Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How a Hacker Proved Cops Used a Stingray to Find Him

politico.com

Post reply on HN
Print view View original

141–150 of 164 posts

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#141

Post by greggarious »

bbrian wrote: post #55
greggarious wrote: post #36

Earlier quoted context omitted.

I'd love to read a source that describes this in more detail. Assuming such an exploit exists, I don't think I'd be targeted with it. It's my understanding three letter agencies tend to hoard that sort of thing, not blast them at random privacy aficionados.

I remember reading an article years ago: FBI taps cell phone mic as eavesdropping tool (2006). > the eavesdropping technique "functioned whether the phone was powered on or off." https://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdr...

Thanks, that seems to apply to older phones.

I would hope that the FBI would not override airplane mode on a smart phone... what if they did so while a suspect was actually on a plane?

A warrant doesn't give police the right to endanger others IIRC...

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#142

Post by [deleted] »

Matt3o12_ wrote: post #130
falsedan wrote: post #120

Earlier quoted context omitted.

> Furthermore, they allegedly already had his ip, so why bother with a stingray? They could simply tell his cell carrier to provide them with all his location data Remember that getting subscriber data/metadata from ISPs requires a warrant, and that a single tower location could cover a 6-12 sq. km. area (plenty of space to hide in)

Can’t they use the towers to triangulate the exact position? So that area should be rather small. Furthermore, if they already had the IP of the offender, getting a search warrant should not be the problem at all. This tells me there is more to this story.

[deleted]

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#143

Post by grkvlt »

xyzzyz wrote: post #133
eboyjr wrote: post #116

Earlier quoted context omitted.

Just a half-baked idea: If you don't want to make a new request for every connection, and the recipient owns a huge block of IPv6 addresses, the recipient can create an asynchronous key pair where the public key is used as the IPv6 suffix. The United States Department of Defense owns /13. This provides 115 bits of public key information. The sender can use the IPv6 address as the public key.

115 bits of security is pretty good, for example 3DES, while not exactly a great choice today, is still considered secure and acceptable for use today, with its 112 bits of security. However, I know of no public key encryption scheme that would give acceptable security with only 115 bits of public key. With RSA, you need at least 1024 bits, and probably should rather use 2048. Elliptic curve cryptography is considera…

2048 bits of RSA key is the same amount of security as 112 bits of symmentric key, though.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#144

Post by decasia »

It seems like a terrible security model to "trust whatever cell site is in range." Are there any alternatives to this state of affairs?

For example, can your carrier supply you with a whitelist of their towers and then ignore everything else? Or the legitimacy of each tower could be signed cryptographically by the cell providers? Of course you have to trust the security infrastructure of your cell provider, but that seems slightly better than just trusting everything by default. (Disclaimer, I know nothing about cellular infrastructure...)

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#145

Post by ThrowawaySR »

falsedan wrote: post #136
Matt3o12_ wrote: post #130

Earlier quoted context omitted.

Can’t they use the towers to triangulate the exact position? So that area should be rather small. Furthermore, if they already had the IP of the offender, getting a search warrant should not be the problem at all. This tells me there is more to this story.

I think triangulation works best when devices do handoff between towers, as they query each one to see which signal is strongest. For a stationary device like a mobile broadband dongle, I'd expect it to never handoff. Getting a search warrant is easy, but not getting one is even easier & leaves no paper trail.

My memories from flashing phones circa 2003-2004 may be a bit rusty (btw. back than "flashing" meant something completely different than nowadays ROM uploads, it was more akin to poking machine code memory locations in BASIC on 8-bits :) ), but if I recall correctly, the device periodically scans all the BTSs it can see and sends that list with signal strengths to the network (and the network decides which tower should the device connect to!). Something tells me that the device even stayed connected to multiple strongest BTSs at once, but that may be a false memory.

Of course, that was old GSM days, it may be something completely different today in 3G/4G/LTE, but so is on the other hand the location hardware and algorithms of carriers.

But no, no handoffs were needed to track you very precisely even back then. There were ways around, but given the poor opsec in the case, it is doubtful something like that was used here.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#146

Post by xj9 »

xyzzyz wrote: post #19
ggm wrote: post #18

Earlier quoted context omitted.

Lest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, t…

If the source IP is encrypted, the recipient needs to decrypt it first in order to be able to send a response. To decrypt it, it needs to either have some shared secret with the sender, or the sender needs to use the recipient's private key. The parties cannot obtain the shared secret the usual way, the Diffie-Helman exchange. It cannot be performed, because it requires back-and-forth communication, which we are tryi…

cjdns[1] is an encrypted ipv6 overlay network that uses the firstbits of your public key hash to generate your ip address.

theoretically, multiple keys can share an ip-hash, but the handshake will fail if the intended recipient doesn't have the expected keypair[2]. so far this hasn't been an issue, but you are better off if you know the destination's pubkey beforehand.

[1]: https://github.com/cjdelisle/cjdns

[2]: https://github.com/cjdelisle/cjdns/blob/master/doc/faq/doppl...

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#147

Post by programbreeding »

decasia wrote: post #144

It seems like a terrible security model to "trust whatever cell site is in range." Are there any alternatives to this state of affairs? For example, can your carrier supply you with a whitelist of their towers and then ignore everything else? Or the legitimacy of each tower could be signed cryptographically by the cell providers? Of course you have to trust the security infrastructure of your cell provider, but that…

There is an Android app called IMSI-Catcher Detector[0] that is supposed to help you detect when you're connected to a stingray-type device. I ran it for around a year and it never once picked up on anything. I'm not involved on the project and can't personally say if it will catch anything or not, but it is open source[1].

[0] https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec...

[1] https://github.com/CellularPrivacy/Android-IMSI-Catcher-Dete...

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#148

Post by jolmg »

Matt3o12_ wrote: post #117

Something doesn’t seem to add up. First of all the story fails to mention that those devices do not only track the target, they track and record all phones in its range, which is a massive breach of privacy and the real issue with those devices. Furthermore, they allegedly already had his ip, so why bother with a stingray? They could simply tell his cell carrier to provide them with all his location data (as well as…

I don't know about Verizon, but all the cellphone carriers I know have carrier-grade NAT set up. That would mean the public IP they have would correspond with many customers with different private IPs. The article says Verizon matched the IP address with a particular AirCard, but maybe that was an oversimplification in the article.

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#149

Post by OliverJones »

cantrevealname wrote: post #66

The hacker was exposed because of poor OPSEC (due to tracking of his IP address). > Rigmaiden had received boxes and boxes of criminal discovery that would help him understand how the government planned to prosecute its case. In the penultimate box, he saw the word “stingray” in a set of notes. The authorities were exposed because of poor OPSEC as well. They weren't supposed to ever mention “stingray”.

All secrets eventually leak. It's a question of time. Not even state actors with unlimited resources can prevent secrets from leaking. So this wasn't bad operational security by authorities. It was a fundamentally flawed operation.

Security through obscurity has limited and unpredictable usefulness. Good OPSEC can delay a leak, maybe. But OPSEC is still much harder for defenders than attackers.

The article doesn't mention it, but SURELY agency planning about this particular secret covered the next steps to take when it leaked.

Ordinarily good OPSEC has defense in depth. Secrets should have limited useful lifetime. "Stingray" as a secret doesn't: once bad actors know their phone locations can be targeted, they can't un-know it.

It should be obvious to the holders of secrets when they leak, so they know they're compromised. Having this "Stingray" crop up in a big mess of bankers' boxes full of court docs isn't obvious.

Security by obscurity needs a plan B ready to roll at any time.

Much better is transparent security, where the tech is well known, the actual secrets have limited useful lifetimes (key-rotation and forward secrecy for example), and reasonable controls exist (search warrants in this case).

If law enforcement executives don't know this, they need to go back to school. But they probably do know it, and they're practicing security-by-obscurity on their plan B.

(I don't defend somebody who stole large quantities of taxpayers' money. Not at all. But the rule of law--search warrants--is vital.)

Re: How a Hacker Proved Cops Used a Stingray to Find Him

#150

Post by xyzzyz »

grkvlt wrote: post #143
xyzzyz wrote: post #133

Earlier quoted context omitted.

115 bits of security is pretty good, for example 3DES, while not exactly a great choice today, is still considered secure and acceptable for use today, with its 112 bits of security. However, I know of no public key encryption scheme that would give acceptable security with only 115 bits of public key. With RSA, you need at least 1024 bits, and probably should rather use 2048. Elliptic curve cryptography is considera…

2048 bits of RSA key is the same amount of security as 112 bits of symmentric key, though.

Yes, that’s my point — you need to use 2048 bits for key to get 128 bits of security, so there is no way to fit the public key in the IPv6 address.
Post reply on HN