Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How a Hacker Proved Cops Used a Stingray to Find Him

politico.com

Post reply on HN
Print view View original

131–140 of 164 posts

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#131

Post by ra1n85 »

caf wrote: post #74
ra1n85 wrote: post #37

Earlier quoted context omitted.

+RPF requires it to help prevent spoofing (BCP 38)

In our thought-experiment world where each address has a public key that can be used to encrypt the payload data destined for it, the public key of the source can also be used to sign the data, ensuring the sender address isn't spoofed.

What validates that - the destination or intermediate devices? Spoofing is often just a means for volumetric DDoS attacks - if the destination is responsible for validate sources then we’re no better off there.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#132

Post by effingwewt »

ymse wrote: post #25
Aloha wrote: post #20

Earlier quoted context omitted.

You must not be looking for work, or for that matter have a job. My phone is indispensable for the kind of work that I do, I literally couldn't do my job without it.

Ha, funny you should mention that. I am in fact looking for a job. Luckily the one interview I've had since losing the phone was on-site. If I need to participate in on-call rotation or similar, I expect the employer to issue a phone. For a remote job, I will obviously get one myself -- but then strictly for job-related activities. (by the way, if anyone is looking for an experienced infrastructure engineer/"DevOps"…

I went several years using only wifi services on my phone, including voice and text services if I really needed them. Unfortunately it didn't help me much as, being OCD,I tend to quickly find other things to focus too intently on.

Anyway, point is, if you need a temporary phone while job hunting, try google voice? I hate google now but this may help temporarily, or maybe you could find a better provider (other than google, that is).

Good luck with the job hunt!

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#133

Post by xyzzyz »

eboyjr wrote: post #116
xyzzyz wrote: post #19

Earlier quoted context omitted.

If the source IP is encrypted, the recipient needs to decrypt it first in order to be able to send a response. To decrypt it, it needs to either have some shared secret with the sender, or the sender needs to use the recipient's private key. The parties cannot obtain the shared secret the usual way, the Diffie-Helman exchange. It cannot be performed, because it requires back-and-forth communication, which we are tryi…

Just a half-baked idea: If you don't want to make a new request for every connection, and the recipient owns a huge block of IPv6 addresses, the recipient can create an asynchronous key pair where the public key is used as the IPv6 suffix. The United States Department of Defense owns /13. This provides 115 bits of public key information. The sender can use the IPv6 address as the public key.

115 bits of security is pretty good, for example 3DES, while not exactly a great choice today, is still considered secure and acceptable for use today, with its 112 bits of security. However, I know of no public key encryption scheme that would give acceptable security with only 115 bits of public key. With RSA, you need at least 1024 bits, and probably should rather use 2048. Elliptic curve cryptography is considerably better here, but an ECC key of length n stil gives you only n/2 bits of security, which would be way too little here.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#134

Post by kimdotcom »

l_t wrote: post #22
Aloha wrote: post #20

Earlier quoted context omitted.

You must not be looking for work, or for that matter have a job. My phone is indispensable for the kind of work that I do, I literally couldn't do my job without it.

I don't see a strong reason for a software developer to need a phone: - Async communication (slack/email) can be checked at your computer. - Voice calls are usually done with your computer anyway. - If you are on call, an old-fashioned pager can be used. Frankly, although I do have a smartphone, I wouldn't want a job where I was required to use it, or one where I was expected to be available at all times unless on ca…

If email works fine, why have Slack?

Does Slack have better uptime than email?

Does the office have redundant ISPs?

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#135

Post by darpa_escapee »

greggarious wrote: post #36
pests wrote: post #34

Earlier quoted context omitted.

The phone being off or it being on airplane is no longer enough. It is known that complete operating systems run on every chip on that phone of which you don't have knowledge of or access to. To think a software security solution provided by an OS, a pretty high-level abstraction when considering hardware, of the ability to turn off the radio is insane in these days and ages. Furthermore with permanent batteries (or…

I'd love to read a source that describes this in more detail. Assuming such an exploit exists, I don't think I'd be targeted with it. It's my understanding three letter agencies tend to hoard that sort of thing, not blast them at random privacy aficionados.

Look up "Broadpwn" for an attack on Broadcom's BCM43xx radios.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#136

Post by falsedan »

Matt3o12_ wrote: post #130
falsedan wrote: post #120

Earlier quoted context omitted.

> Furthermore, they allegedly already had his ip, so why bother with a stingray? They could simply tell his cell carrier to provide them with all his location data Remember that getting subscriber data/metadata from ISPs requires a warrant, and that a single tower location could cover a 6-12 sq. km. area (plenty of space to hide in)

Can’t they use the towers to triangulate the exact position? So that area should be rather small. Furthermore, if they already had the IP of the offender, getting a search warrant should not be the problem at all. This tells me there is more to this story.

I think triangulation works best when devices do handoff between towers, as they query each one to see which signal is strongest. For a stationary device like a mobile broadband dongle, I'd expect it to never handoff.

Getting a search warrant is easy, but not getting one is even easier & leaves no paper trail.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#137

Post by swebs »

falsedan wrote: post #136
Matt3o12_ wrote: post #130

Earlier quoted context omitted.

Can’t they use the towers to triangulate the exact position? So that area should be rather small. Furthermore, if they already had the IP of the offender, getting a search warrant should not be the problem at all. This tells me there is more to this story.

I think triangulation works best when devices do handoff between towers, as they query each one to see which signal is strongest. For a stationary device like a mobile broadband dongle, I'd expect it to never handoff. Getting a search warrant is easy, but not getting one is even easier & leaves no paper trail.

That's not true. Cell phones have been using clock synchronized triangulation since the mid 2000s.

https://en.wikipedia.org/wiki/Enhanced_9-1-1#Wireless_enhanc...

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#140

Post by overlordalex »

Matt3o12_ wrote: post #117

Something doesn’t seem to add up. First of all the story fails to mention that those devices do not only track the target, they track and record all phones in its range, which is a massive breach of privacy and the real issue with those devices. Furthermore, they allegedly already had his ip, so why bother with a stingray? They could simply tell his cell carrier to provide them with all his location data (as well as…

From the article:

> Rigmaiden eventually pieced together the story of his capture. Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of apartments where Rigmaiden lived.

Post reply on HN