How a Hacker Proved Cops Used a Stingray to Find Him • Hacker News Board

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#51

Post by pests » Mon, Jul 02, 2018, 1:17 AM UTC

Arbalest wrote: post #43

pests wrote: post #34

Earlier quoted context omitted.

The phone being off or it being on airplane is no longer enough. It is known that complete operating systems run on every chip on that phone of which you don't have knowledge of or access to. To think a software security solution provided by an OS, a pretty high-level abstraction when considering hardware, of the ability to turn off the radio is insane in these days and ages. Furthermore with permanent batteries (or…

I'm curious as to where this backup battery thing came from? Surely the likes of ifixit would notice extra batteries. If you're going to assert that such a thing is still hidden, then frankly, your mindset is such that there is no lengths you can go to protect yourself from... whatever? I would think a phone with a removable battery would otherwise serve your concerns.

I didn't say backup batteries were in use or assert it as a thing or hidden.

The sentence was about permanent batteries with an aside about how technically a remove-able battery phone could still have power somewhere with it removed.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#52

Post by xyzzyz » Mon, Jul 02, 2018, 1:18 AM UTC

eftychis wrote: post #31

xyzzyz wrote: post #19

Earlier quoted context omitted.

If the source IP is encrypted, the recipient needs to decrypt it first in order to be able to send a response. To decrypt it, it needs to either have some shared secret with the sender, or the sender needs to use the recipient's private key. The parties cannot obtain the shared secret the usual way, the Diffie-Helman exchange. It cannot be performed, because it requires back-and-forth communication, which we are tryi…

Nit-picking a bit/kind of augmenting your train of thought. You can have non-interactive Diffie-Helman key exchange (via a PKI). As you say, the client would need to know prior to that the public key/have access to the certificate and that would require certainly revamping the DNS approach we now have (even if we did not use DNS, we would still have to deal with DNS requests).

That's literally the second option I describe. What is your point?

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#53

Post by cantrevealname » Mon, Jul 02, 2018, 1:26 AM UTC

ggm wrote: post #18

panarky wrote: post #6

The salient bit: Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of…

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

> Src IP is not actually neccessary, in the IP layer.

I like your thoughts, but I don't understand how it would have helped in the Hacker-Verizon-Stingray case.

First, an analogy: Suppose no one ever wrote a return address on postal letters. People wrote only the destination. The recipient has to open the envelope to see who wrote the letter. The postal system still works and it's way more private. However, if the authorities are watching your particular mailbox at your house, copying the outside of every incoming and outgoing letter, what privacy have you gained? They still know who you wrote to and who replied.

Now back to the Hacker-Verizon-Stingray case: When the hacker connects to Verizon, his phone must identify him as a Verizon customer at some protocol layer. The identifying info could be IMEI, IMSI, or Verizon account number. Otherwise anyone could use Verizon for free if there were no account. Likewise, when Verizon transmits info back to the hacker, Verizon has to know which cellphone it should go to, or at least which cell tower.

In your design, the outbound packets from hacker to Verizon contain cleartext destination IP, but the src IP is encrypted. Fine, but then the Stingray finds the Verizon account number associated with that connection -- that info being available at some protocol layer. The Stingray then watches for any connections from Verizon back to the hacker that use the same Verizon account number. The Stingray thus collects both sides of the connection just as before. Am I missing something?

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#54

Post by downer63 » Mon, Jul 02, 2018, 1:28 AM UTC

curiousgal wrote: post #7

erentz wrote: post #2

Jesus. I wanted to keep reading that article but half way through my phone was hot enough it was burning my fingers and 20% of my battery had disappeared. What on earth is Politico doing.

Firefox Focus is your friend.

A condom ain't nothin' but a bridge for a crab, lad.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#55

Post by bbrian » Mon, Jul 02, 2018, 1:49 AM UTC

greggarious wrote: post #36

pests wrote: post #34

Earlier quoted context omitted.

The phone being off or it being on airplane is no longer enough. It is known that complete operating systems run on every chip on that phone of which you don't have knowledge of or access to. To think a software security solution provided by an OS, a pretty high-level abstraction when considering hardware, of the ability to turn off the radio is insane in these days and ages. Furthermore with permanent batteries (or…

I'd love to read a source that describes this in more detail. Assuming such an exploit exists, I don't think I'd be targeted with it. It's my understanding three letter agencies tend to hoard that sort of thing, not blast them at random privacy aficionados.

I remember reading an article years ago: FBI taps cell phone mic as eavesdropping tool (2006).

> the eavesdropping technique "functioned whether the phone was powered on or off."

https://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdr...

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#56

Post by joncrane » Mon, Jul 02, 2018, 2:03 AM UTC

greggarious wrote: post #33

ezoe wrote: post #9

I value the privacy so I don't own or use cellphone.

> I value the privacy so I don't own or use cellphone. This is a little extreme, but I've started turning off my phone or putting it in airplane mode when not expecting a call. In addition to not being as distracted, I've had a marked decrease in spam calls - I think they tend to mark phones that repeatedly send them straight to VM as "cold".

You really should place it in a metal box if you really want privacy while not using your cell phone.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#57

Post by Can_Not » Mon, Jul 02, 2018, 2:11 AM UTC

curiousgal wrote: post #7

erentz wrote: post #2

Jesus. I wanted to keep reading that article but half way through my phone was hot enough it was burning my fingers and 20% of my battery had disappeared. What on earth is Politico doing.

Firefox Focus is your friend.

I found focus to be woefully unfeatured compared to just using Firefox's incognito. Last time I tried it, you couldn't install any extensions (privacy badger, ublock origin, etc.) and also couldn't disable JS.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#58

Post by kryogen1c » Mon, Jul 02, 2018, 2:14 AM UTC

cantrevealname wrote: post #53

ggm wrote: post #18

Earlier quoted context omitted.

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

> Src IP is not actually neccessary, in the IP layer. I like your thoughts, but I don't understand how it would have helped in the Hacker-Verizon-Stingray case. First, an analogy: Suppose no one ever wrote a return address on postal letters. People wrote only the destination. The recipient has to open the envelope to see who wrote the letter. The postal system still works and it's way more private. However, if the au…

I'm not an expert, but I believe what you're missing is the current legal gray area of meta data like IP addresses. Pulling account numbers associated with contracted accounts sounds more like it needs a warrant.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#59

Post by mirimir » Mon, Jul 02, 2018, 2:22 AM UTC

panarky wrote: post #6

The salient bit: Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of…

Yes, this was the key fail. If he'd been careful enough not to leak his IP address, he would arguably have remained free.

I was, for example, using VPN services and Tor well before 2008. And I've never been more than a gray-hat hobbyist sort of "hacker". Anyone seriously into criminal activity who didn't reliably hide their IP address was a fool, even then.

My point isn't to dump on Rigmaiden. It's just that articles like this contribute to the FUD about privacy being impossible now. The reality is that most criminals have horrible OPSEC. Especially when they're just getting started. And then they're careless about historical connections.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#60

Post by wu-ikkyu » Mon, Jul 02, 2018, 2:24 AM UTC

Mikushi wrote: post #11

wu-ikkyu wrote: post #10

Earlier quoted context omitted.

How did you post this comment?

Computers, ever heard of them ?

Haha never :)

For someone so paranoid about privacy as to not even own a "dumb" phone, I was curious what type of computer/internet setup they would be using to work around all the privacy traps such as broswer fingerprinting, traffic analysis, deep OS and hardware exploits, linguistic analysis, etc. etc.