The method does not give an absolutely accurate result, but quite reliably tracks the buyer to a certain part of the country. The technology improves the accuracy of the identification if the subscriber is monitored more carefully. Fortunately, there is protection against this.

How does it work

The basis of the method is the so-called “silent” or “zero” SMS, which is nothing new. While sending such a message, which is widely used by law enforcement, the calling party is not informed and does not know that he is interested in it, while the sender receives information about the location of the receiver, knowing which base station received the message. The new technique proposes to make everything easier, using only an application from the attacker side, without close interaction with the equipment of the operators..

The experiment was conducted in the USA, United Arab Emirates and seven European countries. It covered ten communication operators with LTE, LTE+ and 5G NSA networks. Technology gradually revealed where the recipient of the “silent” SMS is: on which continent, in which country and in which part of the country. The country identification accuracy reached 96%. Accuracy indicators decreased as countries were divided into a specific region. Thus, the accuracy of identifying one of the two regions was 86% in Belgium, 68% in Germany, 79% in Greece and 76% in the United Arab Emirates.

Information for locating the recipient is calculated on the basis of the delay in delivery of the SMS, taking into account the time elapsed from the moment the SMS is sent until the delivery of service notifications for the sending. (CP-ACK) from the reference network and delivery (SMS-DR, Delivery Report) from the operator whose network the recipient is currently connected to. All the computation work is provided by the machine learning algorithm. It is pre-trained by measuring delays in the location of the attacked receiver.

You can protect yourself from such an attack on the operator side when using SMS-DR message blocking or switching the SMS Main Forwarding service to non-transparent mode. In the latter case, the SMS will be sent to the main forwarding network with instant delivery notification, regardless of when the recipient physically receives the SMS.

Researchers promise to upload the code and detailed attack methodology to GitHub.