4 ms·

Interestingly enough, during last trip to London, my phone (Nexus 5 running Cyanogenmod 12.1) was able to somehow detect something fishy and warned me several t

by scott77 11y ago

Interestingly enough, during last trip to London, my phone (Nexus 5 running Cyanogenmod 12.1) was able to somehow detect something fishy and warned me several times "Network may be monitored by an unknown 3rd party". Among others, I've seen this warning two times out of two when passing by Cheapside/St Martin's corner - next to the St Paul's Cathedral. At the time I just dismissed this as some tinfoil hat developer adding some nonsensical warnings to the firmware, but in retrospect, after reading this article - this matches perfectly, chances are - phone was indeed detecting Stingrays. Still no idea how it managed to do it. EDIT: I had no data/IP connection of any kind at and around the time of seeing this, so this is clearly unrelated to TLS interception.

m_t 11y ago
I'm not getting these warning on my Nexus 4 running the default Android build. The only time I see them is when I use my own VPN connection. Do you think it might get triggered on your phone by the presence of the anti-porn filter that UK mobile provider have? For instance, when trying to access "adult" website (I use quotes as sometimes, even non porno website gets filtered out) you end up on your mobile provider page blocking you from the actual website your looking for.
- deleted 11y ago
  [deleted]
- andyjohnson0 11y ago
  Some details regarding the message here: http://security.stackexchange.com/questions/61750/android-kitkat-reports-network-may-be-monitored-by-an-unknown-third-party-whe http://security.stackexchange.com/questions/61750/android-ki...
  - scott77 11y ago
    This is not the message I've seen. There was nothing about TLS, trusted CA installation, emails, apps, or websites. I wish I've taken a screenshot of it!
    - andyjohnson0 11y ago
      The message you quoted appears in the left-hand screenshot [1] showing notifications, not the one on the right containing a dialog box. [1] http://i.stack.imgur.com/7nCMFm.png http://i.stack.imgur.com/7nCMFm.png
- Spooky23 11y ago
  In the US, most mobile traffic is proxied, and filtering/rate limiting is implemented there. No exotic measures are required to do this.
ter0 11y ago
Could this be caused by the phone surveillance that's set up in One New Change? There are (small) notices at the entrances to One New Change that inform you of phone tracking equipment there.
- scottishfiction 11y ago
  If they're informing you of it, I'd assume it's more likely to be passive WiFi tracking. Related: https://news.ycombinator.com/item?id=8752580 https://news.ycombinator.com/item?id=8752580
  - scott77 11y ago
    WiFi was turned off completely on the phone, also message itself was a native UI dialog, not something on a webpage.
razakel 11y ago
Check your certificates. I saw this when I installed a Fiddler root certificate.
- deleted 11y ago
  [deleted]
JustSomeNobody 11y ago
Own signed certs do this.
pakled_engineer 11y ago
There's apps that can read Qualcomm debugging to detect GSM encryption has changed like SnoopSnitch maybe CM has their own built in version but last I heard their kernel removed many proprietary drivers needed for the Nexus 5 to access Qualcomm DIAG.
underbluewaters 11y ago
Is it completely legal to warn users of suspicious network activity like this? If for example Apple built detection into iOS and gave all users a warning that could do a lot for raising awareness and maybe some support for change. "The network you are using is likely being surveilled. Your identity, online activity, and phone calls may be monitored by government or criminal equipment"
- themartorana 11y ago
  Can you stifle free speech when it's informed by public information and not knowledge of secret activities? That is, if all it's doing is flagging signals it's antenna receives, is it even possible for that to be illegal? Also, how do laws treat waves in public (radio, light) - do they get the same "privacy" treatment as people (that is, no expectation of if in public)? Edit: actually since joining/browsing an open WIFI network can be considered criminal...
  - underbluewaters 11y ago
    > Also, how do laws treat waves in public (radio, light) - do they get the same "privacy" treatment as people (that is, no expectation of if in public)? I believe this area is legally fuzzy but courts have determined that police cannot drive around with say, a thermal imager and observe en-mass people in their homes. One could argue that it's just thermal radiation you are viewing from public space.
- CWuestefeld 11y ago
  Frequently on my town's facebook page, somebody will post "speed trap near the elementary school, better slow down there", and people jump all over the poster about helping people get away with speeding. It seems to me that if you really want people to slow down near the elementary school (as opposed to just issuing tickets and collecting fines), this is EXACTLY what you want to have happen. If you put a cop there, and people warn others of it so they all slow down... mission accomplished! By analogy, if you've got a target very valuable to the enemy (maybe a stadium for a high-profile sporting event), having phones alert users that they're being monitored might help to ensure that nobody tries anything during the event.
imglorp 11y ago
Stingrays operate at the gsm layer, not the IP layer. Evidently their MITM is pretty easy to observe. https://www.reddit.com/r/Stingray https://www.reddit.com/r/Stingray
takeda 11y ago
Check certificates, some app added its own certificate. I installed my own certificate on Android and it warns me about it each time after it boots. It's quite annoying, because there doesn't seem to be a way to disable it (without modifying /system) and I trust my own certificate much more than any other the phone comes with.

by scott77 11y ago

m_t 11y ago

I'm not getting these warning on my Nexus 4 running the default Android build. The only time I see them is when I use my own VPN connection. Do you think it might get triggered on your phone by the presence of the anti-porn filter that UK mobile provider have? For instance, when trying to access "adult" website (I use quotes as sometimes, even non porno website gets filtered out) you end up on your mobile provider page blocking you from the actual website your looking for.

deleted 11y ago
[deleted]
andyjohnson0 11y ago
Some details regarding the message here: http://security.stackexchange.com/questions/61750/android-kitkat-reports-network-may-be-monitored-by-an-unknown-third-party-whe http://security.stackexchange.com/questions/61750/android-ki...
- scott77 11y ago
  This is not the message I've seen. There was nothing about TLS, trusted CA installation, emails, apps, or websites. I wish I've taken a screenshot of it!
  - andyjohnson0 11y ago
    The message you quoted appears in the left-hand screenshot [1] showing notifications, not the one on the right containing a dialog box. [1] http://i.stack.imgur.com/7nCMFm.png http://i.stack.imgur.com/7nCMFm.png
Spooky23 11y ago
In the US, most mobile traffic is proxied, and filtering/rate limiting is implemented there. No exotic measures are required to do this.

ter0 11y ago

Could this be caused by the phone surveillance that's set up in One New Change? There are (small) notices at the entrances to One New Change that inform you of phone tracking equipment there.

scottishfiction 11y ago
If they're informing you of it, I'd assume it's more likely to be passive WiFi tracking. Related: https://news.ycombinator.com/item?id=8752580 https://news.ycombinator.com/item?id=8752580
- scott77 11y ago
  WiFi was turned off completely on the phone, also message itself was a native UI dialog, not something on a webpage.

razakel 11y ago

Check your certificates. I saw this when I installed a Fiddler root certificate.

deleted 11y ago
[deleted]

JustSomeNobody 11y ago

Own signed certs do this.

pakled_engineer 11y ago

There's apps that can read Qualcomm debugging to detect GSM encryption has changed like SnoopSnitch maybe CM has their own built in version but last I heard their kernel removed many proprietary drivers needed for the Nexus 5 to access Qualcomm DIAG.

underbluewaters 11y ago

Is it completely legal to warn users of suspicious network activity like this? If for example Apple built detection into iOS and gave all users a warning that could do a lot for raising awareness and maybe some support for change. "The network you are using is likely being surveilled. Your identity, online activity, and phone calls may be monitored by government or criminal equipment"

themartorana 11y ago
Can you stifle free speech when it's informed by public information and not knowledge of secret activities? That is, if all it's doing is flagging signals it's antenna receives, is it even possible for that to be illegal? Also, how do laws treat waves in public (radio, light) - do they get the same "privacy" treatment as people (that is, no expectation of if in public)? Edit: actually since joining/browsing an open WIFI network can be considered criminal...
- underbluewaters 11y ago
  > Also, how do laws treat waves in public (radio, light) - do they get the same "privacy" treatment as people (that is, no expectation of if in public)? I believe this area is legally fuzzy but courts have determined that police cannot drive around with say, a thermal imager and observe en-mass people in their homes. One could argue that it's just thermal radiation you are viewing from public space.
CWuestefeld 11y ago
Frequently on my town's facebook page, somebody will post "speed trap near the elementary school, better slow down there", and people jump all over the poster about helping people get away with speeding. It seems to me that if you really want people to slow down near the elementary school (as opposed to just issuing tickets and collecting fines), this is EXACTLY what you want to have happen. If you put a cop there, and people warn others of it so they all slow down... mission accomplished! By analogy, if you've got a target very valuable to the enemy (maybe a stadium for a high-profile sporting event), having phones alert users that they're being monitored might help to ensure that nobody tries anything during the event.

imglorp 11y ago

Stingrays operate at the gsm layer, not the IP layer. Evidently their MITM is pretty easy to observe. https://www.reddit.com/r/Stingray https://www.reddit.com/r/Stingray

takeda 11y ago

Check certificates, some app added its own certificate. I installed my own certificate on Android and it warns me about it each time after it boots. It's quite annoying, because there doesn't seem to be a way to disable it (without modifying /system) and I trust my own certificate much more than any other the phone comes with.