Freaky Leaky SMS: Extracting User Locations by Analyzing SMS Timings
Freaky Leaky SMS: Extracting User Locations by Analyzing SMS Timings
复制标题
DOI：
10.48550/arxiv.2306.07695
复制
发表时间：
2023-06
期刊：
影响因子：
--
通讯作者：
Evangelos Bitsikas;Theodor Schnitzler;Christina Popper;Aanjhan Ranganathan
中科院分区：
文献类型：
--
作者：
Evangelos Bitsikas;Theodor Schnitzler;Christina Popper;Aanjhan Ranganathan
短消息服务（SMS）自从在2G蜂窝网络中引入以来一直是最流行的通信信道之一。在本文中，我们证明，只是定期接收无声的短信打开一个隐形的侧通道，允许其他定期网络用户推断的SMS收件人的下落。其核心思想是，接收短信不可避免地会生成发送报告，其接收会在发送方处赋予定时攻击向量。我们在不同的国家、运营商和设备上进行了实验，以证明攻击者可以通过分析典型接收者位置的定时测量来推断SMS接收者的位置。我们的研究结果表明，在训练ML模型后，SMS发送者可以准确地确定收件人的多个位置。例如，我们的模型在不同国家的位置上达到了96%的准确率，在比利时的两个位置上达到了86%。由于蜂窝网络的设计方式，很难防止递送报告被返回给发起者，这使得在不对网络架构进行根本改变的情况下挫败这种隐蔽攻击具有挑战性。
Short Message Service (SMS) remains one of the most popular communication channels since its introduction in 2G cellular networks. In this paper, we demonstrate that merely receiving silent SMS messages regularly opens a stealthy side-channel that allows other regular network users to infer the whereabouts of the SMS recipient. The core idea is that receiving an SMS inevitably generates Delivery Reports whose reception bestows a timing attack vector at the sender. We conducted experiments across various countries, operators, and devices to show that an attacker can deduce the location of an SMS recipient by analyzing timing measurements from typical receiver locations. Our results show that, after training an ML model, the SMS sender can accurately determine multiple locations of the recipient. For example, our model achieves up to 96% accuracy for locations across different countries, and 86% for two locations within Belgium. Due to the way cellular networks are designed, it is difficult to prevent Delivery Reports from being returned to the originator making it challenging to thwart this covert attack without making fundamental changes to the network architecture.