Hacker News Reader

Comment by Gh0stRAT | Hacker News Reader

That would make it harder by increasing the noise, but the signal is still there.

Unless the receiving (target) phone knows the location of each of the senders, it won't be able to vary the delays in a way that perfectly cancels out the signal. The only hope is to raise the noise floor enough that it would take an impractical number of texts to find the phone's location, which should definitely be possible with random delays.

View on HN

Surely you could set a base value (say 1s) and wait to meet that? Then introduce a few hundred ms of variance either way.

What the attack is measuring is basically the transmission delay to the device and back. The device (or the mobile network operator) doesn't know that delay, so they can't cancel it out. If you add a constant wait time you only accomplish something if the attacker doesn't know about that, otherwise they simply subtract that. And random variance just makes the measurement noisier, send enough SMS and the noise averages out.

If they have each delivery report randomly pick one of several ranges of potential delay (0-2seconds, 1-3, 2-4) and then pick a random amount within whichever range is selected, would it still be possible to average out the randomness to get an accurate location? Actually I'm not sure that's any better than just having one wide range that it picks randomly from, but it could expand that range for each message over the first 5 per hour or whatever to make it harder to spam enough to average out without getting to extremely delayed delivered notifications?

Or just turn off read receipts, problem solved.

These aren't read receipts, they're delivery reports from the network (not your device) that you can't control. From the paper:

    It works by leveraging SMS Delivery Reports, which are transmitted back to the sender when the network delivers the SMS to the recipient. The sender can request these reports, and there is no way for the recipient to prevent them.

So setup a gateway that redelivers SMS messages, preferably though some other protocol. The gateway of course sets up another possiblity for exploitation.

My VoIP provider (anveo) redelivers SMS via email. My VoIP client also gets them. Good luck locating my phone.

Reply on news.ycombinator.com