Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How a Hacker Proved Cops Used a Stingray to Find Him

politico.com

Post reply on HN
Print view View original

61–70 of 164 posts

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#61

Post by droopybuns »

mehrdadn wrote: post #23
ggm wrote: post #18

Earlier quoted context omitted.

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

How would you return errors if the destination is known to be unreachable?

Or how would you troubleshoot which hop was the source of a routing problem without including a source IP to send a message back to.

These kinds of discussions seem utterly divorced from the reality of networking to me.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#62

Post by mirimir »

joncrane wrote: post #56
greggarious wrote: post #33

Earlier quoted context omitted.

> I value the privacy so I don't own or use cellphone. This is a little extreme, but I've started turning off my phone or putting it in airplane mode when not expecting a call. In addition to not being as distracted, I've had a marked decrease in spam calls - I think they tend to mark phones that repeatedly send them straight to VM as "cold".

You really should place it in a metal box if you really want privacy while not using your cell phone.

Or a bag: https://www.amazon.com/Faraday-Wisdompro-Blocking-Shielding-...

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#63

Post by ceejayoz »

matt-attack wrote: post #46
pests wrote: post #34

Earlier quoted context omitted.

The phone being off or it being on airplane is no longer enough. It is known that complete operating systems run on every chip on that phone of which you don't have knowledge of or access to. To think a software security solution provided by an OS, a pretty high-level abstraction when considering hardware, of the ability to turn off the radio is insane in these days and ages. Furthermore with permanent batteries (or…

Surely someone with some RF gear could quickly determine if an iPhone, say, in Airplane Mode ever transmits.

Such a thing would likely be used on specific targeted individuals, not the general public, making detection far more difficult.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#64

Post by make3 »

ezoe wrote: post #9

I value the privacy so I don't own or use cellphone.

the probability of this affecting you if you're not a criminal is probably lower to that of you dying everytime you take your car to go anywhere. It's a really big sacrifice in expected utility.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#66

Post by cantrevealname »

The hacker was exposed because of poor OPSEC (due to tracking of his IP address).

> Rigmaiden had received boxes and boxes of criminal discovery that would help him understand how the government planned to prosecute its case. In the penultimate box, he saw the word “stingray” in a set of notes.

The authorities were exposed because of poor OPSEC as well. They weren't supposed to ever mention “stingray”.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#67

Post by johnnymonster »

cantrevealname wrote: post #66

The hacker was exposed because of poor OPSEC (due to tracking of his IP address). > Rigmaiden had received boxes and boxes of criminal discovery that would help him understand how the government planned to prosecute its case. In the penultimate box, he saw the word “stingray” in a set of notes. The authorities were exposed because of poor OPSEC as well. They weren't supposed to ever mention “stingray”.

The story didn't mention how they were able to get his IP address in the first place. That level of detail is important for this community!

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#68

Post by ggm »

ra1n85 wrote: post #37
Ao7bei3s wrote: post #21

Earlier quoted context omitted.

* Secure handshaking requires interactivity, unless you share secrets with your actual partner (no, your CA trust store isn't enough) in advance. So your first packet would leak it. * To return ICMP error messages ("destination unreachable"), otherwise you'd have long timeouts. * Ratelimiting outside the server (e.g. DDOS protection). Many ISPs do actually filter source IPs. (Of course you can't on the backbone, any…

+RPF requires it to help prevent spoofing (BCP 38)

Like AS PATH this is one of the reasons people say but like path security in BGP, its not what people actually do very much. I like BCP38 and I like MANRS but.. traction is hard here.

I was making statements about the road not taken: we have dst IP in the packets, from before BCP existed.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#69

Post by ggm »

ra1n85 wrote: post #40
ggm wrote: post #18

Earlier quoted context omitted.

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

There's way too much baked into the current infrastructure (and two instances of layer 3) for this to be feasible. Access-control lists used for filtering, identifying candidate address for services like NAT, and critical data plane operations like path MTU discovery all rely on the source address being available in the IP header. Sure we could re-engineer things to not be this way, but at what cost? Realistically (a…

Yes. It wasn't a statement about the future, as much as about the past.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#70

Post by woolvalley »

erentz wrote: post #2

Jesus. I wanted to keep reading that article but half way through my phone was hot enough it was burning my fingers and 20% of my battery had disappeared. What on earth is Politico doing.

Ad networks need to add simple perf tracing to the ads they serve and boot off the high consuming ones.
Post reply on HN