Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

California Police Used Stingrays in Planes to Spy on Phones

wired.com

Post reply on HN
Print view View original

51–60 of 79 posts

Re: California Police Used Stingrays in Planes to Spy on Phones

#51

Post by jakeogh »

guelo wrote: post #49
rickycook wrote: post #47

Earlier quoted context omitted.

I think his point though is that the wireless technology itself should make this impossible. The fact that it's not provably secure is problematic, because it's all well and good to say "you're not allowed to" until someone subverts the rules. People break laws all the time, including police

There are very few violations of the FCC's rules in general partly because the FCC regulates and certifies hardware manufacturers of radio equipment, so it's very difficult to purchase equipment that doesn't follow the rules. You can see this happening in the Wifi space where the FCC is clamping down on dd-wrt at the device manufacturer level because the software allows people to violate that frequency's rules. Peopl…

Is it accurate to state they have made illegal (via 'rules') to use open source (user controlled) EM comm above 100um (below 3000GHz[1]) (except a few windows)? Or is it 9kHz to 275GHz? I bet when line of sight NIR comms (there's a nice window around 1550nm) get popular, they will (to stay relevant) want to 'regulate'[2] that too. Prior restraint is the problem here, anyone can mess with the spectrum with basic electronic skills, mandating 'approved' software seems less than pointless.

[1] http://www.spectrumwiki.com/wp/allocations101.pdf

[2] https://www.youtube.com/watch?v=gbYXBJOFgeI

Re: California Police Used Stingrays in Planes to Spy on Phones

#52

Post by akerro »

nikcub wrote: post #45
sandworm101 wrote: post #35

Cell towers are fixed objects. Has any work been done in detecting these planes based on the fact they are the only cell towers around moving at 100+kph? Could standard cellphone gear be sensitive enough to measure or at least guess at any doppler effect? I'm reminded of a British comedy that included a poacher being caught after a tagged animal was found to be traveling at 55mph down the m5.

In active mode the Stingray will broadcast a consistently strong signal to force targets to connect to it so that it can grab identifiers. Some detection methods rely on this, as well as fingerprinting the Stingray (they negotiate a drop in encryption and ask the phone to max signal strength) Current solutions for Android will point out new base stations that stand out and are likely an IMSI catcher: http://secupwn.g…

Sorry to say, but AIMSICD is a placebo. It does not detect anything. It was proved in their issues page many times, it never detected any threat, but detected dozens of false positives (also see their issues).

Re: California Police Used Stingrays in Planes to Spy on Phones

#53

Post by yuhong »

detaro wrote: post #41
yuhong wrote: post #33

Earlier quoted context omitted.

I think the strongest one deployed today (A5/3 and GEA3) can be brute forced (64-bit), but typically takes far more than a few minutes.

You seem to be right. There is a paper about fast attacks against A5/3, but according to the authors it doesn't necessarily apply to real attack scenarios. https://eprint.iacr.org/2010/013

Yea, related key attack I think.

Re: California Police Used Stingrays in Planes to Spy on Phones

#54

Post by Arnt »

sandworm101 wrote: post #35

Cell towers are fixed objects. Has any work been done in detecting these planes based on the fact they are the only cell towers around moving at 100+kph? Could standard cellphone gear be sensitive enough to measure or at least guess at any doppler effect? I'm reminded of a British comedy that included a poacher being caught after a tagged animal was found to be traveling at 55mph down the m5.

Yes, and yes.

A recent news report mentioned that a "cell tower" moved along with participants in a demonstration (in London IIRC), and also that it switched networks, so obviously someone noticed that.

Time division logic involves keeping track of how far each phone is from the tower. I think GSM uses 50m or 100m bands, ie. phones that are 200m from the tower time their broadcast bursts so as not to conflict with phones that are 100m from the tower. I don't know whether the distance information is available to the phones, or is kept internally in the tower, though. (I'm not an expert on this, I just heard that this need paid for a fair amount of NTP research/development, many years ago.)

Re: California Police Used Stingrays in Planes to Spy on Phones

#55

Post by EGreg »

wyldfire wrote: post #3

We've been hearing about Stingrays so much I wondered what the average Joe can do to avoid 'em. This is about the only thing I found, but it's promising for the long term -- http://secupwn.github.io/Android-IMSI-Catcher-Detector/ -- note that they list themselves as still in alpha and to expect false indications. I think the typical advice I've heard -- turning off your phone or turning off the baseband functionality…

Also turning off your phone might not actually work:

http://money.cnn.com/2014/06/06/technology/security/nsa-turn...

Re: California Police Used Stingrays in Planes to Spy on Phones

#57

Post by cnvogel »

Arnt wrote: post #54
sandworm101 wrote: post #35

Cell towers are fixed objects. Has any work been done in detecting these planes based on the fact they are the only cell towers around moving at 100+kph? Could standard cellphone gear be sensitive enough to measure or at least guess at any doppler effect? I'm reminded of a British comedy that included a poacher being caught after a tagged animal was found to be traveling at 55mph down the m5.

Yes, and yes. A recent news report mentioned that a "cell tower" moved along with participants in a demonstration (in London IIRC), and also that it switched networks, so obviously someone noticed that. Time division logic involves keeping track of how far each phone is from the tower. I think GSM uses 50m or 100m bands, ie. phones that are 200m from the tower time their broadcast bursts so as not to conflict with ph…

The parameter in GSM is called "Timing Advance". [http://www.qtc.jp/3GPP/Specs/GSM_GERAN/0510-8c0.pdf] and it's the length of time by which the mobile advances its transmission to the base station. So with increasing "timing advance", the mobile has to start transmitting earlier.

Units are GSM symbol periods, defined to be 48/13 µs = 3.69µs, which, multiplied by the speed of light (3⋅10^8 m/s) is 1108m. As the distance contributes in both ways (from base-station to handset, and back) one timing advance step is half the distance: about 550m.

The base station measures the relative phase of received transmissions from the mobile and will send information to the mobile to set or adjust the timing advance. [look for "timing advance" in http://www.etsi.org/deliver/etsi_gts/04/0408/05.03.00_60/gsm... which specifies the information elements that are exchanged.] So, yes, it should be possible to get TA for each cell the mobile exchanges data with from the phone.

Re: California Police Used Stingrays in Planes to Spy on Phones

#58

Post by coldcode »

TrevorJ wrote: post #23

Serious question: is this not seriously illegal?

It's not illegal unless you have standing to challenge it in court. Standing is used by government (at least in the US) to allow all sorts of likely illegal activities but without a court explicitly making it illegal they can get away with almost anything.

Re: California Police Used Stingrays in Planes to Spy on Phones

#59

Post by toomanybeersies »

jjwiseman wrote: post #42
josu wrote: post #7

"The Anaheim Police Department has acknowledged in new documents that it uses surveillance devices known as Dirtboxes—plane-mounted stingrays—on aircraft flying above the Southern California city that is home to Disneyland, one of the most popular tourist destinations in the world." According to the United States Census Bureau Anaheim County has a population of 346,997 (2014). Not being from the US, the fact that a c…

From looking at the FAA registry[1] and googling, it looks like the Anaheim police department operates 3 aircraft: N226PD, an AS350 helicopter; N326PD, another AS350 helicopter; N508BH, a Cessna 208B. N508BH, the Cessna, is probably the one they're using for surveillance (See the 2012 OC Register article, "$2.2 million Cessna will help fight crime"[2]). FlightAware shows that N508BH flies to northern california a lot…

That's phenomenal.

As a point of contrast, the New Zealand police own 1 helicopter, and contract out flying light aircraft to commercial operators.

Upon saying that, they often call upon the air force for logistical support (in particular for helicopter operations, usually for drug operations, such as airlifting cannabis for destruction, not for raids).

Re: California Police Used Stingrays in Planes to Spy on Phones

#60

Post by geggam »

coldcode wrote: post #58
TrevorJ wrote: post #23

Serious question: is this not seriously illegal?

It's not illegal unless you have standing to challenge it in court. Standing is used by government (at least in the US) to allow all sorts of likely illegal activities but without a court explicitly making it illegal they can get away with almost anything.

What happened to common sense spirit of the law violations ? The 4th amendment is plain English. Why do we let lawyers pollute the system with "translations"
Post reply on HN