SMS messages, as a rule, do not directly identify where users are. However, a group of researchers recently revealed a study that, using some techniques, it is possible to use the traditional SMS system to identify the location of users.
The technique has been dubbed “Freaky Leaky SMS”, and uses the notification system that the SMS message has been delivered to try to deduce the location of users.
SMS messages can have a little “extra”, which allows notifying the senders of the same when the message is actually delivered to the recipients. This system is used via SMSC, an existing technology in operators to validate message delivery.
This type of system, as a rule, has a certain latency to send all the data. And it is at this point that the researchers found a way to validate the location of the senders.
By analyzing the latency delays in confirming that an SMS message has been received, it is possible to find the approximate location where users are located. This is because, the further away the users, the greater the network latency.
The researchers even developed an algorithm capable of identifying, with 96% accuracy, the location where recipients are located when located on two different continents, and with 86% accuracy when they are on the same continent.
This system, although it works, is not perfect. It requires investigators to have knowledge of the mobile network and perform various tests to accurately assess distance. At the same time, this technique is difficult to perform accurately in all tests and can vary from operator to operator.
Possibly, there are simpler and more reliable ways to obtain someone's location, if it is really necessary. However, even though this process is difficult to perform in the real world, and it can have its flaws, it is still considered a privacy flaw that can expose the location of end users without them realizing it.
At the same time, it is possible that the attack will evolve in the future, as more studies are done, and also the hardware will evolve to allow them to be carried out faster and more accurately against victims.
