10 ms·
Feds: There are hostile stingrays in DC, but we don’t know how to find them
- kornish 8y agoFor those confused about the terminology in the title... > The devices, which are also known as stingrays or IMSI catchers, are commonly used by domestic law enforcement nationwide to locate a particular phone. Sometimes, they can also be used to intercept text messages and phone calls. Stingrays act as a fake cell tower and effectively trick a cell phone into transmitting to it, which gives up the phone’s location.
- pacificmint 8y agoI'd say let's hope they'll remember that the next time they'll ask for backdoors in some other technology. But in reality I have very little hope that they will.
- RpFLCL 8y agoThat was the first thing that struck me too. There's some irony about these showing up on the streets of DC. New technology only stays in the hands of "our team" for so long before ultimately showing up on our doorstep. Especially when that's low cost surveillance technology...
- Overtonwindow 8y agoAs a resident, let me pose to you this : The government doesn't always know what the rest of the government is doing. I would be surprised if there weren't rogue Stingray's out there, and even more not surprised that it's some discreet arm of the government.
- jumelles 8y agoYes, I'm sure both likely exist, but that doesn't make Stingrays operated by eg. China, Iran, DPRK, Russia any less of a problem !
- lolc 8y agoYou're jumping to conclusions. You don't need to be a nation state to operate a dingy IMSI-catcher.
- walrus01 8y agoMore likely explanation is various intelligence agencies with contracts with companies like Booz, ITT-Exelis, LockheedMartin, etc that have the technical capability to do private signals intelligence gathering.
- bigiain 8y agoYeah, like the local garbage collection agency, or the animal welfare agency, or the horse racing regulators. All of whom will claim, if cornered, "We don't need a warrant, because, ummm, we're doing this TO PROTECT THE PRESIDENT!!!" (That list may sound idiotic, but you can't make this shit up - there's examples where I live of those exact agencies (and more) requesting warrantless access to telecommunications metadata: https://www.smh.com.au/technology/dozens-of-government-agencies-request-access-to-citizen-metadata-without-warrants-20160119-gm8uql.html https://www.smh.com.au/technology/dozens-of-government-agenc... )
- mkempe 8y agoMy understanding is that all stingrays are by definition hostile.
- mkempe 8y agoAnd if the NSA and FBI had devoted less energy to turning this country into a corrupt republic on its way to a totalitarian nightmare, I am sure they would have had the ability and resources to ensure that such stingrays were impossible to set up.
- mkempe 8y agoHere is what the EFF says: "[Stringrays] can also intercept metadata (such as information about calls made and the amount of time on each call), the content of unencrypted phone calls and text messages and data usage (such as websites visited). Additionally, marketing material indicates that they can be configured to divert calls and text messages, edit messages, and even spoof the identity of a caller in text messages and calls." [1] This is what the FBI and NSA love. They never try to protect the American public from such weaknesses in the country's infrastructure, although that is what they are supposed to be doing. All so they can spy on everybody, feed illegal parallel-construction activities, and generally nurture the growth of a police state; it is also clear by now that these agencies have been interfering with national politics. These are not friends of our freedoms. [1] https://www.eff.org/pages/cell-site-simulatorsimsi-catchers https://www.eff.org/pages/cell-site-simulatorsimsi-catchers
- alexhutcheson 8y agoI wasn't familiar with the term 'stingray', so this headline was both confusing an amusing to me. I was confused about why they would even be looking for 'hostile' cartilaginous fish. I can't be the only one.
- phusion 8y agoYou really are.
- ozzmotik 8y agototally not true, i was confused at first as well
- swagasaurus-rex 8y agoAm stingray, can confirm. Edit: Hate that Steve Irwin guy
- JCharante 8y agoI too thought that for a brief moment when reading the title before remembering what stingrays were.
- eigenvector 8y agoWhy can't they find them the same way government agencies normally enforce radio licensing? Drive around with a receiver (a cell phone, basically) enumerating all the purported cell towers in a geographic area, then cross-check that with a list of legitimate carrier infrastructure?
- phusion 8y agoIt MAY not be that easy... femtocells and whatnot may make that a difficult task. I wondered this myself, since nearly all pirate radio stations are caught.. but cell sites don't work the same way. Just a thought.
- walrus01 8y agoI work in wireless telecom: Really doubtful "we don't know how to find them". The FCC's enforcement bureau has a set of vans equipped to find unauthorized transmitters. IMSI catchers must transmit and remain on the air. It would be very risky to operate, even briefly, a portable imsi catcher in a briefcase and move it around WA DC, nevermind one that remained in fixed locations for hours. The only other explanation I can think of is being operated from embassies with full diplomatic protections, but that runs the risk of the host county (USA) PNG'ing several staff with 24 hour notice as punishment. Quick edit: Whole US federal agencies have their own TSCM (technical surveillance countermeasures) staff entirely separate from the FCC. It is a job position at the dept of state. Evolved from bug detection and removal in the analog days to now encompass just about everything that can leak data.
- subway 8y agoDepends on how much the devices cost to procure, and the budget of the party using them. Seems like these could be treated as "black-throws" given the right cost:budget ratio.
- vvanders 8y agoNot even that, if you want to use them as a MitM just broadcast the data you want and any arbitrary receiver will pick them up that can't be pinpointed. That's assuming you don't mind losing the transmitting hardware.
- subway 8y agoI think we're saying the same thing.
- beamatronic 8y agoI am not familiar with this term, “black-throw”, can you elaborate?
- subway 8y ago
- Slansitartop 8y agoI think this is good news. I think the kinds of politicians that are typically over-friendly with the police are also the kind that want a strong military. The use of "law enforcement" technology like stingrays by hostile intelligence agencies, might create a useful tension in them that could help convince them to harden domestic communications against law enforcement spying.
- mkempe 8y agoIf only they cared about protecting our rights in the first place, as much or more than they apparently care about alleged spying by foreign powers.
- itronitron 8y agoexcept that if/when politicians get cozy, either willingly or not, with the hostile intelligence agencies then they would likely want all the benefits of that cozy relationship to continue indefinitely
- palisade 8y agoIs that Russian ship still parked nearby? I recall reading about that a while back. Maybe that's where the signal is coming from. https://www.cnn.com/2018/01/22/politics/russia-spy-ship-us-coast/index.html https://www.cnn.com/2018/01/22/politics/russia-spy-ship-us-c...
- tbihl 8y agoI admit that I don't have much expertise on the matter, having only ever operated a GSM cell site simulator (never LTE), but the max range I remember (in ideal conditions) is something like 35 miles.
- bigiain 8y ago35km - which is a TDMA timing issue, not a radio range one - that damned pesky speed of light problem... https://en.wikipedia.org/wiki/Timing_advance https://en.wikipedia.org/wiki/Timing_advance (Note there's and "extended range" feature, where you can halve the cell site's capacity by waiting two timeslots in the TDMA schedule instead of one - which lets you go as far as 120km...)
- upofadown 8y agoMost will probably be owned by law enforcement. Many will be operating without the benefit of a warrant. So what do you do when you find one? You won't make many friends if you interfere with an ongoing investigation particularly if you raise questions about the legality of the operation at the same time. Things were much the same back in the old days. If a telephone employee would find listening devices on the lines they were best off just quietly removing them and disposing of them. In the wild, surveillance equipment legally installed under a warrant looks exactly the same as all of the other kinds. So in practice everyone got to tap phone lines, just as long as they didn't annoy anyone too official while doing so. The targets would never find out, unless the were willing to climb a telephone pole and check for themselves. The same thing will probably happen with stingray type devices. People like private investigators are likely already using them.
- itronitron 8y agoThat reminds me of some photos my dad took years ago of a line technician on a crane truck fiddling with some equipment on a utility pole at the edge of our front yard for about thirty minutes. He thinks the guy was testing for some illegal cable descrambler on the line although I suppose it could have been anything since this happened in the DC Metro area :)
- et-al 8y agoLayman question: one can limit their exposure with encrypted VoIP communications (e.g. FaceTime) and chats (iMessage, Signal), correct? That being said, the intercepter would still know: - phone being connected (IMEI) - location of the phone - which servers were requested, but not the encrypted content (yet) - how much data was transmitted, "call time" So if two phones were talking with each other over FaceTime connected to stingrays, a third-party can still deduce that they were talking to each other given the amount of data being transferred and when the requests occurred.
- walrus01 8y agoRe: your last sentence, a stingray rarely if ever offers actual network connectivity, either ss7 or data. Its purpose is just to catch the unique ID numbers from the phone. Whatever you have set into your phone for LTE APN data settings isn't going to work with a random imsi catcher. Such a thing won't have an uplink anyways outside of its command/control functions.
- gruez 8y agoDoesn't that make them really detectable? A deadspot with full signal bars would be really suspicious.
- walrus01 8y agoA phone doesn't stay connected to a stingray, it will get the imsi and then move on to a real site of the phone's carrier.
- pas 8y agoHow/why? Could you elaborate? Will the rouge tower drop the phone? Won't the phone try to connect again and again to the tower with the strongest signal?
- et-al 8y agoThanks! Didn't know that about stingrays.
- walrus01 8y agoPossibly rogue IMSI catchers have also been spotted in in Ottawa. If I had to bet they're run by CSE, which of course will neither confirm nor deny. https://www.google.ca/search?q=ottawa+imsi+catcher&oq=ottawa+imsi+catcher&aqs=chrome..69i57.4289j0j4&sourceid=chrome-mobile&ie=UTF-8 https://www.google.ca/search?q=ottawa+imsi+catcher&oq=ottawa...
- elipsey 8y agoAmbiguous title. On my first reading I thought: do they mean animals? ...or missiles? ...oh no it's even scarier then the first two!
- chapill 8y agoSeems like a good reason to install and use something like https://cellularprivacy.github.io/Android-IMSI-Catcher-Detector/ https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec... Do the Feds have bounties for catching illegal stingrays?
- pcmaffey 8y ago> IMSI-Catchers also allow adversaries to intercept your conversations, text messages, and data. Police can use them to determine your location or to find out who is in a given geographic area at what time. [1] Does turning one's phone off not disable pinging cell towers? [1] https://cellularprivacy.github.io/Android-IMSI-Catcher-Detector/ https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec...
- shakna 8y agoMany modern phones don't turn off all the way, and continue to ping towers. I can't find any official documentation, but several Android phones I've owned over the years have powered themselves on when switched off and receiving a phone call.
- bitexploder 8y agoWrong. This is an exaggeration at best and just plain wrong for most US LTE users. LTE is very hard to fully MiTM. You can still catch / observe through IMSI, but the phone won't deal with your rogue tower. If you can downgrade someone to 3G you can more easily observe voice and or texts. Data is actually harder to MiTM, even on 3G. That said, it is not feasible to down grade any modern US LTE devices as far as I know. Turning your phone off usually does prevent tower pings, but some phones have been known to be sneaky.
- bvinc 8y agoCan someone please explain to me why this cell security problem seems to be completely ignored? If encryption algorithms are broken, they're phased out and untrusted. But if 2g is insecure, there's not a single peep from networks or phone manufactures or Google or Apple about phasing out 2g. There isn't even an option to disable it. Why don't towers have a sort of encryption certificate verifying they're legit? Why doesnt my cell provider just provide my phone a list of it's legit towers? I can think of so many ways to solve this problem. But it's super hard to find any information if how this all works.
- libdjml 8y agoI’ll take a wild guess: * a lot of legacy kit that’s expensive and hard to upgrade * lots of things rely on backward compatibility * attacks are still too difficult/expensive to the point that only hushed adversaries are performing attacks * lack of motivation from cell providers
- chisleu 8y agoIt's not the algo. The keys are the problem
- BuildTheRobots 8y agoActually with 2G (especially A5/0, /1, /2), it's very much the algorithm that's the problem. A5/2 which is the precursor to the encryption used for 3G and LTE is a lot better but there's still issues that are only just coming to light.
- chisleu 8y agoI'm referring to modern networks. 2G is deprecated and going bye bye very soon. For 3G/4G/LTE, the issue is the home cell sites host the keys and people exploited those devices to create the DIY stingrays.
- munin 8y ago> But if 2g is insecure, there's not a single peep from networks or phone manufactures or Google or Apple about phasing out 2g. There isn't even an option to disable it. Good news I guess: AT&T turned off their 2G in December of 2016: https://www.att.com/esupport/article.html#!/wireless/KM1084805 https://www.att.com/esupport/article.html#!/wireless/KM10848... It caused a bit of a stir in the alarm system market, because so many of the alarm panels connected to the home office via embedded 2G modems.
- bsder 8y agoIs Milenage still a safe protocol? Or are all of these stingrays still dependent upon forcing you to switch down to the older 2G protocols?
- Rjevski 8y agoYep most of this bullshit is because garbage like 2G (and 3G) is still in operation. Phones should just phase that out (less code, thus less attack surface).
- deleted 8y ago[deleted]
- homero 8y agoThe same backdoors politicians want in our devices will come back to haunt them.
- vl 8y ago>we don’t know how to find them Triangulation?
- YouKnowBetter 8y agoThis is not limited to the US. In fact, you are late to the party. Both in Oslo and in London these where uncovered and published about, that was 2015. https://www.aftenposten.no/norge/i/kamWB/New-report-Clear-signs-of-mobile-surveillance-in-Oslo_-despite-denial-from-Police-Security-Service https://www.aftenposten.no/norge/i/kamWB/New-report-Clear-si... https://commsrisk.com/reporters-find-20-imsi-catchers-in-london/ https://commsrisk.com/reporters-find-20-imsi-catchers-in-lon...
- ConcernedCoder 8y agoWhy would they admit that they could find them?
- throwawaymanbot 8y agoWasn't there a German company selling a Cell phone that was able to detect these using their baseband firewall? # Added link. https://esdcryptophone.com/ https://esdcryptophone.com/
- benpiper 8y agoThe headline doesn't at all agree with the what the article and its sources say, which is basically a whole lot of nothing.