22 ms·
How a Hacker Proved Cops Used a Stingray to Find Him
- erentz 8y agoJesus. I wanted to keep reading that article but half way through my phone was hot enough it was burning my fingers and 20% of my battery had disappeared. What on earth is Politico doing.
- MR4D 8y agoTracking you. ;)
- walid 8y agoProbably crypto mining.
- kragormonkey 8y agoI thought I was imagining that! If somebody knows a good JavaScript profiler, I might send a screenshot of that to the author. Hopefully they will choose a better outlet next time, or fix the Politico site.
- curiousgal 8y agoFirefox Focus is your friend.
- louithethrid 8y agoAll you need to do is activate a Addon that limits Execution Time or Cycles for JS after initial loading?
- jrockway 8y agoIt's quite the thing. I profiled it with and without ads, and it looks like the ads are the culprit. There are two of them just sitting there using CPU time the entire time the page is open. (I had two Facebook ads that had animated text being typed. They continued to use 100% of the CPU even when the animation was complete.) There should really be some sort of CPU/power budget enforced by one's phone on a per page basis. If there's no user action going on, a page should only be allowed to run a certain number of instructions.
- Raticide 8y agoIt's always the adverts that screw up a site. Maybe it's mining crypto currency too?
- alistproducer2 8y agoI keep JS turned off by default on my phone and make exceptions. Brave browser makes it super easy to do this. Politico was actually the reason I started doing this.
- eftychis 8y agoYeah -- my advice is to use a good adblocker/tracker blocker (ublock origin, ghostery etc). Power consumption/CPU load and memory usage for browsers change considerably. P.S. Yes, people are paying power and time (cpu/personal) to watch ads to pay (?!) for websites and provide private information.
- giancarlostoro 8y agoI recommend FireFox Focus for mobile. It blocks JS and third party tracking by default. I wish they'd let you toggle between either of those options instead of both at once though.
- Sean1708 8y agoOr normal FireFox with uBlock Origin if you want to maintain history, logins, etc.
- woolvalley 8y agoAd networks need to add simple perf tracing to the ads they serve and boot off the high consuming ones.
- panarky 8y agoThe salient bit: Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of apartments where Rigmaiden lived.
- ggm 8y agoLest anyone believe their positional privacy is at risk, even the Verizon routing prefix could have homed the cops onto which provider to drill down into. The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, things might be different. I've asked this question over the years since the 1980s: Given that we thought source based routing was a thing, its understandable we designed for simpler times with src IP in the packet but given its not a thing now, and privacy is, why do we still send the src IP in the packet? It doesn't mean anything useful, to most agents. NAT/CGN devices don't actually care, they want you to be consistent about which interface you arrive on, and the 5-tuple has it, but other things could be used which have no end-to-end impact. Beyond the NAT/CGN boundary, nobody cares, routing is solely on the destination and the ASN of the transits. Once at the destination, the payload is available, to find the originators address, to return things. Src IP is not actually neccessary, in the IP layer. (in theory)
- xyzzyz 8y agoIf the source IP is encrypted, the recipient needs to decrypt it first in order to be able to send a response. To decrypt it, it needs to either have some shared secret with the sender, or the sender needs to use the recipient's private key. The parties cannot obtain the shared secret the usual way, the Diffie-Helman exchange. It cannot be performed, because it requires back-and-forth communication, which we are trying to establish in the first place. Of course, we'd still need to use certificates signed by public authorities to deal with the standard MitM concerns. The alternative would be for the sender to use the recipient's public key to encrypt the source IP address. That would require a DNS-like system that would store and serve public keys corresponding to a given IP address you are trying to communicate with. This is something doable, especially in IPv6 world where you don't really have to reuse IPv6 addresses, but it leads to all kinds of practical problems, figuring out which is probably best left as an exercise for the reader.
- ezoe 8y agoI value the privacy so I don't own or use cellphone.
- wu-ikkyu 8y agoHow did you post this comment?
- Mikushi 8y agoComputers, ever heard of them ?
- tehwebguy 8y agoParent’s point was probably that the connection used is still traceable
- roblabla 8y agoYour phone is always on you. Your computer, less so.
- sandov 8y agoExcept that: 1) If you do it from home, the govt already knows where you live, or you can use proxies, or Tor, or a VPN. 2) If you don't do it from home, you are practically anonymous if you change your mac address and use someone else's wireless network, which are ubiquitous today in airports, restaurants, etc.
- caf 8y agoAnother thing that is ubiquitous today in airports, restaurants etc. is CCTV.
- greggarious 8y ago> Another thing that is ubiquitous today in airports, restaurants etc. is CCTV. Which is not retained indefinitely. If you're not committing a crime, that footage will be gone in 30-90 days.
- ColanR 8y agoThis is a really old story. The article is new, but I don't see any new data. It should be labelled (2013). hn.algolia.com/?query=rigmaiden
- acqq 8y agoRead the whole article, it has newer parts of the story, it doesn't stop in 2013: "Several months later, in April 2015, the New York Civil Liberties Union (the New York State chapter of the ACLU) managed to do what no one else could: successfully sue to obtain an unredacted copy of the NDA that the FBI had law enforcement agencies sign when they acquired stingrays"
- w8rbt 8y agoStingrays were being used as early as the 1990s by federal law enforcement. They were used to help locate Kevin Mitnick in North Carolina. Edit - I recall reading that years ago in Tsutomu Shimomura's book 'Takedown' (published in 1996). Outside of this, I have no other reference. It's a good read BTW. https://www.amazon.com/Takedown-Pursuit-Capture-Americas-Computer/dp/0786889136 https://www.amazon.com/Takedown-Pursuit-Capture-Americas-Com...
- 8bitsrule 8y agoYour assertion re early 1990s is backed up here: https://www.wired.com/2014/03/stingray/ https://www.wired.com/2014/03/stingray/ "Use of stingray technology goes back at least 20 years [ <= 1994]. In a 2009 Utah case, an FBI agent described using a cell site emulator more than 300 times over a decade.... "
- colossal 8y agoThey even use one in an episode of the wire (circa 2003).
- c22 8y agoI seem to have gotten rid of my copy of Takedown, but Jonathan Littman writes in The Fugitive Game, paraphrasing John Markoff: "...Shimomura was sitting in the passenger seat of a Raleigh Sprint technician's car, holding a cellular-frequency direction-finding antenna, and watching a 'signal-strength meter display its reading on a laptop computer screen.'" This sounds, perhaps, functionally equivalent to a modern stingray, but I suspect it was not operating as a cell-site simulator. The hardware/software required at the time to "man in the middle" Mitnick's cellular calls would not have fit comfortably with Shimomura in the passenger seat of a car and would not have run smoothly on a mid-90's era laptop. Also, the bandwidth required to forward the connections would have only been achievable over directional microwave or landline which seems unsuitable for use in a moving vehicle. However, this was the dawn of digital cellular networks. The calls would not have been encrypted in any way at the time so tracking the source of specific emissions using triangulation would have been fairly trivial, especially with the assistance of a Sprint technician with access to the CDMA code Mitnick's handset was using at any given time. Actually, I just checked and it seems Sprint didn't launch its PCS network until later that year[0] so it's possible the network in question was analog(?), making simply "listening in" even easier, without having to simulate anything. [0]http://articles.baltimoresun.com/1995-11-16/business/1995320051_1_cellular-sprint-pcs-network http://articles.baltimoresun.com/1995-11-16/business/1995320...
- halfnibble 8y agoThe police department in Reno, NV uses this in conjunction with thermal sensors from a helicopter in northern Reno and Sun Valley. Mostly for drug busts.
- dannyw 8y agoWhat happened to the charges for this guy? Was the original search via stringrays ruled unconstitutional?
- chasontherobot 8y agoFrom the article, he pled guilty in exchange for time served.
- dublinben 8y ago>By late January 2014, Rigmaiden and federal prosecutors reached a plea deal: He’d plead guilty and prosecutors would recommend that he be given a sentence of time served. The agreement was signed on April 9, 2014. Like many cases involving stingrays, the charges were essentially dropped once challenged in court.
- hsienmaneja 8y agoBack in the day, beige box with laptop was one way to avoid being traced. Of course, this ran risk of being physically identified if you operated the laptop directly from the beige box location..
- cantrevealname 8y agoThe hacker was exposed because of poor OPSEC (due to tracking of his IP address). > Rigmaiden had received boxes and boxes of criminal discovery that would help him understand how the government planned to prosecute its case. In the penultimate box, he saw the word “stingray” in a set of notes. The authorities were exposed because of poor OPSEC as well. They weren't supposed to ever mention “stingray”.
- johnnymonster 8y agoThe story didn't mention how they were able to get his IP address in the first place. That level of detail is important for this community!
- sulam 8y agoHe was filing fake tax returns. That probably exposed his IP in logs on government servers.
- mirimir 8y agoThe safe bet is that every site that you access logs your IP address. At the very least.
- nindalf 8y agoWhat on earth? Isn't using a VPN the bare minimum when you're doing something potentially illegal?
- akvadrako 8y agoMaybe he did. Unless he's careful in picking his VPN provider they probably have some level of cooperation with the FBI.
- boomboomsubban 8y agoHe didn't, but getting anonymous access to a VPN wasn't exactly the simplest thing then. And if you think they would be unable to find the precise location of the aircard, it's not really adding any protection.
- johnnymonster 8y agoThis guy wasn't really a hacker, just someone who knew a little bit about tech and figured out a flawed system. I think that sums him up as a scammer instead of a hacker.
- yborg 8y agoThis. He filed false tax returns with stolen identities, I fail to see any activities one would associate with a technical hack. I also have a hard time understanding why someone who is engaging in criminal acts has a reasonable expectation to privacy related to the commission of said crimes.
- sulam 8y agoYou can't know that a priori, though. The cops should not get to say "I want to track this cell phone, it's being used for a crime" without filing a warrant. That is pretty much exactly what warrants are for in other contexts, cell phones should not be treated differently.
- jlebrech 8y agothe cops have to abide by the law, that's their weakness.
- Nasrudith 8y agoTo be fair that is fundamentally what hacking is - noticing a flawed system an exploiting it. "Just scamming" would be convincing people that they need to use him to get tax refunds while he cashes it and takes a cut. Closer to fraud in many ways too really. Really the term hacking could use more consistent sub-definitions per type. Social engineering is well established but there isn't even a uniform term for quickly conveying the nuance of say cracking DRM offline vs getting in a server.
- rattray 8y agoIs there a physical device that can provide VPN-only wifi connection, so that a laptop or wifi-only ipad (say) which were to connect to it would not risk ever exposing its IP?
- nodelessness 8y agoYou can configure your router to route all traffic through a VPN. It's a standard setting in all routers.
- gusmd 8y agoThat is incorrect. Many, many routers in fact do not have a setting to route your traffic through a VPN. My Linksys for instance does not. Famously, people flash DD-WRT or Tomato on their routers to enable that.
- swebs 8y agoAny Linux machine can do this using IPtables.
- ohashi 8y agoI haven't worked with this stuff in a couple years (subpoena'd cell records), but given the date of this stuff, I didn't think cell phone towers could give a precise location. My understanding of them was they each had three sectors, so you could see in what general area they were in. With multiple towers, you might be able to get a more accurate reading, but it makes it sound like StingRay can actually see in real time their position.
- JdeBP 8y agoA mobile telephone transmits an electromagnetic signal. Direction finding and triangulation for such signals have been known practices since the 19th and early 20th centuries. Remember that this base station impostor is mobile, and that there can be more than one.
- deleted 8y ago[deleted]
- known 8y agoHow can he call himself a hacker when he doesn't know how to hide his ip?
- Matt3o12_ 8y agoSomething doesn’t seem to add up. First of all the story fails to mention that those devices do not only track the target, they track and record all phones in its range, which is a massive breach of privacy and the real issue with those devices. Furthermore, they allegedly already had his ip, so why bother with a stingray? They could simply tell his cell carrier to provide them with all his location data (as well as further dates). It seems to me that they went fishing with their stingrays because they didn’t in fact know his real IP address and only knew from a source or other mistakes his approximate whereabouts. It wouldn’t surprise me if they only had his VPN’s IP and were just looking for everybody connecting to the VPN in the stingray range and this is how they found him.
- falsedan 8y ago> Furthermore, they allegedly already had his ip, so why bother with a stingray? They could simply tell his cell carrier to provide them with all his location data Remember that getting subscriber data/metadata from ISPs requires a warrant, and that a single tower location could cover a 6-12 sq. km. area (plenty of space to hide in)
- Matt3o12_ 8y agoCan’t they use the towers to triangulate the exact position? So that area should be rather small. Furthermore, if they already had the IP of the offender, getting a search warrant should not be the problem at all. This tells me there is more to this story.
- falsedan 8y agoI think triangulation works best when devices do handoff between towers, as they query each one to see which signal is strongest. For a stationary device like a mobile broadband dongle, I'd expect it to never handoff. Getting a search warrant is easy, but not getting one is even easier & leaves no paper trail.
- swebs 8y ago
- ernesth 8y ago> "The Hacker began breathing more heavily." Obviously this is fiction. Romance or thriller?
- decasia 8y agoIt seems like a terrible security model to "trust whatever cell site is in range." Are there any alternatives to this state of affairs? For example, can your carrier supply you with a whitelist of their towers and then ignore everything else? Or the legitimacy of each tower could be signed cryptographically by the cell providers? Of course you have to trust the security infrastructure of your cell provider, but that seems slightly better than just trusting everything by default. (Disclaimer, I know nothing about cellular infrastructure...)
- programbreeding 8y agoThere is an Android app called IMSI-Catcher Detector[0] that is supposed to help you detect when you're connected to a stingray-type device. I ran it for around a year and it never once picked up on anything. I'm not involved on the project and can't personally say if it will catch anything or not, but it is open source[1]. [0] https://cellularprivacy.github.io/Android-IMSI-Catcher-Detector/ https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec... [1] https://github.com/CellularPrivacy/Android-IMSI-Catcher-Detector/wiki https://github.com/CellularPrivacy/Android-IMSI-Catcher-Dete...
- runciblespoon 8y agoFiling fake tax returns online and thinking an AirCard keeps him anonymous and un-locatable hardly makes him a 'hacker' now does it.