[Paper Review] LTrack: Stealthy Tracking of Mobile Phones in LTE

Martin Kotuliak, Simon Erni+3 more|arXiv (Cornell University)|Jun 9, 2021

Advanced MIMO Systems Optimization31 references9 citations

TL;DR

LTrack presents a stealthy LTE tracking attack that combines passive uplink/downlink sniffing with a novel, low-power IMSI Extractor to enable persistent, high-accuracy tracking of mobile phones. By using surgical message overshadowing instead of fake base stations, it extracts IMSIs and binds them to TMSI-based location traces, achieving sub-6m localization accuracy in 90% of cases under line-of-sight conditions.

ABSTRACT

We introduce LTrack, a new tracking attack on LTE that allows an attacker to stealthily extract user devices' locations and permanent identifiers (IMSI). To remain stealthy, the localization of devices in LTrack is fully passive, relying on our new uplink/downlink sniffer. Our sniffer records both the times of arrival of LTE messages and the contents of the Timing Advance Commands, based on which LTrack calculates locations. LTrack is the first to show the feasibility of a passive localization in LTE through implementation on software-defined radio. Passive localization attacks reveal a user's location traces but can at best link these traces to a device's pseudonymous temporary identifier (TMSI), making tracking in dense areas or over a long time-period challenging. LTrack overcomes this challenge by introducing and implementing a new type of IMSI Catcher named IMSI Extractor. It extracts a device's IMSI and binds it to its current TMSI. Instead of relying on fake base stations like existing IMSI Catchers, which are detectable due to their continuous transmission, IMSI Extractor relies on our uplink/downlink sniffer enhanced with surgical message overshadowing. This makes our IMSI Extractor the stealthiest IMSI Catcher to date. We evaluate LTrack through a series of experiments and show that in line-of-sight conditions, the attacker can estimate the location of a phone with less than 6m error in 90% of the cases. We successfully tested our IMSI Extractor against a set of 17 modern smartphones connected to our industry-grade LTE testbed. We further validated our uplink/downlink sniffer and IMSI Extractor in a test facility of an operator.

Motivation & Objective

• Address the challenge of large-scale, stealthy tracking of mobile users in LTE networks.
• Overcome the limitations of passive localization, which cannot link location traces to individual devices without persistent identifiers.
• Develop a stealthier alternative to traditional IMSI catchers that rely on detectable fake base stations.
• Enable long-term tracking by binding TMSI-based location traces to permanent IMSI identifiers.
• Demonstrate feasibility through implementation on software-defined radio and real-world testing with 17 modern smartphones.

Proposed method

• Implement LTEprobe, the first white-box uplink/downlink LTE sniffer using software-defined radio to passively capture timing and content of LTE messages.
• Use timing-of-arrival measurements of uplink and downlink control messages, particularly Timing Advance Commands, to estimate device distance from the eNodeB.
• Apply surgical message overshadowing—injecting carefully timed, protocol-compliant messages—to trigger IMSI disclosure without active base station emulation.
• Combine the uplink/downlink sniffer with the IMSI Extractor to correlate TMSI-based location data with extracted IMSIs.
• Leverage DCI Format 0 and Format 1 messages to decode resource allocation and timing information for localization.
• Use the RRC Connection Request and Service Request procedures to capture initial uplink messages containing TMSI or IMSI during connection setup.

Experimental results

Research questions

• RQ1 Can passive uplink and downlink sniffing in LTE be used to achieve accurate, real-time device localization without active base station emulation?
• RQ2 Is it possible to extract a device’s permanent IMSI without using detectable fake base stations?
• RQ3 Can surgical message overshadowing be used to trigger IMSI disclosure while remaining undetectable by existing detection mechanisms?
• RQ4 To what extent can passive localization and IMSI extraction be combined to enable persistent, stealthy tracking of mobile users?
• RQ5 What is the achievable localization accuracy of such a system in real-world, line-of-sight conditions?

Key findings

• LTrack achieves a localization error of less than 6 meters in 90% of cases under line-of-sight conditions using passive uplink/downlink timing measurements.
• The IMSI Extractor successfully extracted IMSIs from 17 modern smartphones connected to an industry-grade LTE testbed without triggering detection via traditional IMSI catcher detection methods.
• The uplink/downlink sniffer LTEprobe was successfully validated in a real operator test facility, demonstrating reliable capture of control plane messages.
• The surgical message overshadowing technique enables IMSI extraction while remaining compliant with LTE protocol specifications, reducing detectability compared to traditional fake base station attacks.
• The combination of passive localization and stealthy IMSI extraction allows persistent tracking by correlating TMSI-based location traces with permanent IMSI identifiers.
• The attack remains undetected by existing IMSI catcher detection techniques because it avoids continuous high-power transmissions and uses protocol-compliant message injection.