1 Author: Stefan Ćertić https://www.certic.info

Utilizing social engineering in Mobile Location Services.

Despite technology development, social engineering is still used in combination with advanced technologies to discover and prevent crimes.

However, in wrong hands, it might be a powerful tool to compromise your personal security. Especially today, when many hackers have access to the SS7 network, with the ability to execute GSM Map commands such as PSI (Provide Subscriber Information) and ATI (Anytime Interrogation) used to disclose your phone Cell ID location and similar data.

Let’s cover the scenario of an unsuccessful attempt to prevent locating.

  • Subject decides to become invisible and prevent anyone from locating them.
  • Subject throws away a mobile phone along with the SIM card and buys a new one or starts using 'Burner' phones.
  • Subject throws away their laptop and buys a new one, making sure no username that connects to them is ever used.
  • Subject even changes city and state.
  • Subject gets found within a day :)

The behavior is not easy for the subject to change. It's a spectrum of social habits that might be used hand in hand with advanced technology to make a perfect match of the location.

An Example:

  • Subject’s habit is to have breakfast at a restaurant at about 9 am. They enjoy Mexican food. The subject’s phone is likely to connect to a base station within the area of Mexican food restaurants.
  • Subject enjoys taking a long walk at the park after breakfast. It is likely to find the same IMSI at the park areas.
  • Subject likes rock music and has a habit of visiting gigs each Friday. Chances are the IMSI could be isolated from the group of IMSI’s collected within the other locations specific to known social behavior.

By collecting all the IMSI’s connected at the base stations within the radius of Mexican restaurants, parks, rock venues, making it more precise by limiting behavioral time, the intersection could very easily lead towards one single match.

SS7 Connectivity could be a very dangerous weapon in the wrong hands.