Risk
4/21/2010
12:27 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

New Hack Pinpoints Cell Phone User's Location, Personal And Business Relationships

Researchers demonstrate a technique that exploits the cell phone infrastructure to compromise cell user's privacy

Turns out you don't even need a GPS to track a mobile phone user's whereabouts and glean her movements and interactions: Researchers have discovered a way to use information from the GSM mobile infrastructure to track down someone and even listen in on her voicemail messages and calls.

Click here for more of Dark Reading's Black Hat articles.
Don Bailey, security consultant with iSec Partners, and independent researcher Nick DePetrillo today at the SOURCE Boston conference demonstrated how they were able to use a combination of available GSM data plus their own handmade tools to glean someone's cell phone number, pinpoint where she was located physically, and determine what she was doing, as well as gather intelligence about her relationships -- business or otherwise.

"We create a dossier about someone's life over a period of time," Bailey says. "We're able to infer things about an individual's behavior and interactions with the company they work for [as well]," he says.

The researchers gathered information from the GSM network infrastructure itself: "We're using information we can gather from the GSM network to infer your location. And we've taken GSM geolocation a few steps forward, combined with some tools we developed," DePetrillo says. "This is new and novel and really, really scary."

The research has chilling implications for businesses, as well as the individuals themselves. Bailey and DePetrillo say they were able to glean the identity of a government contractor by sifting through caller IDs and phone numbers they traced to the U.S. Department of Homeland Security, for example.

Bottom line is it demonstrates inherent weaknesses in the way mobile providers interoperate over the GSM infrastructure. "There is a soft underbelly in the cell phone network...it's an interoperability thing," Bailey says. "We are taking advantage of the way these companies are exposing interfaces to each other. That's where it becomes a serious problem."

Tyler Shields -- a senior researcher for Veracode who recently released proof-of-concept code for a spyware app for the BlackBerry that can track the victim's physical location via GPS and grab sensitive information -- says Bailey and DePetrillo's research is novel in that it attacks the GSM infrastructure itself.

"That's akin to attacking the Internet at the router level," Shields says. "This attacks at the infrastructure level versus the application level. If you can compromise the infrastructure's underlying building blocks, the rest of it will tumble. That's what makes their [research] so interesting."

The researchers used the GSM provider caller ID database, the Home Location Registry (HLR), and some voicemail-hacking techniques, along with their own tools. They reverse-engineered the mobile phone caller ID database by scanning blocks of cell phone numbers, creating a white pages of sorts of these numbers. "It comes back with the name of the organization that owns it," DePetrillo says. They also were able to determine the cell number's cell provider, even if that number had been ported to a new provider, he says.

They then leveraged the HLR, a central repository of information mobile phone subscribers, to locate cell phone towers and regional locations, among other information. "We [used] the mobile switching center number, which corresponds with all cell phone towers in a region and calls back to the switching center where data is routed," Bailey says.

The researchers were able to combine this data, as well as from social networks, to glean a victim's comings and goings. "We can make connections between the movements and 50 or so candidates and whittle it down to one or two," for example, he says.

They then sifted through voicemail or grabbed phone records of who the victim had been speaking with. "We can take those numbers and get you and the other phone to call each other" and conference in to listen in on the conversation to grab more intelligence, he says.

With a little caller ID spoofing, they can extract other information about the victim by hacking into voicemail, for instance. "We can call someone's phone with a spoofed caller ID. Then we can enter the voicemail box without a PIN," DePetrillo says. "That's not new, but combined with other techniques, it lets us get directly into their voicemail without ringing the phone."

The researchers -- who did not release the tools they created -- have alerted major GSM carriers in the U.S. about their findings. "They are very concerned," Bailey says. Some are looking at how to better mitigate these types of attacks, but it won't be easy.

How can a mobile phone user protect herself from this in the meantime? Short of shutting off her phone, not much, according to the researchers.

There are a few possible red flags that could indicate an attack, but it's mainly a silent one. "If you have a particular missed call, or something strange happens, like you got a phone call from yourself, or your [phone] is suddenly calling someone [itself], those could be telltale signs of an attack."

But most of these attacks would be transparent to the victim. There's only about a 10 to 15 percent chance he would see something awry, Bailey says, because the phone won't ring, for instance.

The researchers say some of their work actually scared them. "The Washington, D.C., area is pretty insecure," DePetrillo says. "I came up with a scenario where you can track very important individuals wherever they are...you don't have to track a government official under high security, just the people who travel with him [via their phones], a lot of whom are not under high security, such as congressional aides."

"So if want to find out where Steve Jobs, Brad Pitt, or Tiger Woods is hiding out, you could [potentially] do that with our techniques," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web