Low-cost IMSI catcher for 4G/LTE networks tracks phones’ precise locations

Researchers have devised a low-cost way to discover the precise location of smartphones using the latest LTE standard for mobile networks, a feat that shatters widely held perceptions that the standard is immune to the types of attacks that targeted earlier specifications.

The attacks target the LTE specification, which is expected to have a user base of about 1.37 billion people by the end of the year, and require about $1,400 worth of hardware that run freely available open source software. The equipment can cause all LTE-compliant phones to leak their location to within a 32- to 64-foot (about 10 to 20 meter) radius and in some cases their GPS coordinates, although such attacks may be detected by savvy phone users. A separate method that's almost impossible to detect teases out locations to within an area of roughly one square mile in an urban setting.

The researchers have devised a separate class of attacks that causes phones to lose connections to LTE networks, a scenario that could be exploited to silently downgrade devices to the less secure 2G and 3G mobile specifications. The 2G, or GSM, protocol has long been known to be susceptible to man-in-the-middle attacks using a form of a fake base station known as an IMSI catcher (like the Stingray). 2G networks are also vulnerable to attacks that reveal a phone's location within about 0.6 square mile. 3G phones suffer from a similar tracking flaw. The new attacks, described in a research paper published Monday, are believed to be the first to target LTE networks, which have been widely viewed as more secure than their predecessors.

"The LTE access network security protocols promise several layers of protection techniques to prevent tracking of subscribers and ensure availability of network services at all times," the researchers wrote in the paper, which is titled "Practical attacks against privacy and availability in 4G/LTE mobile communication systems."

"We have shown that the vulnerabilities we discovered in LTE access network security protocols lead to new privacy and availability threats to LTE subscribers," the researchers wrote.

Like some of its predecessors, LTE attempts to conceal the location of a specific phone by assigning it a regularly changing TMSI, short for a temporary mobile subscriber identity. When a network interacts with a handset, it will address it by its TMSI rather than by its phone number or other permanent identifier to prevent attackers monitoring network traffic from tracking the location of a given user. The 2G attack worked around this scheme by sending phones an invisible text message or imperceptibly brief call that caused the mobile network to locate the phone. That paging request allowed the researchers to tie the TMSI to the phone number.

Passive aggression versus evolved NodeB

The researchers behind the LTE attack found that similar paging requests can be triggered by social messaging apps such as those provided by Facebook, WhatsApp, and Viber, with little to no indication to the owner that any tracking is taking place. A Facebook message sent by someone not in the receiver's friend list, for instance, will cause the text to be silently diverted to a folder marked "other." But behind the scenes, an attacker can use the data sent over the network to link the receiver's Facebook profile to the TMSI. The TMSI, in turn, can be used to locate the phone and track it as it moves from place to place.

A text sent through Whatsapp or Viber, meanwhile, first must be returned by the targeted phone owner. From then on, the attacker can use the apps' typing notification feature to trigger paging requests. The researchers describe such exploits as "semi-passive" because they mainly involve the passive monitoring of network traffic rather than the impersonation and traffic manipulation found in a fully active man-in-the-middle attack.

Attackers can also opt to launch far more accurate active attacks by operating a rogue base station, which in LTE parlance is known as an eNodeB, short for evolved NodeB. To create their own eNodeB, the researchers used a computer-controlled radio known as a Universal Software Radio Peripheral that ran OpenLTE, an open source implementation of the official LTE specification. The total cost of the gear, including the radio board and antennas, was about €1,250 (about $1,400), Ravishankar Borgaonkar, one of the researchers and a post-doctorate student at Aalto University in Finland, told Ars.

When running in active mode, the eNodeB impersonates an official base station provided by a network carrier and forces LTE phones to connect to it. The attackers can then run troubleshooting routines that cause the handset to provide a wealth of information, including all nearby base stations and the signal strength of each one. Attackers can use the data to triangulate the precise location of the device. In some cases, the rogue eNodeB can be used to obtain the GPS coordinates of the phone.

While the active attack provides much more granular location data, it comes at a cost. Darshak, an IMSI-catcher detection app that was released at the 2014 Blackhat security conference in Las Vegas, as well as similar apps from Pwnie Express and others, can easily detect the full-on attacks. That means the semi-passive attacks may be preferable for many attackers, even though the location data is coarser.

There's another feature that makes the semi-passive attacks attractive: At least one of the LTE networks the researchers studied allowed TMSIs to last as long as three days before being changed. That means an attacker who executed such an attack could use it to track a target's comings and goings for days, with an accuracy of about a half mile. While it's likely the messaging apps will try to make changes that thwart the attack, it wouldn't be surprising if there are other ways to trigger the paging requests.

But wait... there’s more

The paper includes a separate attack that prevents phones from connecting to LTE networks. Such an attack would either prevent a phone from receiving voice or data service or would cause the devices to connect using 3G or even 2G technology, which are vulnerable to other types of exploits. In any event, the denial-of-service attacks are generally effective until after a device is rebooted.

The researchers also included Altaf Shaik, a doctoral student at Technische Universität Berlin; N. Asokan of Aalto University and University of Helsinki; Valtteri Niemi of the University of Helsinki; and Jean-Pierre Seifert, a professor at Technische Universität Berlin. They said they contacted all manufacturers and carriers affected by their research in June and July and have proposed several changes the companies can make to better secure their products and networks. The researchers are scheduled to present their findings at the upcoming Blackhat Security conference in Amsterdam, the T2 Security conference 2015, and the Internet Society NDSS conference. A brief description of the attacks is here.

As noted earlier, several of the vulnerabilities exploited reside in the LTE specification itself. That likely means every LTE-compatible manufacturer and carrier is vulnerable to these attacks. A fix will almost certainly take time and money, but at least there will be near unanimous agreement among industry partners that the weaknesses represent a concrete and imminent threat to customers.