[airprobe-main] Cell phone tracking using ss7 hlr lookups

[nibbler]

Hi Karsten, all,

On Thu, 25 Feb 2010 20:50:54 +0100
Karsten Nohl <nohl at virginia.edu> wrote:

> > My question is, is this MSC number, visible from the mobile phone  
> > side? If yes, somebody could actually wardrive, to get the MSC  
> > number-to-location mapping?
> > Can airprobe, or OpenBTS help?
> 
> Creating the {MSC -> location} mapping database would be a very  
> worthwhile exercise. The data collection would have to happen from  
> phones. Either we create an application for one of the popular phone  
> platforms (Symbian, Android, iPhone). Anybody on the list knows if  
> these phones expose the MSC number to application software?

Yes, the answer is: No. The phone does not know about this.

It would have to be a service that incorporates a user or mobile
phone software based part that knows about the location and a network
based part that can perform a SMS routing request. Both of these would
have to be correlated.

The implementation of this in a way that honors privacy as well as
security is left as an exercise to the reader.

This is most certainly not a task within the scope of osmocom-bb.

cheers,
nibbler

p.s. the relevant cell specific information that is known to the phone
can be found in the first seven fields e.g. here:
http://www.nobbi.com/btsdb.php?netw=all&type=c&search=__L447L