Location tracking of GSM cellphones: now easier (and cheaper) than ever

Computer scientists have devised a low-cost way to surreptitiously tease out key location details of people carrying cellphones that are connected to older carrier networks.

The attack, described in a research paper penned by members of the University of Minnesota's College of Science and Engineering, is most useful for determining whether a target is within a given geographic area as large as about 100 square kilometers (about 39 square miles) or as small as one square kilometer. It can also be used to pinpoint a target's location but only when the attacker already knows the city, or part of a city, the person is in. The attack works by exploiting features in GSM, or Global System for Mobile Communications, cellular networks that transmit data sent between base stations and phones in clear text. By simply calling the target's mobile number and monitoring the network's radio signals as it locates the phone, the attacker can quickly confirm if the person is located in what's known as the LAC, or Location Area Code. Attackers can use the same technique to determine if the target is within close proximity to a given base station within the LAC.