Tobias Engel Demonstrates SS7 MAP Phone Location Tracking at 25C3
At the 25th Chaos Communication Congress in Berlin on 27 December 2008, Tobias Engel showed that anyone with SS7 access, or a cheap commercial HLR-lookup service, could locate a mobile subscriber to roughly city level without the owner's knowledge.
02Deep-Dive Technical Analysis
Engel abused MAP_SEND_ROUTING_INFO_FOR_SM, which an SMSC sends to a subscriber's HLR before delivering an SMS. The HLR returns the IMSI and the global title of the serving MSC, and nothing correlates the query with an actual message. Because MSC global titles reveal country, network and often region, Engel mapped German MSC numbering by sending tens of thousands of night-time queries for phone-book numbers. He noted commercial lookup services sold these queries for cents and that SS7 has no authentication.
03Vulnerability & Exploit Flow
Unauthenticated MAP SendRoutingInfoForSM queries returning IMSI and serving-MSC global title for any MSISDN.
04Recommended Defense & Mitigation Protocol
SMS home routing (3GPP TR 23.840) to hide IMSI and MSC address, plus SS7 signaling firewalls filtering unsolicited inter-network MAP queries.
05Security Impact & Geopolitical Consequence
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.