4 ms·

> Due to the way cellular networks are designed, it is difficult to prevent Delivery Reports from being returned to the originator making it challenging to thwa

by paddw 3y ago

> Due to the way cellular networks are designed, it is difficult to prevent Delivery Reports from being returned to the originator making it challenging to thwart this covert attack without making fundamental changes to the network architecture Couldn't you just add a delay from the device?

Gh0stRAT 3y ago
That would make it harder by increasing the noise, but the signal is still there. Unless the receiving (target) phone knows the location of each of the senders, it won't be able to vary the delays in a way that perfectly cancels out the signal. The only hope is to raise the noise floor enough that it would take an impractical number of texts to find the phone's location, which should definitely be possible with random delays.
- jtriangle 3y ago
  Or just turn off read receipts, problem solved.
  - mdasen 3y ago
    These aren't read receipts, they're delivery reports from the network (not your device) that you can't control. From the paper: It works by leveraging SMS Delivery Reports, which are transmitted back to the sender when the network delivers the SMS to the recipient. The sender can request these reports, and there is no way for the recipient to prevent them.
    - russdill 3y ago
      So setup a gateway that redelivers SMS messages, preferably though some other protocol. The gateway of course sets up another possiblity for exploitation.
      - chx 3y ago
        My VoIP provider (anveo) redelivers SMS via email. My VoIP client also gets them. Good luck locating my phone.
- _27d2 3y ago
  Surely you could set a base value (say 1s) and wait to meet that? Then introduce a few hundred ms of variance either way.
  - wongarsu 3y ago
    What the attack is measuring is basically the transmission delay to the device and back. The device (or the mobile network operator) doesn't know that delay, so they can't cancel it out. If you add a constant wait time you only accomplish something if the attacker doesn't know about that, otherwise they simply subtract that. And random variance just makes the measurement noisier, send enough SMS and the noise averages out.
    - deleted 3y ago
      [deleted]
    - swores 3y ago
      If they have each delivery report randomly pick one of several ranges of potential delay (0-2seconds, 1-3, 2-4) and then pick a random amount within whichever range is selected, would it still be possible to average out the randomness to get an accurate location? Actually I'm not sure that's any better than just having one wide range that it picks randomly from, but it could expand that range for each message over the first 5 per hour or whatever to make it harder to spam enough to average out without getting to extremely delayed delivered notifications?
KirillPanov 3y ago
> Couldn't you just add a delay from the device? Cellular baseband software is ultra-closed-source. So no, you can't.
- dheera 3y ago
  Just don't give your cell number to people. I use a virtual number for almost everything. "I don't have a mobile phone and the law doesn't require me to have one" Or have 1 cell phone line that you give out as your number, set it up with an app to auto-forward SMS to an e-mail address and calls your actual cell phone, and put that phone in a locked garage in the middle of Iowa.
  - pempem 3y ago
    A lot of sites have started requiring a non VOIP phone number. Have you noticed this uptick? I used to use my google voice number for everything but it gets rejected as "not a real number" about 2-3x a week
    - dheera 3y ago
      Try using a non-US number. Many of them aren't good at differentiating VOIP/non-VOIP numbers in places other than the US.
    - KirillPanov 3y ago
      I don't use any services that validate phone numbers in any way. Why would I? Whenever a website asks me for a phone number I just make up random digits. Have never run into problems. Credit card companies definitely don't care what phone number I give to merchants.
      - pempem 3y ago
        The SaaS I've been encountering requires reporting a text received by the number to confirm the account.
      - 3y ago

by paddw 3y ago

Gh0stRAT 3y ago

That would make it harder by increasing the noise, but the signal is still there. Unless the receiving (target) phone knows the location of each of the senders, it won't be able to vary the delays in a way that perfectly cancels out the signal. The only hope is to raise the noise floor enough that it would take an impractical number of texts to find the phone's location, which should definitely be possible with random delays.

jtriangle 3y ago
Or just turn off read receipts, problem solved.
- mdasen 3y ago
  These aren't read receipts, they're delivery reports from the network (not your device) that you can't control. From the paper: It works by leveraging SMS Delivery Reports, which are transmitted back to the sender when the network delivers the SMS to the recipient. The sender can request these reports, and there is no way for the recipient to prevent them.
  - russdill 3y ago
    So setup a gateway that redelivers SMS messages, preferably though some other protocol. The gateway of course sets up another possiblity for exploitation.
    - chx 3y ago
      My VoIP provider (anveo) redelivers SMS via email. My VoIP client also gets them. Good luck locating my phone.
_27d2 3y ago
Surely you could set a base value (say 1s) and wait to meet that? Then introduce a few hundred ms of variance either way.
- wongarsu 3y ago
  What the attack is measuring is basically the transmission delay to the device and back. The device (or the mobile network operator) doesn't know that delay, so they can't cancel it out. If you add a constant wait time you only accomplish something if the attacker doesn't know about that, otherwise they simply subtract that. And random variance just makes the measurement noisier, send enough SMS and the noise averages out.
  - deleted 3y ago
    [deleted]
  - swores 3y ago
    If they have each delivery report randomly pick one of several ranges of potential delay (0-2seconds, 1-3, 2-4) and then pick a random amount within whichever range is selected, would it still be possible to average out the randomness to get an accurate location? Actually I'm not sure that's any better than just having one wide range that it picks randomly from, but it could expand that range for each message over the first 5 per hour or whatever to make it harder to spam enough to average out without getting to extremely delayed delivered notifications?

KirillPanov 3y ago

> Couldn't you just add a delay from the device? Cellular baseband software is ultra-closed-source. So no, you can't.

dheera 3y ago
Just don't give your cell number to people. I use a virtual number for almost everything. "I don't have a mobile phone and the law doesn't require me to have one" Or have 1 cell phone line that you give out as your number, set it up with an app to auto-forward SMS to an e-mail address and calls your actual cell phone, and put that phone in a locked garage in the middle of Iowa.
- pempem 3y ago
  A lot of sites have started requiring a non VOIP phone number. Have you noticed this uptick? I used to use my google voice number for everything but it gets rejected as "not a real number" about 2-3x a week
  - dheera 3y ago
    Try using a non-US number. Many of them aren't good at differentiating VOIP/non-VOIP numbers in places other than the US.
  - KirillPanov 3y ago
    I don't use any services that validate phone numbers in any way. Why would I? Whenever a website asks me for a phone number I just make up random digits. Have never run into problems. Credit card companies definitely don't care what phone number I give to merchants.
    - pempem 3y ago
      The SaaS I've been encountering requires reporting a text received by the number to confirm the account.
    - 3y ago