California Police Used Stingrays in Planes to Spy on Phones • Hacker News Board

Re: California Police Used Stingrays in Planes to Spy on Phones

#41

Post by detaro » Thu, Jan 28, 2016, 5:45 AM UTC

yuhong wrote: post #33

detaro wrote: post #29

Earlier quoted context omitted.

For GSM encryption, at least the commonly deployed variants, you do not need cooperation or stolen keys, you can just straight-up break it in a few minutes. (EDIT: might not be correct for up-to-date networks, see below) And if you impersonate a cell tower instead of passively sniffing, you can just turn encryption off or downgrade to a weak one.

I think the strongest one deployed today (A5/3 and GEA3) can be brute forced (64-bit), but typically takes far more than a few minutes.

You seem to be right. There is a paper about fast attacks against A5/3, but according to the authors it doesn't necessarily apply to real attack scenarios.

https://eprint.iacr.org/2010/013

Re: California Police Used Stingrays in Planes to Spy on Phones

#42

Post by jjwiseman » Thu, Jan 28, 2016, 5:46 AM UTC

josu wrote: post #7

"The Anaheim Police Department has acknowledged in new documents that it uses surveillance devices known as Dirtboxes—plane-mounted stingrays—on aircraft flying above the Southern California city that is home to Disneyland, one of the most popular tourist destinations in the world." According to the United States Census Bureau Anaheim County has a population of 346,997 (2014). Not being from the US, the fact that a c…

From looking at the FAA registry[1] and googling, it looks like the Anaheim police department operates 3 aircraft: N226PD, an AS350 helicopter; N326PD, another AS350 helicopter; N508BH, a Cessna 208B.

N508BH, the Cessna, is probably the one they're using for surveillance (See the 2012 OC Register article, "$2.2 million Cessna will help fight crime"[2]).

FlightAware shows that N508BH flies to northern california a lot. You can also see what looks like a probable surveillance flight path at http://flightaware.com/live/flight/N508BH/history/20151128/2...

Three aircraft for a California city with population 350K isn't crazy--Glendale and Burbank together have about 300K people, and their police forces have gone in together to create a "joint air support division" that has 4 helicopters[3].

  [1] http://www.faa.gov/licenses_certificates/aircraft_certification/aircraft_registry/releasable_aircraft_download/
  [2] http://www.ocregister.com/articles/air-356706-police-cessna.html
  [3] http://www.mdhelicopters.com/news/pdf/2014/111914.pdf

Re: California Police Used Stingrays in Planes to Spy on Phones

#43

Post by c22 » Thu, Jan 28, 2016, 6:02 AM UTC

voltagex_ wrote: post #37

jakeogh wrote: post #9

Earlier quoted context omitted.

Somewhere on my todo is "wire pager to cell phone", I think this would work by having a Asterisk system take the incoming call, send the (nationwide) page, pager is wired to phone, phone displays page as if it's an incoming call (while caller hears ringing), if callee decides to answer the GSM circuits get power and the phone calls the Asterisk box which patches the two together. If someone beats me to it, I'll buy o…

What advantage does this give you?

Presumably by using a one-way pager network it gives you the opportunity to be completely passive (thereby undetectable) until you decide to initiate an actual call.

Re: California Police Used Stingrays in Planes to Spy on Phones

#44

Post by tlrobinson » Thu, Jan 28, 2016, 6:03 AM UTC

samstave wrote: post #31

I wonder if the mobile cell tower they just put up outside of att park is a stingray, or a valid mobile tower

Given the cooperation between telcos and law enforcement, is there much difference?

There was temporary cell service at Burning Man for the first time this year, supposedly to "support" law enforcement. I guess you could interpret that in two different ways...

Re: California Police Used Stingrays in Planes to Spy on Phones

#45

Post by nikcub » Thu, Jan 28, 2016, 6:04 AM UTC

sandworm101 wrote: post #35

Cell towers are fixed objects. Has any work been done in detecting these planes based on the fact they are the only cell towers around moving at 100+kph? Could standard cellphone gear be sensitive enough to measure or at least guess at any doppler effect? I'm reminded of a British comedy that included a poacher being caught after a tagged animal was found to be traveling at 55mph down the m5.

In active mode the Stingray will broadcast a consistently strong signal to force targets to connect to it so that it can grab identifiers.

Some detection methods rely on this, as well as fingerprinting the Stingray (they negotiate a drop in encryption and ask the phone to max signal strength)

Current solutions for Android will point out new base stations that stand out and are likely an IMSI catcher:

http://secupwn.github.io/Android-IMSI-Catcher-Detector/

The better method, since the devices change and some are stationary, is to authenticate the real cell phone towers. This would involve either updating the GSM protocol, or having the carriers send out additional settings that make the phone aware of their legitimate sites and only connect to them.

iOS doesn't make these settings available in official API's, but if they did it would be possible to develop apps or features that could detect/avoid IMSI catchers.

The best non-tech solution is to have an anonymous IMSI. The attack relies on linking an IMSI to a real person, or the pattern behavior of a phone to a real person. So - anonymous SIM cards, change them up often, don't have it switched on with any of your real phones or real phones of friends, leave it switched off, etc.

Re: California Police Used Stingrays in Planes to Spy on Phones

#46

Post by schoen » Thu, Jan 28, 2016, 6:47 AM UTC

jakeogh wrote: post #9

wyldfire wrote: post #3

We've been hearing about Stingrays so much I wondered what the average Joe can do to avoid 'em. This is about the only thing I found, but it's promising for the long term -- http://secupwn.github.io/Android-IMSI-Catcher-Detector/ -- note that they list themselves as still in alpha and to expect false indications. I think the typical advice I've heard -- turning off your phone or turning off the baseband functionality…

Somewhere on my todo is "wire pager to cell phone", I think this would work by having a Asterisk system take the incoming call, send the (nationwide) page, pager is wired to phone, phone displays page as if it's an incoming call (while caller hears ringing), if callee decides to answer the GSM circuits get power and the phone calls the Asterisk box which patches the two together. If someone beats me to it, I'll buy o…

That's the most innovative idea I've heard of for reducing the impact of cell phone tracking in a long time!

Re: California Police Used Stingrays in Planes to Spy on Phones

#47

Post by rickycook » Thu, Jan 28, 2016, 6:52 AM UTC

guelo wrote: post #40

schoen wrote: post #20

Earlier quoted context omitted.

I'm still curious why they haven't decided that the fact that cell site simulators are possible is a super-grave bug! It's one thing to say "we think it might be legal to use a cell site simulator in some specific circumstances", but another thing to say "our cell phone infrastructure allows anyone to successfully pretend to be a tower and spy on people, and we're not going to try to fix that".

Harris Corp is not sneaking behind the FCC's back, the FCC specifically approved this use and licensed the device. In any other situation if someone tried to broadcast on licensed spectrum the FCC would come down on them like a ton of bricks.

I think his point though is that the wireless technology itself should make this impossible. The fact that it's not provably secure is problematic, because it's all well and good to say "you're not allowed to" until someone subverts the rules. People break laws all the time, including police

Re: California Police Used Stingrays in Planes to Spy on Phones

#48

Post by kuschku » Thu, Jan 28, 2016, 7:06 AM UTC

superuser2 wrote: post #34

ChuckMcM wrote: post #25

This kind of stuff always annoys me. One of the interesting things would be a 'home designed' cell system based on using unlicensed spectrum in the TV white spaces. Then you could build a system where a phone only answered a tower which sent out an ident frame which was cryptographically signed by a trusted key. And the response would be encrypted with that trusted key as well so only the cell tower could decrypt it.…

To get decent coverage you need to negotiate and pay for space, power, and internet connectivity on thousands of towers/tall buildings all owned by different people and municipalities who see you as somewhere between an annoyance and a revenue stream to exploit. Then you need a field workforce capable of performing maintenance at all of those sites (which requires making appointments and sometimes paying fees to the…

Running a cell provider is not that hard.

A lot of companies have their own towers that only provide service within of a city, and for events, you can even set up your own network, like the CCC always does during their conferences.

Having a national, or even global network is a lot harder, though.

Re: California Police Used Stingrays in Planes to Spy on Phones

#49

Post by guelo » Thu, Jan 28, 2016, 7:20 AM UTC

rickycook wrote: post #47

guelo wrote: post #40

Earlier quoted context omitted.

Harris Corp is not sneaking behind the FCC's back, the FCC specifically approved this use and licensed the device. In any other situation if someone tried to broadcast on licensed spectrum the FCC would come down on them like a ton of bricks.

I think his point though is that the wireless technology itself should make this impossible. The fact that it's not provably secure is problematic, because it's all well and good to say "you're not allowed to" until someone subverts the rules. People break laws all the time, including police

There are very few violations of the FCC's rules in general partly because the FCC regulates and certifies hardware manufacturers of radio equipment, so it's very difficult to purchase equipment that doesn't follow the rules. You can see this happening in the Wifi space where the FCC is clamping down on dd-wrt at the device manufacturer level because the software allows people to violate that frequency's rules. People with the right skills can build custom equipment to violate the rules but it's rare. And for the few people that do try to do things like pirate radio the FCC hunts them down and the penalties are stiff.

My point being that for the most part the FCC's regulatory scheme works at keeping people playing by the rules without extra layers of technically complicated security.

Re: California Police Used Stingrays in Planes to Spy on Phones

#50

Post by cmurf » Thu, Jan 28, 2016, 7:36 AM UTC

Joof wrote: post #39

cmurf wrote: post #30

Earlier quoted context omitted.

A big part of this problem was standing. There was no acknowledgment, in fact denial, that these things existed and were being used. It therefore was incumbent on the claimant to prove they existed. But now it's understood they exist, so that finally might work its way through the court system to see whether or not this is a legal search/seizure.

It's still up to the claimant to prove it was used on them personally and in some damaging manner. This has been a problem for people (Wikipedia) suing the NSA. Despite statistical analysis showing it's probably true, there isn't any 'beyond a doubt' evidence.

I don't think they have to show beyond a doubt. But you're correct they have to somehow demonstrate not just that this capability exists, but that it was used on them, and that the court can provide a remedy.

This is just one example of why whistle blower protections are necessary.