Phone network vulnerability reveals location information, researchers find

Phone towers are leaking location information that can be used to track a mobile phone's location, University of Minnesota researchers have found. And it's not difficult, which worries advocates for stalking and domestic violence victims.

The vulnerability in phone networks can be exploited with just a mobile phone and laptop, said researcher Denis Foo Kune.

"Anybody can set up this particular apparatus to be able to listen to broadcast messages from the towers," Kune said. "They don't need any special cooperation from the service provider, don't need to grab any information from the service provider, don't need to connect to the network, they just have to listen to what the cell towers are broadcasting."

Researchers plugged a mobile phone into a laptop to listen in on transmissions from phone towers. They then dialed the number of the mobile phone they hoped to locate, triggering signals from the tower to the phone that gives away its location within a dozen blocks. The process takes about 10 to 15 minutes. The same techniques could be used to track phones at greater distances if hackers have access to nearby phone towers.

Shellene Johnson, program manager at the Minnesota Coalition for Battered Women, said many victims of domestic violence or stalking rely on mobile phones to find help or call police.

"If victims are unaware this is happening — they may be going into a safe location or into a shelter — it gives very easy access to information of her whereabouts," Johnson said. "The tool she's using to hopefully protect herself could be used to harm or possibly kill her."

Carol Arthur, executive director of the Domestic Abuse Project, said knowledge of a person's location is another way that some abusers can maintain control over their victims.

"If you have changed your address and you're trying to get away from this person... but all of a sudden they found you, it's like you feel trapped, like you'd never be able to get away from this person," Arthur said.

The university report also speculated that the vulnerability could be exploited by oppressive governments or burglars.

The researchers found that they could tap into the locations of phones on T-Mobile and AT&T networks. Kune said it also likely worked on Verizon and Sprint phones, although the tests weren't run on those networks.

The research team proposed fixes to the information leakage to AT&T and phone manufacturer Nokia.

Kune said that Nokia has given the researchers feedback on the viability of their fixes. AT&T has not yet responded to the research team, but AT&T spokesman Alex Carey said the company takes all reports of network vulnerabilities seriously.

"If it's something that's identified as a valid threat, we would act on it right away, devote whatever resources we need to combat the threat," Carey said.

The research was presented in early February at the Annual Network & Distributed System Security Symposium in San Diego, Calif.

Gallery

Fullscreen SlideshowPrevious Slide

1 of 1

Next Slide