Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Burner Phone 101

rebeccawilliams.info

Post reply on HN
Print view View original

41–50 of 198 posts

Re: Burner Phone 101

#41

Post by joha4270 »

escaine wrote: post #29
aja12 wrote: post #10

Earlier quoted context omitted.

Baseband SoC running their own OS independent from Android/iOS and staying asleep (while still listening for incoming signals) is very much no longer in conspiracy theory territory and more an established fact now. I don't have the source at hand but it's in one of the standards. And the purpose is very clear: LEA like Interpol must be able to locate any IMEI at any point if in tower range, regardless of the power st…

Surely this is really easy to prove by putting a phone into an anechoic chamber and using a spectrum analyser to show that it's still TXing?

The phone isn't going to connect to a tower it cannot see.

It can't just scream out into the void and hope a tower picks it up, it needs a few pieces of timing information & cell configuration beforehand.

Re: Burner Phone 101

#42

Post by SahAssar »

arendtio wrote: post #35
h4ck_th3_pl4n3t wrote: post #2

While I like the sentiment of the article, I think most people are not aware of how hostile baseband firmwares are implemented on most SoCs that phones come with. Usually the cell tower handshakes that make you trackable can't be put off, meaning the modem will run in sleep mode even when you are in airplane mode (which is kinda funny considering the dangers of air travel, right? Right?). Are there actually smartphon…

As far as I remember, the whole 'turn off your phone on a plane' was just a precautionary measure and is not a real technical problem nowadays. The risk was that mobile networks could not handle moving many devices from one cell to another at high speeds (during takeoff and landing).

How would that be different for trains? Trains would have similar numbers or more devices, moving at a similar speed (for high speed trains compared to planes at take-off/landing).

Re: Burner Phone 101

#43

Post by kelnos »

forgotusername6 wrote: post #27
theothertimcook wrote: post #6

In many countries you need a valid government ID document to activate a mobile service which means burners do not really exist in those places. Unless you bought a pixel, graphene’d it and then paid a homeless person to activate a pre-paid data only sim which you would top up with vouchers paid in cash and used a von and international voip service… A lot of effort though

I was surprised when a SIM I purchased on Amazon was not only able to connect in China but was also able to bypass the great firewall. I wonder how these travel sims get round the government regulations.

It's because the government regulations only apply to Chinese citizens. My first trip to China was back in the '00s, and I went for work. I was also surprised to find that my home SIM worked just fine there without any interference from the Great Firewall.

Roaming works somewhat unintuitively from what you'd expect. You do indeed connect to the local mobile network, but all of your data traffic is tunneled back to your home wireless provider's PoP. I realized this once I checked what websites I was visiting saw as my public IP address, and it was an address from a network in Texas!

So China's Great Firewall can't actually inspect or block your traffic while you're traveling, and using roaming on your home mobile network's SIM. It's all sent over the equivalent of a VPN to your home soil before going out to the public internet. This iswhy latency can be pretty bad while roaming.

Re: Burner Phone 101

#44

Post by kelnos »

Phelinofist wrote: post #33
theothertimcook wrote: post #6

In many countries you need a valid government ID document to activate a mobile service which means burners do not really exist in those places. Unless you bought a pixel, graphene’d it and then paid a homeless person to activate a pre-paid data only sim which you would top up with vouchers paid in cash and used a von and international voip service… A lot of effort though

How does GrapheneOS help in that?

It doesn't specifically help with obtaining a SIM without presenting ID, but it does help make it easier to avoid later leaking your true identity to Google/Apple/etc. once you start using the phone.

Re: Burner Phone 101

#45

Post by SoftTalker »

eptcyka wrote: post #25
blitzar wrote: post #7

Earlier quoted context omitted.

Just track the hardware. A couple of days of normal usage and should be able to assign a 99% probability on you being the owner of that phone.

You should never turn on your burner in a place where you use your regular phone, duh.

Even using it in the same city, would only require time and maybe a bit more correlation to identify an individual.

Re: Burner Phone 101

#46

Post by kelnos »

SahAssar wrote: post #42
arendtio wrote: post #35

Earlier quoted context omitted.

As far as I remember, the whole 'turn off your phone on a plane' was just a precautionary measure and is not a real technical problem nowadays. The risk was that mobile networks could not handle moving many devices from one cell to another at high speeds (during takeoff and landing).

How would that be different for trains? Trains would have similar numbers or more devices, moving at a similar speed (for high speed trains compared to planes at take-off/landing).

I think part of the issue is that cell tower antennas are designed for talking to devices on the ground or at very low altitudes (like those you'd experience in a tall building). So a cell tower's capacity for talking to lots of somethings directly above it, thousands of feet up, is much lower than talking to lots of somethings below it or adjacent to it.

Re: Burner Phone 101

#47

Post by kelnos »

h4ck_th3_pl4n3t wrote: post #14
madethemcry wrote: post #5

Earlier quoted context omitted.

Can you please give any sources? While it sounds plausible and interesting it's nothing more than a wild conspiracy theory without some background information.

Buy a broadcom smartphone. Turn bluetooth off, and set it to airplane mode. Then Bluepwn your device, with bluetooth turned off. Funny how airplane mode didn't work. That's just one of the quirks. Baseband and what qualcomm is tracking is way worse. I recommend buying an old Motorola Calypso device and fiddling with osmocomBB, you can DIY an IMSI catcher pretty easily. And you'll be mind blown how many class0 SMS you…

Saying more words and then linking to a page from an IMSI catcher's wiki (where it doesn't talk about radio on/off states) isn't exactly "providing sources".

Re: Burner Phone 101

#48

Post by kelnos »

h4ck_th3_pl4n3t wrote: post #15
pdesi wrote: post #11

Earlier quoted context omitted.

Even in airplane mode?

I dare you to do the following: Charge phone to full 100%. Turn it off. Put it into a faraday cage, e.g. a steel box, for 7 days. Take it out again and wonder why the battery is empty. (The faraday cage has the effect of making the modem have to switch bands constantly, which costs more electricity than sleep mode in LTE)

It would still be simpler for you to link to a credible source. A bit strange that you seem uninterested in doing so, and prefer to tell people to do their own experiments, in this case one that requires an extra phone and a week of time.

Re: Burner Phone 101

#49

Post by mjg59 »

h4ck_th3_pl4n3t wrote: post #14
madethemcry wrote: post #5

Earlier quoted context omitted.

Can you please give any sources? While it sounds plausible and interesting it's nothing more than a wild conspiracy theory without some background information.

Buy a broadcom smartphone. Turn bluetooth off, and set it to airplane mode. Then Bluepwn your device, with bluetooth turned off. Funny how airplane mode didn't work. That's just one of the quirks. Baseband and what qualcomm is tracking is way worse. I recommend buying an old Motorola Calypso device and fiddling with osmocomBB, you can DIY an IMSI catcher pretty easily. And you'll be mind blown how many class0 SMS you…

You made the assertion that basebands remain in contact with towers even in airplane mode, and so can be tracked. Someone asked for supporting evidence for that claim. You've responded with examples and links to different issues. It's a fairly extraordinary claim (it's not one I'd heard before - it's clear that other radios may remain alive for various purposes even when airplane mode is switched on, given that you can use wifi and bluetooth on planes, but you're the first person I've heard make this claim about the cellular radio), and you haven't provided any evidence to back it up at all.

Re: Burner Phone 101

#50

Post by userbinator »

h4ck_th3_pl4n3t wrote: post #2

While I like the sentiment of the article, I think most people are not aware of how hostile baseband firmwares are implemented on most SoCs that phones come with. Usually the cell tower handshakes that make you trackable can't be put off, meaning the modem will run in sleep mode even when you are in airplane mode (which is kinda funny considering the dangers of air travel, right? Right?). Are there actually smartphon…

meaning the modem will run in sleep mode even when you are in airplane mode

AFAIK this is not true at least for the Mediatek 65xx and early 67xx platforms; I've analysed the firmware and hardware on those. They actually power off the modem and rest of the RF system when in airplane mode. The modem only boots up and starts searching for a signal when you take it out of airplane mode, which is why it takes a noticeable time (10-30 seconds, depending on how many bands are enabled) to get a signal. If your phone goes from airplane mode to having a signal and immediately capable of calling, then I suspect it's one where the modem is not truly turned off.

I haven't inspected Broadcom, Qualcomm, or Spreadtrum in any detail to say whether they do things differently.

Are there actually smartphones without an IMEI

Look for a "tablet" or anything else without the word "phone" in it if you just want a touchscreen portable computer. An IMEI is obligatory to connect to cellular networks, in much the same way as a MAC address is to Ethernet and WiFi.

Post reply on HN