Hacker News Reader

Comment by paddw | Hacker News Reader

> Due to the way cellular networks are designed, it is difficult to prevent Delivery Reports from being returned to the originator making it challenging to thwart this covert attack without making fundamental changes to the network architecture

Couldn't you just add a delay from the device?

View on HN

That would make it harder by increasing the noise, but the signal is still there.

Unless the receiving (target) phone knows the location of each of the senders, it won't be able to vary the delays in a way that perfectly cancels out the signal. The only hope is to raise the noise floor enough that it would take an impractical number of texts to find the phone's location, which should definitely be possible with random delays.

Or just turn off read receipts, problem solved.

These aren't read receipts, they're delivery reports from the network (not your device) that you can't control. From the paper:

    It works by leveraging SMS Delivery Reports, which are transmitted back to the sender when the network delivers the SMS to the recipient. The sender can request these reports, and there is no way for the recipient to prevent them.

So setup a gateway that redelivers SMS messages, preferably though some other protocol. The gateway of course sets up another possiblity for exploitation.

My VoIP provider (anveo) redelivers SMS via email. My VoIP client also gets them. Good luck locating my phone.

Surely you could set a base value (say 1s) and wait to meet that? Then introduce a few hundred ms of variance either way.

What the attack is measuring is basically the transmission delay to the device and back. The device (or the mobile network operator) doesn't know that delay, so they can't cancel it out. If you add a constant wait time you only accomplish something if the attacker doesn't know about that, otherwise they simply subtract that. And random variance just makes the measurement noisier, send enough SMS and the noise averages out.

If they have each delivery report randomly pick one of several ranges of potential delay (0-2seconds, 1-3, 2-4) and then pick a random amount within whichever range is selected, would it still be possible to average out the randomness to get an accurate location? Actually I'm not sure that's any better than just having one wide range that it picks randomly from, but it could expand that range for each message over the first 5 per hour or whatever to make it harder to spam enough to average out without getting to extremely delayed delivered notifications?

> Couldn't you just add a delay from the device?

Cellular baseband software is ultra-closed-source. So no, you can't.

Just don't give your cell number to people. I use a virtual number for almost everything.

"I don't have a mobile phone and the law doesn't require me to have one"

Or have 1 cell phone line that you give out as your number, set it up with an app to auto-forward SMS to an e-mail address and calls your actual cell phone, and put that phone in a locked garage in the middle of Iowa.

A lot of sites have started requiring a non VOIP phone number. Have you noticed this uptick? I used to use my google voice number for everything but it gets rejected as "not a real number" about 2-3x a week

I don't use any services that validate phone numbers in any way. Why would I?

Whenever a website asks me for a phone number I just make up random digits. Have never run into problems. Credit card companies definitely don't care what phone number I give to merchants.

The SaaS I've been encountering requires reporting a text received by the number to confirm the account.

I had to validate a phone number just to order food at MULTIPLE restaurants in the bay area using the ordering interface at the QR code at the table. They did not have paper menus. An SMS confirmation was required just to place an order from sitting at the table. This wasn't even for payment, just for ordering.

The DMV also required a stupid SMS confirmation just to renew my car registration.

I use virtual numbers for pretty much everything, but yeah, welcome to 2023.

Try using a non-US number. Many of them aren't good at differentiating VOIP/non-VOIP numbers in places other than the US.

Reply on news.ycombinator.com