CAPEC-618: Cellular Broadcast Message Request

MITRE CAPEC attack pattern

Description

In this attack scenario, the attacker uses knowledge of the target’s mobile phone number (i.e., the number associated with the SIM used in the retransmission device) to cause the cellular network to send broadcast messages to alert the mobile device. Since the network knows which cell tower the target’s mobile device is attached to, the broadcast messages are only sent in the Location Area Code (LAC) where the target is currently located. By triggering the cellular broadcast message and then listening for the presence or absence of that message, an attacker could verify that the target is in (or not in) a given location.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-201

Prerequisites

• The attacker must have knowledge of the target’s mobile phone number.

Skills required

• Low: Open source and commercial tools are available for this attack.

Consequences

• Other: Other

Mitigations

• Frequent changing of mobile number.

Source

• MITRE CAPEC CAPEC-618