I wonder if the mobile cell tower they just put up outside of att park is a stingray, or a valid mobile tower
California Police Used Stingrays in Planes to Spy on Phones
31–40 of 79 posts
Re: California Police Used Stingrays in Planes to Spy on Phones
#32More info for anyone else who hasn't heard of Stingrays: > The StingRay is an IMSI-catcher (International Mobile Subscriber Identity), a controversial cellular phone surveillance device, manufactured by Harris Corporation.[2] Initially developed for the military and intelligence community, .... > Active mode operations 1. Extracting stored data such as International Mobile Subscriber Identity ("IMSI") numbers and Ele…
How fitting that they called it airplane mode. Looks like you might want to have that enabled when visiting that particular amusement park.
Or if you happen to live a few blocks away :-/.
Re: California Police Used Stingrays in Planes to Spy on Phones
#33Earlier quoted context omitted.
Very interesting, thank you. So the most likely scenario is that the carriers are cooperating... Are they cooperating only with the US, or are they cooperating with other nations as well? Seems safe to assume they're cooperating with any/all nations that have a significant market for their products (ie leverage). That's fairly scary though -- I assume the keys / encryption stays the same across similar networks, rega…
For GSM encryption, at least the commonly deployed variants, you do not need cooperation or stolen keys, you can just straight-up break it in a few minutes. (EDIT: might not be correct for up-to-date networks, see below) And if you impersonate a cell tower instead of passively sniffing, you can just turn encryption off or downgrade to a weak one.
I think the strongest one deployed today (A5/3 and GEA3) can be brute forced (64-bit), but typically takes far more than a few minutes.
Re: California Police Used Stingrays in Planes to Spy on Phones
#34This kind of stuff always annoys me. One of the interesting things would be a 'home designed' cell system based on using unlicensed spectrum in the TV white spaces. Then you could build a system where a phone only answered a tower which sent out an ident frame which was cryptographically signed by a trusted key. And the response would be encrypted with that trusted key as well so only the cell tower could decrypt it.…
To get decent coverage you need to negotiate and pay for space, power, and internet connectivity on thousands of towers/tall buildings all owned by different people and municipalities who see you as somewhere between an annoyance and a revenue stream to exploit. Then you need a field workforce capable of performing maintenance at all of those sites (which requires making appointments and sometimes paying fees to the property owners), a supply chain of spare parts, and the RF expertise and test equipment to measure and do quality control on their coverage all around the cities you're operating in.
Then you need a way to recoup all this cost.
Being a cell carrier takes staggering amounts of money and staggering amounts of schlep. It's not for hobbyists, hackers, or small companies (who are not in fact carriers but just resell and rebrand real carriers' services). There is a reason it's the domain of giant corporations run by the kind of people who make deals (and not write code) for a living.
Re: California Police Used Stingrays in Planes to Spy on Phones
#35Cell towers are fixed objects. Has any work been done in detecting these planes based on the fact they are the only cell towers around moving at 100+kph? Could standard cellphone gear be sensitive enough to measure or at least guess at any doppler effect?
I'm reminded of a British comedy that included a poacher being caught after a tagged animal was found to be traveling at 55mph down the m5.
Re: California Police Used Stingrays in Planes to Spy on Phones
#36This kind of stuff always annoys me. One of the interesting things would be a 'home designed' cell system based on using unlicensed spectrum in the TV white spaces. Then you could build a system where a phone only answered a tower which sent out an ident frame which was cryptographically signed by a trusted key. And the response would be encrypted with that trusted key as well so only the cell tower could decrypt it.…
You're better off assuming the network is hostile and then encrypting at a higher layer, ZRTP, OTR and so on.
Re: California Police Used Stingrays in Planes to Spy on Phones
#37We've been hearing about Stingrays so much I wondered what the average Joe can do to avoid 'em. This is about the only thing I found, but it's promising for the long term -- http://secupwn.github.io/Android-IMSI-Catcher-Detector/ -- note that they list themselves as still in alpha and to expect false indications. I think the typical advice I've heard -- turning off your phone or turning off the baseband functionality…
Somewhere on my todo is "wire pager to cell phone", I think this would work by having a Asterisk system take the incoming call, send the (nationwide) page, pager is wired to phone, phone displays page as if it's an incoming call (while caller hears ringing), if callee decides to answer the GSM circuits get power and the phone calls the Asterisk box which patches the two together. If someone beats me to it, I'll buy o…
What advantage does this give you?
Re: California Police Used Stingrays in Planes to Spy on Phones
#38As of today, what stops someone (regardless of their intentions) from building or making their own Stingray-like device? Is it illegal for an 'average joe' to build or develop one of these? Or is it just super high difficulty, ie the protocols just aren't published or [easily] reverse-engineered? Or right now is it just the illegality of call recording entirely that is "preventing" it's use? Pretty sure I watched a c…
You're probably thinking of Chris Paget's Defcon 18 talk demonstrating an OpenBTS/USRP/Asterix based 2G IMSI catcher.
Also, it's not entirely illegal to operate on some cellular frequencies which overlap with ham bands, if you're a licensed ham radio operator, which Chris apparently was (KJ6GCG).
He also had to disable encryption (illegal on ham bands), use extremely low power and a highly directional antenna (to ensure he didn't intercept anyone outside of the room), and ensure everyone inside the room was aware of the demonstration (IIRC there were signs outside the room). He also destroyed the USB stick the base station was writing to. Even then it was definitely a legal gray area...
Re: California Police Used Stingrays in Planes to Spy on Phones
#39Earlier quoted context omitted.
Mine was that I thought this might stop once it became common knowledge - that courts would find it massively unconstitutional and it would end.
A big part of this problem was standing. There was no acknowledgment, in fact denial, that these things existed and were being used. It therefore was incumbent on the claimant to prove they existed. But now it's understood they exist, so that finally might work its way through the court system to see whether or not this is a legal search/seizure.
It's still up to the claimant to prove it was used on them personally and in some damaging manner.
This has been a problem for people (Wikipedia) suing the NSA. Despite statistical analysis showing it's probably true, there isn't any 'beyond a doubt' evidence.
Re: California Police Used Stingrays in Planes to Spy on Phones
#40My biggest disillusionment when I learned about Stingrays was with the FCC. I had always thought of the FCC as good stewards of the broadcast spectrum and I didn't think they would ever approve shenanigans like the commercial development of radios that impersonate commercial broadcasters.
I'm still curious why they haven't decided that the fact that cell site simulators are possible is a super-grave bug! It's one thing to say "we think it might be legal to use a cell site simulator in some specific circumstances", but another thing to say "our cell phone infrastructure allows anyone to successfully pretend to be a tower and spy on people, and we're not going to try to fix that".
Harris Corp is not sneaking behind the FCC's back, the FCC specifically approved this use and licensed the device. In any other situation if someone tried to broadcast on licensed spectrum the FCC would come down on them like a ton of bricks.