7 ms·

Since OpenBTS launched 6 years ago they haven't been secret. All you need is a backpack with an Ettus USRP1, handful a D batteries, and a laptop. Walk into an

Since OpenBTS launched 6 years ago they haven't been secret. All you need is a backpack with an Ettus USRP1, handful a D batteries, and a laptop. Walk into any starbucks, connect your laptop to the wifi and then SIP through Google and voila, you can snoop on everything and no one has any clue.

techbio 11y ago
What does this mean? Please elaborate, I have a nagging sensation regarding the open digital airwaves.
- mey 11y ago
  TL;DR: Basically describing an off the shelf, Stringray OpenBTS is basically an opensource cell phone tower software stack. You phone supports older protocols for backwards compatibility as you roam. You can instruct your tower to broadcast on an older protocol, like 2G. 2G has this hilarious design flaw that the tower tells the cellphone which tower has the strongest signal. So you claim that you have super amazing signal. 2G's cryptography is broken wide open, worse then DES. So this little cell tower running on a laptop and a digital radio system has just MITM'd your phone (and everyone else) who's network it is impersonating. I expect/assume this is the general design (which hopefully significant refinement) of most Stringray devices.
  - jacquesm 11y ago
    > 2G has this hilarious design flaw that the tower tells the cellphone which tower has the strongest signal. Can't go trusting those handsets now can we?
    - adrtessier 11y ago
      I'm not sure if this was your point or not, but we can't really trust any handset without an open baseband, of which all of the handsets we use today don't have. As long as we're stuck with proprietary blobs and their secrecy, we can't trust what's in them. Given the technical skill shown in some of the Snowden leaks, it seems to be all but a given that these blobs are compromised from the factory by three-letter agencies. It's somewhat amusing watching the overt rhetoric of the FBI "crypto war" when the majority of even technical people make far less of a fuss over covert exploitation, which has the dual benefits of being pretty much ubiquitous and plausibly deniable. One NSL to Intel and Qualcomm, or better yet, one call to an executive with the loyalty of a few "patriotic" employees, the secret is safe, and everyone is pwned by default. It is basically impossible to use a modern computing stack without trusting someone's proprietary blob, and the general population has little to no care about attacks at a level that they really don't understand. That's probably why all the press is on this crypto rhetoric to begin with.
      - cinquemb 11y ago
        >It's somewhat amusing watching the overt rhetoric of the FBI "crypto war" when the majority of even technical people make far less of a fuss over covert exploitation, which has the dual benefits of being pretty much ubiquitous and plausibly deniable. Sounds like what John Young said today on cypherpunks mailing list[0] and something I don't see the public nor the all actors involved this "crypto c̶i̶r̶c̶u̶s̶ war" shedding light on soon: "Kill metadata and other crypto-issue-overdone diversions. Metadata and other crypto-workarounds resulted from the crypto wars of the 1990s which were bragged to be won rather than faked out. The fake-out was orchestrated by some of the very same crypto warriors claiming to be against gov-controlled crypto. A way to identify them is to note who rose to prominence and wealth in crypto com-edu-org. Still at it, ratcheting up the need for ever more crypto, acknowledging the workarounds but, but, but: Let's Encrypt, HTTPS-HTS everywhere, secure drops, freedom of the press and courage foundations, Snowden talks and tweets, FISC amicus curiea, POTUS and TLA advisories, industry lobbyists, dual hats riding the crypto gravy train and more likely, the subway out of sight. The money and prestige to be gained by working all sides of the crypto phony war is, as Greenwald crows of Omidyar's $250M bribe, irresistable." [0] https://cpunks.org/pipermail/cypherpunks/2015-December/011250.html https://cpunks.org/pipermail/cypherpunks/2015-December/01125...
      - c22 11y ago
        I think jaquesm was making a tongue in cheek reference to the thought process of 2g's designers.
  - tlrobinson 11y ago
    Huh? How are legitimate towers even supposed to know what the strongest signal is for a phone in an unknown location surrounded by unknown towers? Also, do you even need to break any cryptography / MITM, or can you just be your own base station that happens to be called "AT&T"?
    - mey 11y ago
      I don't have the details in mind but checkout https://en.m.wikipedia.org/wiki/Handoff#Implementations https://en.m.wikipedia.org/wiki/Handoff#Implementations Since digital, handsets validate the tower they are talking too, this info is stored on sim or device depending on model. So to intercept 2g, there is some work See https://youtu.be/DU8hg4FTm0g https://youtu.be/DU8hg4FTm0g
  - dcposch 11y ago
    Could this be mitigated w an Android patch that disables 2G entirely? There can be a switch in Settings to reenable (eg when travelling to a country w an old network) but by default your phone should not be so vulnerable.
hayksaakian 11y ago
maybe this sounds simple to you, but it probably goes over the heads of 99.99% of people (and i'd venture to say 90% of technical people).
- adrtessier 11y ago
  I believe the majority of Hacker News readers could run OpenBTS on an Ettus as a weekend project, provided they had a little systems programming experience. I think the greater problem is expense: an Ettus USRP is into the 4 figures, although you could probably make something similar with the HackRF. [1] [1] https://greatscottgadgets.com/hackrf/ https://greatscottgadgets.com/hackrf/
  - archimedespi 11y ago
    HackRF is only half-duplex though, so I'm not sure you actually can.
    - danellis 11y ago
      Cellphones are only half duplex too, though.
      - nuand 11y ago
        Cellphones are half duplex but the basestation is generally full-duplex. A half-duplex basestation could probably handle no more than one cellphone. OpenBTS and YateBTS, as well as most commercial basestations, have design patterns that require tight timing capabilites that in turn lend themselves to running on full-duplex basestations.
        danellis 11y ago
        Ah, yes, you're right, of course. I don't know why I was thinking of the phone side. (You can use two HackRFs, though.)
      - 11y ago

techbio 11y ago

What does this mean? Please elaborate, I have a nagging sensation regarding the open digital airwaves.

mey 11y ago
TL;DR: Basically describing an off the shelf, Stringray OpenBTS is basically an opensource cell phone tower software stack. You phone supports older protocols for backwards compatibility as you roam. You can instruct your tower to broadcast on an older protocol, like 2G. 2G has this hilarious design flaw that the tower tells the cellphone which tower has the strongest signal. So you claim that you have super amazing signal. 2G's cryptography is broken wide open, worse then DES. So this little cell tower running on a laptop and a digital radio system has just MITM'd your phone (and everyone else) who's network it is impersonating. I expect/assume this is the general design (which hopefully significant refinement) of most Stringray devices.
- jacquesm 11y ago
  > 2G has this hilarious design flaw that the tower tells the cellphone which tower has the strongest signal. Can't go trusting those handsets now can we?
  - adrtessier 11y ago
    I'm not sure if this was your point or not, but we can't really trust any handset without an open baseband, of which all of the handsets we use today don't have. As long as we're stuck with proprietary blobs and their secrecy, we can't trust what's in them. Given the technical skill shown in some of the Snowden leaks, it seems to be all but a given that these blobs are compromised from the factory by three-letter agencies. It's somewhat amusing watching the overt rhetoric of the FBI "crypto war" when the majority of even technical people make far less of a fuss over covert exploitation, which has the dual benefits of being pretty much ubiquitous and plausibly deniable. One NSL to Intel and Qualcomm, or better yet, one call to an executive with the loyalty of a few "patriotic" employees, the secret is safe, and everyone is pwned by default. It is basically impossible to use a modern computing stack without trusting someone's proprietary blob, and the general population has little to no care about attacks at a level that they really don't understand. That's probably why all the press is on this crypto rhetoric to begin with.
    - cinquemb 11y ago
      >It's somewhat amusing watching the overt rhetoric of the FBI "crypto war" when the majority of even technical people make far less of a fuss over covert exploitation, which has the dual benefits of being pretty much ubiquitous and plausibly deniable. Sounds like what John Young said today on cypherpunks mailing list[0] and something I don't see the public nor the all actors involved this "crypto c̶i̶r̶c̶u̶s̶ war" shedding light on soon: "Kill metadata and other crypto-issue-overdone diversions. Metadata and other crypto-workarounds resulted from the crypto wars of the 1990s which were bragged to be won rather than faked out. The fake-out was orchestrated by some of the very same crypto warriors claiming to be against gov-controlled crypto. A way to identify them is to note who rose to prominence and wealth in crypto com-edu-org. Still at it, ratcheting up the need for ever more crypto, acknowledging the workarounds but, but, but: Let's Encrypt, HTTPS-HTS everywhere, secure drops, freedom of the press and courage foundations, Snowden talks and tweets, FISC amicus curiea, POTUS and TLA advisories, industry lobbyists, dual hats riding the crypto gravy train and more likely, the subway out of sight. The money and prestige to be gained by working all sides of the crypto phony war is, as Greenwald crows of Omidyar's $250M bribe, irresistable." [0] https://cpunks.org/pipermail/cypherpunks/2015-December/011250.html https://cpunks.org/pipermail/cypherpunks/2015-December/01125...
    - c22 11y ago
      I think jaquesm was making a tongue in cheek reference to the thought process of 2g's designers.
- tlrobinson 11y ago
  Huh? How are legitimate towers even supposed to know what the strongest signal is for a phone in an unknown location surrounded by unknown towers? Also, do you even need to break any cryptography / MITM, or can you just be your own base station that happens to be called "AT&T"?
  - mey 11y ago
    I don't have the details in mind but checkout https://en.m.wikipedia.org/wiki/Handoff#Implementations https://en.m.wikipedia.org/wiki/Handoff#Implementations Since digital, handsets validate the tower they are talking too, this info is stored on sim or device depending on model. So to intercept 2g, there is some work See https://youtu.be/DU8hg4FTm0g https://youtu.be/DU8hg4FTm0g
- dcposch 11y ago
  Could this be mitigated w an Android patch that disables 2G entirely? There can be a switch in Settings to reenable (eg when travelling to a country w an old network) but by default your phone should not be so vulnerable.

hayksaakian 11y ago

maybe this sounds simple to you, but it probably goes over the heads of 99.99% of people (and i'd venture to say 90% of technical people).

adrtessier 11y ago
I believe the majority of Hacker News readers could run OpenBTS on an Ettus as a weekend project, provided they had a little systems programming experience. I think the greater problem is expense: an Ettus USRP is into the 4 figures, although you could probably make something similar with the HackRF. [1] [1] https://greatscottgadgets.com/hackrf/ https://greatscottgadgets.com/hackrf/
- archimedespi 11y ago
  HackRF is only half-duplex though, so I'm not sure you actually can.
  - danellis 11y ago
    Cellphones are only half duplex too, though.
    - nuand 11y ago
      Cellphones are half duplex but the basestation is generally full-duplex. A half-duplex basestation could probably handle no more than one cellphone. OpenBTS and YateBTS, as well as most commercial basestations, have design patterns that require tight timing capabilites that in turn lend themselves to running on full-duplex basestations.
      - danellis 11y ago
        Ah, yes, you're right, of course. I don't know why I was thinking of the phone side. (You can use two HackRFs, though.)
    - 11y ago