Quick edit: Whole US federal agencies have their own TSCM (technical surveillance countermeasures) staff entirely separate from the FCC. It is a job position at the dept of state. Evolved from bug detection and removal in the analog days to now encompass just about everything that can leak data.
how about quick switching between several [semi-stationary or briefcase carried] catchers (by analogy with an old Russia/USSR anti-aircraft tactic of quickly switching between several radars to avoid being detected and locked-in by an anti-radar missile :).
Verint engage gi2
The difference between an open source base station, and a homebuilt stingray in negligible.
While a grand or two's worth of radio hardware and however many weekends/evenings spent getting it all set up and the a software configured is _kind of_ expensive - it's effectively free at criminal org, corporate espionage, or state levels of action.
That's assuming you don't mind losing the transmitting hardware.
Even more so in 2018 where an IMSI catcher is only relevant/useful if you downgrade the target to 2G operation, which requires some kind of additional interference/jamming.
Unless they are using "stingray" as some kind of generic term for "device you use to intercept mobile phones" and there are now 3G/LTE "stingrays".
This would all be so simple to deal with if phones just displayed an "unlocked" or "downgraded" warning when operating in 2G or unencrypted mode ...
https://www.unwiredinsight.com/2014/highlights-of-3gpp-relea...
https://www.google.ca/search?q=3gpp+release+12+imsi+catcher&...
Relevant: http://www.cryptomuseum.com/covert/bugs/selectric/index.htm
Disinformation is a powerful tool.
I'd assume if it was run from an embassy it's not risky at all actually - they can just tell the FCC to pound sand
By knowing how to hack, one knows how to defend. But knowing how to defend also imparts the knowledge to hack.
Things were much the same back in the old days. If a telephone employee would find listening devices on the lines they were best off just quietly removing them and disposing of them. In the wild, surveillance equipment legally installed under a warrant looks exactly the same as all of the other kinds.
So in practice everyone got to tap phone lines, just as long as they didn't annoy anyone too official while doing so. The targets would never find out, unless the were willing to climb a telephone pole and check for themselves. The same thing will probably happen with stingray type devices. People like private investigators are likely already using them.
Why don't towers have a sort of encryption certificate verifying they're legit?
Why doesnt my cell provider just provide my phone a list of it's legit towers?
I can think of so many ways to solve this problem. But it's super hard to find any information if how this all works.
Pushback from various parties/regimes to keep this out of the standards. (e.g. the brits pushed back against strong encryption in the 1. GSM standards, https://www.aftenposten.no/verden/i/Olkl/Sources-We-were-pre... , and this has gone round to other countries pushing back in all kinds of ways since then.)
> Why doesnt my cell provider just provide my phone a list of it's legit towers?
It does, but not securely, so it can be faked. And since the towers does not authenticate themselves to the phone, you can just pretend to be a tower anyway.
> I can think of so many ways to solve this problem. But it's super hard to find any information if how this all works.
Sure, there's numerous ways to solve this - but there is little incentives to do so. it does get somewhat better - LTE can authenticate the network to the phone. But then there are countries where it's illegal to encrypt the public phone networks, so the protocol specs include an option to just disable this mechanism alltogether.
- Phone manufactures want to make their phones work everywhere, and the standards make them have all kinds of fall back mechanisms. So new LTE phones supports everything from LTE to the oldest GSM standards - they don't want a reputation of their phone not working when traveling to XXX.
- Telco companies gets pushback from governments, or in most cases around the world are owned and operated by governments - and they want backdoors into networks for surveillance.
- Telco equipment manufactures just make equipment that the telco companies wants. While all the standards for all the protocols and mechanisms work, they are product of a design-by-commitee, mostly made up by telco companies and telco manufacturers.
LTE and 3G solve the problem of authentication and encryption with the tower - the problem is that an attacker can, through interference or other means, force your handset to downgrade to 2G operation.
There is a very, very simple solution to this: display an icon/error when you downgrade to 2G and an even bigger icon when your 2G connection has no encryption (which is a valid option for a 2G connection).
This would be trivially simple but for reasons that are difficult to understand, phone OS and SIM providers do not do this.
"But it's super hard to find any information if how this all works."
I would recommend viewing/listening to the CCC (Congress) talks on GSM subjects that have been given over the last ten years. The osmocom "baseband-devel" is also a good mailing list to read the archives of ...
Good news I guess: AT&T turned off their 2G in December of 2016: https://www.att.com/esupport/article.html#!/wireless/KM10848...
It caused a bit of a stir in the alarm system market, because so many of the alarm panels connected to the home office via embedded 2G modems.
* a lot of legacy kit that’s expensive and hard to upgrade
* lots of things rely on backward compatibility
* attacks are still too difficult/expensive to the point that only hushed adversaries are performing attacks
* lack of motivation from cell providers
The security nerds make blustery comments that “anyone with motivation and a couple g’s worth of gear can target ANYONE.”
There are a bunch or problems with this argument. Gnuradio is not easy. You need to be in radio proximity to your target. Targeting someone requires some homework and luck (converting msisdn to timsi isn’t trivial. It’s doable, but the nerds double down on trivial, burning credibility by claiming triviality that can easily be argued against by half-wits.). The mbas (whose job it is to move the needle on billion dollar businesses) are getting asked to add expenses that require new software at the base stations, replacement of mobile endpoints, Break roaming and generate NO ADDITIONAL REVENUE BECAUSE CONSUMERS DONT REALLY CARE ABOUT SECURITY.
What would you do? These are not the best and brightest. They have built careers in avoiding risk.
The MNOs have a serious culture problem. The single best solution would be to incentivize competition, but the only thing the SV people want is net neutrality, which only entrenches the established players.
We only have ourselves to blame for this mess. The moves that would resolve this problem: taking on risk that most wont recognize will not move the needle in the right direction. Consumers think mobile internet is too pricey- they won’t pay more for security. The solution creates costs. We are doomed.
Eww. That’s nasty. ‘Piss poor’ is likely the phrase you’re looking for.
A5/2 which is the precursor to the encryption used for 3G and LTE is a lot better but there's still issues that are only just coming to light.
But in reality I have very little hope that they will.
New technology only stays in the hands of "our team" for so long before ultimately showing up on our doorstep. Especially when that's low cost surveillance technology...
(That list may sound idiotic, but you can't make this shit up - there's examples where I live of those exact agencies (and more) requesting warrantless access to telecommunications metadata: https://www.smh.com.au/technology/dozens-of-government-agenc... )
https://www.aftenposten.no/norge/i/kamWB/New-report-Clear-si...
https://commsrisk.com/reporters-find-20-imsi-catchers-in-lon...
Does turning one's phone off not disable pinging cell towers?
[1] https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec...
Turning your phone off usually does prevent tower pings, but some phones have been known to be sneaky.
I can't find any official documentation, but several Android phones I've owned over the years have powered themselves on when switched off and receiving a phone call.
https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec...
Do the Feds have bounties for catching illegal stingrays?
That being said, the intercepter would still know:
- phone being connected (IMEI)
- location of the phone
- which servers were requested, but not the encrypted content (yet)
- how much data was transmitted, "call time"
So if two phones were talking with each other over FaceTime connected to stingrays, a third-party can still deduce that they were talking to each other given the amount of data being transferred and when the requests occurred.
https://www.google.ca/search?q=ottawa+imsi+catcher&oq=ottawa...
> The devices, which are also known as stingrays or IMSI catchers, are commonly used by domestic law enforcement nationwide to locate a particular phone. Sometimes, they can also be used to intercept text messages and phone calls. Stingrays act as a fake cell tower and effectively trick a cell phone into transmitting to it, which gives up the phone’s location.
This is what the FBI and NSA love. They never try to protect the American public from such weaknesses in the country's infrastructure, although that is what they are supposed to be doing. All so they can spy on everybody, feed illegal parallel-construction activities, and generally nurture the growth of a police state; it is also clear by now that these agencies have been interfering with national politics. These are not friends of our freedoms.
[1] https://www.eff.org/pages/cell-site-simulatorsimsi-catchers
https://en.wikipedia.org/wiki/Timing_advance
(Note there's and "extended range" feature, where you can halve the cell site's capacity by waiting two timeslots in the TDMA schedule instead of one - which lets you go as far as 120km...)
Or are all of these stingrays still dependent upon forcing you to switch down to the older 2G protocols?
Triangulation?
