18 ms·
Cell-Site Simulators Aren’t Secret Anymore
- mirimir 11y agoThere are apps for detecting these things. Maybe we need an app that plots locations based on anonymized submissions. Also, I wonder if it's possible to distribute blacklists. But I suppose that's buried in the radio firmware.
- rubicon33 11y agoCare to list some of those apps?
- tomlongson 11y agoAndroid IMSI-Catcher Detector: https://secupwn.github.io/Android-IMSI-Catcher-Detector/ https://secupwn.github.io/Android-IMSI-Catcher-Detector/ SnoopSnitch: https://play.google.com/store/apps/details?id=de.srlabs.snoopsnitch https://play.google.com/store/apps/details?id=de.srlabs.snoo...
- yqoa1r0jb0p0 11y agoBoth of these apps are available on F-Droid for those that prefer that distribution method.
- adrtessier 11y agoI have used both apps before. SnoopSnitch only works on specific Qualcomm chipsets. If you want to use IMSI-catcher detectors, make sure it actually works with your specific chipset. AIMSICD eats a decent amount of battery as it really needs GPS to be useful as a historical data source.
- akerro 11y agoAIMSICD is very faulty. I made full code review in my spare time and tests on OpenBTS. It can't detect SilentSMS even if they claim it can. It doesn't detect fake BTSs nor connections using them. You can connect to fake BTS, make calls, send texts, it doesn't detect anything suspicious. This project sounds serious, but it doesn't do anything. Moreover it sends data about fake BTSs to remote service - OpenCellId (they get data about cells from OCID). Recently all of this what I say here was proven on their issue board on Github. https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/issues/75 https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/iss... Next week I will put my hands on SnoopSnitch.
- SecUpwN 11y agoThis is SecUpwN, the project maintainer of mentioned app. Let me say this: Before discrediting an eager project like ours, RTFM! Obviously you closed your eyes the whole time when doing the "full code review", otherwise you would have read: * https://github.com/SecUpwN/Android-IMSI-Catcher-Detector#warnings https://github.com/SecUpwN/Android-IMSI-Catcher-Detector#war... * https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/blob/development/DISCLAIMER https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/blo... * What is the first thing popping up in our app? Right, our DISCLAIMER! Bummer, huh? Furthermore, where are your contributions to below Issue? * https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/issues/75 https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/iss... Everyone with a pair of eyes is able to clearly see the warnings, disclaimers and statements all over our project that our app is still in ALPHA development. And if you really are a skilled developer and not just a troll wanting to discredit our app in favour of making another one more popular (which I think you actually are), you'd have contributed. But you're just a fake "security researcher", ranting on public sites about an open source project where everyone is invited and very welcome to add a bit to make it better. Next time, please think twice before publishing shit like yours above.
- mirimir 11y agoSee https://www.sba-research.org/wp-content/uploads/publications/DabrowskiEtAl-IMSI-Catcher-Catcher-ACSAC2014.pdf https://www.sba-research.org/wp-content/uploads/publications... But Android only, it seems. > iOS neither exposes high-level nor low-level baseband information (e.g. cell info) to applications through the official and public API.
- codezero 11y agoAre there any standalone tools that can be used to capture the meta-information about cell towers? It seems like it would be really useful to crowdsource known towers, their identities and strengths, so that simulators can be singled out.
- bottled_poe 11y agoIt exists: http://opencellid.org http://opencellid.org
- yqoa1r0jb0p0 11y agoMozilla has an even larger database. https://location.services.mozilla.com/downloads https://location.services.mozilla.com/downloads If you want to contribute, there's an opt-in toggle in Firefox for Android.
- mirimir 11y agoOK, this seems to be all GSM towers. I wonder how one would select the fake ones. Edit: Not just GSM.
- adrtessier 11y agoThe AIMSICD application mentioned above for Android uses this as a synchronizable data source.
- ipunchghosts 11y agoany rtlsdr or ettus radio can capture cell metadata. Most of the tools to process the captures are linux based but highly automated.
- ipunchghosts 11y agoSince OpenBTS launched 6 years ago they haven't been secret. All you need is a backpack with an Ettus USRP1, handful a D batteries, and a laptop. Walk into any starbucks, connect your laptop to the wifi and then SIP through Google and voila, you can snoop on everything and no one has any clue.
- techbio 11y agoWhat does this mean? Please elaborate, I have a nagging sensation regarding the open digital airwaves.
- mey 11y agoTL;DR: Basically describing an off the shelf, Stringray OpenBTS is basically an opensource cell phone tower software stack. You phone supports older protocols for backwards compatibility as you roam. You can instruct your tower to broadcast on an older protocol, like 2G. 2G has this hilarious design flaw that the tower tells the cellphone which tower has the strongest signal. So you claim that you have super amazing signal. 2G's cryptography is broken wide open, worse then DES. So this little cell tower running on a laptop and a digital radio system has just MITM'd your phone (and everyone else) who's network it is impersonating. I expect/assume this is the general design (which hopefully significant refinement) of most Stringray devices.
- jacquesm 11y ago> 2G has this hilarious design flaw that the tower tells the cellphone which tower has the strongest signal. Can't go trusting those handsets now can we?
- adrtessier 11y agoI'm not sure if this was your point or not, but we can't really trust any handset without an open baseband, of which all of the handsets we use today don't have. As long as we're stuck with proprietary blobs and their secrecy, we can't trust what's in them. Given the technical skill shown in some of the Snowden leaks, it seems to be all but a given that these blobs are compromised from the factory by three-letter agencies. It's somewhat amusing watching the overt rhetoric of the FBI "crypto war" when the majority of even technical people make far less of a fuss over covert exploitation, which has the dual benefits of being pretty much ubiquitous and plausibly deniable. One NSL to Intel and Qualcomm, or better yet, one call to an executive with the loyalty of a few "patriotic" employees, the secret is safe, and everyone is pwned by default. It is basically impossible to use a modern computing stack without trusting someone's proprietary blob, and the general population has little to no care about attacks at a level that they really don't understand. That's probably why all the press is on this crypto rhetoric to begin with.
- malandrew 11y agoIs there any way to re-engineer infrastructure so that all cell-sites cryptographically identify themselves so that cellular devices can verify the identity of a cell-site before identifying itself to the cell-site?
- gruez 11y agoAFIAK 3g and 4g has this. the issue is that there are still legacy 2g and gprs networks so those protocols can't be disabled yet.
- samstave 11y agoshouldnt it be expected that we would be able to prevent our devices to not talk to any non 3/4G tower?
- jlgaddis 11y agoYou could, sure... if you could modify the software running on your phone. Since you can't, it's only possible for the (either hardware or software) manufacturer to build in that feature and I'm not sure they have any compelling reason to give the user that option. (It's entirely possible that this option is available on some phones but I really no idea, I haven't used anything other than an iPhone for several years.)
- fulafel 11y agoMany phones have this in settings, many other phones have this in a hidden service menu (eg http://android.stackexchange.com/a/66819 http://android.stackexchange.com/a/66819)
- Relys 11y ago3G networks that still use the A5/1 cipher can also broken with a rainbow table.
- gruez 11y ago>3G networks use the KASUMI block cipher instead of the older A5/1 stream cipher https://en.wikipedia.org/wiki/3G#Security https://en.wikipedia.org/wiki/3G#Security I don't see any exceptions for this. Can you link to a source that states it's still possible for 3G to use A5/1?
- themartorana 11y agoSome version of these went up all over Philadelphia when the Pope came to town and they turned the city into a giant TSA checkpoint, replete with National Guard troops. The Pope left. The boxes stayed. Edit: here's one of several pics I took: (see edit 2 below for link) anyone recognize it? Interestingly enough, the nuclear and chemical detection boxes were labeled... Edit 2: direct photo link: https://s3.amazonaws.com/f.cl.ly/items/1X2f2i1M2P0e0n322r1X/4C9295AC-A89F-459F-947E-A01226E3E47D.JPG https://s3.amazonaws.com/f.cl.ly/items/1X2f2i1M2P0e0n322r1X/...
- yqoa1r0jb0p0 11y agoWould you be so kind as to post a direct link? EDIT: Thanks! I would really be interested in a crowdsourced wiki-style database of these. If nothing else, submit them to Wikimedia commons with coordinates.
- carbocation 11y agohttps://photos.google.com/share/AF1QipMNG8CWmf3A4zDeGZwyqIlXCwUD1jiOH0gkgb73rgNUlxF_BLdGQBDo8qFG80IPJw/photo/AF1QipO3H4asfFNYZ9pr-kgcaBBLFrw4hb36uoJFr6aL?key=WDZELVpCTFpQRFNHcWF6d0R0NGgxOVFFMzdSVExB https://photos.google.com/share/AF1QipMNG8CWmf3A4zDeGZwyqIlX...
- blt 11y agopossible solution: http://english.controleradar.org/burning-gatso.php http://english.controleradar.org/burning-gatso.php
- jacquesm 11y agoIf you're wondering why they're called Gatso's: https://en.wikipedia.org/wiki/Maus_Gatsonides https://en.wikipedia.org/wiki/Maus_Gatsonides
- madengr 11y agoWell it could be a genuine microcell, not a simulator.
- mmaunder 11y agoRelated: A video I took at blackhat 2013 demo'ing a hacked femtocell intercepting calls. Voice is intercepted before the call even starts. https://vimeo.com/71466006 https://vimeo.com/71466006
- danellis 11y agoI worked for a picocell/femtocell company a few years ago, and when I started I had to get up to speed on GSM protocols. I remember thinking at the time something along the lines of, "Connecting the call and telling your phone to ring are different messages, so if instead of sending the ring, waiting for a pickup, then connecting the call you just connected the call..."
- alexvr 11y agoWhat? Why doesn't it work like this: Cell phones have SIM cards with an ID and a secret key. Cell service providers have a database of these SIM associations. Cell phones encrypt IP packets in their entirety with the symmetric key and send it as the payload of some cell protocol packet that might expose my ID, if anything. Assuming the cell provider is secure and not on the dark side, this is the safest part of my my packet's trip. I don't understand how a cell-site simulator could see what websites I visit, much less the messages I send, without knowing my key. And it's not like one could trick my phone into thinking it's the actual cell site, because it won't be able to respond to my transmission with a message that my key can decrypt. What the heck am I missing?
- kinghajj 11y agoFBI: "Hey, cellular provider, give us the secret key and ID for X." Provider: "Sure, thing, just one moment." ... "Here you go." --- Or, if your provider has a bit of a spine: FBI: "Hey, cellular provider, give us the secret key and ID for X." Provider: "Got a warrant?" FBI: "No problem, give a half hour to call our go-to judge." / "No, but here's a NSL."
- doctorshady 11y agoThat's assuming that is even necessary. Harris made an upgrade to their Stingray equipment called Hailstorm that intercepts 3G and 4G standards.
- superuser2 11y agoThese devices do not necessarily have insight into the contents of your communications, their main feature is that they can uniquely identify and locate a phone.
- nitrogen 11y agoThe ID is probably the most important thing for them to track.
- patcheudor 11y ago2G ruins everything. It is effectively wide-open now and handsets will connect to the strongest connection. This is one of the oldest problems in cryptography. It doesn't matter how great the latest and greatest is so long as the old broken standard is still widely used and supported.
- EFruit 11y agoI was speaking with a friend regarding cellphone jamming, and a question was posed: Suppose there is a piece of equipment that strictly follows all the relevant cellular protocol specs and can route 911 calls, but drops all other traffic. Is such a system illegal?
- FireBeyond 11y agoAt least civilly, if not criminally, yes, illegal - you don't hold a license for broadcasting on that spectrum.
- jlgaddis 11y agoI believe your device would need type acceptance by the FCC and, presumably, a valid license to transmit/operate on those frequencies. Otherwise, yes, it would be illegal. I don't have a citation/reference handy but, if memory serves, it is illegal (in the U.S.) to interfere with any cellular communications.
- FLUX-YOU 11y agoIs there a quick way to figure out if this is occurring? I've gone into one or two restaurants with their own wifi and my cell connection goes down to 3G.
- droopybuns 11y ago"Cell Simulators" is a bad name. We should be calling them "Phoney Base Stations"
- jlgaddis 11y agoAgreed, a "cell-site simulator" sounds like something one uses when developing/testing mobiles phones/devices. Personally, I would prefer "rogue" or "malicious" or something similar that adequately highlights their true intentions.
- atallcostsky 11y agoI wonder if it would be possible to take the idea of certificate authorities and apply it to cell phone towers. Basically, each cell tower company would be a CA, and could generate a certificate for each cell tower. Major cell tower companies could then be trusted by other CAs, and cell phones could have a store of trusted CAs. Then, when a cell phone attempts to connect to a tower, a check is made to verify that the tower is trusted by a trusted CA. This way, a user could (at least maybe) revoke a certificate from a CA that has trusted a group that has set up a cell site simulator. My knowledge of PKI is pretty shaky. Does anyone know if something like this would work and/or be an improvement?
- c22 11y agoProbably would make it hard for non-smart / low powered handsets to participate.
- jlgaddis 11y agoThe SIM card in your phone is, basically, a smartcard. The private/public keypair on the SIM is how your phone authenticates to the cellular network. Is what you're asking technically possible? Sure. What motivation do the cellular companies have to implement it, though? They are currently satisfied with the level of security already offered and to do what you are asking would cost a not-insignificant amount of money with little or no return (for them).
- mtgx 11y agoWhy aren't the OS vendors such as Apple, Google and Microsoft protecting users against this?
- akerro 11y agoBecause they are contributing to it.
- ikawe 11y agoBuild your own! https://github.com/Shadytel https://github.com/Shadytel
- cm2187 11y agoI can see how it can be creepy, however my house was burglarized recently, and I would have loved to have a device that could catch the IMSI of all the mobiles in my flat at that time. I can't really do anything with the IMSIs myself but I could give them to the police after a burglary, like a CCTV tape.
- lotsofcows 11y agoMuch easier just to log whatever SSIDs the phones are broadcasting. My phone currently knows about 20 wifi networks from which I can work out where I live, where I work and where I've been on holiday.
- Johnny_Brahms 11y agoFor those that are surprised that your phone is such a snitch: That can be shut off, even on app-level. There is Wifi privacy police for android, and probably something similar for ios. I actually did just that at work. First of all I had a raspberry pi that got all the device names connected to my company wifi (the guy responsible for the network is actually just the janitor, so the wifi is basically the wild west). After a bit of puzzling I knew the MAC-addresses 90% of my closest colleague’s phones. From there it was easy to do the rest. Just set up your own wifi network and monitor SSID broadcasts. This worked fine until iphones started randomizing their mac addresses, but since I know when a certain device appears on our work wifi, I could probably just compare when a scan was made to when a certain device was connected. I just can't be bothered. The system is still up and running, and now even has a nice web interface that I can access from home. I'll eventually release it as FLOSS, but I'll have to clean the code quite badly. It only requires guile and nmap, but can probably be ported to something fancier.
- cm2187 11y agoBut can the police do anything with this SSID?
- lotsofcows 11y agoIs it presentable in court? Depends on your jurisdiction. Can they use it as I can - to translate SSIDs into locations? https://wigle.net/ https://wigle.net/
- KazWolfe 11y agoSo, how long until schools decide to deploy this in the name of "student security?"
- ck2 11y agoSo is wiretapping illegal without a warrant or isn't it? Because they aren't collecting just meta data with this and unlike the NSA there is likely no discipline at all about how the data is used or shared. Policing in this country has come down to "try to stop us from doing it" instead of asking first "is this even legal" on every aspect.