Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds: There are hostile stingrays in DC, but we don’t know how to find them

arstechnica.com

Post reply on HN
Print view View original

31–40 of 101 posts

Re: Feds: There are hostile stingrays in DC, but we don’t know how to find them

#31

Post by walrus01 »

subway wrote: post #25
beamatronic wrote: post #24

Earlier quoted context omitted.

I am not familiar with this term, “black-throw”, can you elaborate?

blackthrow or svartkast is a term for a device left behind in potentially hostile territory to continue operating until it is discovered or fails

For example an imsi catcher spliced into 120vac power and stuffed up into a ceiling tile in a busy shopping mall. I bet that with a stepladder, a clipboard and two guys in high visibility vests, a set of electrician tools, you could do this at nearly any mall in America.

Re: Feds: There are hostile stingrays in DC, but we don’t know how to find them

#32

Post by subway »

walrus01 wrote: post #31
subway wrote: post #25

Earlier quoted context omitted.

blackthrow or svartkast is a term for a device left behind in potentially hostile territory to continue operating until it is discovered or fails

For example an imsi catcher spliced into 120vac power and stuffed up into a ceiling tile in a busy shopping mall. I bet that with a stepladder, a clipboard and two guys in high visibility vests, a set of electrician tools, you could do this at nearly any mall in America.

Bonus points for installing a few near each other, configured to operate identically, but at different times.

Re: Feds: There are hostile stingrays in DC, but we don’t know how to find them

#33

Post by walrus01 »

et-al wrote: post #28

Layman question: one can limit their exposure with encrypted VoIP communications (e.g. FaceTime) and chats (iMessage, Signal), correct? That being said, the intercepter would still know: - phone being connected (IMEI) - location of the phone - which servers were requested, but not the encrypted content (yet) - how much data was transmitted, "call time" So if two phones were talking with each other over FaceTime conne…

Re: your last sentence, a stingray rarely if ever offers actual network connectivity, either ss7 or data. Its purpose is just to catch the unique ID numbers from the phone. Whatever you have set into your phone for LTE APN data settings isn't going to work with a random imsi catcher. Such a thing won't have an uplink anyways outside of its command/control functions.

Re: Feds: There are hostile stingrays in DC, but we don’t know how to find them

#35

Post by walrus01 »

PeterisP wrote: post #23
walrus01 wrote: post #10

I work in wireless telecom: Really doubtful "we don't know how to find them". The FCC's enforcement bureau has a set of vans equipped to find unauthorized transmitters. IMSI catchers must transmit and remain on the air. It would be very risky to operate, even briefly, a portable imsi catcher in a briefcase and move it around WA DC, nevermind one that remained in fixed locations for hours. The only other explanation I…

The other explanation is very low power / short range e.g. femtocells. If a Stingray-like device is affecting a single building or the like, targeting a particular person, it likely won't be noticed by anyone.

Something strong enough to get a whole building full of phones to ping it most certainly can be found by a $70,000 spectrum analyzers and trained RF engineer.

Re: Feds: There are hostile stingrays in DC, but we don’t know how to find them

#38

Post by bigiain »

walrus01 wrote: post #35
PeterisP wrote: post #23

Earlier quoted context omitted.

The other explanation is very low power / short range e.g. femtocells. If a Stingray-like device is affecting a single building or the like, targeting a particular person, it likely won't be noticed by anyone.

Something strong enough to get a whole building full of phones to ping it most certainly can be found by a $70,000 spectrum analyzers and trained RF engineer.

Hell - I bet you could find that with a $12 RTL-SDR and a home built antenna plugged into your laptop - if you were curious and suspected there was one nearby...

Re: Feds: There are hostile stingrays in DC, but we don’t know how to find them

#39

Post by bigiain »

subway wrote: post #14
walrus01 wrote: post #10

I work in wireless telecom: Really doubtful "we don't know how to find them". The FCC's enforcement bureau has a set of vans equipped to find unauthorized transmitters. IMSI catchers must transmit and remain on the air. It would be very risky to operate, even briefly, a portable imsi catcher in a briefcase and move it around WA DC, nevermind one that remained in fixed locations for hours. The only other explanation I…

Depends on how much the devices cost to procure, and the budget of the party using them. Seems like these could be treated as "black-throws" given the right cost:budget ratio.

OpenBTS and Ettus USPR (software defined radios) have made it inexpensive enough for hobbyists to set up cellular base stations at Burningman.

The difference between an open source base station, and a homebuilt stingray in negligible.

While a grand or two's worth of radio hardware and however many weekends/evenings spent getting it all set up and the a software configured is _kind of_ expensive - it's effectively free at criminal org, corporate espionage, or state levels of action.

Re: Feds: There are hostile stingrays in DC, but we don’t know how to find them

#40

Post by bigiain »

QuarterReptile wrote: post #22
palisade wrote: post #21

Is that Russian ship still parked nearby? I recall reading about that a while back. Maybe that's where the signal is coming from. https://www.cnn.com/2018/01/22/politics/russia-spy-ship-us-c...

I admit that I don't have much expertise on the matter, having only ever operated a GSM cell site simulator (never LTE), but the max range I remember (in ideal conditions) is something like 35 miles.

35km - which is a TDMA timing issue, not a radio range one - that damned pesky speed of light problem...

https://en.wikipedia.org/wiki/Timing_advance

(Note there's and "extended range" feature, where you can halve the cell site's capacity by waiting two timeslots in the TDMA schedule instead of one - which lets you go as far as 120km...)

Post reply on HN