5 ms·

As of today, what stops someone (regardless of their intentions) from building or making their own Stingray-like device? Is it illegal for an 'average joe' to

As of today, what stops someone (regardless of their intentions) from building or making their own Stingray-like device? Is it illegal for an 'average joe' to build or develop one of these? Or is it just super high difficulty, ie the protocols just aren't published or [easily] reverse-engineered? Or right now is it just the illegality of call recording entirely that is "preventing" it's use? Pretty sure I watched a conference talk that demoed a functional one that included pass-thru [to prevent suspicion/non-functional devices] to the real cell tower IIRC). I'm just curious because obviously this isn't something you want just anyone to be able to build & deploy -- so much potential for abuse, anything from basic identity theft to serious securities fraud, and much more quickly becomes a very serious & probable threat once these become even just slightly more "mainstream" for the public / criminals / mafia / etc...

superuser2 11y ago
It is illegal to make or sell or own radio hardware capable of operating on that spectrum, or modify other hardware to work on that spectrum, or hint to your users how they might modify your product to work on that spectrum, unless you are a licensee or have permission from one. Even Motorola can't take its new basebands out of RF-isolated testing facilities before FCC approval. Theoretically calls are encrypted, however security researches have shown vulnerabilities due to old/incorrectly applied primitives. Not sure exactly which protocol versions this applies to. Stingray might just have asked nicely for the keys. Commercial IMSI-catchers (made with the cooperation of carriers?) do exist, and there are some hobbyist proofs of concept. It is very hard to get caught doing passive receiving. Transmit in a way that catches the eyes of carrier network engineers, though, and the federal government will come knocking with criminal charges. FCC makes exceptions to most things for official purposes. For example, government installations can be licensed to operate cell phone jammers
- adanto6840 11y ago
  Very interesting, thank you. So the most likely scenario is that the carriers are cooperating... Are they cooperating only with the US, or are they cooperating with other nations as well? Seems safe to assume they're cooperating with any/all nations that have a significant market for their products (ie leverage). That's fairly scary though -- I assume the keys / encryption stays the same across similar networks, regardless of nation (given that phones continue to work abroad)? Perhaps the keys / encryption does differ by carrier, I'm not sure, but I'd definitely be curious. As long as they stay undetected, sounds like there is very little stopping COUNTRY_X from deploying these in COUNTRY_Y for their own gain, not to mention 'lower level' criminals / mafia / etc... And obviously there are plenty of people out there (reverse-engineers, employees/insiders, et al) that have access to the keys... Any idea if the exceptions that the FCC makes are public information, or obtainable via FOIA or similar? I'm guessing the FCC has a rigid "exception request process" in place and, hopefully, they only provide [super] limited-scope exceptions (without warrants, eh)... I'd love to see what exceptions are actually being made and what limits, if any, they contain. Anyways, this is definitely pretty far outside of my realm of knowledge but I find the tech incredibly intriguing and very interesting nonetheless (and I agree with commentshere regarding the FCC).
  - detaro 11y ago
    For GSM encryption, at least the commonly deployed variants, you do not need cooperation or stolen keys, you can just straight-up break it in a few minutes. (EDIT: might not be correct for up-to-date networks, see below) And if you impersonate a cell tower instead of passively sniffing, you can just turn encryption off or downgrade to a weak one.
    - yuhong 11y ago
      I think the strongest one deployed today (A5/3 and GEA3) can be brute forced (64-bit), but typically takes far more than a few minutes.
      - detaro 11y ago
        You seem to be right. There is a paper about fast attacks against A5/3, but according to the authors it doesn't necessarily apply to real attack scenarios. https://eprint.iacr.org/2010/013 https://eprint.iacr.org/2010/013
        yuhong 11y ago
        Yea, related key attack I think.
Zigurd 11y ago
If you can settle for 2G IMSI-catching, there are some old femtocells with SIP backhaul that could be hackable enough. Someone once tried to build a "roam-to-voip-at-home" kind of service out of those. It was just SIP VoIP backhaul without protection preventing spoofing the backhaul network. I can't recall the company but I think they pivoted to shipboard phone service.
tlrobinson 11y ago
You're probably thinking of Chris Paget's Defcon 18 talk demonstrating an OpenBTS/USRP/Asterix based 2G IMSI catcher. Also, it's not entirely illegal to operate on some cellular frequencies which overlap with ham bands, if you're a licensed ham radio operator, which Chris apparently was (KJ6GCG). He also had to disable encryption (illegal on ham bands), use extremely low power and a highly directional antenna (to ensure he didn't intercept anyone outside of the room), and ensure everyone inside the room was aware of the demonstration (IIRC there were signs outside the room). He also destroyed the USB stick the base station was writing to. Even then it was definitely a legal gray area...

superuser2 11y ago

It is illegal to make or sell or own radio hardware capable of operating on that spectrum, or modify other hardware to work on that spectrum, or hint to your users how they might modify your product to work on that spectrum, unless you are a licensee or have permission from one. Even Motorola can't take its new basebands out of RF-isolated testing facilities before FCC approval. Theoretically calls are encrypted, however security researches have shown vulnerabilities due to old/incorrectly applied primitives. Not sure exactly which protocol versions this applies to. Stingray might just have asked nicely for the keys. Commercial IMSI-catchers (made with the cooperation of carriers?) do exist, and there are some hobbyist proofs of concept. It is very hard to get caught doing passive receiving. Transmit in a way that catches the eyes of carrier network engineers, though, and the federal government will come knocking with criminal charges. FCC makes exceptions to most things for official purposes. For example, government installations can be licensed to operate cell phone jammers

adanto6840 11y ago
Very interesting, thank you. So the most likely scenario is that the carriers are cooperating... Are they cooperating only with the US, or are they cooperating with other nations as well? Seems safe to assume they're cooperating with any/all nations that have a significant market for their products (ie leverage). That's fairly scary though -- I assume the keys / encryption stays the same across similar networks, regardless of nation (given that phones continue to work abroad)? Perhaps the keys / encryption does differ by carrier, I'm not sure, but I'd definitely be curious. As long as they stay undetected, sounds like there is very little stopping COUNTRY_X from deploying these in COUNTRY_Y for their own gain, not to mention 'lower level' criminals / mafia / etc... And obviously there are plenty of people out there (reverse-engineers, employees/insiders, et al) that have access to the keys... Any idea if the exceptions that the FCC makes are public information, or obtainable via FOIA or similar? I'm guessing the FCC has a rigid "exception request process" in place and, hopefully, they only provide [super] limited-scope exceptions (without warrants, eh)... I'd love to see what exceptions are actually being made and what limits, if any, they contain. Anyways, this is definitely pretty far outside of my realm of knowledge but I find the tech incredibly intriguing and very interesting nonetheless (and I agree with commentshere regarding the FCC).
- detaro 11y ago
  For GSM encryption, at least the commonly deployed variants, you do not need cooperation or stolen keys, you can just straight-up break it in a few minutes. (EDIT: might not be correct for up-to-date networks, see below) And if you impersonate a cell tower instead of passively sniffing, you can just turn encryption off or downgrade to a weak one.
  - yuhong 11y ago
    I think the strongest one deployed today (A5/3 and GEA3) can be brute forced (64-bit), but typically takes far more than a few minutes.
    - detaro 11y ago
      You seem to be right. There is a paper about fast attacks against A5/3, but according to the authors it doesn't necessarily apply to real attack scenarios. https://eprint.iacr.org/2010/013 https://eprint.iacr.org/2010/013
      - yuhong 11y ago
        Yea, related key attack I think.

Zigurd 11y ago

If you can settle for 2G IMSI-catching, there are some old femtocells with SIP backhaul that could be hackable enough. Someone once tried to build a "roam-to-voip-at-home" kind of service out of those. It was just SIP VoIP backhaul without protection preventing spoofing the backhaul network. I can't recall the company but I think they pivoted to shipboard phone service.

tlrobinson 11y ago

You're probably thinking of Chris Paget's Defcon 18 talk demonstrating an OpenBTS/USRP/Asterix based 2G IMSI catcher. Also, it's not entirely illegal to operate on some cellular frequencies which overlap with ham bands, if you're a licensed ham radio operator, which Chris apparently was (KJ6GCG). He also had to disable encryption (illegal on ham bands), use extremely low power and a highly directional antenna (to ensure he didn't intercept anyone outside of the room), and ensure everyone inside the room was aware of the demonstration (IIRC there were signs outside the room). He also destroyed the USB stick the base station was writing to. Even then it was definitely a legal gray area...