacking into voicemail, for instance. "We can call someone's phone with a spoofed caller ID. Then we can enter the voicemail box without a PIN," DePetrillo says. "That's not new, but combined with other techniques, it lets us get directly into their voicemail without ringing the phone."

The researchers -- who did not release the tools they created -- have alerted major GSM carriers in the U.S. about their findings. "They are very concerned," Bailey says. Some are looking at how to better mitigate these types of attacks, but it won't be easy.

How can a mobile phone user protect herself from this in the meantime? Short of shutting off her phone, not much, according to the researchers.

There are a few possible red flags that could indicate an attack, but it's mainly a silent one. "If you have a particular missed call, or something strange happens, like you got a phone call from yourself, or your [phone] is suddenly calling someone [itself], those could be telltale signs of an attack."

But most of these attacks would be transparent to the victim. There's only about a 10 to 15 percent chance he would see something awry, Bailey says, because the phone won't ring, for instance.

The researchers say some of their work actually scared them. "The Washington, D.C., area is pretty insecure," DePetrillo says. "I came up with a scenario where you can track very important individuals wherever they are...you don't have to track a government official under high security, just the people who travel with him [via their phones], a lot of whom are not under high security, such as congressional aides."

"So if want to find out where Steve Jobs, Brad Pitt, or Tiger Woods is hiding out, you could [potentially] do that with our techniques," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/14/2014 | 6:11:59 PM
Re: Better privacy in Windows phones
Interesting...I didn't know that about Windows smartphones. Android definitely has the most security/privacy issues right now, and its popularity will obviously mean even more threats/issues to come.
speedo1456
50%
50%
speedo1456,
User Rank: Apprentice
7/13/2014 | 10:02:56 PM
Better privacy in Windows phones
The privacy in windows phones can be secured much better than android phones. Windows phones have the possibility to make calls through Skype with the possibility to hide the IP address and therefore hide your location.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-7839
Published: 2014-11-25
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVE-2014-8001
Published: 2014-11-25
Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

CVE-2014-8002
Published: 2014-11-25
Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?