3 ms·

That would make it harder by increasing the noise, but the signal is still there. Unless the receiving (target) phone knows the location of each of the senders

That would make it harder by increasing the noise, but the signal is still there. Unless the receiving (target) phone knows the location of each of the senders, it won't be able to vary the delays in a way that perfectly cancels out the signal. The only hope is to raise the noise floor enough that it would take an impractical number of texts to find the phone's location, which should definitely be possible with random delays.

jtriangle 3y ago
Or just turn off read receipts, problem solved.
- mdasen 3y ago
  These aren't read receipts, they're delivery reports from the network (not your device) that you can't control. From the paper: It works by leveraging SMS Delivery Reports, which are transmitted back to the sender when the network delivers the SMS to the recipient. The sender can request these reports, and there is no way for the recipient to prevent them.
  - russdill 3y ago
    So setup a gateway that redelivers SMS messages, preferably though some other protocol. The gateway of course sets up another possiblity for exploitation.
    - chx 3y ago
      My VoIP provider (anveo) redelivers SMS via email. My VoIP client also gets them. Good luck locating my phone.
_27d2 3y ago
Surely you could set a base value (say 1s) and wait to meet that? Then introduce a few hundred ms of variance either way.
- wongarsu 3y ago
  What the attack is measuring is basically the transmission delay to the device and back. The device (or the mobile network operator) doesn't know that delay, so they can't cancel it out. If you add a constant wait time you only accomplish something if the attacker doesn't know about that, otherwise they simply subtract that. And random variance just makes the measurement noisier, send enough SMS and the noise averages out.
  - deleted 3y ago
    [deleted]
  - swores 3y ago
    If they have each delivery report randomly pick one of several ranges of potential delay (0-2seconds, 1-3, 2-4) and then pick a random amount within whichever range is selected, would it still be possible to average out the randomness to get an accurate location? Actually I'm not sure that's any better than just having one wide range that it picks randomly from, but it could expand that range for each message over the first 5 per hour or whatever to make it harder to spam enough to average out without getting to extremely delayed delivered notifications?

jtriangle 3y ago

Or just turn off read receipts, problem solved.

mdasen 3y ago
These aren't read receipts, they're delivery reports from the network (not your device) that you can't control. From the paper: It works by leveraging SMS Delivery Reports, which are transmitted back to the sender when the network delivers the SMS to the recipient. The sender can request these reports, and there is no way for the recipient to prevent them.
- russdill 3y ago
  So setup a gateway that redelivers SMS messages, preferably though some other protocol. The gateway of course sets up another possiblity for exploitation.
  - chx 3y ago
    My VoIP provider (anveo) redelivers SMS via email. My VoIP client also gets them. Good luck locating my phone.

_27d2 3y ago

Surely you could set a base value (say 1s) and wait to meet that? Then introduce a few hundred ms of variance either way.

wongarsu 3y ago
What the attack is measuring is basically the transmission delay to the device and back. The device (or the mobile network operator) doesn't know that delay, so they can't cancel it out. If you add a constant wait time you only accomplish something if the attacker doesn't know about that, otherwise they simply subtract that. And random variance just makes the measurement noisier, send enough SMS and the noise averages out.
- deleted 3y ago
  [deleted]
- swores 3y ago
  If they have each delivery report randomly pick one of several ranges of potential delay (0-2seconds, 1-3, 2-4) and then pick a random amount within whichever range is selected, would it still be possible to average out the randomness to get an accurate location? Actually I'm not sure that's any better than just having one wide range that it picks randomly from, but it could expand that range for each message over the first 5 per hour or whatever to make it harder to spam enough to average out without getting to extremely delayed delivered notifications?