Pages

Thursday, April 3, 2014

Search and Neutralize. How to Determine Subscriber’s Location


Mobile networks can be attacked though multiple vectors. In this article, we will consider an attack that allows detecting a cell where a subscriber is located. You see, I do not use more common measure units because the size of a cell is not permanent. In cities, a cell site may have a range of hundred meters, and in rural areas, the range is about several kilometers.

Everything should be in a right way to guarantee successful performance of an attack:

  • Access to SS7 should be provided
  • There’s a possibility to form any SS7 messages (the MAP protocol is required for the attack)
  • There is no filtration system for incorrect or suspicious SS7 messages (almost 85% providers all over the world do not implement such system)

During an audit for one of our clients, we detected strange SS7 messages that generated originating SMS messages received every now and then. A part of the tracing is shown in figure 1. First of all, each following message contained the receiver’s node address incremented by one, which is to say that all the address range of the network was being scanned. Another odd thing was that the sender's node address was Greek (2), but the telephone number from which the SMS messages were sent was Israeli (1). And in the third place, the text of the SMS message contained an exact address of the destination node (3).


Figure 1

The SS7 traffic was banned, and the Greek telephone number became an object of a close analysis. We composed a Type-0 SMS message and sent it to this mobile. A Type-0 SMS message is also called a ping SMS. Such message is not displayed on a phone screen and neither is it saved in a list of received messages. Moreover, the message updates location data in the VLR database. Now VLR contains the current value of the sector, where the cellphone is located and we have an opportunity to determine subscriber's location rather accurately.

We made our first move, but we don’t have any results yet. Information about the subscriber's location is updated, but it's stored deep in the operator's equipment. So we continued our research to get the data. At the next step, we composed a signaling message sendRoutingInfoForSM (the telephone number of the subscriber serves as the parameter) and sent the message to the operator's network.
The sendRoutingInfoForSM signaling message (figure 2) has a very interesting feature: one does not need equipment addressing to send this message successfully, subscriber's number is enough for the message to reach its destination. The reply message contained confidential information: address of the Home Location Register (HLR) (1), the International Mobile Subscriber Identity (IMSI) (2), and the MSC/VLR address (3), where the subscriber is located.


Figure 2

So now we know the subscriber's IMSI and the commutator address where he or she is located. Moreover, we updated information about the cell that is used by the subscriber. It's high time to get information out of the operator. We sent the provideSubscriberInfo message to the MSC/VLR address that we had obtained before; the IMSI served as the parameter. We received the reply message (figure 3) and picked out the cell identifier.


 Figure 3

Now we only have to determine the subscriber's location on a map. There are many map services available on the Internet that can show us the location of a base station according to its identifier. We can use one of them...

Not surprising at all — Greece, Athens, Nikaia (figure 4). However, we still don't not know why he or she needed to scan our network.


Figure 4

Author: Sergey Puzankov, Positive Research

41 comments:

  1. Thanks for posting this, it was very informative and helped me very muchThe design of this website looks awesome, not bad content either.Your responsibility is your response to TrackR bravo His ability.I'm having a weird issue I cannot seem to be able to subscribe your feed, I'm using google reader by the way.
    http://www.healthcaresdiscussion.com/trackr-bravo/

    ReplyDelete
  2. Thats the secret of success.Lately,Somatodrol I did not give a lot of consideration to giving comments on site page posts and have placed feedback even much less. Reading through your pleasant post, will support me to do so sometimes.http://gojivitafacts.com/somatodrol/

    ReplyDelete
  3. That's a Pure Testo Xplode of astronomical proportions. Do you wish to provide something that gives an important explanation relative to Pure Testo Xplode. I've always been told of that happening. Obviously, nothing is perfect. Therefore, my Pop quotes often in connection with Pure Testo Xplode, "Good things can come in a small package." I, sadly, must know Pure Testo Xplode. The end result, of course, is to see a professional with regard to Pure Testo Xplode. As a matter of course, I don't care what it costs you. As a matter of fact, I wish you every happiness. I told you it would be exciting. That's the information.

    more info > > > http://naturalsmaleenhancement.com/pure-testo-xplode/

    ReplyDelete
  4. CogniQ could require all night. This can't hurt. I don't prefer that option. It doesn't actually need any complicated equipment. I am at a loss for adequate terms to describe CogniQ. You don't have to spend any bills on CogniQ or anything for that matter. Under any circumstances, now is not the time to be complacent as soon as they can do this whenever they wish. I don't want to remove my defenses when it is linked to CogniQ. It's an uncomplicated solution. CogniQ is a tremendous mistake. You might find that you find a lot better results.
    http://truburnplusfacts.org/cogniq/

    ReplyDelete
  5. I had speculated that I should not take a wider ranging approach. That is probably the best way to find a Nitro Slim. Nitro Slim is showing up in all types of inconvenient locations lately. That hurt a little bit, however not too much. Let's look on the bright side. Do take Nitro Slim seriously yet hollywood doesn't like Nitro Slim. You have a variety of Nitro Slim to choose from today. Sure, nothing is perfect. Until then… They took me to the store. That is the fastest process of perfect strangers doing that. Nitro Slim is a good touch. But, "La via esta duro, amigo." so that the truly neat ones will appear. I don't know why I would fend off that entirely.

    more info > > > http://tryslenderagarciniacambogia.net/nitro-slim/

    ReplyDelete
  6. That is what you're trying to do with Synagen IQ. I could easily sell them a Synagen IQ. You will have to establish yourself as a Synagen IQ expert. It is uninspired how licensed professionals must avoid an elaborate circumstance like this. There were no blogs to tell you concerning Synagen IQ back then. Through what agency do leaders pinpoint optimal Synagen IQ webinars? I discovered a phenomenal deal on Synagen IQ. It's a permanent commitment. It was an one shot deal. It's a follow up on this issue.

    They were as happy as a clam. Novices don't like it when Synagen IQ leads to mayhem. If Synagen IQ solves my problem, it might solve problems for folks also. My number one suggestion is to simply be as active as you may be with Synagen IQ. Out of all the possibilities, Synagen IQ is the hardest task to achieve. One of the best plans to alleviate that situation is to ask a friend that as that respects Synagen IQ. This is kindhearted.

    http://tryslenderagarciniacambogia.net/synagen-iq/

    ReplyDelete

  7. Those who adapt to Addium will succeed. Those who don't won't. It was the coldest item I ever saw. That's the first scenario. Teachers are making a habit of Addium and I'm keeping on top of it. It is wrong to presume of Addium as being irrelevant.
    http://tryslenderagarciniacambogia.net/addium/

    ReplyDelete
  8. It's salient that you do that with Addium right away. That represents real freedom to them. Winning this game is easy, but That is really trivial. This is part of the new year. I am sure this is one of the most interesting articles you've read on that subject and I'm going to party.

    I use Addium to attract prospects. They always deliver on this promise. Some future leaders avoid Addium simply because they've never seen one.

    http://naturalsmaleenhancement.com/addium/

    ReplyDelete
  9. Brain Peak also has advantages, although maybe that's different. My confidence in Brain Peak had become quite dented. They may not be flabbergasted at this. All you ought to do is advertise. Brain Peak is known to cause this situation. Where else can guests unearth invaluable Brain Peak tips? That doesn't solve it.

    You might try to do this from your garage. There are different levels of Brain Peak. A good Brain Peak always turns up. Unfortunately that is the risky part of Brain Peak.

    http://www.strongehealthcare.com/brain-peak/

    ReplyDelete

  10. If you have the hard earned cash, you might need to go pay for your CogniLift. Lucky for me that CogniLift is that way. It is the fastest I've seen. It needs a number of brainstorming. There has been an overemphasis on CogniLift recently. This is why using CogniLift can increase your CogniLift.
    http://musclebuildingproducts.info/cognilift/

    ReplyDelete

  11. Cogniflex is an underutilized asset. It's a long wait for a train that won't ever come. It can be argued, but I'm tired of talking in respect to Cogniflex. Listen, it is safe to assume that gentlemen like Cogniflex. Have you thought about purchasing a refurbished Memory?

    You can't put the Cogniflex genie back in the bottle. Necessarily, I woke up on the wrong side of the bed. I got in a heated argument as to Cogniflex the other day.

    http://naturalsmaleenhancement.com/cogniflex/

    ReplyDelete
  12. As I mentioned, I've been there. Timber!!! That is how to request our book on Adderin. This is a style you should use when learning with that. I do not use a Adderin that ruins a training for a Adderin. We're going to burn the midnight oil discussing Adderin. Through what medium do top hands dig up low cost Adderin things?
    http://naturalsmaleenhancement.com/adderin/

    ReplyDelete

  13. I haven't been wondering regarding that. In fact, where did you go wrong? I'm sold. Natto5 moved at breakneck speed. This is never to be missed. Here's how to make shekels working at home with your Natto5. I know Natto5 stock is an investor darling. You might suppose that I'm out in left field.

    Natto5 is not easy and in a number of cases, you might need to make sacrifices and let's just say this is quite comprehensive.

    http://naturalsmaleenhancement.com/natto5/

    ReplyDelete
  14. Brain R8 has also been shown to do the same. That's how to prevent yourself from being disquieted. I'm ready to go to bed early. Even Brain R8 can prove to be useful. I'm searching for a Brain R8 clearinghouse. Probabilities are neat until you become a casualty. That's all topsy turvy but they had a creepy nature.
    http://naturalsmaleenhancement.com/brain-r8/

    ReplyDelete
  15. Email sometimes you know me that get ready for have that now I wanted a fresh air and I sometimes a little bit from the neck no on theme on on LLICIF Thomas J how you doing Nikkei night yeah fix more .
    http://www.healthcaresupslot.com/apex-vitality-mastermind/

    ReplyDelete
  16. That's illustrious. Let me start out by saying that I have nothing against Ceraloft. I'm sure you heard of Ceraloft. We'll cut down the enigma down to size. We'll examine the facts as this concerns Ceraloft. A practical program for understanding Ceraloft is to send out a survey. You require something you can actually sink your teeth into.
    http://trytotalhealthcleanse.net/ceraloft/

    ReplyDelete

  17. The same tactic works with OptiMind. OptiMind was firing on all cylinders. How do foolish people secure distinguished OptiMind directories? It was a traditional deal. This is a fun announcement to make. I was on it like a duck on a june bug.
    http://trytotalhealthcleanse.net/optimind/

    ReplyDelete
  18. large scale smack you need what I do I come here to my Mac so: which may weight United cartoonist sixty that two in the sixty I mean sixty that day by for all intents and purposes by Gram a demonstrating rugged Testerone XL to it to you the to serving the vessels are all the more today to serving the through the so you can connect those numbers to the man sorry session the penmanship gram protein programs that by dams are dietary fiber the so there we have it have Adam I'm numbers a bit yet due to that for .
    http://www.nutritionofhealth.com/testerone-xl-review/

    ReplyDelete
  19. If you are uncertain on Accelerin, don't take the risk. I may have to add a few more Accelerin suggestions. I can't weep over what wasn't. I firmly placed my faith in Accelerin. The inventory of Accelerin in a local area is usually measured like this.
    http://www.strongehealthcare.com/accelerin/

    ReplyDelete
  20. The most notable explanation the actual distinctive factors perform the job fundamentally comes about when you're ready keep track of the outcome while i received while watching reflection. Family holiday find the perfect anti-aging basic aspect once you pick to be able to supply you with a a lot more more youthful searching look at that you have generally predicted. Are you looking forward to offering view the deal with seems haggard, saggy pores and skin and also consumed? Make it easy for this kind of mindset anti-aging pores and skin lotions possibility to re-collagen pores and skin that will help you get quite possibly probably the most encouraged linked with this kind of changes.
    Face Flash Cream Review | http://fun-flicks.com/face-flash-cream/

    ReplyDelete
  21. http://supplementranking.com/raging-lion/

    ReplyDelete
  22. This type of effective parts is actually a mix of vitamins in addition to cell fortifications of which act into the support with this particular mind and body. Your entire matter are going to be parts are going to be technologically avowed with regards to development through the intellect performing. That's the reason We all and lots of extra ordered certainly not received almost any tricky consequence through it can be daily implement.
    OptiMind Reviews- Cognitive Enhancement| http://nationalfitnesspoint.com/optimind-reviews/

    ReplyDelete
  23. [19] Viewpoint


    OptiMind A proper head could be the vital which often makes it possible for folks proficient to remain onward for most elements of lifestyle, but often may need to confront your difficult task associated with dropping this vital along with forces you to definitely concern along with major depression. A number of usually are due to penalties associated with ageing and even virtually any major depression which often raises the actual focus together with hard drive from the trouble along with you ought to count on other people, perhaps while using plan pursuits with their exclusive. If you are also some sort of concentrate on from the trouble along with have to get some sort of well-defined head utilizing a crystal clear concentrate or a stable hard drive, along with now we have the most effective process readily available for an individual '', a clever product or service to improve human brain pursuits.


    OptiMind Reviews- Cognitive Enhancement| http://nationalfitnesspoint.com/optimind-reviews/

    ReplyDelete
  24. There are no shortages of postulations on that wide ranging issue. Notwithstanding this, it's not a surprise that top brass are closed to this. I leave this thought with you now. What are your feelings on King Size Male Enhancement?
    http://naturalsmaleenhancement.com/kingsize/

    ReplyDelete
  25. Liquid Steel Male Enhancement good quality, though the woman's entire body doesn't just use it with this purpose, as it truly is required for correct health and fitness within
    the two genders. And also males also are able to transform into estrogen, mainly because this kind of is amongst the qualities
    regarding excess fat tissues. Most of these tissues productively alter androgen hormone or testosterone into woman's the body's hormones within both women and men, in addition to
    that is why a greater level of extra fat can actually decrease the actual androgen hormone or testosterone level within guys.


    Liquid Steel Male Enhancement | http://nationalfitnesspoint.com/liquid-steel-male-enhancement/

    ReplyDelete
  26. Liquid Steel Male Enhancement But the most prevalent cause regarding reduced androgen hormone or testosterone is usually aging. Soon after age thirty, the quality of androgen hormone or testosterone
    starts for you to by natural means decrease, even though quite little by little. This mustn't be a serious cause of matter with this
    unique population as a dietary supplement can undoubtedly aid, in addition to we all value the official web page regarding Liquid Steel Male Enhancement claims that will readers underneath 20 that will encounter signs or symptoms of a reduced androgen hormone or testosterone level ought to view


    https://liquidsteelmaleenhancementscam.wordpress.com/

    ReplyDelete
  27. my favorite Goji Sbelt won. Sign me up… When it is on par with Goji Sbelt, there actually is no difference in the quality of Goji Sbelt. A Goji Sbelt can be a second-rate choice for your Goji Sbelt plans if you have several tendencies in this direction.

    http://trytotalhealthcleanse.net/goji-sbelt/

    ReplyDelete
  28. That helps keep you abreast of Brainplus Iq developments. It incident with Brainplus Iq raised new questions as to Brainplus Iq. They did this with effortless aptitude. Brainplus Iq is straightforward to locate and plentiful online. This is a summary of Brainplus Iq. I'm a newbie when it is on par with Brainplus Iq.
    http://naturalsmaleenhancement.com/brainplus-iq/

    ReplyDelete
  29. That's decent to you. This is an essential function. Rexburn includes most of the amenities found in Rexburn, plus Rexburn. That is living proof of that theory. That's what would I have preferred to see this morning. You're a clueless newbie. My brain is buzzing with Rexburn conclusions. This will supply you with Rexburn wisdom you need.
    http://musclebuildingproducts.info/rexburn/

    ReplyDelete
  30. At that point, you will be in the position to begin with Alpha fuel 720. It just so happens I need this for Alpha fuel 720. I'm behind the eight ball again although you should add the typical Alpha fuel 720 to make that look pretty.
    http://musclebuildingproducts.info/alpha-fuel-720/

    ReplyDelete
  31. In addition to judging are the elements, Bio x4 should act as publicised. The item offers the ideal strains connected with bacterias as well as other chemicals which have been referred to as efficient, along with it looks like it has been designed with a legit nutritionist that will doesn’t solely specialize about sensible food, and also hypnosis that has foodstuff dependancy. Your doctor is presented one specific along
    Bio x4 with any kind of potential customer may exploration their experience, which is good from a organization that

    http://www.healthcaresupslot.com/bio-x4/

    ReplyDelete
  32. There are a multitude of Blackcore Edge attitudes that have developed over several years. I had presumed that I would explore the long tail of Blackcore Edge. The truth hurts, doesn't it?

    click here > > > http://trytotalhealthcleanse.net/blackcore-edge/

    ReplyDelete
  33. You're a clueless newbie. My brain is buzzing with Rexburn conclusions. This will supply you with Rexburn wisdom you need.What are your feelings on King Size Male Enhancement?
    Escorts in Bangalore

    ReplyDelete
  34. Athletic Greens:- The thought of weight reduction seems sufficiently straightforward, simply eat less and practice more than you allow that'll wind up making them thin down and you'll smolder more calories. Be that as it may, there are various more particular points of interest which could permit you to finish this impact snappier and significantly more effectively. Utilize then 10 tips to help succeed with weight lessening promptly.
    Read More==>> http://newhealthsupplement.com/athletic-greens/

    ReplyDelete


  35. That will be the contribution of Megadrox as this business continues to grow. Megadrox is, by far, the best choice available. Because I didn't know referring to Megadrox, I didn't know Megadrox was possible, and therefore Megadrox didn't worry m
    http://naturalsmaleenhancement.com/megadrox/

    ReplyDelete

  36. Hi,
    Well this was definitely something new, I really liked it as I am new to this
    Biomanix

    ReplyDelete
  37. There are very helpful tips. So I like it. Are you out of the sexual track and looking to find ways to augment your sexual energy and desire? Click here more information: Biomanix Ingredients.

    ReplyDelete

  38. Hello dear blog owner,
    At first i want to thank you for your great writing skills. I like your blog post. Thanks for this awesome content.
    Attention Please-
    There are a lot of penis enlargement solutions available today. However, how do you pick which one to use? The simplest way would probably be to choose one that you are most comfortable using.For more information- Biomanix review

    ReplyDelete
  39. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    earn to die
    Hi! I’ve been reading your blog for a while now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    tank trouble
    tank trouble

    earn to die 1

    earn to die 2

    earn to die 3

    tank trouble 4
    tank trouble 3
    tank trouble 2

    ReplyDelete

  40. "How does it do anything for me?" We'll make this a quick operation. How can novices gather up estimable Megadrox guidebooks? It's OK if this is what you need. I gather it's a good point I got into Megadrox back in 2005. This is the time to regenerate your interest in Megadrox.
    http://musclebuildingproducts.info/megadrox/

    ReplyDelete