Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Observing my cellphone switch towers

fabiensanglard.net

Post reply on HN
Print view View original

61–70 of 137 posts

Re: Observing my cellphone switch towers

#61

Post by BCM43 »

oasisbob wrote: post #51
heelix wrote: post #45

Something like this would make it pretty easy to spot one of those stingray devices, I bet. Cell towers tend to stay put, so mapping out an area would go quick. Were a new 'tower' show up in an odd spot -- there may be shenanigans at hand.

That type of exception analysis is exactly how University of Washington researchers do their stingray hunting. It doesn't take much time monitoring to figure out which towers smell funny: https://seaglass.cs.washington.edu/

Crocodile Hunter as well. https://github.com/EFForg/crocodilehunter

Re: Observing my cellphone switch towers

#62

Post by franga2000 »

rurban wrote: post #32
vbsteven wrote: post #20

On a related note, this same mechanism can be used as a fallback for GPS to determine device location. I have worked on an IoT device with builtin SIM in the personal alarm space. Often when a device is indoors no GPS fix can be found, but the GSM module can report all celltower ids in range with signal strengths. These can be used to triangulate the device location. Google has an API for this where you can pass celt…

I'm doing same right now. My cheap soc has no gps module, which would need too much power also, but I can trivially get the tac+cellid from the AT+CEREG command, which have to do anyway to check network connection (I have no roaming with NB-IoT). And from this you can externally get the lat/long gps values via the OpenCellID database. They protected queries, but you can get the source also as csv. Didn't know about t…

Isn't there a specific GSM command or whatever they're called to request location from the provider? I remember seeing it in a GSM module datasheet at some point, but I never tried it.

Re: Observing my cellphone switch towers

#63

Post by ajsnigrutin »

qb2021 wrote: post #53

At this one industrial customer I visit every week for a full day, my Verizon cell phone date/time time will suddenly change back by 19 years, six months, and some days (I don't have the exact value). This has been going on for almost a year. My pet theory was that law enforcement turned on a stingray nearby back in 2020, it came up with a default date of 1/1/2001, and has been running ever since. Steel building with…

Yep, i complained and they fixed it (mobile operator or the stingray.. don't know who caused the issue or if there even was a stingray (or just a misconfigured basestation)).

The problem i had is, that the time in my case was in the future, so when i called someone (personA) from within that cell, the call was made sometime in 2025... this wouldn't bother me in general, but when you use the redial function in your headset (double tap on the button), the phone would call the last dialed number (which means max(timestamp), not the actual last call), and instead of ringing the last person dialed (eg. personB), it would redial the personA I called from the affected cell, and after misdialing them by accident, a couple of times, I had to manual remove that call from the calllog, to get the redial to work again... until I entered that cell again and called someone from there again.

Re: Observing my cellphone switch towers

#64

Post by iudqnolq »

the8472 wrote: post #47
heelix wrote: post #45

Something like this would make it pretty easy to spot one of those stingray devices, I bet. Cell towers tend to stay put, so mapping out an area would go quick. Were a new 'tower' show up in an odd spot -- there may be shenanigans at hand.

the GPS location is reported by the tower, so nothing is stopping a mitm device from spoofing that too

Edit: totally wrong. Thanks ectopod8!

I'm pretty sure gps location is derived from signals from GPS satellites and ground stations. You can see this if you're somewhere with no cell signal but have gps, or visa versa.

Re: Observing my cellphone switch towers

#65

Post by SSLy »

sipjca wrote: post #49
SSLy wrote: post #42

Earlier quoted context omitted.

There are barely corporation-backed 5G mmWave stacks, and they're absurdly more complicated than 4G.

Can you shed more light on this? Do you mean in terms of beam forming? And other radio resource management complexities that arise from it? I worked in 5G mmWave on the UE side so can imagine some of the scheduling complexity. However for a basic mmW stack, like one to be implemented by OAI or srsRAN would likely scale the problem down to something more basic

Yes, pretty much indeed beamforming and scheduling complexity.

I could see srsRAN making a lowband (<6 GHz) impl of 5G, but not the crazily complicated high freqs. At least without some crazy funding.

Re: Observing my cellphone switch towers

#66

Post by scrozier »

montroser wrote: post #55
qb2021 wrote: post #53

At this one industrial customer I visit every week for a full day, my Verizon cell phone date/time time will suddenly change back by 19 years, six months, and some days (I don't have the exact value). This has been going on for almost a year. My pet theory was that law enforcement turned on a stingray nearby back in 2020, it came up with a default date of 1/1/2001, and has been running ever since. Steel building with…

Yes, a similar thing used to happen to me just at this one particular bar in Chelsea. But it wasn't off by 19 years, it was off by just an hour, which is worse in a way. That made for some confusing drunken time warps until I figured out the pattern...

I was in a rental vacation house at the southeastern end of Lake Michigan three years ago. It was a pretty big house, and as you walked from one end to the other, the time zone would change. Really messed with me until I figured that out.

Re: Observing my cellphone switch towers

#67

Post by grishka »

rcarmo wrote: post #16

This is nicely done, and takes me back to when I worked in mobile network planning. Most people are blissfully unaware of how much radio chatter and constant adjustment is actually holding up their browsing session from second to second, with the UE negotiating the best possible terms (power, throughput, etc.) with adjacent cell towers before it decides (or is prompted) to hand-over to a new cell. Optimizing cell han…

I learned that the cellular protocol stack wasn't as simple as it seemed when I was debugging my VoIP library under different network conditions. I would go into the *#*#INFO#*#* menu on an Android phone and force it to a particular network type. 2G/EDGE provided just barely enough throughput for me to fit my packets through on my lowest bitrate. But sometimes there were periods when the packets would just stop coming through. This would last for a perceptible amount of time, sometimes even more than a second, but after that, all the packets I sent during that time would come through in a burst. That's how I found out about the RLC protocol that's somewhere in the stack in 2G, 3G, and 4G, and that it has this "acknowledged mode", and that in this mode it does retransmissions if there are bit errors. This also made it very clear why TCP sometimes struggles so much when running over a 2G connection.

Anyway, I wish there was something like Wireshark to which I could connect a phone and see it talk to the cell towers in real time. This would really help understand how this all works.

Re: Observing my cellphone switch towers

#68

Post by garaetjjte »

windowsworkstoo wrote: post #30
emteycz wrote: post #29

Earlier quoted context omitted.

I think that's roaming. Mesh wifi should IMHO be routing the traffic through the nodes (with possible backhaul).

Correct, enterprise wifi is usually just APs with a common SSID and security configuration and some tuning to try to force clients to roam sensibly. There’s no AP to AP comms, it all goes back to the switchport

There are solutions for AP-side roaming that is transparent to the client and whole network is visible as single AP, like UniFi "Zero-Handoff Roaming". Though because it forces whole network to use single channel it is deprecated in favor of 802.11r client side fast roaming.

https://help.ui.com/hc/en-us/articles/115004662107-UniFi-Fas...

Re: Observing my cellphone switch towers

#69

Post by Gys »

drmpeg wrote: post #41
ng55QPSK wrote: post #2

"There are no open source LTE stack to learn from" https://osmocom.org/projects

The most popular open source LTE stack is srsLTE (now called srsRAN). https://github.com/srsran/srsRAN

Unfortunately this refers to srs.io for more info, but that domain is not found. So I am left wondering what SRS means.

Re: Observing my cellphone switch towers

#70

Post by bombcar »

slim wrote: post #58
qb2021 wrote: post #53

At this one industrial customer I visit every week for a full day, my Verizon cell phone date/time time will suddenly change back by 19 years, six months, and some days (I don't have the exact value). This has been going on for almost a year. My pet theory was that law enforcement turned on a stingray nearby back in 2020, it came up with a default date of 1/1/2001, and has been running ever since. Steel building with…

It happened to me. 1 hour off. It was related to DST. I missed a meeting because of this. Since then I disable "automatic time from network" on my new phones and have a casio watch. I thought the tower was misconfigured, why do you suppose it's a stingray?

Time-sync is important for mobile operators (there are standards to keep the towers in sync with the correct time) - and a tower out of sync would be noticed.

But not if it is a stingray as that's not managed by the network.

Post reply on HN