Understanding Radio-Based Tracking Attacks

1. What Are UE Capabilities?

Every mobile device, or User Equipment (UE), needs to inform the network about its technical abilities. Can it handle high-speed data? Does it support voice calls over LTE? Which frequency bands can it use? This information is bundled into UE Capability messages.

These capabilities are broadly divided into two categories:

1. Core Network Capabilities: These relate to non-radio functions, such as supported security algorithms and session management features. They are typically included in the initial Attach Request message.
2. Radio Access Capabilities: This is the core of today's lesson. This information details the radio-specific features of the UE's modem (the baseband chipset). It's a highly detailed list including supported frequency bands, maximum data rates (UE Category), and complex combinations of technologies.

To function correctly, the base station (eNodeB) must ask the UE for its radio capabilities. This is done via a UE Capability Enquiry message, to which the UE responds with its UE Capability Information.

The following short reading explains the role of these capabilities and highlights the vulnerability we are about to exploit.

2. Fingerprinting a Device: The MNmap Attack

As the paper states, the fact that capabilities are exchanged before security is fully established creates a vulnerability. The set of radio capabilities is determined by the phone's manufacturer, its specific model, and the baseband modem it uses. This combination is often so specific that it can serve as a unique fingerprint for the device.

For example, an iPhone 14 Pro supports a different set of 5G band combinations than a Samsung Galaxy S23 Ultra. Even two phones with the same modem might report different capabilities due to manufacturer customizations. This uniqueness is what allows for a device-type identification attack.

A well-documented attack that leverages this is called Mobile Network Mapping (MNmap). An active attacker with a rogue base station can use it to build a map of devices in the area based on their hardware fingerprints.

Here is the attack flow:

1. Rogue eNodeB: The attacker sets up a rogue base station, just like in an IMSI catcher attack.
2. Capability Enquiry: When a victim device attempts to connect (e.g., via a Tracking Area Update), the attacker's rogue base station sends a UE Capability Enquiry message.
3. Capture Fingerprint: The UE, following standard protocol, dutifully responds with its UE Capability Information. This message contains the device's unique radio fingerprint, which the attacker captures.
4. Release: The attacker can then release the device, which will connect back to a legitimate network, often without the user noticing.

The following reading describes this attack in detail.

The key takeaway is that by matching these captured fingerprints over time, an attacker can track a physical device's movement across different locations, even if that device changes its temporary network identifiers (TMSI/GUTI).

3. Advanced Tracking with Radio Parameters

Fingerprinting is not the only way to use radio information for tracking. More advanced, stealthy attacks can use other unencrypted radio control messages to pinpoint a user's physical location passively. A state-of-the-art example of this is the LTRACK attack.

LTRACK combines two passive techniques:

1. Exploiting the Timing Advance (TA) Command:

   • To prevent uplink signals from multiple UEs from colliding, the eNodeB measures the signal propagation delay from a UE and tells it to adjust its transmission timing. This correction is sent in an unencrypted Timing Advance Command.
   • The TA value is directly proportional to the distance between the UE and the eNodeB.
   • A passive sniffer can read this command and determine the UE's distance from the cell tower, placing it on a ring around the tower.

2. Using Time Difference of Arrival (TDoA):

   • The attacker also uses their sniffer to measure the arrival time of the UE's uplink signal.
   • By calculating the difference in arrival time between the signal reaching the legitimate eNodeB and the attacker's sniffer, the attacker can place the UE on a hyperbola (or an ellipse, as described in the paper).

By intersecting the ring from the Timing Advance and the ellipse from the TDoA, the attacker can determine the UE's location with surprising accuracy (the paper reports an error of less than 6 meters).

The LTRACK paper is highly technical, but the core concepts are what matter for your understanding.

LTRACK demonstrates that by cleverly combining different pieces of unencrypted radio information, an attacker can achieve highly effective and stealthy tracking without ever needing to impersonate a network or request an IMSI.

Conclusion

In this lesson, we explored a different dimension of tracking in LTE networks. Instead of focusing on the subscriber's identity (IMSI), we learned how to target the physical device itself using its radio characteristics.

Key Takeaways:

• A UE's radio capabilities form a complex and often unique set of features that can be used as a device fingerprint.
• Attacks like MNmap use a rogue base station to actively query for these capabilities before security is established, allowing an attacker to identify and track specific device models.
• This fingerprint allows for persistent tracking of a device even if its temporary identifiers (like TMSI) change.
• More advanced passive attacks like LTRACK can use other unencrypted radio parameters, such as the Timing Advance Command, to stealthily calculate a device's physical location with high precision.
• Capability-based fingerprinting and location tracking can be combined to create a powerful system for monitoring devices.

Preview of the Next Lesson:

So far, we have focused on attacks that compromise privacy through tracking and identification. In the next lesson, we will pivot to attacks that compromise integrity. We will describe user-plane manipulation attacks, such as the aLTEr attack for DNS spoofing, and understand how an attacker can move from simply watching traffic to actively modifying it.