Slashdot Mirror
All GSM Phones Open To Attack, Tracking
Trailrunner7 writes "A pair of security researchers has discovered a number of new attack vectors that give them the ability not only to locate any GSM mobile handset anywhere in the world, but also to find the name of the subscriber associated with virtually any cellular phone number, raising serious privacy and security concerns for customers of all of the major mobile providers. The research builds upon earlier work on geolocation of GSM handsets and exposes a number of fundamental weaknesses in the architecture of mobile providers' networks. However, these are not software or hardware vulnerabilities that can be patched or mitigated with workarounds. Rather, they are features and functionality built into the networks and back-end systems that Bailey and DePetrillo have found ways to abuse in order to discover information that most cell users assume is private and known only to the cell provider."
Our attorneys will be contacting you shortly for exposing these methods and invalidating our security through obscurity SOP.
Because you just couldn't allow these methods to remain hidden, you are now responsible for any attacks that take place as a result.
We take our customers security very seriously. As an example, we've ensured these holes have stayed well hidden. Now, you've ruined that. You idiot.
"No duh"
http://yro.slashdot.org/story/10/04/21/1547234/Legal-Spying-Via-the-Cell-Phone-System
Slashdot reported on this last week...
About time someone found one of the many government backdoors they build in years ago. Do you expect government worker #84772 to be able to use a complicated secure backdoor? I know I don't, so I expect all the newest routers that the US made firmware updates with backdoors, cell phones everything has stupid obscure easy to use backdoors built into them now. Its a danger and we need to stem and turn this shit around NOW!
They're following me and reading my thoughts. They're in it with the Scientologists and Starbucks and Major League Baseball. And the Freemasons. And Goo
^%$&^#$&^%$&^% NO CARRIER
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
...
I seem to recall a discussion some time ago involving a carrier - I think it was T-Mobile - who did not want to do business with anyone who wouldn't give them their SSN. Now we find that information is carried openly on the network?
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
This is some scary shit. How long until some celebrity or world leader is abducted, raped, or shot based on this vulnerability?
The article does not sound credible but like a lot of Bullshit. For example they claim that they are able to lookup the customer name for a given mobile number ("also find the name of the subscriber associated with virtually any cellular phone number"). But they don't explain how they do this. The article just states: "At the heart of the work the pair did is their ability to access the caller ID database mobile providers use to match the names of subscribers to mobile numbers. Then they claim: "This is the same database that contains the subscriber information for landlines", which is simply untrue for many mobile operators who do not even operate landlines. They somewhat suggest that the database in question is the Home Location Register HLR ("Once they accessed the database, known as the Home Location Register (HLR),"), but as you can easily lookup, the HLR does NOT contain the name of a subscriber: http://en.wikipedia.org/wiki/Network_switching_subsystem#Home_Location_Register_.28HLR.29 Now there might be networks where you can lookup the name of a customer given the number, but this is not standard, so claiming they can find the subscribe for "virtually any cellular phone number" is just BS on a great scale. The whole article is loads of gibberish making no much sense. I don't believe any of their sensational claims.
I don't know.. TFA is a little short on details, but sounds like the attacks are based on known implementation weaknesses in the (American) networks. HLR is certainly something that no unauthorized party is supposed to access. CallerId I don't know, but probably should also not be publicly accessible. In any case doesn't sound like something you can execute in any network (or would be impossible to fix).
My network isn't vulnerable because it's never fucking working.
But no details are given about how they got in. But really, this isn't that much more scary then a phonebook.
Second
I know my company, verizon, still requires your password even if you call from your number.
Third
But no further info is given...
Looks like there really isn't much news here except that maybe t-mobile doesn't require a password for voicemail if you call from your home phone number.
Technology, the cause of and solution to all of life's problems.
>>>This is a correlation that most mobile subscribers think isn't possible because there isn't a public white pages directory of mobile numbers.
I think even the average user understands that the providers have and share such information to manage calls themselves, whether or not it's easily available. And security through obscurity that worked just fine in a landline-only era is wide open when you can listen to the challenge-response over the air. The only question is why anyone other than a telco can get to the databases; OTOH since anyone can be a telco nowadays, that wouldn't help much.
This does demonstrate how a difference of degree becomes a difference of kind, as is so often the case with data mining. When there was noticeable cost to get each piece of information and/or to correlate one set of information against another, it was only worthwhile for a targeted attack. Now when one can get millions of pieces of information and correlate them with minimal effort, scattershot attacks are economically productive. It was never worthwhile to just dial numbers sequentially, because you had to pay living people to do it, until robodialers were created (and permitted to be attached to the phone lines); then suddenly it became an industry.
well well, how the tables have turned!
Website Hosting
If this get wide actively exploited we will see how will be built Babel Tower 2.0, using only social engineering.
In fact, don't think on God...think in terrorists, or in the children. Always will be a worse application of this than what you tought.
"For example, during their research, Bailey and DePetrillo scanned a number block in Washington, D.C., and identified a large block of numbers allocated to a defense contractor."
I am sorry, what? How exactly does this scan work? If a defence contractor has it's numbers available in a publically accessible number database, this is probably a lapse in security at said contractor, not some kind of a GSM technology exploit. If you don't want to tell the world that YOU own number 123 4567, don't share this information. DUH. Every operator out there has an option where the subscriber can chose to "keep my number secret and do not share my information with public registries". Your failure to use this option is well, your failure.
"Once they accessed the database, known as the Home Location Register (HLR), the researchers are able to determine which mobile provider a given subscriber uses, and then combine that with the caller ID data, giving them a profile of the subscriber."
I am an operator. What the fuck gives you the idea that YOU can access my HLR? Are you retarded?
Good for you!
A warning, though. Those burgers are someday going to be flipped by a machine.
I like how they list GSM and imply all carriers in the US when the largest GSM providers are AT&T, T-Mobile, Sprint and Cricket. The CDMA networks are Verizon and Alltel. Of course, the're now one in the same since Verizon bought Alltel a year or so ago.
I've got a T-Mobile prepay card.
Even T-Mobile doesn't know my name, so perhaps these uber-hackers are a bit exaggerating?
If anyone using a cellphone doesn't understand Caller-ID, or that the entire system is based on knowing where your phone is (to wtihin the range of a given tower), then they're probably not worthy of having privacy.
Being able to find someone's name and location is not exactly a privacy issue.
Next thing you know, the nuffers will be posting stories about the privacy implications of the Marauder's Map.
Verizon and Sprint!
I still cannot find the droids I am looking for...
How in the world did you get from "here's how caller ID maps numbers to name" to "they're transmitting SSNs over the network"?
"Insightful"? Did the moderators not read the story either?
Because the article basically says that they will, and now presumably have, presented the details at SOURCE Boston, and the papers/slides from there haven't been released yet.
Found an interview with some more details here, though: http://news.cnet.com/8301-27080_3-20002986-245.html
Emotions! In your brain!
You must be ne..
tgd (2822)
Er. You must not come around very often.
The Nextel portion of Sprint is actually GSM.
Wrong again.. Nextel is actually iDEN, which is yet another different technology that happens to use a SIM card. Having a SIM card does not make it GSM.
...are belong to us.
That's why I stick with my trusted landline, they'll NEVER know where I'm at! SUCKERS!!!!
Yes, because a company having your SIN means that it'll be accessible on your phone...
Yup, get a TRAC Phone, and no more worries about being tracked, since nobody knows who owns the TRAC phone.
Oh wait, they aren't in are they, no camera, no mp3 player, no bells and whistle crap, guess all you cell phone fashion victims are toast.
All this article is pretty unclear about the attack method described.
All it says is that they supposedly find ways to tap in APIs that associate GSM phone numbers with names. I am not sure that such API are standardized.
Then they say that IF you have direct access to SS7 network and you are able to query the HLR, you are able to track down people (because you are able to get the attachement MSC and possibily the Cell ID using the MAP protocol).
This IF is a big IF. They did not demonstre haw you may break in to the SS7 network from outside of it.
Guys, you have to understand that SS7 network are not exactly working like a IP network. Most of the time, routing is statick and a peer to peer trust relationship must be established between your host and the network before you can eventhing of querying an HLR like this. So this "attack" supposes that the attacked network would basically allow you in.
Unless, they come up with something very new, this is pretty weak. The attack on GSM encryption for conversation was much more significant.
That's news to me.
Wait a minute? You guys actually have THREE competing mobile carrier technologies in the US?
Free Manning, jail Obama.
If you carry a cell phone - you're carrying a radio transmitter that broadcasts its serial number to any interested receiver. That serial number is directly tied to your account at the cell service provider; name, address, bank info, you name it. This is just the way things are.
So what's with the dog and pony show from some writer that doesn't know what he's talking about? And finding the name that goes with a phone number isn't what you should be worried about - consider instead that your friendly government can tell where your cell phone is at any time they desire. Since that's usually in your pocket / purse, that means your location, your movements, and who you meet with. This is more real than the linked article and a lot more troubling.
Wait a minute? You guys actually have THREE competing mobile carrier technologies in the US?
"Mr. President. The hackers may have cracked GSM and CDMA!"
Smug smile: "Don't worry, there's is another."
Just buy a prepaid cell phone with cash and top up the minutes with cash. No ID required.
Is the use of the word "vectors" pretensious speak for method, or does it actually have a specific meaning ? (and yes, I can't spell)
The differences between iDEN and GSM are primarily on the access side. The network side is GSM, as is most of the access side messaging. The "attack" being described here is on the network side, so that would make Sprint susceptible to the same thing, at least its Nextel customers.
"People that quote themselves in their signatures bother me" - athakur999
In the interview, they explicitly state that they got access:
"Only telecom providers are supposed to have access to the location register, but small telcos in the EU are offering online access to it for a fee, mostly to companies using it for marketing data and cost projections, according to DePetrillo."
Emotions! In your brain!
Yeah, the US is pretty screwed up.
and how is this news...
Four, at least: GSM, CDMA, PCS, iDen. Interestingly, the latter two are provided by the same company. And there's still AMPS floating around in the more thinly-populated parts that still haven't been kicked to some digital format or other yet.
Kid-proof tablet..
The Killer: Do you know where I am? [Feet are sticking out from behind couch, and are kicking up and down] Cindy Campbell: Um, you're behind the couch, I can see your feet. The Killer: [Killer sticks head up and sees his feet. He grabs his head] D'oh! The Killer: Okay,okay close your eyes! [Cindy closes her eyes, and the killer tries to hide under the carpet, but then goes behind the curtains] The Killer: Now do you know where I am? [Cindy opens her eyes] everyone chuck your cellphone into a river! actually that would be very bad for the environment. - Christine Malczanek
The interview stated QUITE CLEARLY that many smaller European telcos are selling access to the HLR. There you go.
Failing that, it's not NEARLY as hard as you might think to be granted legal access to the SS7 network these days. All you have to do is get into the calling card business (consider all those calling cards from companies you've never heard of) VoIP business, or get a PBX. It's not something every individual would do, but it's well within the reach of a private detective or slimeball marketing firm. There's your "peer to peer trust relationship". Those only work when you can trust your peers not to trust anyone who waves a dollar at them.
The SS7 system is a WAY too baroque layer cake of APIs and protocols designed with the idea that there is THE phone company and that everything on it is therefore trusted.