Thursday, April 3, 2014

Search and Neutralize. How to Determine Subscriber’s Location

Mobile networks can be attacked though multiple vectors. In this article, we will consider an attack that allows detecting a cell where a subscriber is located. You see, I do not use more common measure units because the size of a cell is not permanent. In cities, a cell site may have a range of hundred meters, and in rural areas, the range is about several kilometers.

Everything should be in a right way to guarantee successful performance of an attack:

  • Access to SS7 should be provided
  • There’s a possibility to form any SS7 messages (the MAP protocol is required for the attack)
  • There is no filtration system for incorrect or suspicious SS7 messages (almost 85% providers all over the world do not implement such system)

During an audit for one of our clients, we detected strange SS7 messages that generated originating SMS messages received every now and then. A part of the tracing is shown in figure 1. First of all, each following message contained the receiver’s node address incremented by one, which is to say that all the address range of the network was being scanned. Another odd thing was that the sender's node address was Greek (2), but the telephone number from which the SMS messages were sent was Israeli (1). And in the third place, the text of the SMS message contained an exact address of the destination node (3).

Figure 1

The SS7 traffic was banned, and the Greek telephone number became an object of a close analysis. We composed a Type-0 SMS message and sent it to this mobile. A Type-0 SMS message is also called a ping SMS. Such message is not displayed on a phone screen and neither is it saved in a list of received messages. Moreover, the message updates location data in the VLR database. Now VLR contains the current value of the sector, where the cellphone is located and we have an opportunity to determine subscriber's location rather accurately.

We made our first move, but we don’t have any results yet. Information about the subscriber's location is updated, but it's stored deep in the operator's equipment. So we continued our research to get the data. At the next step, we composed a signaling message sendRoutingInfoForSM (the telephone number of the subscriber serves as the parameter) and sent the message to the operator's network.
The sendRoutingInfoForSM signaling message (figure 2) has a very interesting feature: one does not need equipment addressing to send this message successfully, subscriber's number is enough for the message to reach its destination. The reply message contained confidential information: address of the Home Location Register (HLR) (1), the International Mobile Subscriber Identity (IMSI) (2), and the MSC/VLR address (3), where the subscriber is located.

Figure 2

So now we know the subscriber's IMSI and the commutator address where he or she is located. Moreover, we updated information about the cell that is used by the subscriber. It's high time to get information out of the operator. We sent the provideSubscriberInfo message to the MSC/VLR address that we had obtained before; the IMSI served as the parameter. We received the reply message (figure 3) and picked out the cell identifier.

 Figure 3

Now we only have to determine the subscriber's location on a map. There are many map services available on the Internet that can show us the location of a base station according to its identifier. We can use one of them...

Not surprising at all — Greece, Athens, Nikaia (figure 4). However, we still don't not know why he or she needed to scan our network.

Figure 4

Author: Sergey Puzankov, Positive Research


  1. Thanks for posting this, it was very informative and helped me very muchThe design of this website looks awesome, not bad content either.Your responsibility is your response to TrackR bravo His ability.I'm having a weird issue I cannot seem to be able to subscribe your feed, I'm using google reader by the way.

  2. Thats the secret of success.Lately,Somatodrol I did not give a lot of consideration to giving comments on site page posts and have placed feedback even much less. Reading through your pleasant post, will support me to do so sometimes.

  3. That's a Pure Testo Xplode of astronomical proportions. Do you wish to provide something that gives an important explanation relative to Pure Testo Xplode. I've always been told of that happening. Obviously, nothing is perfect. Therefore, my Pop quotes often in connection with Pure Testo Xplode, "Good things can come in a small package." I, sadly, must know Pure Testo Xplode. The end result, of course, is to see a professional with regard to Pure Testo Xplode. As a matter of course, I don't care what it costs you. As a matter of fact, I wish you every happiness. I told you it would be exciting. That's the information.

    more info > > >

  4. CogniQ could require all night. This can't hurt. I don't prefer that option. It doesn't actually need any complicated equipment. I am at a loss for adequate terms to describe CogniQ. You don't have to spend any bills on CogniQ or anything for that matter. Under any circumstances, now is not the time to be complacent as soon as they can do this whenever they wish. I don't want to remove my defenses when it is linked to CogniQ. It's an uncomplicated solution. CogniQ is a tremendous mistake. You might find that you find a lot better results.

  5. I had speculated that I should not take a wider ranging approach. That is probably the best way to find a Nitro Slim. Nitro Slim is showing up in all types of inconvenient locations lately. That hurt a little bit, however not too much. Let's look on the bright side. Do take Nitro Slim seriously yet hollywood doesn't like Nitro Slim. You have a variety of Nitro Slim to choose from today. Sure, nothing is perfect. Until then… They took me to the store. That is the fastest process of perfect strangers doing that. Nitro Slim is a good touch. But, "La via esta duro, amigo." so that the truly neat ones will appear. I don't know why I would fend off that entirely.

    more info > > >

  6. That is what you're trying to do with Synagen IQ. I could easily sell them a Synagen IQ. You will have to establish yourself as a Synagen IQ expert. It is uninspired how licensed professionals must avoid an elaborate circumstance like this. There were no blogs to tell you concerning Synagen IQ back then. Through what agency do leaders pinpoint optimal Synagen IQ webinars? I discovered a phenomenal deal on Synagen IQ. It's a permanent commitment. It was an one shot deal. It's a follow up on this issue.

    They were as happy as a clam. Novices don't like it when Synagen IQ leads to mayhem. If Synagen IQ solves my problem, it might solve problems for folks also. My number one suggestion is to simply be as active as you may be with Synagen IQ. Out of all the possibilities, Synagen IQ is the hardest task to achieve. One of the best plans to alleviate that situation is to ask a friend that as that respects Synagen IQ. This is kindhearted.


  7. Those who adapt to Addium will succeed. Those who don't won't. It was the coldest item I ever saw. That's the first scenario. Teachers are making a habit of Addium and I'm keeping on top of it. It is wrong to presume of Addium as being irrelevant.

  8. It's salient that you do that with Addium right away. That represents real freedom to them. Winning this game is easy, but That is really trivial. This is part of the new year. I am sure this is one of the most interesting articles you've read on that subject and I'm going to party.

    I use Addium to attract prospects. They always deliver on this promise. Some future leaders avoid Addium simply because they've never seen one.

  9. Brain Peak also has advantages, although maybe that's different. My confidence in Brain Peak had become quite dented. They may not be flabbergasted at this. All you ought to do is advertise. Brain Peak is known to cause this situation. Where else can guests unearth invaluable Brain Peak tips? That doesn't solve it.

    You might try to do this from your garage. There are different levels of Brain Peak. A good Brain Peak always turns up. Unfortunately that is the risky part of Brain Peak.


  10. If you have the hard earned cash, you might need to go pay for your CogniLift. Lucky for me that CogniLift is that way. It is the fastest I've seen. It needs a number of brainstorming. There has been an overemphasis on CogniLift recently. This is why using CogniLift can increase your CogniLift.