Re: Mobile phones used as trackers

>                Mobile phones used as trackers 
>                BY MICHAEL EVANS AND NIGEL HAWKES 
>
>  MOBILE PHONES can be used as tracking devices to
>  pinpoint users within a few hundred yards, according to a
>  report yesterday. 
>
>  Sonntags Zeitung, published in Zurich, said Swiss police
>  had been secretly tracking mobile phone users through a
>  telephone company computer. 
>
>  "Swisscom [the state-owned telephone company] has
>  stored data on the movements of more than a million
>  mobile phone users and can call up the location of all its
>  mobile subscribers down to a few hundred metres and
>  going back at least half a year," the paper reports, adding:
>  "When it has to, it can exactly reconstruct, down to the
>  minute, who met whom, where and for how long for a
>  confidential tte--tte." 

Anyone who desires not to be constantly tracked should carry a one-way pager and keep your cell phone turned off.  This way you can return calls when it suits you and from a location of your choosing. In some U.S. localities I understand, it it possible to rent cellphone w/o offering any form of ID, only a deposit to cover the instrument and a prepayment for the airtime  This may be illegal in some EU countries.  To keep someone from correlating your pager info and cellular you'd want your callers to send 'coded' info, rather than phone numbers.

--Steve

PGP mail preferred, see  	http://www.pgp.com and
				http://web.mit.edu/network/pgp.html

RSA fingerprint: FE90 1A95 9DEA 8D61  812E CCA9 A44A FBA9
RSA key: http://keys.pgp.com:11371/pks/lookup?op=index&search=0x55C78B0D
---------------------------------------------------------------------
Steve Schear              | tel: (702) 658-2654
CEO                       | fax: (702) 658-2673
Lammar Laboratories       |
7075 West Gowan Road      |
Suite 2148                |
Las Vegas, NV 89129       | Internet: schear@lvdi.net
---------------------------------------------------------------------

-----BEGIN PGP SIGNED MESSAGE-----

In <v03102808b0d0b5632db7@[208.129.55.202]>, on 12/31/97 
   at 06:53 PM, Steve Schear <schear@lvdi.net> said:

>and keep your cell phone turned off.

It is my understanding that they can still track you with the cell phone
turned off so long as there is power going to the box (most auto cell
phones are hardwired into the cars electrical system).

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://users.invweb.net/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://users.invweb.net/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a-sha1
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNKwA+o9Co1n+aLhhAQG15gP/eG3w/i4L2HjWlacroj7BWLWZYgjoOWdn
yNxmvrOPQGSrrTBCO28dn3xOvJfz4z87G918h7pRZvxmhElNsHEbqCSK2CqsUCnZ
ahfF/aiXMm59ToF1HMMRXgpCxORORC58GxOkIR5zUp7HKjpPc6KhEdARovBfYnJM
LcxS2kcOJ+4=
=aljX
-----END PGP SIGNATURE-----

William H. Geiger III writes:
> In <v03102808b0d0b5632db7@[208.129.55.202]>, on 12/31/97
>    at 06:53 PM, Steve Schear <schear@lvdi.net> said:
> 
> >and keep your cell phone turned off.
> 
> It is my understanding that they can still track you with the cell phone
> turned off so long as there is power going to the box (most auto cell
> phones are hardwired into the cars electrical system).

How?


The little I know about cellular is that the handset only broadcasts
to the cells when its on.  Of course, 'on' and 'off' might mean
different things on a hand-held with limited battery life, and a
mobile that's connected to a large battery with a generator (car).
But it doesn't make sense to have the even the mobile system constantly
communicating with cells and getting hand-offs when the operator
has switched it 'off' and isn't using it-  it'd be taking up bandwidth
for no reason at all.  And we all know that cellular bandwidth is
in short supply.

-- 
Eric Murray  Chief Security Scientist  N*Able Technologies  www.nabletech.com
(email:  ericm  at  lne.com   or   nabletech.com)          PGP keyid:E03F65E5

In article <199801012054.PAA25297@users.invweb.net>,
"William H. Geiger III" <whgiii@invweb.net> writes:

> It is my understanding that they can still track you with the cell phone
> turned off so long as there is power going to the box (most auto cell
> phones are hardwired into the cars electrical system).

This is the funniest thing I have read in some time.  Assuming you
watch the show, I think you may have watched too many episodes of the
X-Files (TM).

When the subscriber unit (SU a.k.a. the cellular phone) is turned off,
"they" can't track you.  Now, it is possible that some cars have
built-in SUs that automatically power-on whenever the car is started.
In this case, the SU is clearly turned on and the user knows it.

Analog cellular phone systems in the U.S. only force the SU to
transmit when they need too.  As someone else already mentioned, from
the perspective of cellular system operators, bandwidth is in short
supply.  The cellular system operators wouldn't stand for a bunch of
unneeded transmissions "just to track location".

Based upon my own personal informal study [1] and some past knowledge
of cellular-type systems [2], in general, I believe the following
about analog cellular systems fielded in the U.S.:

1) "They" might be able to get a location reading at power-on time.
   The SU will check to see if it is being powered on within a
   different cell than it was last registered.  If the cell is
   different, then the SU transmits a message on the cell's control
   channel to reregister.  If the SU believes it is in the same cell,
   then it doesn't transmit anything at power-on time.  If the SU
   transmits, it will be a very short burst.  This would allow an
   attacker to see your location at power-on time.

2) When your SU is on, "they" can track your cell-to-cell movements.
   Cells are on the order of 1-10 miles in diameter.  The more
   populated the area (actually, the more likely the system is to be
   used in an area), the smaller the cell size.  "They" will only get
   a reading when you move between cells.  The system uses a form of
   hysteresis so your SU doesn't flip back and forth between two cells
   while you are on the "edge" between cell.  Actually, there are no
   real edges to the cells in an RF cellular system.  There is a bit
   of overlap between cells and the cell boundaries actually move over
   time due to environmental factors.  I.e. your SU might be
   stationary and yet decide to move to a different cell due to a
   stronger signal being seen from a different cell at a particular
   point in time.

3) "They" can track your fine-grain movement while you are engaged in
    a call or call setup.  This is because an SU transmits the entire
    time these activities take place.  Note that call setup can be for
    either incoming or outgoing calls.

The above appear to be the only times an SU will transmit in a
properly functioning analog cellular system.

Now, if we change the rules to allow an active "spoof" attack or
participation by the service provider, I speculate that specific
attacks against one or a few people (well, actually against their SUs)
could be waged to track their fine-grain movement:

4) Continuously inform the SU that an incoming call is waiting.  The
   user would get an indication of this attack since the phone would
   "ring" to signal an incoming call.  OTOH, perhaps, there is a way
   to inform the SU that an incoming call is waiting without allowing
   the phone to enter the final state where it begins to "ring".  A
   detailed study of the air interface and SU implementations would be
   required to understand if the silent attack is possible.  This
   attack could target one SU.  Even if direct indications were not
   seen by the user, battery life would be shortened somewhat.

5) Continuously force the SU to "see" a different cell code, thus
   forcing it to continuously reregister.  The user would get no
   direct indication during the attack.  However, battery life would
   be shortened somewhat.  There may be protection in the SU to ensure
   a minimum time period between reregistrations.  However, this would
   just limit the fineness of the tracking.  Again, detailed study
   would be required.  This attack would appear to target multiple SUs
   in a given area.

If you assume your attacker is capable of (4), (5) and similar tricks
and you have something to hide, then I suppose turning your SU off and
on is a wise course of action.

However, the coarse-grain (pin-point location but only at widely
dispersed points in time) tracking afforded by (1) and (2) seem like
minimal threats.  If you are concerned by (3), then please remind me
why you are using the analog cellular phone system.

Regards,
Loren

[1] My informal study was conducted with a Motorola Micro TAC Lite SU
    and an HP 2.9 GHz Spectrum Analyzer on 1/5/98 and 1/6/98.  My
    analog cellular service provider is Ameritech in the Chicagoland
    area.

[2] Disclaimer: I personally work on research related to the iDEN
    system (which is an advanced form of digital cellular with
    dispatch services and packet data) being rolled out nationwide in
    the U.S. by Nextel along with other local and international
    operators.  Motorola recently shipped the millionth SU for iDEN.
    I am only speaking for myself.  I have never worked on analog
    cellular systems nor read its specification.

-- 
Loren J. Rittle (rittle@comm.mot.com)	PGP KeyIDs: 1024/B98B3249 2048/ADCE34A5
Systems Technology Research (IL02/2240)	FP1024:6810D8AB3029874DD7065BC52067EAFD
Motorola, Inc.				FP2048:FDC0292446937F2A240BC07D42763672
(847) 576-7794				Call for verification of fingerprints.

-----BEGIN PGP SIGNED MESSAGE-----

In <199801061007.EAA28104@supra.rsch.comm.mot.com>, on 01/06/98 
   at 05:07 AM, "Loren J. Rittle" <rittle@supra.rsch.comm.mot.com> said:

>In article <199801012054.PAA25297@users.invweb.net>,
>"William H. Geiger III" <whgiii@invweb.net> writes:

>> It is my understanding that they can still track you with the cell phone
>> turned off so long as there is power going to the box (most auto cell
>> phones are hardwired into the cars electrical system).

>This is the funniest thing I have read in some time.  Assuming you watch
>the show, I think you may have watched too many episodes of the X-Files
>(TM).

The point I was trying to make, and you seemed to have missed, is that
just because you turn off the switch and the lights are not flashing and
blinking does not mean that power is not going to some of the circuits.

Take the following into account:

1) Location Tracking via Cell Phone is currently available using equipment
in place.

2) FCC mandates for Location tracking under the cover of 911 service

3) In field testing being done in several cities.

4) Lojack systems in place in several cities.

5) Systems in development for continuous traffic monitoring in the major
cities for automated traffic management to address the problems of "rush
hour" traffic.

6) GPS systems being built into productions vehicles at the factory.

It seems only natural to merge these into one piece of equipment using one
communication infrastructure. I think that if you take a closer look at
where various technologies and regulations are going to see that this is
less "X-File" like than you may think.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://users.invweb.net/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://users.invweb.net/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a-sha1
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNLJsa49Co1n+aLhhAQENDwQAg93KFwtcSlKX2MB/W/zaQ1DoPtPoo1/+
69qd8v9fTz35IOr8hKLiwwSf1jxqJNOMasU1jyjQtmPqZLVJFS6vQdgbj+9mcRaQ
VKL48HrmiGasEFYXlsVP7qBSPxYP63qxz3gs0zKlKVLrZ6dO+0dt+WXdc1lYCcaJ
a9BM9B3w/Pw=
=dULr
-----END PGP SIGNATURE-----

Loren J. Rittle wrote:

> If you assume your attacker is capable of (4), (5) and similar tricks
> and you have something to hide, then I suppose turning your SU off and
> on is a wise course of action.

Another attack that was recently described to me by someone in the industry
is to setup a three-way conversation, which basically is a cellular phone
tap.  The conversation could be split within the cell network to a silent
party more interested in your communications than your location.

--David Miller