Security researcher finds a way to take off the ankle bracelet without alerting law enforcement agencies

Aug 12, 2015 13:02 GMT  ·  By

William Turner presented a talk at the DEF CON 2015 security conference in Las Vegas, detailing a method through which ankle tracking bracelets used by police forces around the globe can be disabled and allow criminals to get away.

Performing his tests on an ankle tracking bracelet supplied by GWG International, Mr. Turner, also known in hacking circles as AmmonRa, managed to evade the anti-tampering systems that come built-in with most of these devices, and took the bracelet off his foot without triggering alerts to law enforcement and similar authorities.

The exploitation procedure may be hard to reproduce without advanced technical knowledge

Because ankle tracking bracelets use mobile networks to communicate their current GPS coordinates, by placing the object inside a Faraday cage, Mr. Turner was able to stop the device from broadcasting data to law enforcement authorities.

At the same time, he spoofed a phone network inside the Faraday cage, which he used to trap the warning message sent to the police when he opened the ankle bracelet's case and took out the SIM card.

With the SIM card in his phone, he was then able to obtain its phone number by sending an SMS to another phone.

This number he later used with an online SMS spoofing service to send fake messages to law enforcement, messages crafted to look like the real ones, giving the impression that the person held in house arrest was at his home.

Mr. Turner did not disclose his findings to GWG International

In a statement for Motherboard, Mr. Turner said he didn't contact GWG International about their issue because he had bad experiences in the past while reporting other similar vulnerabilities with other companies.

According to his presentation, his methods should work in theory with other tracking ankle bracelet manufacturers, since most use the same design architecture for their devices.

Criminal groups should find his presentation very interesting, since, if put into practice, it would allow dangerous individuals to evade law enforcement while under house arrest. We expect an ankle bracelet exploitation kit to hit the Dark Web in the following weeks.