5 ms·

Law Enforcement can track a phone with 'silent' SMS messages designed not to alert the user. well, that's something i didn't know

War_tijn 8y ago
As far as I know they can only see to which tower your phone is connected, so it's not too accurate. I'm not an expert in this field though.
- adrianN 8y ago
  When I was playing around with that about ten years ago you could triangulate the position using multiple towers to narrow it down to a radius of a few dozen meters. It depends of course on the density of towers around the phone.
- chatmasta 8y ago
  If you repeatedly triangulate a phone at < 100m resolution for a few hours, it should become trivial to identify its exact location. The more people in the area, the less reliable the method is. But in rural or suburban areas, it's going to be pretty good. See the LocationSmart stories the past few days for more on this.
tinus_hn 8y ago
It isn’t like they track the phone using the messages, instead you can more accurately track the phone if it is sending and receiving things; the network needs to know more to make the connection work. So sending the phone things that don’t do anything puts it in a state where you can track it more accurately, and then you need to cooperate with the provider to actually track it. They can track you the same way if they would just call you. That would be kind of conspicuous so that’s why they use silent messages instead. But it isn’t like you can send a message that tells the phone to reports its location.
- ian0 8y ago
  Generally you wouldn't need any type of messaging to the handset for this. As the phone periodically reports the signal strengths of surrounding cells for the purposes of handover just taking a glimpse of this is enough to triangulate well. As long as your phone is on your broadcasting. Indeed I think there are cases of tracing where the phone is switched off too, though not sure if they used historical cell data to guess at its location or there is some secret sauce. But - as you mention, you require to have connections into an operator to do all this.
  - thesimon 8y ago
    >As the phone periodically reports the signal strengths of surrounding cells for the purposes of handover just taking a glimpse of this is enough to triangulate well. Not when the phone is idle and is not leaving a location area though. (At least that's my memory from my college class)
    - dfox 8y ago
      In GSM there is some periodic communication even in the idle non-moving case, but the period is on the order of hours.
    - ian0 8y ago
      For the purposes of location tracking I think thats acceptable :)
  - codedokode 8y ago
    If you put your phone close to your amp or sound card and if they are not perfectly shielded then you can hear when the phone is transmitting the signal. You can hear modem-like sound before receiving a call or a message, and in idle mode the phone usually transmits something every 15-30 minutes.
ian0 8y ago
In practice you don't need SMS for this. Back in the day they would use lower level routing commands (eg SRI lookup) to find the VLR and then cell towers codes of the phone. Most of the time after a few pings you can get 2 or more cells, enough for a decent approximate location. There are DBs that match codes to lat/long. This works even if the number your tracing isn't on your network, but you need to have access to "a" network to do it. Lots of guys like SMS aggregators and small MVNOs have access to this. If you have access to the network where the user is you can use either dedicated location systems if they have them or use the VLR method above for a rough location. If you wanted to get very fancy you could log into a system closer to the towers and check the reports on cell tower power that your phone periodically sends to triangulate better. Or even match them off coverage maps. Under both systems above your phone is never party to comms (unlike actual SMS) so its impossible to know someone is tracing you.. This was 2G / early 3G systems. Loc tracking was more difficult with WCDMA, esp triangulation. Maybe thats changed. Or it hasn't because governments find it easier to check leaky app level APIs :P

War_tijn 8y ago

As far as I know they can only see to which tower your phone is connected, so it's not too accurate. I'm not an expert in this field though.

adrianN 8y ago
When I was playing around with that about ten years ago you could triangulate the position using multiple towers to narrow it down to a radius of a few dozen meters. It depends of course on the density of towers around the phone.
chatmasta 8y ago
If you repeatedly triangulate a phone at < 100m resolution for a few hours, it should become trivial to identify its exact location. The more people in the area, the less reliable the method is. But in rural or suburban areas, it's going to be pretty good. See the LocationSmart stories the past few days for more on this.

tinus_hn 8y ago

It isn’t like they track the phone using the messages, instead you can more accurately track the phone if it is sending and receiving things; the network needs to know more to make the connection work. So sending the phone things that don’t do anything puts it in a state where you can track it more accurately, and then you need to cooperate with the provider to actually track it. They can track you the same way if they would just call you. That would be kind of conspicuous so that’s why they use silent messages instead. But it isn’t like you can send a message that tells the phone to reports its location.

ian0 8y ago
Generally you wouldn't need any type of messaging to the handset for this. As the phone periodically reports the signal strengths of surrounding cells for the purposes of handover just taking a glimpse of this is enough to triangulate well. As long as your phone is on your broadcasting. Indeed I think there are cases of tracing where the phone is switched off too, though not sure if they used historical cell data to guess at its location or there is some secret sauce. But - as you mention, you require to have connections into an operator to do all this.
- thesimon 8y ago
  >As the phone periodically reports the signal strengths of surrounding cells for the purposes of handover just taking a glimpse of this is enough to triangulate well. Not when the phone is idle and is not leaving a location area though. (At least that's my memory from my college class)
  - dfox 8y ago
    In GSM there is some periodic communication even in the idle non-moving case, but the period is on the order of hours.
  - ian0 8y ago
    For the purposes of location tracking I think thats acceptable :)
- codedokode 8y ago
  If you put your phone close to your amp or sound card and if they are not perfectly shielded then you can hear when the phone is transmitting the signal. You can hear modem-like sound before receiving a call or a message, and in idle mode the phone usually transmits something every 15-30 minutes.

ian0 8y ago

In practice you don't need SMS for this. Back in the day they would use lower level routing commands (eg SRI lookup) to find the VLR and then cell towers codes of the phone. Most of the time after a few pings you can get 2 or more cells, enough for a decent approximate location. There are DBs that match codes to lat/long. This works even if the number your tracing isn't on your network, but you need to have access to "a" network to do it. Lots of guys like SMS aggregators and small MVNOs have access to this. If you have access to the network where the user is you can use either dedicated location systems if they have them or use the VLR method above for a rough location. If you wanted to get very fancy you could log into a system closer to the towers and check the reports on cell tower power that your phone periodically sends to triangulate better. Or even match them off coverage maps. Under both systems above your phone is never party to comms (unlike actual SMS) so its impossible to know someone is tracing you.. This was 2G / early 3G systems. Loc tracking was more difficult with WCDMA, esp triangulation. Maybe thats changed. Or it hasn't because governments find it easier to check leaky app level APIs :P