Slashdot Mirror

← Back to Stories (view on slashdot.org)

Flaws Allow Every 3G Device To Be Tracked

Posted by Unknown on from the police-departments-line-up-to-purchase dept.

mask.of.sanity writes "New privacy threats have been uncovered by security researchers that could allow every device operating on 3G networks to be tracked. The vulnerabilities could be exploited with cheap commercial off-the-shelf technology to reveal the location of phones and other 3G-capable devices operating on all 3G compliant networks. It was similar, but different, to previous research that demonstrated how attackers could redirect a victim's outgoing traffic to different networks."

81 comments

  1. Makes me wonder by Chrisq · · Score: 5, Funny

    Did the 3G equipment come from Huwei or ztc?

    1. Re:Makes me wonder by Anonymous Coward · · Score: 5, Informative

      Did the 3G equipment come from Huwei or ztc?

      No, but that is a rather amusing post, I lol'd.

      On a more serious note, the summary and article make it sound worse than it is. Here's what they are doing:

      "The attacks were made by intercepting, altering and injecting 3G Layer-3 messages into communication between the base station and mobile phones in both directions."

      So to be clear, it won't allow you to just track any 3G device any time you want. It's a MITM attack which requires you to physically intercept and spoof a cell signal using the 3G standard... assuming the network fully complies with 3G and doesn't have it's own signalling or other security added on.

    2. Re:Makes me wonder by msauve · · Score: 3, Informative

      Actually, if they were CDMA phones from Huwei or ZTE (ztc?), they apparently wouldn't be subject to the "flaw" mentioned. The article blithely uses "3G" to refer exclusively to UMTS, no mention whatsoever of CDMA2000. Of course, "every 3G device" is not on a UMTS network.

      --
      "National Security is the chief cause of national insecurity." - Celine's First Law
  2. "Flaw" allows us to be tracked. by mosb1000 · · Score: 5, Insightful

    I'm pretty sure the word flaw should be in quotation marks in this context.

    1. Re:"Flaw" allows us to be tracked. by Anonymous Coward · · Score: 5, Informative

      Indeed - it requires malevolent base stations to be deployed and even then only determines the presence of particular 3G devices in the area.

      They were obviously straining for an example when discussing an employed deploying such stations to track employee movements in a building; door pass access is somewhat easier to track...

      In general though I'm resigned to the fact that the telco underlying my MVNO knows my location when I am connected and will happily relay this to the "authorities" with minimal encouragement, so this new attack doesn't seem particularly startling; now someone else other than the telco can know this. Whoppeee.

    2. Re:"Flaw" allows us to be tracked. by Anonymous Coward · · Score: 0

      Someone else other than the telco, like the mob.

    3. Re:"Flaw" allows us to be tracked. by mabhatter654 · · Score: 4, Funny

      If the mob is tracking you, you have bigger problems than "privacy"

    4. Re:"Flaw" allows us to be tracked. by mabhatter654 · · Score: 3, Insightful

      I don't see how you think any ACTIVE radio transmitter can't be tracked? By definition, phones connect to towers and that gets logged for network purposes. All these people are doing is adding their own radio to the mix, which your phone happily pings to see if ithat "tower" useful. That's the whole definition of a network and "cellular" communication.

      Next thing you know, they'll be telling me my IP address is in EVERY packet I send and receive on the Internet!!!!

    5. Re:"Flaw" allows us to be tracked. by flappinbooger · · Score: 2, Funny

      Next thing you know, they'll be telling me my IP address is in EVERY packet I send and receive on the Internet!!!!

      What? What? That is outrageous! This needs to be front page news! I will not tolerate such privacy violations!

      --
      Flappinbooger isn't my real name
    6. Re:"Flaw" allows us to be tracked. by wonkey_monkey · · Score: 3, Funny

      No, it's okay because everyone has the same IP address - 127.0.0.1.

      --
      systemd is Roko's Basilisk.
    7. Re:"Flaw" allows us to be tracked. by flappinbooger · · Score: 2

      No, it's okay because everyone has the same IP address - 127.0.0.1.

      Phew. That's a relief.

      --
      Flappinbooger isn't my real name
    8. Re:"Flaw" allows us to be tracked. by JustOK · · Score: 2

      mines ::1

      --
      rewriting history since 2109
    9. Re:"Flaw" allows us to be tracked. by Anonymous Coward · · Score: 1

      OMG! The cell phone company knows that I am connected to their network and which towers should broadcast my calls?

    10. Re:"Flaw" allows us to be tracked. by Anonymous Coward · · Score: 0

      I don't see how you think any ACTIVE radio transmitter can't be tracked? By definition, phones connect to towers and that gets logged for network purposes. All these people are doing is adding their own radio to the mix, which your phone happily pings to see if ithat "tower" useful. That's the whole definition of a network and "cellular" communication.

      You cannot hide the fact that there is a mobile device. What you can hide from eavesdroppers, however, is the identity of the device.

      1) establish a secure, encrypted connection
      2) verify the identity of the "tower" using cryptographic certificates
      3) send your own identity only when the above steps have been completed

      . Of course, there will be some sort of communication.

    11. Re:"Flaw" allows us to be tracked. by Anonymous Coward · · Score: 0

      I find Law Enforcement more frightening than a cartoon villain from the past century. Keep up with your boogeymen. There are real life demons now that even journalists and anonymous cowards are afraid to mention.

    12. Re:"Flaw" allows us to be tracked. by mabhatter654 · · Score: 2

      That singles you out as one of those IPV6 hipster kiddos!

    13. Re:"Flaw" allows us to be tracked. by mabhatter654 · · Score: 1

      You still have to have some ID number so the tower can find you and route your encrypted packets. The device has to "check in" and get the new keys for each tower... Thats what this attack is.

      Unless you are going to use a device with pre-approved encryption keys, on pre-approved towers to create a "closed" network you are going to have to need some kind of ID that's visible. At which point you've entirely defeated the idea of sharing your device on multiple networks to get the best signal as you drive across town or the state.

    14. Re:"Flaw" allows us to be tracked. by Anonymous Coward · · Score: 0

      Unless you are going to use a device with pre-approved encryption keys, on pre-approved towers to create a "closed" network you are going to have to need some kind of ID that's visible. At which point you've entirely defeated the idea of sharing your device on multiple networks to get the best signal as you drive across town or the state.

      Except that's exactly what SIM cards are for. There is absolutely no technical reason for your phone to reveal its identity except over a verified encrypted connection to a tower that its SIM card has authentication data for. You can use cryptography to have a phone promise it is a subscriber without saying which one.

    15. Re:"Flaw" allows us to be tracked. by viperidaenz · · Score: 1

      like Mob 2.0

    16. Re:"Flaw" allows us to be tracked. by Anonymous Coward · · Score: 0

      It sounds like the 3G equivalent of the GSM trick, where you can use spoofed HLR queries to return a subscribers information (such as location).

      You can protect against HLR spoofing, don't know about this 3G one.

    17. Re:"Flaw" allows us to be tracked. by hvm2hvm · · Score: 1

      Challenge accepted!

      DeBeers, OPEC, all IT firms, all food/drinks chains
      Zionists, Illuminati, jew conspiracy, mormon conspiracy
      JFK inside job, 9/11 inside job, terrorism in general inside job
      USA wants oil, europe is USA's bitch, USA doesn't care about selling out to china, Russia is too drunk to care
      I dunno, I'm running out of shit to say but there you go

      I'm not a journalist nor an anonymous coward so I guess I don't apply to your comment?

      --
      ics
  3. Intentional by aaaaaaargh! · · Score: 3, Interesting

    I believe these kinds of flaws are intentional. Just think about the early cell phone encryption standards, who were completely insecure despite having been designed by teams who should have known better.

    Governments and government-near task forces and interest groups have no incentive to make communication devices for the general population secure.

    1. Re:Intentional by Anonymous Coward · · Score: 1

      You make it sound as if it's some government conspiracy or something. The simple fact is that the general population doesn't care, so neither do the people designing devices for them.

    2. Re:Intentional by Anonymous Coward · · Score: 0

      Governments and government-near task forces and interest groups have no incentive to make communication devices for the general population secure.

    3. Re:Intentional by Anonymous Coward · · Score: 0, Flamebait

      agreed. bush 9/11 oil cheney halliburton gnaa jews did wtc.

    4. Re:Intentional by aaaaaaargh! · · Score: 1

      Idiot.

    5. Re:Intentional by umghhh · · Score: 3, Informative
      they do not have to - in majority of jurisdictions where such networks operate there are laws in place that force operators to:
      • be able know where a mobile device is
      • to intercept all standard mobile communications i.e. calls and texting

      I believe in US this is called Lawful Interception.

    6. Re:Intentional by Anonymous Coward · · Score: 1

      The idea is that these flaws ease unlawful interception - without all the hassle of asking a judge and possibly on foreign soil.

    7. Re:Intentional by MrZilla · · Score: 2

      Yes, an obscure error message that can be used to differentiate one UE from another, if you have already used a compromised base station to sniff earlier sessions, and which will give you an indication if that UE is in the area of your transmitter or not sounds just like the sort of nefarious flaw that the Men in Black Illuminati would work into an international standard to spy on the tinfoil community.

      As a comment above already mentioned, the operator knows where you are, with a lot more precision than this attack gives, and most of them will happily share this data with the authorities, especially if a judge has OK'd it. This will, by the way, also give you voice and text intercepts, should you need them.

      --
      mov ax, 4c00h
      int 21h
    8. Re:Intentional by aaaaaaargh! · · Score: 2

      You and the other poster are comparing apples with bananas.

      If intentional flaws indeed have been inserted into communications technology, then certainly for complementing lawful interception with means for unlawful interception rather than as a substitute. You need to take into account that many government agencies are explicitly allowed (by the laws of their country) to spy on foreign residents in foreign countries, and only under rare circumstances will these be able to ask local authorities for help and judicial permission.

    9. Re:Intentional by zippthorne · · Score: 2

      Ah.. but spying on foreign residents in foreign countries is almost always an offense with a maximum penalty of death in the target country....

      --
      Can you be Even More Awesome?!
    10. Re:Intentional by MrZilla · · Score: 2

      Well, I grouped you in with the crowd that seem to think governments only spy on their own citizens.

      But I still feel that this method of tracking gives too little data for the effort needed to execute it. Not to mention sneaking it in to a 3GPP standard with this express intent. Not saying that it's impossible, but it does seem far fetched.

      --
      mov ax, 4c00h
      int 21h
    11. Re:Intentional by Anonymous Coward · · Score: 0

      The alghoritm used for GSM encryption was known to be flawed before it was decided to use it.

    12. Re:Intentional by viperidaenz · · Score: 1

      Yeah, and it still took security researchers 20 years to crack it. They designed GSM in the 80's and it wasn't cracked until 2009.

  4. 4g by Anonymous Coward · · Score: 0

    Most,if not all 4g devices have 3g fallback, does this mean these 4g devices are trackable.

    Meaning all devices are trackable, therefore, being tracked at will?

  5. Not thatbad by Anonymous Coward · · Score: 3, Informative

    Acctually from the article "This would reveal the presence of devices in a monitored area, breaking anonymity and ‘unlinkability’ by revealing the IMSI and TMSI correlation." And by moitored area they mean area with specific hardware installed. So you have to be a spy or something to be afraid of such tracking.

    1. Re:Not thatbad by Anonymous Coward · · Score: 2, Interesting

      Bullshit. The police can set one up near any protest, make life hell for everybody who showed up, even if the protesters weren't breaking the law. It's been done before, why trust this time?

    2. Re:Not thatbad by MrZilla · · Score: 5, Insightful

      Sure. If they know the IMSI of the mobiles that the protesters are using in advanced. This attack gives the TMSI of the device, which is a temporary identifier, and will change when the mobile roams outside of the current location area.

      Then they need to set up compromised base stations all over the city if they want to track this protester, and I am sure that there are easier ways to go about that.

      --
      mov ax, 4c00h
      int 21h
    3. Re:Not thatbad by Anonymous Coward · · Score: 0

      If you want to do whole scale tracking of a population, anything you can do to automate the process is a potential win.

      In the US, people have found what appear to be government trackers on their vehicles. A method like this one would appear to be less susceptible to being discovered by the target which is also a win.

      If you have "easier ways" that have these benefits, please elaborate.

    4. Re:Not thatbad by Desler · · Score: 1

      Go straight to the teleco with your rubber-stamped warrant. Hell, the warrant part can probably skipped since the telecos are little lapdogs.

  6. Re:I don't know how to post by ericloewe · · Score: 1

    Considering there are few if any Maemo/MeeGo haters, it's relatively safe.

  7. You know... by GeekWithAKnife · · Score: 5, Interesting


    Richard Stallman, often considered a nutcase, once said that he won't use a cell phone because he does not want to be tracked.

    Whether by design, by accident or by the nature of the device, the fact is you can be tracked. Of course I don't care about that, because I have nothing to hide...then again what will this information be/is used for? big brother stuff, of course not!? Naturally, it's all just a big misunderstanding.

    --
    A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
    1. Re:You know... by thegarbz · · Score: 1

      I wonder if Richard Stallman has ever used a computer attached to the internet. Because you know, the whole theory of packet switching and networks which relies on your IP address being constantly sent back and forth. God forbid he uses a landline too, I'd much rather some anonymous $5 SIM card inserted in my phone then actually use something linked to an account under my name.

      The man fights for our privacy but he is a nutcase.

    2. Re:You know... by Anonymous Coward · · Score: 0

      This just in: An active radio blasting out signals can be tracked. Film at 11.

    3. Re:You know... by alexgieg · · Score: 1

      Of course I don't care about that, because I have nothing to hide...

      The problem isn't what you do, is what you can be accused of having done, which is an entirely different problem. If you were near a crime scene at or near the moment it occurred, and might ever so slightly linked to it (you were friends in college to the roommate of the boyfriend of the victim) and at some point in your life commented on Friendster (yep, going old school here) you found said boyfriend a slob or whatever, a case WILL be made for you potentially being the criminal. Things can go downhill from there pretty fast.

      That said, yeah, I also don't mind carrying a mobile phone around. Convenience and all that. But that doesn't mean we couldn't be aware of what could possibly go wrong.

      Anyway, here's the always repeated rule of thumb, once again: whatever happens, NEVER talk to the police about ANYTHING without your lawyer near you. Resist the urge to talk, even about the weather, no matter what. If you were in the above or a similar scenario, any word you said would be twisted into strengthening the case against you. Be on the safe side and don't talk. It won't hurt you in any way other than the slightly "social ape" discomfort we feel, while talking most certainly might, and in many cases definitely will.

      Watch this. It's long, but worth every second.

      --
      Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.
    4. Re:You know... by Anonymous Coward · · Score: 0

      Actually, the only part of the internet he uses is email, and he fetches and sends that in batches over dial up modem a few times per day, and then he works offline.
      http://richard.stallman.usesthis.com

    5. Re:You know... by Anonymous Coward · · Score: 0

      Richard Stallman, often considered a nutcase, once said that he won't use a cell phone because he does not want to be tracked.

      Oh, you mean that bearded fat-ass that had his passport and laptop stolen? Yeah, real security/privacy expert that guy is.

  8. Buy a pager and use airplane mode by Anonymous Coward · · Score: 0

    Almost all pagers can not be tracked, use a pay phone or turn on the GSM radio in your phone if you need to.
    Most calls aren't emergencies and can go to voice mail til you have time.
    FYI some phones will register on 3g/GSM when they boot up an then turn it off.

    1. Re:Buy a pager and use airplane mode by omnichad · · Score: 1

      Even a pager can be tracked via tower triangulation (not 911 GPS). But most of them aren't 3G, so this won't apply.

    2. Re:Buy a pager and use airplane mode by segin · · Score: 1

      Pagers are as traceable as the FM radio in your car. Neither have transmitters to reply back.

    3. Re:Buy a pager and use airplane mode by omnichad · · Score: 1

      So pagers only get one shot to receive a page? And they broadcast over all transmitters in the country at once? Doesn't sound very reliable without an acknowledgement. I admit I don't know how they operate.

    4. Re:Buy a pager and use airplane mode by plover · · Score: 1

      So pagers only get one shot to receive a page? And they broadcast over all transmitters in the country at once? Doesn't sound very reliable without an acknowledgement.

      Actually, digital pagers get a few shots to receive a page, because the packet is retransmitted a few times over the course of a minute for redundancy. Some of the fancy pagers had a reply transmitter (they acknowledged receipt, and had four buttons you could press to return one of four answers.) And depending on the paging service you subscribed to, pages could be sent from a local tower, all towers in a region, or all towers across the country. At least all this was true back in 2000 when I still carried a nationwide receive-only pager for work.

      I admit I don't know how they operate.

      Then you made a good set of guesses.

      --
      John
  9. Re:I don't know how to post by Anonymous Coward · · Score: 0, Troll

    Just put something like

    "I hate apple and google can do no wrong"

    Then follow it up with the sarcasm tag /s

    To really confuse the pea brained further, you could then add that you intend to queue up for Lumia 920 in Cyan.

    This should confuse the idiots who don't know how to use the moderation system properly. The amount I see flagged as troll for partisan reasons rather that the quality of the post is getting out of hand.

  10. I'm safe! by Cruciform · · Score: 5, Funny

    Good luck tracking me! I'm served by Bell Aliant. I can lose service anywhere they offer coverage!
    And they charge me a reasonably high fee for this knd of security.
    Thanks Bell!

    1. Re:I'm safe! by clickclickdrone · · Score: 3, Funny

      And they charge me a reasonably high fee for this knd of security.

      "Reassuringly expensive" is the phrase you're looking for.

      --
      I want a list of atrocities done in your name - Recoil
  11. Yet next year we'll be on 12G connection by Anonymous Coward · · Score: 0

    Will it have 4x thee amount of flaws?

  12. i'm safe by Anonymous Coward · · Score: 1

    can't hack me. i'm on cdma. verizon secured me so i can't even talk and use data at the same time, good luck getting in, hackers!

  13. Obligatory by Anonymous Coward · · Score: 0

    It's not a bug, you insensitive clod, it's a feature!

  14. Shocked and appalled at 3G smartphone insecurity by cvtan · · Score: 2

    I'm going to keep using Windows so I know I'm safe.

    --
    Sorry, but gray text on gray background is making my eyes bleed.
  15. NEWS At 6... Radio transmitter can be tracked!!!!! by Anonymous Coward · · Score: 0

    Yep, it's a radio transmitter... I'm not sure that finding it would be a major breakthrough in snooping technology.. Now reading the data transmitted, that might be newsworthy, but I'm sure that this has been done for a very long time...

  16. _Every_ phone can be tracked... by Anonymous Coward · · Score: 1

    That's how they work. http://en.wikipedia.org/wiki/Mobile_phone_tracking

    And it's not a "flaw"... it is a "feature"!

    1. Re:_Every_ phone can be tracked... by HarrySquatter · · Score: 1

      Of course it's a feature since only an idiot wouldn't know that your phone is an active radio transmitter. Also, if you couldn't be tracked how exactly would you expect the cell network to know which towers to hand you off to while you were moving?

  17. We should just go back to analogue phones by Viol8 · · Score: 1

    At least then everyone knew that they were in effect glorified CB radios and could be listened in to by a scanner so don't say anything you wouldn't want anyone else to hear. Now everything thinks because its digital it must be secure. Nope. If its broadcast it can be intercepted and (eventually unless its using serious encryption) decoded. End of.

  18. That'll make'm buy newer phones! by erroneus · · Score: 2

    Lately, I have seen a decrease in smartphone fever. Okay, maybe not "lately" -- it has been decreasing for a long time actually. People are less excited about new gadgets and spending that money when they know another new thing is coming along soon. Even the demand for iPhone 5 seems to have dropped where I am... I have a good number of iPhone users where I work but they have been moving to droid and even a couple back to flip phones. I have seen exactly zero iPhone5 phones where I work or anywhere in the wild.

    I think people are realizing what "good enough" means and that spending the $100-$300 more doesn't buy them a whole lot more. Also, simple and reliable seem to be features many people are interested having again.

    But the phone companies have invested a lot of money in FCC costs, marketing and especially in ruining perfectly good smart phones with their bloatware and hacked ROMs that remove features they hope to sell back to customers at a premium. People are losing interest. I know *I* am losing interest... not completely... I'm still looking to get an unlocked, unbranded GalaxyS3 for my next phone and ditching the carrier's plans. Prepaid is the way to go for me. I will save TONS of money when my contract is up.

    1. Re:That'll make'm buy newer phones! by Anonymous Coward · · Score: 0

      Welcome to the movement.

      I switched from Verizon to Virgin last month. I get the same 2gb of data(with no overages if I take it to 5gb throttled) for $35/month instead of $70. Virgin Mobile is 1/2 the cost of Verizon, and T-Mobile is 5gb unthrottled for $30.

      I can buy a T-Mobile prepaid Modem for my laptop and a feature phone for the cost of a Verizon Smartphone. Virgin Mobile pissed me off because they want to charge $15/Month(check verizon's price on that feature) for Mobile Hotspot.

      Guess what? I don't have to wait 2 years to change carriers. Virgin is fired, I'm buying a T-Mobile handset as soon as my prepaid contract expires(30 days).

      Remember all the times you felt pissed off at Verizon but helpless to do anything because you sold yourself in to 2 years of servitude for a fancy radio? I do. I remember feeling helpless several times a year.

      When I cancel my 2gb Virgin Mobile line and switch to a 5gb T-Mobile line, I'm going to be paying $50/year less for 150% more data.

      Fuck the carriers, welcome to the race to the bottom that is an empowered consumer. It's nice to see the tables are turned.

      Maybe the Obama administration can fire Eric Holder and break up the oil company oligarchy in his second term. At this rate I'm feeling optimistic about my oppressors.

    2. Re:That'll make'm buy newer phones! by viperidaenz · · Score: 1

      That's that you get for living in USA. I couldn't buy an operator locked phone in my country if I tried. Some of the very cheap ones are still branded though.

  19. As Designed by ThatsNotPudding · · Score: 2

    Probably in an NSA spec book somewhere.

    1. Re:As Designed by HarrySquatter · · Score: 2

      Why? They can just ask for the far more precise location data straight from the telecoms who are more than willing to give it up.

    2. Re:As Designed by ThatsMyNick · · Score: 1

      Sometimes, you dont want the telecoms to know what you are looking for.

  20. From bash.org: by jensend · · Score: 2

    <gmaxwell> 1960: "I have a great idea! lets have every person in the country carry a radio tracking beacon!" "That'll never fly!" 2012: "I can has TWO iphones??"

  21. It's not a flaw when it's intentional by Anonymous Coward · · Score: 0

    ...and I seriously doubt it's only 3G phones. Face it. Anonymity is a thing of the past. Terrorism, piracy, protection against crime, etc have all played a part (been used as an excuse?) to push through legislation making it so. Would you like to find out how fast the government can track you down? Join anonymous and do something to aggrivate them like spoof the white house web site. You'll probably be shot and tried for treason. Found guilty after the fact.

  22. Not if you're a Sprint customer by gelfling · · Score: 1

    Because Sprint ensures your privacy by not actually having a functional network. Hand to god, smoke signals have better bandwidth.

  23. Name of the authors, link to the article? by Anonymous Coward · · Score: 0

    Very bad ethics on the reporter's side - the article link is http://www.isti.tu-berlin.de/fileadmin/fg214/Papers/UMTSprivacy.pdf and the authors are Myrto Arapinis, Loretta Mancini, Eike Ritter, Mark Ryan, Nico Golde, Kevin Redon and Ravishankar Borgaonkar

  24. Aint a bug, by Pirulo · · Score: 2

    It's a feature

  25. So what about AT&T? by MobileTatsu-NJG · · Score: 2

    So does this include my 3G AT&T phone that shows an icon claiming it's 4G?

    --

    "I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)

  26. The Dark Knight Rises! by Anonymous Coward · · Score: 0

    The Dark Knight Rises!