Location Leaks on GSM Air Interface D Foo

  • Slides: 14
Download presentation
Location Leaks on GSM Air Interface D. Foo Kune, J. Koelndorfer, N. Hopper, Y.

Location Leaks on GSM Air Interface D. Foo Kune, J. Koelndorfer, N. Hopper, Y. Kim

Location Privacy �News Nov 2011: Carrier IQ Oct 2011: HTC Android phone location leakage

Location Privacy �News Nov 2011: Carrier IQ Oct 2011: HTC Android phone location leakage April 2011: i. Phone and Android location information �Default options HLR (Home Location Register) Apps allowing location tracking

Location Privacy Leaks on GSM � We have the victim’s mobile phone number �

Location Privacy Leaks on GSM � We have the victim’s mobile phone number � Can we detect if the victim is in/out of an area of interest? Granularity? 100 km 2? 1 km 2? Next door? � No collaboration from service provider i. e. How much information leaks from the HLR over broadcast messages? � Attacks by passively listening Paging channel Random access channel Location leaks on the GSM air interface, D. F. Kune, J. Koelndorfer, N. Hopper, Y. Kim, NDSS 2012 Media: Ars Technica, Slashdot, MPR, Fox Twin Cities, Physorg, TG Daily, Network World, e! Science News, Scientific Computing, gizmag, Crazy Engineers, PC Advisor, Mobile Magazine, The Cyber. Jungle, Inquisitr

Cellular Network HSS ATR HLR BTS VLR PSTN GSM Air Interface MSC BSC MS

Cellular Network HSS ATR HLR BTS VLR PSTN GSM Air Interface MSC BSC MS

Location Leaks on Cellular Network � IMSI a unique # associated with all GSM

Location Leaks on Cellular Network � IMSI a unique # associated with all GSM � TMSI Randomly assigned by the VLR Updated in a new area � PCCH Broadcast paging channel � RACH Random Access Channel � SDCCH Standalone Dedicated Control Channel � LAC has multiple cell towers that uses different ARFCN BTS MS Paging Request PCCH Channel Request RACH Immediate Assignment PCCH Paging Response SDCCH Setup and Data

Platform Serial cable and reprogrammer cable ($30) HTC Dream with custom Android Kernel ($100)

Platform Serial cable and reprogrammer cable ($30) HTC Dream with custom Android Kernel ($100) Virtual. Box running Ubuntu and Osmosom. BB software (free) Motorola C 118 ($30)

Phone number-TMSI mapping dt PSTN PCH dt Time

Phone number-TMSI mapping dt PSTN PCH dt Time

Silent Paging � Delay between the call initiation and the paging request: 3 sec

Silent Paging � Delay between the call initiation and the paging request: 3 sec � Median delay between call initiation and ring: 6 sec

Immediate Assignment � Is IA message sent to all towers in the same LAC?

Immediate Assignment � Is IA message sent to all towers in the same LAC? � How do we identify IA message? No identifiable information � Check the correlation between IA and Paging request

Location Area Code (LAC)

Location Area Code (LAC)

Hill Climbing to discover towers

Hill Climbing to discover towers

Mapping cell signal strength

Mapping cell signal strength

Coverage area with 1 antenna Downtown Minneapolis Observer John’s newly shaved head Yagi antenna

Coverage area with 1 antenna Downtown Minneapolis Observer John’s newly shaved head Yagi antenna Towers in this area are observable with a rooftop 12 db gain antenna

Following a walking person Observer End Start Approximate areas covered by towers to which

Following a walking person Observer End Start Approximate areas covered by towers to which the victim’s phone was attached to

GSM RADIO INTERFACE GSM RADIO INTERFACE IN THISGSM RADIO INTERFACE GSM RADIO INTERFACE IN THIS
GSM RADIO INTERFACE GSM RADIO INTERFACE IN THISGSM RADIO INTERFACE GSM RADIO INTERFACE IN THIS
GSM RADIO INTERFACE GSM RADIO INTERFACE IN THISGSM RADIO INTERFACE GSM RADIO INTERFACE IN THIS
GSM Channels Air Interface 1 The GSM radioGSM Channels Air Interface 1 The GSM radio
GSM Architecture 1 GSM Sub Systems GSM architectureGSM Architecture 1 GSM Sub Systems GSM architecture
INTERFACE DESIGN INTERFACE DESIGN INTERFACE INTERFACE DESIGN INTERFACEINTERFACE DESIGN INTERFACE DESIGN INTERFACE INTERFACE DESIGN INTERFACE
Little Bunny Foo Little Bunny Foo hopping throughLittle Bunny Foo Little Bunny Foo hopping through
define foo 25 define foo let x 5define foo 25 define foo let x 5
package foo class Foo Impl void run printHellopackage foo class Foo Impl void run printHello
RUNTIME MEMORY MANAGEMENT Keyword new int foo fooRUNTIME MEMORY MANAGEMENT Keyword new int foo foo
define foo 25 define foo let x 5define foo 25 define foo let x 5
Foo Doo team has Foo Do o ConquerFoo Doo team has Foo Do o Conquer
Location Roadmap Location 2 Location 3 Location 1Location Roadmap Location 2 Location 3 Location 1