  In cellular networks, it can become necessary for authorities to physically
locate user devices for tracking criminals or illegal devices. While cellular
operators can provide authorities with cell information the device is camping
on, fine-grained localization is still required. Therefore, the authorized
agents trace the device by monitoring its uplink signals. However, tracking the
uplink signal source without its cooperation is challenging even for operators
and authorities. Particularly, three challenges remain for fine-grained
localization: i) localization works only if devices generate enough uplink
traffic reliably over time, ii) the target device might generate its uplink
traffic with significantly low power, and iii) cellular repeater may add too
much noise to true uplink signals. While these challenges present practical
hurdles for localization, they have been overlooked in prior works.
  In this work, we investigate the impact of these real-world challenges on
cellular localization and propose an Uncooperative Multiangulation Attack (UMA)
that addresses these challenges. UMA can 1) force a target device to transmit
traffic continuously, 2) boost the target's signal strength to the maximum, and
3) uniquely distinguish traffic from the target and the repeaters. Notably, the
UMA technique works without privilege on cellular operators or user devices,
which makes it operate on any LTE network. Our evaluations show that UMA
effectively resolves the challenges in real-world environments when devices are
not cooperative for localization. Our approach exploits the current cellular
design vulnerabilities, which we have responsibly disclosed to GSMA.
