How a Hacker Proved Cops Used a Stingray to Find Him • Hacker News Board

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#31

Post by eftychis » Mon, Jul 02, 2018, 12:13 AM UTC

xyzzyz wrote: post #19

ggm wrote: post #18

Earlier quoted context omitted.

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

If the source IP is encrypted, the recipient needs to decrypt it first in order to be able to send a response. To decrypt it, it needs to either have some shared secret with the sender, or the sender needs to use the recipient's private key. The parties cannot obtain the shared secret the usual way, the Diffie-Helman exchange. It cannot be performed, because it requires back-and-forth communication, which we are tryi…

Nit-picking a bit/kind of augmenting your train of thought. You can have non-interactive Diffie-Helman key exchange (via a PKI). As you say, the client would need to know prior to that the public key/have access to the certificate and that would require certainly revamping the DNS approach we now have (even if we did not use DNS, we would still have to deal with DNS requests).

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#32

Post by eftychis » Mon, Jul 02, 2018, 12:20 AM UTC

erentz wrote: post #2

Jesus. I wanted to keep reading that article but half way through my phone was hot enough it was burning my fingers and 20% of my battery had disappeared. What on earth is Politico doing.

Yeah -- my advice is to use a good adblocker/tracker blocker (ublock origin, ghostery etc). Power consumption/CPU load and memory usage for browsers change considerably.

P.S. Yes, people are paying power and time (cpu/personal) to watch ads to pay (?!) for websites and provide private information.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#33

Post by greggarious » Mon, Jul 02, 2018, 12:25 AM UTC

ezoe wrote: post #9

I value the privacy so I don't own or use cellphone.

> I value the privacy so I don't own or use cellphone.

This is a little extreme, but I've started turning off my phone or putting it in airplane mode when not expecting a call.

In addition to not being as distracted, I've had a marked decrease in spam calls - I think they tend to mark phones that repeatedly send them straight to VM as "cold".

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#34

Post by pests » Mon, Jul 02, 2018, 12:35 AM UTC

greggarious wrote: post #33

ezoe wrote: post #9

I value the privacy so I don't own or use cellphone.

> I value the privacy so I don't own or use cellphone. This is a little extreme, but I've started turning off my phone or putting it in airplane mode when not expecting a call. In addition to not being as distracted, I've had a marked decrease in spam calls - I think they tend to mark phones that repeatedly send them straight to VM as "cold".

The phone being off or it being on airplane is no longer enough.

It is known that complete operating systems run on every chip on that phone of which you don't have knowledge of or access to.

To think a software security solution provided by an OS, a pretty high-level abstraction when considering hardware, of the ability to turn off the radio is insane in these days and ages.

Furthermore with permanent batteries (or with a backup battery hidden inside) being off to the user doesn't mean anything either.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#35

Post by caf » Mon, Jul 02, 2018, 12:36 AM UTC

sandov wrote: post #16

tehwebguy wrote: post #12

Earlier quoted context omitted.

Parent’s point was probably that the connection used is still traceable

Except that: 1) If you do it from home, the govt already knows where you live, or you can use proxies, or Tor, or a VPN. 2) If you don't do it from home, you are practically anonymous if you change your mac address and use someone else's wireless network, which are ubiquitous today in airports, restaurants, etc.

Another thing that is ubiquitous today in airports, restaurants etc. is CCTV.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#36

Post by greggarious » Mon, Jul 02, 2018, 12:38 AM UTC

pests wrote: post #34

greggarious wrote: post #33

Earlier quoted context omitted.

> I value the privacy so I don't own or use cellphone. This is a little extreme, but I've started turning off my phone or putting it in airplane mode when not expecting a call. In addition to not being as distracted, I've had a marked decrease in spam calls - I think they tend to mark phones that repeatedly send them straight to VM as "cold".

The phone being off or it being on airplane is no longer enough. It is known that complete operating systems run on every chip on that phone of which you don't have knowledge of or access to. To think a software security solution provided by an OS, a pretty high-level abstraction when considering hardware, of the ability to turn off the radio is insane in these days and ages. Furthermore with permanent batteries (or…

I'd love to read a source that describes this in more detail.

Assuming such an exploit exists, I don't think I'd be targeted with it. It's my understanding three letter agencies tend to hoard that sort of thing, not blast them at random privacy aficionados.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#37

Post by ra1n85 » Mon, Jul 02, 2018, 12:39 AM UTC

Ao7bei3s wrote: post #21

ggm wrote: post #18

Earlier quoted context omitted.

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

* Secure handshaking requires interactivity, unless you share secrets with your actual partner (no, your CA trust store isn't enough) in advance. So your first packet would leak it. * To return ICMP error messages ("destination unreachable"), otherwise you'd have long timeouts. * Ratelimiting outside the server (e.g. DDOS protection). Many ISPs do actually filter source IPs. (Of course you can't on the backbone, any…

+RPF requires it to help prevent spoofing (BCP 38)

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#38

Post by w8rbt » Mon, Jul 02, 2018, 12:41 AM UTC

Stingrays were being used as early as the 1990s by federal law enforcement. They were used to help locate Kevin Mitnick in North Carolina.

Edit - I recall reading that years ago in Tsutomu Shimomura's book 'Takedown' (published in 1996). Outside of this, I have no other reference. It's a good read BTW. https://www.amazon.com/Takedown-Pursuit-Capture-Americas-Com...

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#39

Post by greggarious » Mon, Jul 02, 2018, 12:46 AM UTC

caf wrote: post #35

sandov wrote: post #16

Earlier quoted context omitted.

Except that: 1) If you do it from home, the govt already knows where you live, or you can use proxies, or Tor, or a VPN. 2) If you don't do it from home, you are practically anonymous if you change your mac address and use someone else's wireless network, which are ubiquitous today in airports, restaurants, etc.

Another thing that is ubiquitous today in airports, restaurants etc. is CCTV.

> Another thing that is ubiquitous today in airports, restaurants etc. is CCTV.

Which is not retained indefinitely. If you're not committing a crime, that footage will be gone in 30-90 days.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#40

Post by ra1n85 » Mon, Jul 02, 2018, 12:46 AM UTC

ggm wrote: post #18

panarky wrote: post #6

The salient bit: Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of…

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

There's way too much baked into the current infrastructure (and two instances of layer 3) for this to be feasible. Access-control lists used for filtering, identifying candidate address for services like NAT, and critical data plane operations like path MTU discovery all rely on the source address being available in the IP header. Sure we could re-engineer things to not be this way, but at what cost?

Realistically (and unfortunately), if you don't want to be tracked then you're going to need to do some combination of tunneling, proxying, and encrypting.