Leaky Cellphone Nets Can Give Attackers Your Location 67
alphadogg writes "GSM cellular networks leak enough location data to give third-parties secret access to cellphone users' whereabouts, according to new University of Minnesota research. 'We have shown that there is enough information leaking from the lower layers of the GSM communication stack to enable an attacker to perform location tests on a victim's device. We have shown that those tests can be performed silently without a user being aware by aborting PSTN calls before they complete,' write the authors, from the College of Science and Engineering, in a paper titled 'Location Leaks on the GSM Air Interface' (Pdf). The researchers are working with carriers and equipment makers, including AT&T and Nokia, to address the security issues."
Re:Is this really a thing? (Score:3, Interesting)
Re:It probably matters, but I don't care. (Score:5, Interesting)
You, sir, are totally full of shit and out of touch with reality. Or you live in a state that doesn't matter, like Montana or one of the Dakotas.
Come down to California and try to drive across an interstate highway. You may not be "arrested" per se, but you will be detained and your personal effects be searched...all because a low-rent goon fed the right hand-signal to a well-trained dog at a blatantly unnecessary highway checkpoint.
Re: Not a problem (Score:4, Interesting)
Further to this, here is an example of some paging traffic I captured over a live UMTS network (Telstra NextG, in Australia), using nothing more than a USRP with 900MHz daughterboard, and some custom Matlab code. The message has been unpacked from ASN.1 format to XML, but it clearly shows IMSI and TMSI in plaintext.
File is here [jquirke.com.au].
This shows the flaw is definitely not GSM only.
Re:It probably matters, but I don't care. (Score:5, Interesting)
Yeeeep. I used to think law enforcement was a good thing, then one day, a cop decided to become my worst enemy and now I hate them all equally. I am not a "bad guy", but they have made it clear they are not the "good guys".
When I was 18, I totaled my parents' car. I wasn't drinking, nor high, nor doing anything wrong besides driving at night on an unfamiliar and poorly maintained, where I was blinded by oncoming high-beams and veered into the ditch... where a giant stone was waiting to send my vehicle flying. Freak accident.
30 minutes later, someone stops to help and calls 9-1-1. Minutes later, the ambulance takes my passenger, who had a pretty bad gash in his arm. I wasn't hurt at all. A full hour later, the police officer shows up. She (*grumble*) asked me if I'd been drinking, I'd say about 4-5 times, hoping I'd change my story. So she had me do a roadside breathalyzer test. Zero. Took me down to the station, did the same test on a bigger machine. Zero. When she realized I was clean as a whistle, she slapped me with $5000 worth of bogus fines and suspended my licence. Two months later, the judge overturned all my fines and reinstated my licence.
Fast-forward two years, I was working a shit job at a video store. One night, I got robbed by armed thugs. Sure enough, that same asshole cop showed up to take my report. Instead of actually taking my report, she said I had to be lying, that a big guy like me could not possibly be scared of two (knife-wielding) crackheads and I must have been in on it. I caught her comments on the CCTV and took her to court, won, and had her suspended without pay for a year. Only problem was, her husband was also a cop, so for the next two years, they stalked me. They'd park at the end of my street in the morning, and wait for me to leave for work, and hubby would follow me in his squad car, sometimes tailgating very aggresively, trying to psych me into doing something stupid, or pulling me over every morning for a week. I endured two years of this harassment, until he actually bumped me and caused an accident. He tried very hard to blame it on me, that I had been driving "suspiciously" and somehow caused him to rear-end me, but that didn't hold up in court. Both of them were again suspended (goddamned unions), and a restraining order was issued.
Needless to say, after all that bullshit, I have a less than stellar view of law enforcement officials. I'll go as far as saying that, if a cop were to be injured and in need of help, I would sit and watch them suffer. It boggles my mind that we entrust such heinous, immature people with a badge and a gun. In the few times when I needed help, they just kicked me down. That to me makes them less than human and instead of giving them new ways to harass, we should be stripping them of their powers because they clearly lack the intelligence and respect to use them properly.