Cellphone Backdoor

I was talking tonight with a friend of mine who is in the military and has also worked for one of the popular cell phone companies. He was telling me about when they would work with the authorities that they would track and pinpoint people by their cell phones, he also told me about how they would get into someones cellphone messaging service and copy over their contents. The next time their passcode doesn't work they have to call and have it reset. The point is he got to telling me about how you can call up a server that handles all the processes of leaving a message and enter a 6 digit passcode, thus allowing you to do as you wish.
Anyone ever heard of anyone doing anything like this?

This doesn't sound like a "backdoor" to me. Your cellphone messages are stored on a server. Therefore, any administrator with root access to that server would be able to read all these messages. It is quite possible, especially for a cellphone company, that the server can be accessed over the telephone with a passcode as you have mentioned.

The system could quite easily be set up to comply with privacy laws so that administrators cannot access customers' messages without first changing the password, in order to limit the abuse of this power.

So the cellphone company is not getting into the customers' messaging service, they are getting into their own database, which is where all the messages are stored.

Quote:

---

would track and pinpoint people by their cell phones,

---

Yeah they can see by which antenna (you know those big things) your signal is trong and locate you that way. or some cellphones have GPS, you could be traced by that too.

edit: how do you think they know when your out of their network range ?

Finding a backdoor into a cellphone content through GSM network is a new thing...

However tracking someone is a common phenomenon these days. Anybody can be tracked for the accuracy of nearly a few hundered meters, if he has his cellphone ON.

*** or if SHE has HER cellphone on ***

Quote:

---

accuracy of nearly a few hundered meters

---

part of the method is triangulation.... but it is better than normal RDF methods.. with GSM phones the Cell base determines your range accurate to a few meters to determine if your still in its cell.. at the same time you phone will be negotiating with (in an urban area) at least one other cell base.. that information is logged there as well.. the distance information will give an investigator at worst 2 possable locations.. so throw in a third base and bingo. we have you with in a few meters.. . each cell base coverage is not always circular.many are 90degs or less.. so then with only one base you may be within a few hundred meters..
rely on triangulation alone hmm .. yes you will be a any number of meters for margin of error..

I will go with Undies on this one.

Whilst the theory is fine, the reality is somewhat different, depending on your local topograhy and climatic conditions............you might actually be connecting to an antenna 5 clicks away, when the closest one is only 500 metres?

Obviously, I am not talking about fancy stuff with built-in GPS, just your regular cell phone.

Naturally, the more remote the area the more accurate the triangulation is likely to be. Built up areas produce all sorts of interference. You only have to look at TV reception to see that?

:)

I'm not sure if it is exactly GPS at work.

There are cellular sites (or relay stations) at various spatial points by which a particular cellular number can be located citing "At the vicinity of ___ street, ___ city" and this works when the cellular phone owner authorizes such a query by another within the same cell service provider. I think it is the relative distance of the cellphone from a given number of cell sites/stations that enables the immediate location identification.

If the other cell user can query another (of course, subject to prior authorization), then the service provider itself can track a particular cell unit at will.

BTW, this reminds me of the hacker tracking done in the US sometime in 1988-1990 where the hacker has been using a cellphone to link to the Internet. The hacker was located and subsequently nabbed at the precise location of the cellphone but I would presume that the system then was still analog since the article said something about azimuth which is all about RDF application.

Backdoor would be possible given the presence of cellphone virus particularly for those using multimedia messaging service capable units (e.g., Nokia 6600) and the proliferation of Bluetooth users. One nasty virus reported by the media is CommWarrior that drains the account by sending MMS to those listed in the directory.

Of course, if one is interested only in a particular cellphone, it would oblige a hacker/tracker to take the virus into a higher stage, right?

I remember this coming up in a telecommunications class in college. I thought they didn't track based on gps, I remeber the deiscussion being about how they kind of ocerlooked the pinpointing feature, especially with 911 service. I cant remember for the life of me but I thought there was some goofy way emergancy services could pinpoint your cell rather than gps, (perhaps tower trangulation)?

On A GSM network it works like this:

Each GSM tower location is known, either plotted during installation and fed in manually, or since each one has a GPS in it nowadays, they just turn it on and have it feed location data into the network. Also each tower has multiple sectors that it covers, usually three, but it can be more and in rare cases less. But It is like the tower being in the center of a pie, cut it into three equal slices and you get the gist. Directional antennas are used to keep the sectors more or less autonomous, though there is some overlap.

(Try drawing this out to make it easier to follow)

Now you have concentric rings around the tower, making it look like a big bullseye, these represent a timing advance. Since GSM uses TDMA, a digital nultiplexing technique in the time domain, you have to feed the handsets a psuedorandom number in order to overcome problems inherent with phones being different distances from the tower and using different time within the same RF frequency.

The network can have a specified handset re-authenticate on the network, this is something that happens all the time. When the phone authenticates on the network it is like the scene form "Horton Hears a Who" We are here, we are here.........

The network can then take the measurement from multiple towers within Line of Sight to the phone and correlate the tower location, sector and timing advance data from as many towers as can "hear" the phone. So now draw out severa towers with sectors and concentric rings and see where they overlap in space.

For a GSM network this is handled by the BSC or Base Station Controller.

Much easier to draw than it is to explain in text, but I hope ya'll can follow it.

Very different for CDMA or Analog systems, but pretty much the same for all TDMA multiplexed cell networks. (GSM, IS-136)

What if I said cell phone towers do no triangulation? And that it's the cell phone that decided when a hop to an adjacent cell was necessary. What if I said it's pretty near impossible to triangulate a cell phone because the data to do so does not even exist? GPS data is one thing, triagulation except in rare circumstances like a million to one is NOT possible.