GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier.

No ratings

Presented at NDSS 2018 by

Yongdae Kim

Byeongdo Hong

Sangwook Bae

To keep subscribers’ identity con dential, a cellular network operator must use a temporary identi er instead of a permanent one according to the 3GPP standard. Temporary identi ers include Temporary Mobile Subscriber Identity (TMSI) and Globally Unique Temporary Identi er (GUTI) for GSM/3G and Long-Term Evolution (LTE) networks, respectively. Unfortunately, recent studies have shown that carriers fail to protect subscribers in both GSM/3G and LTE mainly because these identi ers have static and persistent values. These identi ers can be used to track subscribers’ locations. These studies have suggested that temporary identi ers must be reallocated frequently to solve this privacy problem. The only mechanism to update the temporary identi er in current LTE implementations is called GUTI reallocation. We investigate whether the current implementation of the GUTI reallocation mechanism can provide enough security to protect subscribers’ privacy. To do this, we collect data by performing GUTI reallocation more than 30,000 times with 28 carriers across 11 countries using 78 SIM cards. Then, we investigate whether (1) these reallocated GUTIs in each carrier show noticeable patterns and (2) if they do, these patterns are consistent among different SIM cards within each carrier. Among 28 carriers, 19 carriers have easily predictable and consistent patterns in their GUTI reallocation mechanisms. Among the remaining 9 carriers, we revisit 4 carriers to investigate them in greater detail. For all these 4 carriers, we could nd interesting yet predictable patterns after invoking GUTI reallocation multiple times within a short time period. By using this predictability, we show that an adversary can track subscribers’ location as in previous studies. Finally, we present a lightweight and unpredictable GUTI reallocation mechanism as a solution.