In cellular networks, authorities may need to physically locate user devices to track criminals or illegal equipment. This process involves authorized agents tracing devices by monitoring uplink signals with cellular operator assistance. However, tracking uncooperative uplink signal sources remains challenging, even for operators and authorities. Three key challenges persist for fine-grained localization: i) devices must generate sufficient, consistent uplink traffic over time, ii) target devices may transmit uplink signals at very low power, and iii) signals from cellular repeaters may hinder localization of the target device. While these challenges pose significant practical obstacles to localization, they have been largely overlooked in existing research. This work examines the impact of these real-world challenges on cellular localization and introduces the Uncooperative Multiangulation Attack (UMA) to address them. UMA can 1) force a target device to transmit traffic continuously, 2) boost the target's signal strength to maximum levels, and 3) uniquely differentiate between signals from the target and repeaters. Importantly, UMA operates without requiring privileged access to cellular operators or user devices, making it applicable to any LTE network. Our evaluations demonstrate that UMA effectively overcomes practical challenges in physical localization when devices are uncooperative.

翻译：在蜂窝网络中，执法机构可能需要物理定位用户设备以追踪罪犯或非法设备。该过程涉及授权代理在蜂窝运营商协助下通过监测上行链路信号来追踪设备。然而，即使对于运营商和执法机构而言，追踪非合作上行链路信号源仍具挑战性。细粒度定位存在三个关键挑战：i) 设备必须持续产生充足且稳定的上行流量，ii) 目标设备可能以极低功率发射上行信号，iii) 蜂窝中继器信号可能干扰目标设备的定位。尽管这些挑战对实际定位构成重大障碍，现有研究却普遍忽视了这些问题。本研究探讨了这些现实挑战对蜂窝定位的影响，并提出了非合作多边定位攻击（UMA）以应对这些挑战。UMA能够：1) 强制目标设备持续发射流量，2) 将目标信号强度提升至最高水平，3) 独特区分目标设备与中继器的信号。重要的是，UMA无需蜂窝运营商或用户设备的特权访问权限，可适用于任何LTE网络。评估结果表明，当设备处于非合作状态时，UMA能有效克服物理定位中的实际挑战。