{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,30]],"date-time":"2026-01-30T08:33:52Z","timestamp":1769762032326,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":51,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,4]],"date-time":"2024-12-04T00:00:00Z","timestamp":1733270400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100003600","name":"Korean National Police Agency","doi-asserted-by":"publisher","award":["PR10-03-020-22"],"award-info":[{"award-number":["PR10-03-020-22"]}],"id":[{"id":"10.13039\/501100003600","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,4]]},"DOI":"10.1145\/3636534.3690709","type":"proceedings-article","created":{"date-parts":[[2024,12,4]],"date-time":"2024-12-04T23:13:18Z","timestamp":1733353998000},"page":"1530-1544","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Enabling Physical Localization of Uncooperative Cellular Devices"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-4726-8433","authenticated-orcid":false,"given":"Taekkyung","family":"Oh","sequence":"first","affiliation":[{"name":"KAIST, Daejeon, KR"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-3845-4060","authenticated-orcid":false,"given":"Sangwook","family":"Bae","sequence":"additional","affiliation":[{"name":"Cape, Washington, DC, US"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-3773-1263","authenticated-orcid":false,"given":"Junho","family":"Ahn","sequence":"additional","affiliation":[{"name":"KAIST, Daejeon, KR"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3509-5973","authenticated-orcid":false,"given":"Yonghwa","family":"Lee","sequence":"additional","affiliation":[{"name":"Theori, Seoul, Republic of Korea"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-2229-6533","authenticated-orcid":false,"given":"Tuan Dinh","family":"Hoang","sequence":"additional","affiliation":[{"name":"KAIST, Daejeon, KR"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8334-2262","authenticated-orcid":false,"given":"Min Suk","family":"Kang","sequence":"additional","affiliation":[{"name":"KAIST, Daejeon, KR"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8424-2602","authenticated-orcid":false,"given":"Nils Ole","family":"Tippenhauer","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Saarland, DE"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4879-1262","authenticated-orcid":false,"given":"Yongdae","family":"Kim","sequence":"additional","affiliation":[{"name":"KAIST, Daejeon, KR"}]}],"member":"320","published-online":{"date-parts":[[2024,12,4]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"v17.1.0","author":"GPP. TS","year":"2022","unstructured":"3GPP. TS 36.213, v17.1.0. 2022. Evolved Universal Terrestrial Radio Access (E-UTRA); Physical layer procedures."},{"key":"e_1_3_2_1_2_1","volume-title":"v17.0.0","author":"GPP. TS","year":"2022","unstructured":"3GPP. TS 36.305, v17.0.0. 2022. Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Stage 2 functional specification of User Equipment (UE) positioning in E-UTRAN."},{"key":"e_1_3_2_1_3_1","volume-title":"v16.6.0","author":"GPP. TS","year":"2021","unstructured":"3GPP. TS 36.321, v16.6.0. 2021. Evolved Universal Terrestrial Radio Access (E-UTRA); Medium Access Control (MAC) protocol specification."},{"key":"e_1_3_2_1_4_1","volume-title":"v17.3.0","author":"GPP. TS","year":"2023","unstructured":"3GPP. TS 36.331, v17.3.0. 2023. Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification."},{"key":"e_1_3_2_1_5_1","unstructured":"Aaronia. 2023. HyperLOG 7060X. https:\/\/aaronia.com\/en\/shop\/antennas-sensors\/logper-antennas\/aktive-emv-peilantenne-hyperlog7060x"},{"key":"e_1_3_2_1_6_1","unstructured":"Accuver. 2015. XCAL. http:\/\/www.accuver.com\/"},{"key":"e_1_3_2_1_7_1","unstructured":"Strategy Analytics. 2022. Cellular Baseband Processor Market Share. https:\/\/www.businesswire.com\/news\/home\/20220224005191\/en\/5G-Basebands-Capture-70-Percent-Revenue-Share-in-Q3-2021-Says-Strategy-Analytics"},{"key":"e_1_3_2_1_8_1","volume-title":"Watching the Watchers: Practical Video Identification Attack in LTE Networks. In 31st USENIX Security Symposium.","author":"Bae Sangwook","year":"2022","unstructured":"Sangwook Bae, Mincheol Son, Dongkwan Kim, CheolJun Park, Jiho Lee, Sooel Son, and Yongdae Kim. 2022. Watching the Watchers: Practical Video Identification Attack in LTE Networks. In 31st USENIX Security Symposium."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN58367.2023.00035"},{"key":"e_1_3_2_1_10_1","volume-title":"32nd USENIX Security Symposium.","author":"Bitsikas Evangelos","year":"2023","unstructured":"Evangelos Bitsikas, Theodor Schnitzler, Christina P\u00f6pper, and Aanjhan Ranganathan. 2023. Freaky Leaky SMS: Extracting User Locations by Analyzing SMS Timings. In 32nd USENIX Security Symposium."},{"key":"e_1_3_2_1_11_1","unstructured":"Minseok Chae. 2022. Manipulating 070 numbers into 010... Police arrest 15 members of voice phishing gang. https:\/\/biz.chosun.com\/topics\/topics_social\/2022\/07\/11\/K3QWGLQZKNAEPJUFPFPYT6M434"},{"key":"e_1_3_2_1_12_1","volume-title":"Watching your call: Breaking VoLTE Privacy in LTE\/5G Networks. arXiv preprint arXiv:2301.02487","author":"Cheng Zishuai","year":"2023","unstructured":"Zishuai Cheng, Mihai Ordean, Flavio D Garcia, Baojiang Cui, and Dominik Rys. 2023. Watching your call: Breaking VoLTE Privacy in LTE\/5G Networks. arXiv preprint arXiv:2301.02487 (2023)."},{"key":"e_1_3_2_1_13_1","volume-title":"LTE Location Technologies and Delivery Solutions. Bell Labs Technical Journal","author":"Cherian Suma S","year":"2013","unstructured":"Suma S Cherian and Ashok N Rudrapatna. 2013. LTE Location Technologies and Delivery Solutions. Bell Labs Technical Journal (2013)."},{"key":"e_1_3_2_1_14_1","unstructured":"Tom Cheshire. 2015. Fake mobile phone towers operating in the UK. http:\/\/news.sky.com\/story\/fake-mobile-phone-towers-operating-in-the-uk-10356433"},{"key":"e_1_3_2_1_15_1","volume-title":"Indoor Localization Without the Pain. In International Conference on Mobile Computing and Networking.","author":"Chintalapudi Krishna","year":"2010","unstructured":"Krishna Chintalapudi, Anand Padmanabha Iyer, and Venkata N Padmanabhan. 2010. Indoor Localization Without the Pain. In International Conference on Mobile Computing and Networking."},{"key":"e_1_3_2_1_16_1","unstructured":"AB Handshake Corporation. 2021. Interconnect Bypass - Which Regions of the World are Most Vulnerable? https:\/\/totaltele.com\/interconnect-bypass-which-regions-of-the-world-are-most-vulnerable\/"},{"key":"e_1_3_2_1_17_1","volume-title":"Survey of Cellular Mobile Radio Localization Methods: From 1G to 5G","author":"del Peral-Rosado Jos\u00e9 A","year":"2017","unstructured":"Jos\u00e9 A del Peral-Rosado, Ronald Raulefs, Jos\u00e9 A L\u00f3pez-Salcedo, and Gonzalo Seco-Granados. 2017. Survey of Cellular Mobile Radio Localization Methods: From 1G to 5G. IEEE Communications Surveys & Tutorials (2017)."},{"key":"e_1_3_2_1_18_1","unstructured":"Richard W. Downing. 2016. Geolocation Technology and Privacy. https:\/\/www.justice.gov\/sites\/default\/files\/testimonies\/witnesses\/attachments\/2016\/05\/12\/508_compliant_03-02-16_aag_downing_testimony_from_march_2_2016_hearing_re_geolocation_technology_and_privacy.pdf"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3495243.3560525"},{"key":"e_1_3_2_1_20_1","volume-title":"Mobile Phones: Location Tracking. https:\/\/ssd.eff.org\/module\/mobile-phones-location-tracking","author":"Electronic Frontier EFF","year":"2021","unstructured":"EFF (Electronic Frontier Foundation). 2021. Mobile Phones: Location Tracking. https:\/\/ssd.eff.org\/module\/mobile-phones-location-tracking"},{"key":"e_1_3_2_1_21_1","volume-title":"Breaking Band: Reverse Engineering and Exploiting the Shannon Baseband. Recon, jun","author":"Golde Nico","year":"2016","unstructured":"Nico Golde and Daniel Komaromy. 2016. Breaking Band: Reverse Engineering and Exploiting the Shannon Baseband. Recon, jun (2016)."},{"key":"e_1_3_2_1_22_1","unstructured":"Dan Goodin. 2013. The body-worn \"IMSI catcher\" for all your covert phone snooping needs. https:\/\/arstechnica.com\/information-technology\/2013\/09\/the-body-worn-imsi-catcher-for-all-your-covert-phone-snooping-needs\/"},{"key":"e_1_3_2_1_23_1","unstructured":"GSMA. 2020. COVID-19: Mobile Cyber Security & Fraud Threat Observations and Incidents. https:\/\/www.gsma.com\/newsroom\/wp-content\/uploads\/FASG-COVID-19-Situation-Report-April-2020.pdf"},{"key":"e_1_3_2_1_24_1","unstructured":"GSMA. 2024. Mobile Money Fraud Typologies and Mitigation Strategies. https:\/\/www.gsma.com\/solutions-and-impact\/connectivity-for-good\/mobile-for-development\/wp-content\/uploads\/2024\/03\/GSMA-Fraud-Typologies-04-03-24.pdf"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3558482.3590196"},{"key":"e_1_3_2_1_26_1","volume-title":"GUTI Re-allocation Demystified: Cellular Location Tracking with Changing Temporary Identifier. In Network and Distributed System Security Symposium.","author":"Hong Byeongdo","year":"2018","unstructured":"Byeongdo Hong, Sangwook Bae, and Yongdae Kim. 2018. GUTI Re-allocation Demystified: Cellular Location Tracking with Changing Temporary Identifier. In Network and Distributed System Security Symposium."},{"key":"e_1_3_2_1_27_1","unstructured":"E. Houweling. 2021. Chinese 'anti-fraud centre' becomes most downloaded app. https:\/\/www.verdict.co.uk\/chinese-anti-fraud-centre-becomes-most-downloaded-app\/?cf-view."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23442"},{"key":"e_1_3_2_1_29_1","unstructured":"Karri Ranta-Aho. 2010. Performance of 3GPP Rel-9 LTE positioning methods. https:\/\/www.cwins.wpi.edu\/workshop10\/pres\/std_2.pdf"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3317549.3323416"},{"key":"e_1_3_2_1_31_1","volume-title":"LTrack: Stealthy Tracking of Mobile Phones in LTE. In 31st USENIX Security Symposium.","author":"Kotuliak Martin","year":"2022","unstructured":"Martin Kotuliak, Simon Erni, Patrick Leu, Marc Roeschlin, and Srdjan Capkun. 2022. LTrack: Stealthy Tracking of Mobile Phones in LTE. In 31st USENIX Security Symposium."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"crossref","unstructured":"Swarun Kumar Ezzeldin Hamed Dina Katabi and Li Erran Li. 2014. LTE Radio Analytics Made Easy and Accessible. In ACM SIGCOMM.","DOI":"10.1145\/2619239.2626320"},{"key":"e_1_3_2_1_33_1","volume-title":"Location Leaks on the GSM Air Interface. In Network and Distributed System Security Symposium.","author":"Kune Denis Foo","year":"2012","unstructured":"Denis Foo Kune, John Koelndorfer, Nicholas Hopper, and Yongdae Kim. 2012. Location Leaks on the GSM Air Interface. In Network and Distributed System Security Symposium."},{"key":"e_1_3_2_1_34_1","volume-title":"30th USENIX Security Symposium.","author":"Lakshmanan Nitya","year":"2021","unstructured":"Nitya Lakshmanan, Nishant Budhdev, Min Suk Kang, Mun Choon Chan, and Jun Han. 2021. A Stealthy Location Identification Attack Exploiting Carrier Aggregation in Cellular Networks. In 30th USENIX Security Symposium."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179353"},{"key":"e_1_3_2_1_36_1","unstructured":"Josh McConnell. 2017. No the authorities can't actually track your iPhone's GPS without your permission and here's why. https:\/\/financialpost.com\/technology\/personal-tech\/no-the-authorities-cant-actually-track-your-iphones-gps-without-your-permission-and-heres-why"},{"key":"e_1_3_2_1_37_1","volume-title":"24th USENIX Security Symposium.","author":"Michalevsky Yan","year":"2015","unstructured":"Yan Michalevsky, Aaron Schulman, Gunaa Arumugam Veerapandian, Dan Boneh, and Gabi Nakibly. 2015. PowerSpy: Location Tracking using Mobile Device Power Analysis. In 24th USENIX Security Symposium."},{"key":"e_1_3_2_1_38_1","volume-title":"Accurate GSM Indoor Localization. In International Conference on Ubiquitous Computing.","author":"Otsason Veljo","year":"2005","unstructured":"Veljo Otsason, Alex Varshavsky, Anthony LaMarca, and Eyal de Lara. 2005. Accurate GSM Indoor Localization. In International Conference on Ubiquitous Computing."},{"key":"e_1_3_2_1_39_1","volume-title":"Battery Guru: Battery monitoring application. https:\/\/www.paget96projects.com\/battery-guru.html","year":"2019","unstructured":"Paget96 Projects. 2019. Battery Guru: Battery monitoring application. https:\/\/www.paget96projects.com\/battery-guru.html"},{"key":"e_1_3_2_1_40_1","volume-title":"24th USENIX Security Symposium.","author":"Reaves Bradley","year":"2015","unstructured":"Bradley Reaves, Ethan Shernan, Adam Bates, Henry Carter, and Patrick Traynor. 2015. Boxed Out: Blocking Cellular Interconnect Bypass Fraud at the Network Edge. In 24th USENIX Security Symposium."},{"key":"e_1_3_2_1_41_1","unstructured":"Ettus Research. 2014. USRP X310. https:\/\/www.ettus.com\/x310-kit\/"},{"key":"e_1_3_2_1_42_1","volume-title":"Breaking LTE on Layer Two. In IEEE Symposium on Security and Privacy.","author":"Rupprecht David","year":"2019","unstructured":"David Rupprecht, Katharina Kohls, Thorsten Holz, and Christina P\u00f6pper. 2019. Breaking LTE on Layer Two. In IEEE Symposium on Security and Privacy."},{"key":"e_1_3_2_1_43_1","volume-title":"SoK: Fraud in Telephony Networks. In IEEE European Symposium on Security and Privacy.","author":"Sahin Merve","year":"2017","unstructured":"Merve Sahin, Aur\u00e9lien Francillon, Payas Gupta, and Mustaque Ahamad. 2017. SoK: Fraud in Telephony Networks. In IEEE European Symposium on Security and Privacy."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23236"},{"key":"e_1_3_2_1_45_1","unstructured":"Software Radio Systems. 2019. srsRAN. https:\/\/www.srslte.com\/"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/3447993.3483255"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/TASSP.1983.1164062"},{"key":"e_1_3_2_1_48_1","unstructured":"UMA. 2024. Our public website about Enabling Physical Localization of Uncooperative Cellular Devices. https:\/\/sites.google.com\/view\/uma-site"},{"key":"e_1_3_2_1_49_1","volume-title":"A-J Van der Veen, and Arogyaswami Paulraj","author":"Vanderveen Michaela C","year":"1998","unstructured":"Michaela C Vanderveen, A-J Van der Veen, and Arogyaswami Paulraj. 1998. Estimation of Multipath Parameters in Wireless Communications. IEEE Transactions on Signal Processing (1998)."},{"key":"e_1_3_2_1_50_1","volume-title":"Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE. In 28th USENIX Security Symposium.","author":"Yang Hojoon","year":"2019","unstructured":"Hojoon Yang, Sangwook Bae, Mincheol Son, Hongil Kim, Song Min Kim, and Yongdae Kim. 2019. Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE. In 28th USENIX Security Symposium."},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2911558"}],"event":{"name":"ACM MobiCom '24: 30th Annual International Conference on Mobile Computing and Networking","location":"Washington D.C. DC USA","acronym":"ACM MobiCom '24","sponsor":["SIGMOBILE ACM Special Interest Group on Mobility of Systems, Users, Data and Computing"]},"container-title":["Proceedings of the 30th Annual International Conference on Mobile Computing and Networking"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3636534.3690709","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3636534.3690709","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:17:37Z","timestamp":1750295857000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3636534.3690709"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,4]]},"references-count":51,"alternative-id":["10.1145\/3636534.3690709","10.1145\/3636534"],"URL":"https:\/\/doi.org\/10.1145\/3636534.3690709","relation":{},"subject":[],"published":{"date-parts":[[2024,12,4]]},"assertion":[{"value":"2024-12-04","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}