5 ms·

GSMA considers giving away mobile device locations through API

151 points by louismerlin 3y ago

michelangelo 3y ago
The reference repository - with some more information - seems to be on [1]. It also includes meeting minutes other than some early API spec. Ah! Meeting information are also included... you know, in case one is interested in attending.;-) [1] https://github.com/camaraproject/DeviceLocation https://github.com/camaraproject/DeviceLocation
- morkalork 3y ago
  I have a sudden urge to scrape github for zoom and teams meeting links!
  - jononor 3y ago
    ConfRoulette - visit a random web conference call.
barbazoo 3y ago
> The API allows an application to check if a mobile device is in proximity of a given location. The API request contains the location to be checked and an accuracy range in km (between 2km and 200km). The API response indicates whether the location is within the accuracy range of the last known location of the MSISDN. I'd say this can only "give away" the location if you already roughly know where someone is AND no rate limit exists.
- legulere 3y ago
  With adjustable accuracy range you can do binary search to find out where someone is.
  - PreInternet01 3y ago
    Which is where API rate limits come in. But if you really need to know where someone is, today, just be a telco with its own mobile infrastructure, and you can pretty much query the current network+cell ID of any of your subscribers without any limitations. Same goes for anyone with, say, subpoena powers in your jurisdiction and/or sufficient (social) engineering skills. And cell ID to geo mapping is also a solved problem...
    - mplewis 3y ago
      API rate limits don't keep you from doing the nasty stuff when you want to target one specific individual.
      - barbazoo 3y ago
        Depends on the limit and how it's implemented
      - wolpoli 3y ago
        Even if API rate limit exists and is strictly enforced, it's also easy to bypass it with multiple API keys and over time. Most people adhere to a weekly schedule.
        Koffiepoeder 3y ago
        Rate limits can also be based on the message contents, e. g. max 20 lookups per day for a cell.
        wongarsu 3y ago
        Assuming you already know what continent somebody is on, 20 circles of 200km radius (120 miles) should cover most of the major population centers. If you live out in Nebraska or the middle of the Sahara this attack is easy to defend against, but humans tend to clump up.
        3y ago
- downrightmike 3y ago
  Yeah, the apple air tags do something similar, the more devices the more accurate the location
- m4rtink 3y ago
  Sounds like you can just easily triangulete someone using this API.
Nextgrid 3y ago
> Retail marketing: a retailer Edge Application may query the API to verify that a user is close enough to a physical location before pushing a notification to them. Hopefully by the time this is rolled out, GDPR enforcement would’ve actually caught up and forced them to make it opt-in only.
tamimio 3y ago
So that FBI can raid people’s houses quickly now? No wonder a lot of services and apps are still keeping you tied to SMS.
- pohuing 3y ago
  Can't they already just query from network providers?
  - tamimio 3y ago
    Of course, but that takes time and some legalities, that’s why they use stingrays, or used to.. [1] [1] https://en.m.wikipedia.org/wiki/Stingray_use_in_United_States_law_enforcement https://en.m.wikipedia.org/wiki/Stingray_use_in_United_State...
- qbasic_forever 3y ago
  The FBI can already subpoena this information from your cell provider. They would even do this back in the analog cell phone days--Kevin Mitnick was nearly caught a few times because they were tracking the location of his analog cell phone.
  - tamimio 3y ago
    Keyword: Quickly. Unlike before, now they will add this API to their OSINT software (mostly Babel X) so they can quickly access that, why all the paperwork in this digital world!!?
    - qbasic_forever 3y ago
      Subpoenas can happen extremely quickly though so don't think it's a slow process today. They just need a DA to talk to a judge and get the paperwork approved. I've heard there are judges on call effectively 24/7 ready to approve subpoenas as necessary.
      - 3y ago
hexo 3y ago
What is this? Cyberstalking as a service or what? Is anything there even legal?
- rogerthis 3y ago
  As far as I know, they already do this (legally). They seem to be "just" standardizing for interoperability.
  - usr1106 3y ago
    Legally in what jurisdiction?
zeroCalories 3y ago
Wonder if this is in response to BeiDou having such tracking built in. There is a lot of potential value that businesses can derive from location data.
iSloth 3y ago
Services like this are actively in use by most Banks/ATMs around the world on most mobile carriers, just via creative but common reusing of long standing mobile/telco protocols. GSMA are actively attempting to lockdown them existing methods, as they’re built on trust in a very untrustworthy environment between carriers, and in some cases state actors. Sure on the face of it this isn’t brilliant to the average HN reader, but with context it’s a significant improvement vs where we are today.
- tamimio 3y ago
  How about an easier and better solution, stop using a broken protocol and enforcing the use of phone numbers as an identification for critical information or banking, there are better and more secure ways, and just keep the GSM network for emergencies and 911 calls.
  - DaiPlusPlus 3y ago
    > How about an easier and better solution Such as? Difficulty: nothing that requires an end-user to understand PKI; and also would not impede a lawful (and for the purposes of this conversation: ethically necessary) police wiretap.
    - tamimio 3y ago
      > nothing that requires an end-user to understand PKI None is needed, how hard it’s for a bank handing over physical tokens to the customers when they open an account or mailing them to existing ones? - You can loose them? Sure, just like any smartphone or even government ID, but the process after to replace is what will make you careful next time. - They can be stolen? Same as above - They can be used in banks or even for online banking, just tap it with your NFC enabled phone (yubico is an example) - They can be used by someone else? Sure, just like your phone. - However, no sim-swap attacks or similar, so in theory it’s better given no negligence from the users which is always the biggest risk anyway, but overall it’s an improvement. >and also would not impede a lawful (and for the purposes of this conversation: ethically necessary) police wiretap. Why would the police wiretap a banking verification, they can wiretap the transaction at the banks if they are legally authorized.
tamimio 3y ago
Also further reading it >Traffic management of drones: the Uncrewed Aircraft System Traffic Management or the drone operator can obtain drone location information from its GPS data, however this is vulnerable to jamming or spoofing. They can query the API to verify the drone location, e.g. for law enforcement purposes or to check compliance with approved flight plan. That’s not the real use case since not a single drone (commercial or consumer) is using the builtin GNSS in the modem (if any as most don’t even have modems) as they are usually weak compared to professional ones, the real reason is > or to check compliance with approved flight plan. There! Quick background: consumer drones like DJI are easily trackable by DJI AeroScope [1] which is actively used by police to track these drones in specific events, and now FAA is also requiring the remote ID is an extension to that to cover other drones. However, that doesn’t cover all drones, you have a sub-category of drones that are un-trackable, not easily anyway, the ones that fly over cellular networks, which is a challenge to know since from network perspective it’s just another UE, so what’s the easiest way to know?! Exactly, the builtin gnss, a quick query and you can tell, although I’m still not sure how they will distinguish the normal UE from drone UE. So I wouldn’t be surprised that people are disabling the builtin gnss either by the AT commands or just disconnecting the antennas. [1] https://www.dji.com/ca/mobile/aeroscope https://www.dji.com/ca/mobile/aeroscope
recursive4 3y ago
Misleading title.
- usr1106 3y ago
  Violating HN submission guidelines.
Johnie 3y ago
This has been around for ages. At least 20 years now. Loc-Aid had been one of the biggest provider of location data. Here are some articles: * https://www.nytimes.com/interactive/2018/12/10/business/location-data-privacy-apps.html https://www.nytimes.com/interactive/2018/12/10/business/loca... * https://readwrite.com/loc-aid-the-biggest-location-s/ https://readwrite.com/loc-aid-the-biggest-location-s/ * https://www.technologyreview.com/2011/12/09/189247/startup-turns-your-cell-phone-number-into-a-location-fix/ https://www.technologyreview.com/2011/12/09/189247/startup-t...
- joecool1029 3y ago
  Adding in, they are still around just having merged with LocationSmart: https://www.locationsmart.com/company/news/locationsmart-and-locaid-announce-merger https://www.locationsmart.com/company/news/locationsmart-and...
dfox 3y ago
The network simply has to have a pretty good idea of where the given MS is and how fast it is moving in which direction. The network maintains some kind of CDMA/OFDM/whatever radio link to said MS and thus either has to know that or learns the same data from behavior of the link. What this does is formalisation of how these data can be queried and used and by whom.
- dfox 3y ago
  And as for some additional context: before multi-constellation GNSS receivers and such stuff, multilateriation from GSM timing advance was a somewhat good way to get precise position fix, especially with GSM PLMN that has additional support for using it for position fixes.
theycallhermax 3y ago
Pretty concerned about GDPR compliance...

151 points by louismerlin 3y ago

The reference repository - with some more information - seems to be on [1]. It also includes meeting minutes other than some early API spec. Ah! Meeting information are also included... you know, in case one is interested in attending.;-) [1] https://github.com/camaraproject/DeviceLocation https://github.com/camaraproject/DeviceLocation

morkalork 3y ago
I have a sudden urge to scrape github for zoom and teams meeting links!
- jononor 3y ago
  ConfRoulette - visit a random web conference call.

barbazoo 3y ago

> The API allows an application to check if a mobile device is in proximity of a given location. The API request contains the location to be checked and an accuracy range in km (between 2km and 200km). The API response indicates whether the location is within the accuracy range of the last known location of the MSISDN. I'd say this can only "give away" the location if you already roughly know where someone is AND no rate limit exists.

legulere 3y ago
With adjustable accuracy range you can do binary search to find out where someone is.
- PreInternet01 3y ago
  Which is where API rate limits come in. But if you really need to know where someone is, today, just be a telco with its own mobile infrastructure, and you can pretty much query the current network+cell ID of any of your subscribers without any limitations. Same goes for anyone with, say, subpoena powers in your jurisdiction and/or sufficient (social) engineering skills. And cell ID to geo mapping is also a solved problem...
  - mplewis 3y ago
    API rate limits don't keep you from doing the nasty stuff when you want to target one specific individual.
    - barbazoo 3y ago
      Depends on the limit and how it's implemented
    - wolpoli 3y ago
      Even if API rate limit exists and is strictly enforced, it's also easy to bypass it with multiple API keys and over time. Most people adhere to a weekly schedule.
      - Koffiepoeder 3y ago
        Rate limits can also be based on the message contents, e. g. max 20 lookups per day for a cell.
        wongarsu 3y ago
        Assuming you already know what continent somebody is on, 20 circles of 200km radius (120 miles) should cover most of the major population centers. If you live out in Nebraska or the middle of the Sahara this attack is easy to defend against, but humans tend to clump up.
        3y ago
downrightmike 3y ago
Yeah, the apple air tags do something similar, the more devices the more accurate the location
m4rtink 3y ago
Sounds like you can just easily triangulete someone using this API.

Nextgrid 3y ago

> Retail marketing: a retailer Edge Application may query the API to verify that a user is close enough to a physical location before pushing a notification to them. Hopefully by the time this is rolled out, GDPR enforcement would’ve actually caught up and forced them to make it opt-in only.

tamimio 3y ago

So that FBI can raid people’s houses quickly now? No wonder a lot of services and apps are still keeping you tied to SMS.

pohuing 3y ago
Can't they already just query from network providers?
- tamimio 3y ago
  Of course, but that takes time and some legalities, that’s why they use stingrays, or used to.. [1] [1] https://en.m.wikipedia.org/wiki/Stingray_use_in_United_States_law_enforcement https://en.m.wikipedia.org/wiki/Stingray_use_in_United_State...
qbasic_forever 3y ago
The FBI can already subpoena this information from your cell provider. They would even do this back in the analog cell phone days--Kevin Mitnick was nearly caught a few times because they were tracking the location of his analog cell phone.
- tamimio 3y ago
  Keyword: Quickly. Unlike before, now they will add this API to their OSINT software (mostly Babel X) so they can quickly access that, why all the paperwork in this digital world!!?
  - qbasic_forever 3y ago
    Subpoenas can happen extremely quickly though so don't think it's a slow process today. They just need a DA to talk to a judge and get the paperwork approved. I've heard there are judges on call effectively 24/7 ready to approve subpoenas as necessary.
    - 3y ago

hexo 3y ago

What is this? Cyberstalking as a service or what? Is anything there even legal?

rogerthis 3y ago
As far as I know, they already do this (legally). They seem to be "just" standardizing for interoperability.
- usr1106 3y ago
  Legally in what jurisdiction?

zeroCalories 3y ago

Wonder if this is in response to BeiDou having such tracking built in. There is a lot of potential value that businesses can derive from location data.

iSloth 3y ago

Services like this are actively in use by most Banks/ATMs around the world on most mobile carriers, just via creative but common reusing of long standing mobile/telco protocols. GSMA are actively attempting to lockdown them existing methods, as they’re built on trust in a very untrustworthy environment between carriers, and in some cases state actors. Sure on the face of it this isn’t brilliant to the average HN reader, but with context it’s a significant improvement vs where we are today.

tamimio 3y ago
How about an easier and better solution, stop using a broken protocol and enforcing the use of phone numbers as an identification for critical information or banking, there are better and more secure ways, and just keep the GSM network for emergencies and 911 calls.
- DaiPlusPlus 3y ago
  > How about an easier and better solution Such as? Difficulty: nothing that requires an end-user to understand PKI; and also would not impede a lawful (and for the purposes of this conversation: ethically necessary) police wiretap.
  - tamimio 3y ago
    > nothing that requires an end-user to understand PKI None is needed, how hard it’s for a bank handing over physical tokens to the customers when they open an account or mailing them to existing ones? - You can loose them? Sure, just like any smartphone or even government ID, but the process after to replace is what will make you careful next time. - They can be stolen? Same as above - They can be used in banks or even for online banking, just tap it with your NFC enabled phone (yubico is an example) - They can be used by someone else? Sure, just like your phone. - However, no sim-swap attacks or similar, so in theory it’s better given no negligence from the users which is always the biggest risk anyway, but overall it’s an improvement. >and also would not impede a lawful (and for the purposes of this conversation: ethically necessary) police wiretap. Why would the police wiretap a banking verification, they can wiretap the transaction at the banks if they are legally authorized.

tamimio 3y ago

Also further reading it >Traffic management of drones: the Uncrewed Aircraft System Traffic Management or the drone operator can obtain drone location information from its GPS data, however this is vulnerable to jamming or spoofing. They can query the API to verify the drone location, e.g. for law enforcement purposes or to check compliance with approved flight plan. That’s not the real use case since not a single drone (commercial or consumer) is using the builtin GNSS in the modem (if any as most don’t even have modems) as they are usually weak compared to professional ones, the real reason is > or to check compliance with approved flight plan. There! Quick background: consumer drones like DJI are easily trackable by DJI AeroScope [1] which is actively used by police to track these drones in specific events, and now FAA is also requiring the remote ID is an extension to that to cover other drones. However, that doesn’t cover all drones, you have a sub-category of drones that are un-trackable, not easily anyway, the ones that fly over cellular networks, which is a challenge to know since from network perspective it’s just another UE, so what’s the easiest way to know?! Exactly, the builtin gnss, a quick query and you can tell, although I’m still not sure how they will distinguish the normal UE from drone UE. So I wouldn’t be surprised that people are disabling the builtin gnss either by the AT commands or just disconnecting the antennas. [1] https://www.dji.com/ca/mobile/aeroscope https://www.dji.com/ca/mobile/aeroscope

recursive4 3y ago

Misleading title.

usr1106 3y ago
Violating HN submission guidelines.

Johnie 3y ago

This has been around for ages. At least 20 years now. Loc-Aid had been one of the biggest provider of location data. Here are some articles: * https://www.nytimes.com/interactive/2018/12/10/business/location-data-privacy-apps.html https://www.nytimes.com/interactive/2018/12/10/business/loca... * https://readwrite.com/loc-aid-the-biggest-location-s/ https://readwrite.com/loc-aid-the-biggest-location-s/ * https://www.technologyreview.com/2011/12/09/189247/startup-turns-your-cell-phone-number-into-a-location-fix/ https://www.technologyreview.com/2011/12/09/189247/startup-t...

joecool1029 3y ago
Adding in, they are still around just having merged with LocationSmart: https://www.locationsmart.com/company/news/locationsmart-and-locaid-announce-merger https://www.locationsmart.com/company/news/locationsmart-and...

dfox 3y ago

The network simply has to have a pretty good idea of where the given MS is and how fast it is moving in which direction. The network maintains some kind of CDMA/OFDM/whatever radio link to said MS and thus either has to know that or learns the same data from behavior of the link. What this does is formalisation of how these data can be queried and used and by whom.

dfox 3y ago
And as for some additional context: before multi-constellation GNSS receivers and such stuff, multilateriation from GSM timing advance was a somewhat good way to get precise position fix, especially with GSM PLMN that has additional support for using it for position fixes.

theycallhermax 3y ago

Pretty concerned about GDPR compliance...