Researchers track mobile phone locations with cheap hardware and open-source software

Researchers have shown it is easy for a third party to track a mobile phone user's location using a cheap phone and some open source software (Image: Shutterstock)

While cop shows have shown us that it's easy for service providers to track a person's location via their mobile phone, researchers at the University of Minnesota have revealed it's also an easy task for hackers. Using a cheap phone and open source software, the researchers were able to track the location of mobile phone users without their knowledge on the GSM network, which is estimated to serve 80 percent of the global mobile market.
According to the new research by computer scientists in the University of Minnesota's College of Science and Engineering, a third party could easily track the location of a mobile phone user without their knowledge because cellular mobile phone networks "leak" the locations of mobile phone users.

"Cell phone towers have to track cell phone subscribers to provide service efficiently," Foo Kune explained. "For example, an incoming voice call requires the network to locate that device so it can allocate the appropriate resources to handle the call. Your cell phone network has to at least loosely track your phone within large regions in order to make it easy to find it."
To do this, mobile phone towers will broadcast a page to a user's phone and wait for the phone to respond when they get a call. Hackers would be able to ascertain the general location of the user by forcing those pages to go out and hanging up before the phone rings.
Although the GSM standard assigns a phone a temporary ID to disguise its identity, it is possible to map the phone number to its temporary ID. Just by looking at the broadcast messages sent by the network, the researchers say it is possible to locate the device within an area of 100 square km (38 square miles). But by testing for a user on a single tower allows a user to be tracked to within a geographic area of 1 square km (0.38 square miles) or less.
"It has a low entry barrier," Foo Kune said. "Being attainable through open source projects running on commodity software."
In a field test using an inexpensive mobile phone and open source software and with no direct help from the service provider, the researchers were able to track the location of a test subject within a 10-block area as they traveled across an area of Minneapolis at walking pace.
In their Paper, which was presented at the 19th Annual Network & Distributed System Security Symposium in San Diego, California, the researchers highlight some possible personal safety issues arising from their discovery.
"For example, agents from an oppressive regime may no longer require cooperation from reluctant service providers to determine if dissidents are at a protest location. A second example could be the location test of a prominent figure by a group of insurgents with the intent to cause physical harm for political gain. Yet another example could be thieves testing if a user's cell phone is absent from a specific area and therefore deduce the risk level associated with a physical break-in of the victim's residence."
But it's not all bad news. Foo Kune and his group have identified low-cost techniques to plug the leaks that could be implemented without changing the hardware. They have contacted AT&T and Nokia to inform them of these techniques and are also in the process of drafting responsible disclosure statements for mobile service operators.
Source: University of Minnesota