4 ms·

I'm surprised that Stingray has such an obvious signature (break everything on nearby phones), seems like that makes it trivial to detect and defeat for any cap

by asn0 8y ago

I'm surprised that Stingray has such an obvious signature (break everything on nearby phones), seems like that makes it trivial to detect and defeat for any capable criminal.

Spooky23 8y ago
That’s why the law enforcement community fought so hard to keep it secret. Criminals are always looking for the next tech that gives them an edge and know immediately when the police can exploit it. Nextel direct connect (which was not interceptable for a long time) and BBM were the big ones of recent memory.
- gowld 8y ago
  So are non-criminals interested in not being persecuted by a police state.
  - asn0 8y ago
    How feasible would it be to have a white list of known-good cell base stations, so I could control my phone's cellular connections just like I do WiFi and Bluetooth?
    - toomuchtodo 8y ago
      Discussion about a similar question 3 years ago: https://news.ycombinator.com/item?id=9030531 https://news.ycombinator.com/item?id=9030531 Importantly, you're going to need Apple to support this in the baseband hardware of iPhones to perform tower discrimination (some vendors exist that have proprietary software and/or baseband firmware to perform this functionality on Android). EDIT: Maybe this could be done with bunnie and snowden's introspection engine? https://www.tjoe.org/pub/direct-radio-introspection https://www.tjoe.org/pub/direct-radio-introspection
- mtgx 8y ago
  No, that's not why. Otherwise they wouldn't have to lie to judges, too. But they did, and still do. And it's because they know the judges would require them to follow proper due process if they are caught using Stingrays.
- betterunix2 8y ago
  "Criminals are always looking for the next tech that gives them an edge and know immediately when the police can exploit it." Some, but the vast majority of criminals do not put that much effort into their crimes, and among those that do, most wind up botching things. When criminals gravitate toward a system law enforcement agencies have trouble with it is more survival of the fittest than active planning. Law enforcement fought to keep stingrays a secret for two reasons: pressure from the manufacturer, and a desire to avoid public scrutiny (which is likely the reason the manufacturer pressured them to keep it secret). The police would greatly prefer that the general public not spend too much time thinking about stingrays to avoid the risk of a stricter warrant process being required. It is also helpful if judges and defense lawyers are not familiar with the device and do not know what questions to ask.
rsync 8y ago
This is, I believe, the most comprehensive list of "stingray" behaviors - these are the behaviors that snoopsnitch[1] recognizes and scores/weighs to determine matches: https://opensource.srlabs.de/projects/snoopsnitch/wiki/IMSI_Catcher_Score https://opensource.srlabs.de/projects/snoopsnitch/wiki/IMSI_... [1] https://opensource.srlabs.de/projects/snoopsnitch https://opensource.srlabs.de/projects/snoopsnitch
mtgx 8y ago
> seems like that makes it trivial to detect and defeat for any capable criminal Or OS vendors. crickets
downandout 8y ago
My understanding has always been that the point of Stingrays was to make cell phones connect to it, and then it would act as a bridge between a real cell tower and connected phones, which allowed them to intercept communications instead of blocking them. This [1] seems to indicate that my understanding is correct. Where is the disconnect here? [1] https://www.wired.com/2015/10/stingray-government-spy-tools-can-record-calls-new-documents-confirm/ https://www.wired.com/2015/10/stingray-government-spy-tools-...
- dgzl 8y ago
  Aka, Man in the Middle
- Bartweiss 8y ago
  I had always thought this too, but apparently it's not the default behavior. Stingrays (and presumably other IMSI catchers) don't actually act as a bridge to a legitimate network; they're a terminal connection, and effectively deny service to any devices connected to them. This is the default behavior, and it's how the FBI has claimed they're deployed domestically. The reason they don't cause major outages appears to be that they only accept connections from targeted phones; they could equally easily be used as mobile DoS beacons. And the reason they don't cause targets to abandon their 'broken' phone is that they don't have to run full-time for effective triangulation. For Stingrays to collect calls, as outlined in your link, is effectively a whole new service on top of the basic behavior. The Stingray continues to be an endpoint for the targeted phone, but also extracts the GSM encryption key on the device. It then opens a new connection to a cell tower, and uses the IMSI and stolen encryption to impersonate the real device. From that point on, its a mitm attack. So the only way a Stingray transfers calls is for targeted users, while configured in a mode that's supposedly not employed in the US. Harris is claiming they use a variant of this system to pass 911 calls, Wyden is pointing out that it's completely untested and doesn't even claim to support text-to-speech dialing. (Source: Wikipedia is surprisingly comprehensive, primary source at: https://www.documentcloud.org/documents/1282642-07-08-29-2007-dea-purchase-of-stingray-fishhawk.html https://www.documentcloud.org/documents/1282642-07-08-29-200...)
  - 8y ago
tzs 8y ago
Most criminals are not smart enough, educated enough, or sophisticated enough to be what you were probably thinking of when you wrote "capable criminal".
- AngryData 8y ago
  I think you severely underestimate criminals and their activities. Sure a lot of them are dumb, but so is the average person, and you are going to have a HUGE selection bias of catching the dumb criminals while the smart criminals rarely get caught.
  - betterunix2 8y ago
    There are smart criminals out there, but the majority of crimes are poorly planned and not committed by the smart criminals. I suspect that the real reason many criminals avoid arrest is that the police lack the resources and manpower to pursue everyone.

by asn0 8y ago

I'm surprised that Stingray has such an obvious signature (break everything on nearby phones), seems like that makes it trivial to detect and defeat for any capable criminal.

Spooky23 8y ago

That’s why the law enforcement community fought so hard to keep it secret. Criminals are always looking for the next tech that gives them an edge and know immediately when the police can exploit it. Nextel direct connect (which was not interceptable for a long time) and BBM were the big ones of recent memory.

gowld 8y ago
So are non-criminals interested in not being persecuted by a police state.
- asn0 8y ago
  How feasible would it be to have a white list of known-good cell base stations, so I could control my phone's cellular connections just like I do WiFi and Bluetooth?
  - toomuchtodo 8y ago
    Discussion about a similar question 3 years ago: https://news.ycombinator.com/item?id=9030531 https://news.ycombinator.com/item?id=9030531 Importantly, you're going to need Apple to support this in the baseband hardware of iPhones to perform tower discrimination (some vendors exist that have proprietary software and/or baseband firmware to perform this functionality on Android). EDIT: Maybe this could be done with bunnie and snowden's introspection engine? https://www.tjoe.org/pub/direct-radio-introspection https://www.tjoe.org/pub/direct-radio-introspection
mtgx 8y ago
No, that's not why. Otherwise they wouldn't have to lie to judges, too. But they did, and still do. And it's because they know the judges would require them to follow proper due process if they are caught using Stingrays.
betterunix2 8y ago
"Criminals are always looking for the next tech that gives them an edge and know immediately when the police can exploit it." Some, but the vast majority of criminals do not put that much effort into their crimes, and among those that do, most wind up botching things. When criminals gravitate toward a system law enforcement agencies have trouble with it is more survival of the fittest than active planning. Law enforcement fought to keep stingrays a secret for two reasons: pressure from the manufacturer, and a desire to avoid public scrutiny (which is likely the reason the manufacturer pressured them to keep it secret). The police would greatly prefer that the general public not spend too much time thinking about stingrays to avoid the risk of a stricter warrant process being required. It is also helpful if judges and defense lawyers are not familiar with the device and do not know what questions to ask.

rsync 8y ago

This is, I believe, the most comprehensive list of "stingray" behaviors - these are the behaviors that snoopsnitch[1] recognizes and scores/weighs to determine matches: https://opensource.srlabs.de/projects/snoopsnitch/wiki/IMSI_Catcher_Score https://opensource.srlabs.de/projects/snoopsnitch/wiki/IMSI_... [1] https://opensource.srlabs.de/projects/snoopsnitch https://opensource.srlabs.de/projects/snoopsnitch

mtgx 8y ago

> seems like that makes it trivial to detect and defeat for any capable criminal Or OS vendors. crickets

downandout 8y ago

My understanding has always been that the point of Stingrays was to make cell phones connect to it, and then it would act as a bridge between a real cell tower and connected phones, which allowed them to intercept communications instead of blocking them. This [1] seems to indicate that my understanding is correct. Where is the disconnect here? [1] https://www.wired.com/2015/10/stingray-government-spy-tools-can-record-calls-new-documents-confirm/ https://www.wired.com/2015/10/stingray-government-spy-tools-...

dgzl 8y ago
Aka, Man in the Middle
Bartweiss 8y ago
I had always thought this too, but apparently it's not the default behavior. Stingrays (and presumably other IMSI catchers) don't actually act as a bridge to a legitimate network; they're a terminal connection, and effectively deny service to any devices connected to them. This is the default behavior, and it's how the FBI has claimed they're deployed domestically. The reason they don't cause major outages appears to be that they only accept connections from targeted phones; they could equally easily be used as mobile DoS beacons. And the reason they don't cause targets to abandon their 'broken' phone is that they don't have to run full-time for effective triangulation. For Stingrays to collect calls, as outlined in your link, is effectively a whole new service on top of the basic behavior. The Stingray continues to be an endpoint for the targeted phone, but also extracts the GSM encryption key on the device. It then opens a new connection to a cell tower, and uses the IMSI and stolen encryption to impersonate the real device. From that point on, its a mitm attack. So the only way a Stingray transfers calls is for targeted users, while configured in a mode that's supposedly not employed in the US. Harris is claiming they use a variant of this system to pass 911 calls, Wyden is pointing out that it's completely untested and doesn't even claim to support text-to-speech dialing. (Source: Wikipedia is surprisingly comprehensive, primary source at: https://www.documentcloud.org/documents/1282642-07-08-29-2007-dea-purchase-of-stingray-fishhawk.html https://www.documentcloud.org/documents/1282642-07-08-29-200...)
- 8y ago

tzs 8y ago

Most criminals are not smart enough, educated enough, or sophisticated enough to be what you were probably thinking of when you wrote "capable criminal".

AngryData 8y ago
I think you severely underestimate criminals and their activities. Sure a lot of them are dumb, but so is the average person, and you are going to have a HUGE selection bias of catching the dumb criminals while the smart criminals rarely get caught.
- betterunix2 8y ago
  There are smart criminals out there, but the majority of crimes are poorly planned and not committed by the smart criminals. I suspect that the real reason many criminals avoid arrest is that the police lack the resources and manpower to pursue everyone.