7 ms·

Do phones not do any kind of cryptographic verification that the cell tower is real and that mobile data is sent securely between the phone and the tower? In 2

Do phones not do any kind of cryptographic verification that the cell tower is real and that mobile data is sent securely between the phone and the tower? In 2016?

revelation 10y ago
The cell tower is trusted, and the preferred cell tower is the one with the strongest signals. That's literally the entire selection strategy. Cell towers also choose the encryption that the cell phone should use. I don't think any currently available phone notifies you when no (A5/0) or weak (A5/1) encryption is used.
- digi_owl 10y ago
  And then there is the whole "notification fatigue" issue, where people will dismiss or ok notifications because they get so many in a day.
stanleydrew 10y ago
It's a collective action problem. How do you incentivize an upgrade while allowing for seamless fallback? For billions of devices made by thousands of manufacturers? Which access hundreds of different carrier networks around the world? I think you need some industry leader to push for this. Apple could do it, or possibly Google although they have a hard time exerting influence over Android device manufacturers.
- Malk0lm 10y ago
  Apple and Google aren't going to do anything. If you want someone to change it talk to Ericsson, Nokia and Qualcomm.
  - joecool1029 10y ago
    Well, here's the deal. They can't do anything as it would be a potential quality of service issue to the end user if GSM were disabled currently. Can't blame the vendors either, they built the hardware years ago that operators continue to operate. It's like wanting to blame Ford and Chevy because you bought a car from the 1950's and it doesn't have airbags. T-Mobile and AT&T are the national carriers supporting GSM through most of their footprint, AT&T is phasing out their network at the end of the year. T-Mobile moved to A5/3 to try to slow down eavesdropping a bit. There are more rural carriers who aren't in a rush to upgrade and probably still use the older ciphers. Currently, I am on T-Mobile. There are a few areas that never saw HSPA deployed, and voLTE is not supported on all devices and also suffers separate outages. GSM is needed in those situations as fallback. Operators would prefer to not have customers complain about outages due to accidentally having GSM turned off. So many phones don't have the option to disable.... though I'd argue now with low band LTE, the footprint is becoming larger than GSM. I would expect Apple to whitelist 'disable 2G' option sometime in the future for AT&T sims. If not just disabling it outright (unless gov pressure gets in the way) EDIT: as noted below, some manufacturers/OS you can set 3G only. Android is pokey about it on some devices. With Blackberry 10, I have the option to change network generations on T-Mobile, but not if I put an AT&T sim in.
    - tdkl 10y ago
      Interesting, you could set Android phones to 3G only since I can remember (2010).
      - jakub_g 10y ago
        I just checked my phone and I can indeed do that ("3G only"), though if I wanted 4G, the only option is to enable "4G/3G/2G".
        ikeboy 10y ago
        You may be able to disable it through the data settings menu. On sprint it's *#*#data#*#*
        kire456 10y ago
        For my phone it is *#*#service#*#* then Service Settings in the menu.
        jakub_g 10y ago
        Indeed, there are more options there, cool!
droopybuns 10y ago
For UMTS and LTE, yes. GSM is the problem here. Jam the others, and the phone falls back to 2g. 2g needs to die.
- jasoncchild 10y ago
  It is. It's being shutdown. I believe all/most carriers are doing so, which is problematic for lots of cheap iot solutions. https://www.business.att.com/content/other/2G-Sunset-FAQ_2016.pdf https://www.business.att.com/content/other/2G-Sunset-FAQ_201...
  - sliverstorm 10y ago
    Don't lots of phones still send SMS & voice calls over GSM/CDMA? I know VoLTE is appearing, but slowly & only on a couple flagship devices, and quality degrades faster with loss of signal...
    - joecool1029 10y ago
      Haven't actually seen the signal degradation issues you speak of, probably offset by being able to use a lower band than GSM or HSPA for my carrier. Carriers have made it a policy to not whitelist imported devices for voLTE. IMEI needs to be whitelisted at carrier AND carrier file installed in phone needs to have support turned on. Either thing missing, no voLTE for you. EDIT: Forgot to mention, non-voLTE still signals with LTE for incoming calls and SMS, it'll handover to HSPA/CDMA/GSM within about 2 seconds of the signal coming in. Unfortunately I don't have specifics of this process.
      - deleted 10y ago
        [deleted]
    - digi_owl 10y ago
      Actually i think most SMS is handled via "WAP" these days, meaning that it is carried as a short duration data connection rather than as a special packet in the cells control channel (GSM, dunno about how CDMA implemented it).
rupellohn 10y ago
For 3G/4G networks there is strong mutual authentication between the device and the network, for 2G(GSM) networks only the device is authenticated so these interception devices work by jamming the 3G/4G bands forcing the device onto the (fake) 2G network.
- digi_owl 10y ago
  Could have sworn that even though a more recent network is the preferred one at that time, the older ones are still connected and listening to provide a smoother handover experience. Depending on the device you may be able to tell it to use newer network only though (my somewhat aging Android device can opt for UMTS only for example).
- guelo 10y ago
  Which makes me wonder how Stingray/Hailstorm works. Does Harris Corp have a universal key for LTE?
  - digi_owl 10y ago
    Best i can tell, stingray is a passive device. It just use a directional antenna to listen for the "keepalive" exchange between cell tower and device, focusing on a specific IMSI. Also, even if your device is currently using LTE or similar, the GSM (or whatever 2G radio it has) will still be on and talking to the relevant network (unless you specifically tell the device otherwise, and the OEM allowed you to). This to provide a smoother handover should the LTE signal drop too low. Hailstorm on the other hand is basically a jammer tuned to 3G and 4G frequencies, thus forcing any devices in range to drop down to 2G. For the general public a jammer would be a big nono, but law enforcement is a different matter.
    - dublinben 10y ago
      IMSI catchers (like Stingray) are not fully passive devices. They have an operation mode where they broadcast a signal that appears to come from a legitimate cell phone tower. This captures traffic from all devices within range, targeted or not. This is why they are often called "cell site simulators" because that accurately describes how they are often used. For more information, check out this EFF page. https://www.eff.org/sls/tech/cell-site-simulators https://www.eff.org/sls/tech/cell-site-simulators
drzaiusapelord 10y ago
You're using GSM here which is from 1991. It may be 2016, but your phone still primarily uses or falls-back to 1991 era protocols. Protocols which are the de facto global standard for cellular communication.
- digi_owl 10y ago
  And sadly had cryptographic modes that were intentionally weak because the cold war...
  - betaby 10y ago
    In fact argument was because of the cold war encryption should be strong. But later was intentionally tailored to allow wiretapping.
kempbellt 10y ago
There was a very informative (terrifying?) talk at Defcon 2012 where it was demonstrated how easily you can pretend to be a GSM base station. Not sure if any of the vulnerabilites have been addressed yet, four years later. You can watch the talk here: https://www.youtube.com/watch?v=xKihq1fClQg https://www.youtube.com/watch?v=xKihq1fClQg
tbihl 10y ago
You have to remember that GSM, which provides fall back for most providers, was framed as a standard in Europe in the 90s. So when you wonder "why is this so insecure?", the answer is not naivete on the designers' parts.

Do phones not do any kind of cryptographic verification that the cell tower is real and that mobile data is sent securely between the phone and the tower? In 2016?

revelation 10y ago

The cell tower is trusted, and the preferred cell tower is the one with the strongest signals. That's literally the entire selection strategy. Cell towers also choose the encryption that the cell phone should use. I don't think any currently available phone notifies you when no (A5/0) or weak (A5/1) encryption is used.

digi_owl 10y ago
And then there is the whole "notification fatigue" issue, where people will dismiss or ok notifications because they get so many in a day.

stanleydrew 10y ago

It's a collective action problem. How do you incentivize an upgrade while allowing for seamless fallback? For billions of devices made by thousands of manufacturers? Which access hundreds of different carrier networks around the world? I think you need some industry leader to push for this. Apple could do it, or possibly Google although they have a hard time exerting influence over Android device manufacturers.

Malk0lm 10y ago
Apple and Google aren't going to do anything. If you want someone to change it talk to Ericsson, Nokia and Qualcomm.
- joecool1029 10y ago
  Well, here's the deal. They can't do anything as it would be a potential quality of service issue to the end user if GSM were disabled currently. Can't blame the vendors either, they built the hardware years ago that operators continue to operate. It's like wanting to blame Ford and Chevy because you bought a car from the 1950's and it doesn't have airbags. T-Mobile and AT&T are the national carriers supporting GSM through most of their footprint, AT&T is phasing out their network at the end of the year. T-Mobile moved to A5/3 to try to slow down eavesdropping a bit. There are more rural carriers who aren't in a rush to upgrade and probably still use the older ciphers. Currently, I am on T-Mobile. There are a few areas that never saw HSPA deployed, and voLTE is not supported on all devices and also suffers separate outages. GSM is needed in those situations as fallback. Operators would prefer to not have customers complain about outages due to accidentally having GSM turned off. So many phones don't have the option to disable.... though I'd argue now with low band LTE, the footprint is becoming larger than GSM. I would expect Apple to whitelist 'disable 2G' option sometime in the future for AT&T sims. If not just disabling it outright (unless gov pressure gets in the way) EDIT: as noted below, some manufacturers/OS you can set 3G only. Android is pokey about it on some devices. With Blackberry 10, I have the option to change network generations on T-Mobile, but not if I put an AT&T sim in.
  - tdkl 10y ago
    Interesting, you could set Android phones to 3G only since I can remember (2010).
    - jakub_g 10y ago
      I just checked my phone and I can indeed do that ("3G only"), though if I wanted 4G, the only option is to enable "4G/3G/2G".
      - ikeboy 10y ago
        You may be able to disable it through the data settings menu. On sprint it's *#*#data#*#*
        kire456 10y ago
        For my phone it is *#*#service#*#* then Service Settings in the menu.
        jakub_g 10y ago
        Indeed, there are more options there, cool!

droopybuns 10y ago

For UMTS and LTE, yes. GSM is the problem here. Jam the others, and the phone falls back to 2g. 2g needs to die.

jasoncchild 10y ago
It is. It's being shutdown. I believe all/most carriers are doing so, which is problematic for lots of cheap iot solutions. https://www.business.att.com/content/other/2G-Sunset-FAQ_2016.pdf https://www.business.att.com/content/other/2G-Sunset-FAQ_201...
- sliverstorm 10y ago
  Don't lots of phones still send SMS & voice calls over GSM/CDMA? I know VoLTE is appearing, but slowly & only on a couple flagship devices, and quality degrades faster with loss of signal...
  - joecool1029 10y ago
    Haven't actually seen the signal degradation issues you speak of, probably offset by being able to use a lower band than GSM or HSPA for my carrier. Carriers have made it a policy to not whitelist imported devices for voLTE. IMEI needs to be whitelisted at carrier AND carrier file installed in phone needs to have support turned on. Either thing missing, no voLTE for you. EDIT: Forgot to mention, non-voLTE still signals with LTE for incoming calls and SMS, it'll handover to HSPA/CDMA/GSM within about 2 seconds of the signal coming in. Unfortunately I don't have specifics of this process.
    - deleted 10y ago
      [deleted]
  - digi_owl 10y ago
    Actually i think most SMS is handled via "WAP" these days, meaning that it is carried as a short duration data connection rather than as a special packet in the cells control channel (GSM, dunno about how CDMA implemented it).

rupellohn 10y ago

For 3G/4G networks there is strong mutual authentication between the device and the network, for 2G(GSM) networks only the device is authenticated so these interception devices work by jamming the 3G/4G bands forcing the device onto the (fake) 2G network.

digi_owl 10y ago
Could have sworn that even though a more recent network is the preferred one at that time, the older ones are still connected and listening to provide a smoother handover experience. Depending on the device you may be able to tell it to use newer network only though (my somewhat aging Android device can opt for UMTS only for example).
guelo 10y ago
Which makes me wonder how Stingray/Hailstorm works. Does Harris Corp have a universal key for LTE?
- digi_owl 10y ago
  Best i can tell, stingray is a passive device. It just use a directional antenna to listen for the "keepalive" exchange between cell tower and device, focusing on a specific IMSI. Also, even if your device is currently using LTE or similar, the GSM (or whatever 2G radio it has) will still be on and talking to the relevant network (unless you specifically tell the device otherwise, and the OEM allowed you to). This to provide a smoother handover should the LTE signal drop too low. Hailstorm on the other hand is basically a jammer tuned to 3G and 4G frequencies, thus forcing any devices in range to drop down to 2G. For the general public a jammer would be a big nono, but law enforcement is a different matter.
  - dublinben 10y ago
    IMSI catchers (like Stingray) are not fully passive devices. They have an operation mode where they broadcast a signal that appears to come from a legitimate cell phone tower. This captures traffic from all devices within range, targeted or not. This is why they are often called "cell site simulators" because that accurately describes how they are often used. For more information, check out this EFF page. https://www.eff.org/sls/tech/cell-site-simulators https://www.eff.org/sls/tech/cell-site-simulators

drzaiusapelord 10y ago

You're using GSM here which is from 1991. It may be 2016, but your phone still primarily uses or falls-back to 1991 era protocols. Protocols which are the de facto global standard for cellular communication.

digi_owl 10y ago
And sadly had cryptographic modes that were intentionally weak because the cold war...
- betaby 10y ago
  In fact argument was because of the cold war encryption should be strong. But later was intentionally tailored to allow wiretapping.

kempbellt 10y ago

There was a very informative (terrifying?) talk at Defcon 2012 where it was demonstrated how easily you can pretend to be a GSM base station. Not sure if any of the vulnerabilites have been addressed yet, four years later. You can watch the talk here: https://www.youtube.com/watch?v=xKihq1fClQg https://www.youtube.com/watch?v=xKihq1fClQg

tbihl 10y ago

You have to remember that GSM, which provides fall back for most providers, was framed as a standard in Europe in the 90s. So when you wonder "why is this so insecure?", the answer is not naivete on the designers' parts.