6 ms·

SeaGlass – Enabling City-Wide IMSI-Catcher Detection

363 points by risk 9y ago

nafizh 9y ago
Wow, this feels like something similar to the mechanism Batman uses to find Joker at the end of the dark knight movie. Instead of Joker, it's IMSI-Catchers. It would be interesting to see how they validate their findings which should be a challenge I guess.
- rosser 9y ago
  I think that would be more them packaging their algorithms into a (preferably free) smartphone app, which (optionally) silently collects "anomaly signatures" until it's on a trusted network, where it uploads its findings for analysis. (It's probably dangerous in some places to do anything that might overtly indicate you're onto "them"...) EDIT: Based on another top-level comment, someone's already running with a similar idea.
bicubic 9y ago
Are the collected datasets available publicly?
Scoundreller 9y ago
Are they really running a DC->AC inverter, and then plugging SMPS AC->DC converters into it?
- notatoad 9y ago
  it's not efficient, but who cares? using the bricks that come with your equipment and parts you can get at the hardware store solves problems quickly
  - y04nn 9y ago
    A simple DC-DC converter from ebay would do the trick a save you a lot of space and money.
    - mcguire 9y ago
      Would that handle the noise and transients in an automotive electrical system?
      - mschuster91 9y ago
        Especially the transients are a problem. IIRC certified-for-automotive parts have to endure >100V input, which e.g. may happen when the battery connection is flaky and the engine is running, due to the sudden load drop. What's missing on this setup imho is a) a solid power connection (those 12V sockets are known for being loose because of wildly varying manufactoring tolerance) and b) the lack of a supercap+diode setup to prevent brownouts during engine start.
      - myself248 9y ago
        The vast majority of aftermarket electronics won't survive a load-dump transient. This includes every AC inverter, every USB charger, every laptop PSU, whatever you find at the store. Most 12v-targeted electronics are good to about 30v transients. The DC-DC converters would likely be no more or less susceptible than the DC-AC inverter used here. Just quieter, smaller, and more efficient.
- boxcardavin 9y ago
  Multiple stable 2.5amp sources for a Pi and other devices is important and not always reliable with many 12v->5v converters or even with (how I would probably do it) with a power bank that acts as a buffer and is charged via 12v. It's messy but it works, if that bothers you then you should read about how inefficient compilers can be.
  - flamedoge 9y ago
    compilers are pretty dumb, but it's inching towards perfection every second.
- zkms 9y ago
  This is a data-acquisition tool made by academics that lives in an environment (hybrid passenger automobile) where some extra weight and some conversion loss is utterly fine. What matters here is reliability -- the device runs without being attended, and needs to keep working otherwise data gets lost / doesn't get collected. These researchers don't really have the inclination to faff around with designing a DC-DC converter system, they're trying to study IMSI catchers! Were this to be made an actual polished product or deployed in an environment (like in a UAV) where weight/loss matters, I'm sure that someone could design a DC-DC conversion system that's tolerant of the nasty transients on automobile 12V bus and also supplies all needed voltages, without any needless conversions.
sasas 9y ago
You could possibly achieve interesting results with a single handset to keep in your pocket as you go about your day. The Samsung Galaxy S3 is ideal due to the fact that Android apps are written to access low level data from it's baseband which is normally not available to end-user applications. In fact there is a company that sells re-modded S3's at a decent price for this exact purpose [1]. Save some money and find an old handset and load on free IMSI catcher detection software. [2] EDIT: It seems SnoopSnitch [3] which is used in the SeaGlass project works on rooted Android phones with that use Qualcomm chipsets. [1] https://www.wired.com/2014/09/cryptophone-firewall-identifies-rogue-cell-towers/ https://www.wired.com/2014/09/cryptophone-firewall-identifie... [2] https://cellularprivacy.github.io/Android-IMSI-Catcher-Detector/ https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec... [3] https://opensource.srlabs.de/projects/snoopsnitch https://opensource.srlabs.de/projects/snoopsnitch
- xorcist 9y ago
  There's also Snoopsnitch from SRLabs (Nohl et al). Most of these software seems to suffer from the combination of hardware dependencies and device churn/neglect. Neither have received updates in a while. We really need to gather all these resources together if we want software that works. Ideally, there should also be a simple way to know that it's working.
- sliken 9y ago
  Very early android (I bought 2 G1's the first day they were available) there weren't many apps. One popular app would show you where you were, where the tower you were connected to was, a bunch of related metadata, and a link to the FCC database for the tower. Not sure if that data is still available though. Seaglass seems like basically the same thing, but they track the metadata across carriers, cities, and of course over time. That way they can track changes in the tower, unusual towers, or unusual signal strengths.
  - tombrossman 9y ago
    I think the app you refer to is 'Antennas', and I ran it on my G1 also. It worked as advertised in North America and I used it for a while in Europe, and it worked there as well. Obviously not part of the FCC database, so there must have been more than one in use. Sadly it's no longer maintained. https://play.google.com/store/apps/details?id=com.technolatry.antennas&hl=en https://play.google.com/store/apps/details?id=com.technolatr...
earngurus 9y ago
https://www.earngurus.com/get-a-free-us-phone-number-for-verifications/ https://www.earngurus.com/get-a-free-us-phone-number-for-ver...
pm24601 9y ago
It would be nice if there was a way for cellphones to reject connection with the anomalous "base towers"
- awqrre 9y ago
  It would also be nice if they could get sued/jailed for the use of stingrays
rootsudo 9y ago
This can also be done on CDMA via Qualcomm QXDM and qCAT for logging, enabling you to just have a single cell phone, a laptop and some scripting in QXDM to log. Of course this would mean you have access to unlicensed Qualcomm software, know a bit about interfacing with the radio of CDMA phones and qCAT will correctly parse it to meaningful data. On the other hand, you can also log numbers being actively dialed and even intercept text messages on the SMS paging channel if you happen to have the correct UM/AN on the phone (ESN/MEID not needed) But with the eventual shut down of CDMA, this sort of phreaking is long lost and over.
IshKebab 9y ago
Off-topic, but I'm so sick of this website theme. Can you please make more than one sentence fit on the screen?
- tdy721 9y ago
  I really do despise iOS for removing the "zoom" feature from the browsers. Not really sure about Android... Also, IOS is the name for the switch OS by Cisco,,, amirite?
Hackbraten 9y ago
If law enforcement ever builds a device to find these detectors so they can seize them, they should call it the IMSI Catcher catcher catcher.
jimnotgym 9y ago
It would be interesting to push this out to the crowd of people interested in privacy. Maybe we could put a setup like this in our own cars, or at least run an app on our phones. It would really harm their surveillance efforts if 1000's of people were contributing to a global map.
- nmstoker 9y ago
  Excellent idea, but one step further would be to find some amenable Uber / taxi drivers to drive them around. They'd be likely to get coverage of a fairly broad area for a more continuous period than a private driver
  - gruez 9y ago
    I thought thats what they were already doing? >Partnering with ride-sharing drivers allowed us to collect millions of measurements across both cities.
1001101 9y ago
Clone that github repo while you can.
deleted 9y ago
[deleted]
samstave 9y ago
Awesome - I actually saw this idea posed on Reddit recently: ">So there are factory methods in each cellphoe where you can get the tower ID and RSSI and other data from the tower... what is needed is an app that actively logs ALL that data with the GPS location of the phone regularly and pushes it to a DB in AWS - and you keep capturing all that data, and you compare geo-loc from al the phones and the towers they see/connect to when within that cells signal domain - the app should be able, after time, to "know" which tower it should be connected to based on GPS as it moves into and out f each cell... you get an alert if the phone connects to the non-predicted cell signature. Simple."
JumpCrisscross 9y ago
How come there hasn't been a serious hack or heist involving criminals with IMSI catchers?

363 points by risk 9y ago

Wow, this feels like something similar to the mechanism Batman uses to find Joker at the end of the dark knight movie. Instead of Joker, it's IMSI-Catchers. It would be interesting to see how they validate their findings which should be a challenge I guess.

rosser 9y ago
I think that would be more them packaging their algorithms into a (preferably free) smartphone app, which (optionally) silently collects "anomaly signatures" until it's on a trusted network, where it uploads its findings for analysis. (It's probably dangerous in some places to do anything that might overtly indicate you're onto "them"...) EDIT: Based on another top-level comment, someone's already running with a similar idea.

bicubic 9y ago

Are the collected datasets available publicly?

Scoundreller 9y ago

Are they really running a DC->AC inverter, and then plugging SMPS AC->DC converters into it?

notatoad 9y ago
it's not efficient, but who cares? using the bricks that come with your equipment and parts you can get at the hardware store solves problems quickly
- y04nn 9y ago
  A simple DC-DC converter from ebay would do the trick a save you a lot of space and money.
  - mcguire 9y ago
    Would that handle the noise and transients in an automotive electrical system?
    - mschuster91 9y ago
      Especially the transients are a problem. IIRC certified-for-automotive parts have to endure >100V input, which e.g. may happen when the battery connection is flaky and the engine is running, due to the sudden load drop. What's missing on this setup imho is a) a solid power connection (those 12V sockets are known for being loose because of wildly varying manufactoring tolerance) and b) the lack of a supercap+diode setup to prevent brownouts during engine start.
    - myself248 9y ago
      The vast majority of aftermarket electronics won't survive a load-dump transient. This includes every AC inverter, every USB charger, every laptop PSU, whatever you find at the store. Most 12v-targeted electronics are good to about 30v transients. The DC-DC converters would likely be no more or less susceptible than the DC-AC inverter used here. Just quieter, smaller, and more efficient.
boxcardavin 9y ago
Multiple stable 2.5amp sources for a Pi and other devices is important and not always reliable with many 12v->5v converters or even with (how I would probably do it) with a power bank that acts as a buffer and is charged via 12v. It's messy but it works, if that bothers you then you should read about how inefficient compilers can be.
- flamedoge 9y ago
  compilers are pretty dumb, but it's inching towards perfection every second.
zkms 9y ago
This is a data-acquisition tool made by academics that lives in an environment (hybrid passenger automobile) where some extra weight and some conversion loss is utterly fine. What matters here is reliability -- the device runs without being attended, and needs to keep working otherwise data gets lost / doesn't get collected. These researchers don't really have the inclination to faff around with designing a DC-DC converter system, they're trying to study IMSI catchers! Were this to be made an actual polished product or deployed in an environment (like in a UAV) where weight/loss matters, I'm sure that someone could design a DC-DC conversion system that's tolerant of the nasty transients on automobile 12V bus and also supplies all needed voltages, without any needless conversions.

sasas 9y ago

You could possibly achieve interesting results with a single handset to keep in your pocket as you go about your day. The Samsung Galaxy S3 is ideal due to the fact that Android apps are written to access low level data from it's baseband which is normally not available to end-user applications. In fact there is a company that sells re-modded S3's at a decent price for this exact purpose [1]. Save some money and find an old handset and load on free IMSI catcher detection software. [2] EDIT: It seems SnoopSnitch [3] which is used in the SeaGlass project works on rooted Android phones with that use Qualcomm chipsets. [1] https://www.wired.com/2014/09/cryptophone-firewall-identifies-rogue-cell-towers/ https://www.wired.com/2014/09/cryptophone-firewall-identifie... [2] https://cellularprivacy.github.io/Android-IMSI-Catcher-Detector/ https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec... [3] https://opensource.srlabs.de/projects/snoopsnitch https://opensource.srlabs.de/projects/snoopsnitch

xorcist 9y ago
There's also Snoopsnitch from SRLabs (Nohl et al). Most of these software seems to suffer from the combination of hardware dependencies and device churn/neglect. Neither have received updates in a while. We really need to gather all these resources together if we want software that works. Ideally, there should also be a simple way to know that it's working.
sliken 9y ago
Very early android (I bought 2 G1's the first day they were available) there weren't many apps. One popular app would show you where you were, where the tower you were connected to was, a bunch of related metadata, and a link to the FCC database for the tower. Not sure if that data is still available though. Seaglass seems like basically the same thing, but they track the metadata across carriers, cities, and of course over time. That way they can track changes in the tower, unusual towers, or unusual signal strengths.
- tombrossman 9y ago
  I think the app you refer to is 'Antennas', and I ran it on my G1 also. It worked as advertised in North America and I used it for a while in Europe, and it worked there as well. Obviously not part of the FCC database, so there must have been more than one in use. Sadly it's no longer maintained. https://play.google.com/store/apps/details?id=com.technolatry.antennas&hl=en https://play.google.com/store/apps/details?id=com.technolatr...

earngurus 9y ago

https://www.earngurus.com/get-a-free-us-phone-number-for-verifications/ https://www.earngurus.com/get-a-free-us-phone-number-for-ver...

pm24601 9y ago

It would be nice if there was a way for cellphones to reject connection with the anomalous "base towers"

awqrre 9y ago
It would also be nice if they could get sued/jailed for the use of stingrays

rootsudo 9y ago

This can also be done on CDMA via Qualcomm QXDM and qCAT for logging, enabling you to just have a single cell phone, a laptop and some scripting in QXDM to log. Of course this would mean you have access to unlicensed Qualcomm software, know a bit about interfacing with the radio of CDMA phones and qCAT will correctly parse it to meaningful data. On the other hand, you can also log numbers being actively dialed and even intercept text messages on the SMS paging channel if you happen to have the correct UM/AN on the phone (ESN/MEID not needed) But with the eventual shut down of CDMA, this sort of phreaking is long lost and over.

IshKebab 9y ago

Off-topic, but I'm so sick of this website theme. Can you please make more than one sentence fit on the screen?

tdy721 9y ago
I really do despise iOS for removing the "zoom" feature from the browsers. Not really sure about Android... Also, IOS is the name for the switch OS by Cisco,,, amirite?

Hackbraten 9y ago

If law enforcement ever builds a device to find these detectors so they can seize them, they should call it the IMSI Catcher catcher catcher.

jimnotgym 9y ago

It would be interesting to push this out to the crowd of people interested in privacy. Maybe we could put a setup like this in our own cars, or at least run an app on our phones. It would really harm their surveillance efforts if 1000's of people were contributing to a global map.

nmstoker 9y ago
Excellent idea, but one step further would be to find some amenable Uber / taxi drivers to drive them around. They'd be likely to get coverage of a fairly broad area for a more continuous period than a private driver
- gruez 9y ago
  I thought thats what they were already doing? >Partnering with ride-sharing drivers allowed us to collect millions of measurements across both cities.

1001101 9y ago

Clone that github repo while you can.

deleted 9y ago

[deleted]

samstave 9y ago

Awesome - I actually saw this idea posed on Reddit recently: ">So there are factory methods in each cellphoe where you can get the tower ID and RSSI and other data from the tower... what is needed is an app that actively logs ALL that data with the GPS location of the phone regularly and pushes it to a DB in AWS - and you keep capturing all that data, and you compare geo-loc from al the phones and the towers they see/connect to when within that cells signal domain - the app should be able, after time, to "know" which tower it should be connected to based on GPS as it moves into and out f each cell... you get an alert if the phone connects to the non-predicted cell signature. Simple."

JumpCrisscross 9y ago

How come there hasn't been a serious hack or heist involving criminals with IMSI catchers?