7 ms·

Police Stingray Tools Can Indeed Record Calls

134 points by howrude 11y ago

mtgx 11y ago
We've been talking about these at least for the past two years, but I haven't seen any of the three major mobile platform vendors implement anything to protect against this sort of attacks. What exactly are they waiting for? This is only going to get worse. They can already break 4G connections as well with these weapons of mass surveillance.
- caseysoftware 11y ago
  In all seriousness, I suspect they want it this way. As long as law enforcement is doing this "without their knowledge" then they may not have to provide a backdoor to their core systems. Then the carriers can make a bold stand, say all the right things whenever they need, and express outrage at the idea that they'd share data.
- late2part 11y ago
  It's worth noting that the major mobile company's largest single customer is almost certainly the federal government. And, many of them fear being Nacchio-ed if they don't toe the line. https://en.wikipedia.org/wiki/Joseph_Nacchio https://en.wikipedia.org/wiki/Joseph_Nacchio
  - drzaiusapelord 11y ago
    Oh come on, Nacchio was clearly guilty. HN is just becoming conspiracy central it seems.
    - porkloin 11y ago
      A lot of people are guilty of a lot of things and don't ever get investigated or prosecuted. I agree with you that people take things a little far, but I think it's hardly conspiratorial thinking to acknowledge that the DOJ selectively pursues cases based on other factors than the crime committed.
      - rayiner 11y ago
        A lot of people are not guilty of insider trading.
        CamperBob2 11y ago
        Nacchio broke multiple laws every day, just like you and I do. They were always going to be able to find something.
        rayiner 11y ago
        What laws do you break every day that are on the same order of magnitude as insider trading laws?
        CamperBob2 11y ago
        Our opinion about what laws "matter" isn't important. We're not the ones who get to decide.
        tptacek 11y ago
        Definitely makes it easier for them to find something when that something grosses you almost 40 million dollars.
        dragonwriter 11y ago
        The idea that DOJ was targeting based on something other than the crimes committed isn't supported unless there are people guilty of the same crimes -- not just the same number of crimes -- that were not pursued.
  - tptacek 11y ago
    Does "Nacchio-ed" mean "get caught having improperly sold tens of millions of dollars of stock of the giant telecom company he ran, in the whirlwind of prosecutions following the collapse of Enron and Worldcom"? Because that's what happened to Nacchio.
- ianstallings 11y ago
  What worries me is the number of non-government nodes discovered that are out there, running simple setups. e.g.: http://securityaffairs.co/wordpress/41513/hacking/low-cost-imsi-catcher-lte.html http://securityaffairs.co/wordpress/41513/hacking/low-cost-i... The way things currently are anyone with a cheap setup can start intercepting your calls using a MITM attack. Related: https://www.schneier.com/blog/archives/2015/04/the_further_dem_1.html https://www.schneier.com/blog/archives/2015/04/the_further_d...
deepnet 11y ago
Considering a stingray is no more than a software radio and laptop does this mean all cell communications are vulnerable to easy surveillance by almost anyone ? Are Cell Phone calls encrypted, does this mean the police devices have the universal decryption keys ? If the police devices have such decryption abilities then it is probably safe to assume they have leaked and various criminals possess this as well. Thankfully those in power have the best interests of the citizenry at heart ;) /s
- rascul 11y ago
  https://news.ycombinator.com/item?id=10459695 https://news.ycombinator.com/item?id=10459695
- mindslight 11y ago
  Anecdata: Back when I had an old 2G featurephone, I inherited the exact same model from a friend (Sprint/CDMA). I used QPST to clone my ESN onto that one, to have a handy backup device. When both were on, calling my number would ring both (I only ever checked this with them in the same cell). Picking up both I would hear audio in both until one of them "won". The ESN can't be considered any kind of secret, so the observed behavior makes it clear that there is no meaningful encryption. We've had two generations of mobile protocols since then, but with Qualcomm et al's attitude of "lock things down harder" rather than Kerckhoff's principle and open review, I doubt security has gotten any better. If you want meaningful mobile privacy, the only way to achieve this is with separate application/baseband processors that communicate over an auditable bus (so not a broken-by-design Qualcomm integrated chipset), with encryption done on the trusted application processor. The easiest way to realize this is using a mifi+vpn+voip. Note that this still leaves your location fully tracked, but most every use of the cell network will do that.
  - deepnet 11y ago
    It appears that 2G is the vulnerability the stingrays exploit. "... exploits a vulnerability in the 2G protocol. Phones using 2G don’t authenticate cell towers, which means that a rogue tower can pass itself off as a legitimate cell tower. But because 3G and 4G networks have fixed this vulnerability, the stingray will jam these networks to force nearby phones to downgrade to the vulnerable 2G network to communicate." [article] Is it possible to disable 2G ?
geggam 11y ago
Used to be scanners were able to track cell phone conversations. They started rolling frequencies but it was trivial to find out what they were and filter for only those. The drama one could hear over cell phones was better than any daytime soap, especially in small towns. They digitized it and made it harder but I am sure with a bit of work one could listen in.
hackuser 11y ago
Related news: The Internal Revenue Service is using StingRays: http://thehill.com/policy/national-security/258209-irs-head-reassures-congress-about-use-of-phone-tracking-tech http://thehill.com/policy/national-security/258209-irs-head-...
godgod 11y ago
The hacker community needs to come together and release an open source stingray unit that citizens can easily build for cheap...then sit outside their local police department, judges houses and record all their private calls made to their spouses. Imagine how quick these stingray devices would be come illegal and how fast phone calls would be encrypted. Turn about is fair play.
ck2 11y ago
The IRS already said it can see SMS via stingray and wtf does the IRS have its own criminal law enforcement branch vs all the other ones at their disposal

134 points by howrude 11y ago

mtgx 11y ago

We've been talking about these at least for the past two years, but I haven't seen any of the three major mobile platform vendors implement anything to protect against this sort of attacks. What exactly are they waiting for? This is only going to get worse. They can already break 4G connections as well with these weapons of mass surveillance.

caseysoftware 11y ago
In all seriousness, I suspect they want it this way. As long as law enforcement is doing this "without their knowledge" then they may not have to provide a backdoor to their core systems. Then the carriers can make a bold stand, say all the right things whenever they need, and express outrage at the idea that they'd share data.
late2part 11y ago
It's worth noting that the major mobile company's largest single customer is almost certainly the federal government. And, many of them fear being Nacchio-ed if they don't toe the line. https://en.wikipedia.org/wiki/Joseph_Nacchio https://en.wikipedia.org/wiki/Joseph_Nacchio
- drzaiusapelord 11y ago
  Oh come on, Nacchio was clearly guilty. HN is just becoming conspiracy central it seems.
  - porkloin 11y ago
    A lot of people are guilty of a lot of things and don't ever get investigated or prosecuted. I agree with you that people take things a little far, but I think it's hardly conspiratorial thinking to acknowledge that the DOJ selectively pursues cases based on other factors than the crime committed.
    - rayiner 11y ago
      A lot of people are not guilty of insider trading.
      - CamperBob2 11y ago
        Nacchio broke multiple laws every day, just like you and I do. They were always going to be able to find something.
        rayiner 11y ago
        What laws do you break every day that are on the same order of magnitude as insider trading laws?
        CamperBob2 11y ago
        Our opinion about what laws "matter" isn't important. We're not the ones who get to decide.
        tptacek 11y ago
        Definitely makes it easier for them to find something when that something grosses you almost 40 million dollars.
        dragonwriter 11y ago
        The idea that DOJ was targeting based on something other than the crimes committed isn't supported unless there are people guilty of the same crimes -- not just the same number of crimes -- that were not pursued.
- tptacek 11y ago
  Does "Nacchio-ed" mean "get caught having improperly sold tens of millions of dollars of stock of the giant telecom company he ran, in the whirlwind of prosecutions following the collapse of Enron and Worldcom"? Because that's what happened to Nacchio.
ianstallings 11y ago
What worries me is the number of non-government nodes discovered that are out there, running simple setups. e.g.: http://securityaffairs.co/wordpress/41513/hacking/low-cost-imsi-catcher-lte.html http://securityaffairs.co/wordpress/41513/hacking/low-cost-i... The way things currently are anyone with a cheap setup can start intercepting your calls using a MITM attack. Related: https://www.schneier.com/blog/archives/2015/04/the_further_dem_1.html https://www.schneier.com/blog/archives/2015/04/the_further_d...

deepnet 11y ago

Considering a stingray is no more than a software radio and laptop does this mean all cell communications are vulnerable to easy surveillance by almost anyone ? Are Cell Phone calls encrypted, does this mean the police devices have the universal decryption keys ? If the police devices have such decryption abilities then it is probably safe to assume they have leaked and various criminals possess this as well. Thankfully those in power have the best interests of the citizenry at heart ;) /s

rascul 11y ago
https://news.ycombinator.com/item?id=10459695 https://news.ycombinator.com/item?id=10459695
mindslight 11y ago
Anecdata: Back when I had an old 2G featurephone, I inherited the exact same model from a friend (Sprint/CDMA). I used QPST to clone my ESN onto that one, to have a handy backup device. When both were on, calling my number would ring both (I only ever checked this with them in the same cell). Picking up both I would hear audio in both until one of them "won". The ESN can't be considered any kind of secret, so the observed behavior makes it clear that there is no meaningful encryption. We've had two generations of mobile protocols since then, but with Qualcomm et al's attitude of "lock things down harder" rather than Kerckhoff's principle and open review, I doubt security has gotten any better. If you want meaningful mobile privacy, the only way to achieve this is with separate application/baseband processors that communicate over an auditable bus (so not a broken-by-design Qualcomm integrated chipset), with encryption done on the trusted application processor. The easiest way to realize this is using a mifi+vpn+voip. Note that this still leaves your location fully tracked, but most every use of the cell network will do that.
- deepnet 11y ago
  It appears that 2G is the vulnerability the stingrays exploit. "... exploits a vulnerability in the 2G protocol. Phones using 2G don’t authenticate cell towers, which means that a rogue tower can pass itself off as a legitimate cell tower. But because 3G and 4G networks have fixed this vulnerability, the stingray will jam these networks to force nearby phones to downgrade to the vulnerable 2G network to communicate." [article] Is it possible to disable 2G ?

geggam 11y ago

Used to be scanners were able to track cell phone conversations. They started rolling frequencies but it was trivial to find out what they were and filter for only those. The drama one could hear over cell phones was better than any daytime soap, especially in small towns. They digitized it and made it harder but I am sure with a bit of work one could listen in.

hackuser 11y ago

Related news: The Internal Revenue Service is using StingRays: http://thehill.com/policy/national-security/258209-irs-head-reassures-congress-about-use-of-phone-tracking-tech http://thehill.com/policy/national-security/258209-irs-head-...

godgod 11y ago

The hacker community needs to come together and release an open source stingray unit that citizens can easily build for cheap...then sit outside their local police department, judges houses and record all their private calls made to their spouses. Imagine how quick these stingray devices would be come illegal and how fast phone calls would be encrypted. Turn about is fair play.

ck2 11y ago

The IRS already said it can see SMS via stingray and wtf does the IRS have its own criminal law enforcement branch vs all the other ones at their disposal