3

My honeypot caught a hack attempt from an IP that was issued by Three Mobile Broadband (UK).

My immediate thought was that most probable explanation was that the user was in the UK and had his laptop hooked up to a cell data stick. But it got me thinking:

Would it be possible for the user to be in Romania, use a cellular phone or data stick from a UK provider, and get an IP from the UK? Or, would the user have to be in the UK to get an IP from the UK provider?

I do not know things like:

  • when does an IP address get assigned to a cellular Internet connection? As soon as it hits the local data network, or does it complete a cellular data network routing before it hits Internet?
  • are cell-to-cell connections possible on data networks? Like a VPN, but over GSM.
  • what options are there for a hacker to use cellular data networks to anonymize his traffic?
Improve this question

3 Answers 3

Reset to default
2

After reading a study about this (Geolocating IP Addresses in Cellular Data Networks), it looks like most of the cellular companies will assign a private IP address to your device, even though there are some which assign public IP addresses. Having a private IP address, means that you are behind a NAT owned by the provider, which is actually your gateway to the Internet. This gateway, not only that it can be (physically) in another country or even continent, but also sometimes the geolocalization will point it differently compared to its current location, due to administrative reasons.

For the anonymization of the data network, most probably using a VPN (most smartphones have this feature) is the way to go... as long as your VPN is anonymous (depending on your provider - no logs kept, etc).

Improve this answer
2
  • From the paper, you can be in Romania and get a UK IP. "mobile hosts exit the operator's network through a few gateways within the country, and these exit points may also be maintained while roaming" "hosts behind NATs appear from a few IP addresses per country, we shown how these IP addresses can cover hosts physically present in entire countries, across inter-national borders, and even continents"
    – schroeder ♦
    Jun 21, 2012 at 16:52
  • Yes, exactly...
    – Silviu
    Jun 21, 2012 at 16:54
0 
when does an IP address get assigned to a cellular Internet connection? As soon as it hits the local data network, or does it complete a cellular data network routing before it hits Internet?

They use a pool of addresses technical details of how their network is outside of the scope of this question( in other words every mobile provider would be different ).

are cell-to-cell connections possible on data networks? Like a VPN, but over GSM.

My Motorola Droid phone supports VPN applications.

what options are there for a hacker to use cellular data networks to anonymize his traffic?

There are lots of options again a specfic list would be outside of the scope of your question. Furthermore this is likely the case of somebody using their cell phone and tethering it to a more typical electronic device.

In the US I have been assigned an ip address registered to my provider, and looking at the Geo Location information for said address, it was 2 states away from where I live.

Improve this answer
0

Yes this is possible because the traffic goes via roaming interfaces "GR" to UK and therefore even when you are in Africa you get an IP from your home country.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .