21–30 of 79 posts
My biggest disillusionment when I learned about Stingrays was with the FCC. I had always thought of the FCC as good stewards of the broadcast spectrum and I didn't think they would ever approve shenanigans like the commercial development of radios that impersonate commercial broadcasters.
Is it illegal for an 'average joe' to build or develop one of these? Or is it just super high difficulty, ie the protocols just aren't published or [easily] reverse-engineered? Or right now is it just the illegality of call recording entirely that is "preventing" it's use?
Pretty sure I watched a conference talk that demoed a functional one that included pass-thru [to prevent suspicion/non-functional devices] to the real cell tower IIRC).
I'm just curious because obviously this isn't something you want just anyone to be able to build & deploy -- so much potential for abuse, anything from basic identity theft to serious securities fraud, and much more quickly becomes a very serious & probable threat once these become even just slightly more "mainstream" for the public / criminals / mafia / etc...
As of today, what stops someone (regardless of their intentions) from building or making their own Stingray-like device? Is it illegal for an 'average joe' to build or develop one of these? Or is it just super high difficulty, ie the protocols just aren't published or [easily] reverse-engineered? Or right now is it just the illegality of call recording entirely that is "preventing" it's use? Pretty sure I watched a c…
Theoretically calls are encrypted, however security researches have shown vulnerabilities due to old/incorrectly applied primitives. Not sure exactly which protocol versions this applies to. Stingray might just have asked nicely for the keys.
Commercial IMSI-catchers (made with the cooperation of carriers?) do exist, and there are some hobbyist proofs of concept. It is very hard to get caught doing passive receiving.
Transmit in a way that catches the eyes of carrier network engineers, though, and the federal government will come knocking with criminal charges.
FCC makes exceptions to most things for official purposes. For example, government installations can be licensed to operate cell phone jammers
Its on my list of projects to look at with SDR, but sadly I am no Fabrice Ballard (who no doubt has already built such a system as a proof of concept and then tossed it away)
As of today, what stops someone (regardless of their intentions) from building or making their own Stingray-like device? Is it illegal for an 'average joe' to build or develop one of these? Or is it just super high difficulty, ie the protocols just aren't published or [easily] reverse-engineered? Or right now is it just the illegality of call recording entirely that is "preventing" it's use? Pretty sure I watched a c…
It is illegal to make or sell or own radio hardware capable of operating on that spectrum, or modify other hardware to work on that spectrum, or hint to your users how they might modify your product to work on that spectrum, unless you are a licensee or have permission from one. Even Motorola can't take its new basebands out of RF-isolated testing facilities before FCC approval. Theoretically calls are encrypted, how…
So the most likely scenario is that the carriers are cooperating... Are they cooperating only with the US, or are they cooperating with other nations as well? Seems safe to assume they're cooperating with any/all nations that have a significant market for their products (ie leverage).
That's fairly scary though -- I assume the keys / encryption stays the same across similar networks, regardless of nation (given that phones continue to work abroad)? Perhaps the keys / encryption does differ by carrier, I'm not sure, but I'd definitely be curious. As long as they stay undetected, sounds like there is very little stopping COUNTRY_X from deploying these in COUNTRY_Y for their own gain, not to mention 'lower level' criminals / mafia / etc...
And obviously there are plenty of people out there (reverse-engineers, employees/insiders, et al) that have access to the keys...
Any idea if the exceptions that the FCC makes are public information, or obtainable via FOIA or similar? I'm guessing the FCC has a rigid "exception request process" in place and, hopefully, they only provide [super] limited-scope exceptions (without warrants, eh)... I'd love to see what exceptions are actually being made and what limits, if any, they contain.
Anyways, this is definitely pretty far outside of my realm of knowledge but I find the tech incredibly intriguing and very interesting nonetheless (and I agree with commentshere regarding the FCC).
Serious question: is this not seriously illegal?
I'm not well-versed on how cell carriers & landline carriers differ as far as common-carrier & wiretapping laws go.
As of today, what stops someone (regardless of their intentions) from building or making their own Stingray-like device? Is it illegal for an 'average joe' to build or develop one of these? Or is it just super high difficulty, ie the protocols just aren't published or [easily] reverse-engineered? Or right now is it just the illegality of call recording entirely that is "preventing" it's use? Pretty sure I watched a c…
Earlier quoted context omitted.
It is illegal to make or sell or own radio hardware capable of operating on that spectrum, or modify other hardware to work on that spectrum, or hint to your users how they might modify your product to work on that spectrum, unless you are a licensee or have permission from one. Even Motorola can't take its new basebands out of RF-isolated testing facilities before FCC approval. Theoretically calls are encrypted, how…
Very interesting, thank you. So the most likely scenario is that the carriers are cooperating... Are they cooperating only with the US, or are they cooperating with other nations as well? Seems safe to assume they're cooperating with any/all nations that have a significant market for their products (ie leverage). That's fairly scary though -- I assume the keys / encryption stays the same across similar networks, rega…
And if you impersonate a cell tower instead of passively sniffing, you can just turn encryption off or downgrade to a weak one.
My biggest disillusionment when I learned about Stingrays was with the FCC. I had always thought of the FCC as good stewards of the broadcast spectrum and I didn't think they would ever approve shenanigans like the commercial development of radios that impersonate commercial broadcasters.
Mine was that I thought this might stop once it became common knowledge - that courts would find it massively unconstitutional and it would end.