164

New vulnerability in SMS messaging could expose smartphone users' location to hackers, researcher says (arxiv.org)

submitted 11 months ago* (last edited 11 months ago) by 0x815@feddit.de to c/technology@beehaw.org

29 comments fedilink hide all child comments

Evangelos Bitsikas, who is pursuing a PhD in cybersecurity at the Northwestern University in the US, applied a new machine-learning program to data gleaned from the SMS system of mobile devices.

Receiving an SMS inevitably generates Delivery Reports whose reception bestows a timing attack vector at the sender. Bitsikas developed an ML model enabling the SMS sender to determine the recipient's location with a 96% accuracy for locations across different countries, the researcher says in a study.

The basic idea is that a hacker would send multiple text messages to the target phone, and the timing of each automated delivery reply creates a fingerprint of the target's location. These fingerprints have ever been there but weren't a problem until Bitsikas' group used ML to develop an algorithm capable of reading them. They can be fed into the machine-learning model, which then responds with the predicted location.

According to the researcher, it doesn't matter whether or not the communication is encrypted.

you are viewing a single comment's thread
view the rest of the comments

[-] jet@hackertalks.com 10 points 11 months ago

This is another excellent reason to never give anyone at all your cell phone number. Give them a voice number, like Google voice, Google Fi, voip.ms. The number of people have should not be the number attached to the device you walk around with.

Then if somebody wants to track you by your phone number they'll have to go to the phone service who is not connected directly to your phone other than through the internet. And then they'll have to track you through the internet. So it won't be a data broker selling your location data enmass indexable by your known phone number.

[-] honk@feddit.de 12 points 11 months ago

This type of attack theoretically also works with signal or telegram or whatever message service that works entirely without a phone number.

[-] jet@hackertalks.com 2 points 11 months ago

I don't think I understand the attack then. So a timing attack on Read receipts gives you approximate location how?

I understood the SMS case because the tower data could then be extrapolated. But if we're just talking about a standard internet application like signal. The read receipts are coming over the internet and not coming from Tower records.

Or at least that's my understanding. If I have a computer attached to some point on the internet. People could use ping timings to theoretically restrict the location but not very accurately right?

[-] honk@feddit.de 5 points 11 months ago

You just measure the time until the delivery recipe arrives. You can approximate how far away the recipient is. Now you keep doing that while changing your own location (use vpns etc.) and you can slowly get a more accurate location of the target. Now you automate that stuff and also utilize machine learning to interpret the data.

[-] jet@hackertalks.com 1 points 11 months ago

That makes sense. It wouldn't give you very accurate data. But it'll get you within a hundred kilometers or so?

Though it seems like the solution here isn't always on VPN. So the measurements would only get to your VPN endpoint. Which is trivial to know by the IP address