News

4G mobile communications system is vulnerable to location tracking

The study uncovered several vulnerabilities using monitoring of mobile communications and setting up fake base stations in laboratory environments.

Monitoring device placed in each of the cells can identify where the target user is located in (Copyright: Altaf Shaik).

4G was thought to provide strong privacy and availability guarantees for mobile users, assuming that for instance tracking the user movement would be impossible or ineffective.

– We built a 4G fake base station and showed that most popular phones can be tricked into giving up location information or degrading their service level, states Professor N. Asokan.

Location leak of the mobile phone may include forcing the 4G device into revealing its location. The target user can be localised within a 2 km² area in an urban setting. The necessary equipment for all forms of attacks is inexpensive and readily available. They are even low cost, anyone can purchase the equipment for a little over one thousand euros.

Risks in social media

When a mobile device attaches to a network, it is given a temporary identifier. Temporary identifiers are random and updated frequently, in order to prevent an attacker to link a temporary identifier to the permanent identifier or track movements of a given user. But social network messaging applications, such as Facebook Messenger and WhatsApp, can still be used to trigger signaling messages that leak information to the attacker.

– If you receive messages from people that are not in your friend list in Facebook, these messages end up in the “Other” mailbox. The user will not be notified upon the reception of the message. If you also have a Facebook Messenger application installed in your 4G device, these messages in the “Other” mailbox cause a paging request by the network. Paging is the process of locating the user in a particular area. A paging request triggered by a Facebook message can allow an attacker to link your temporary identifier to your Facebook identity and track your movements, explains Asokan.

– We also noticed that temporary identifiers are not changed sufficiently frequently. In an urban area temporary identifiers persisted up to three days. In other words, once the attacker knows your temporary identifier, he or she can track your movements for up to three days, states Professor Valtteri Niemi from the University of Helsinki.

4G is a complex system whose design requires making different trade-offs between security and other criteria.

In addition, an attacker may even use a fake base station to accurately pinpoint the target user via GPS coordinates or by the distance from three stations. Yet another way of attacking is a denial of service. The target user can be forced into using 2G or 3G networks or even denied access to all networks. These attacks are persistent and devices require explicit user action to recover, such as rebooting the device.

– An important question is why these attacks are possible. 4G is a complex system whose design requires making different trade-offs between security and other criteria, such as availability, performance and functionality, and this leads to vulnerabilities. Hopefully we will see standardization efforts in the future that allow room for trade-offs that can change over time, concludes Niemi.

This work is being jointly conducted by Aalto University, University of Helsinki, and Technische Universität Berlin and Telekom Innovation Laboratories. The research has been accepted to T2, Black Hat Europe and NDSS 2016 conferences.

More information:
Professor N. Asokan
Aalto University
Department of Computer Science
tel. +358 50 483 6465
[email protected]

Professor Valtteri Niemi
University of Helsinki
tel. +358 50 483 7327
[email protected]

  • T2 October 29-30, 2015 in Helsinki (t2.fi)
  • Black Hat Europe November 13, 2015 in Amsterdam (blackhat.com)
  • NDSS February 21-24, 2016 in San Diego (internetsociety.org)
  • Published:
  • Updated:
Share
URL copied!

Read more news

The design space in the virtual reality task
Press releases, Research & Art Published:

Designers find better solutions with computer assistance, but sacrifice creative touch

Computer-guided design can propose more solutions and balance out human inexperience and design fixation
A night sky with the northern lights visible behind the silhouettes of trees. / Yötaivas, jossa revontulet näkyvät puiden siluettien takana.
Press releases Published:

The aurora borealis can be heard even when they can’t be seen

Recordings reveal sounds linked with geomagnetic activity that’s too weak to cause northern lights at the same spot
Ensimmäinen kuva Linnunradan keskellä olevasta mustasta aukosta. Kuva: EHT Collaboration
Press releases Published:

Astronomers reveal first image of the black hole at the heart of our galaxy

Researchers from Aalto University, the University of Turku and the Finnish Centre for Astronomy with ESO were part of the international research group in taking a revolutionary picture.
Aalto_glass_challenge_2018_Jaea Chang_Glass_Lake_Photo_Anne_Kinnunen_KDQ0207.jpg
Press releases Published:

Kone Foundation donates 800 000 euros to Aalto University's area of art and design

With this donation, the foundation wants to support research in the arts and artistic research in particular. The aim is to safeguard the diversity of disciplines and freedom of research in fields of education that have suffered from funding cuts and educational policy prioritisation.