3 ms·

My understanding has always been that the point of Stingrays was to make cell phones connect to it, and then it would act as a bridge between a real cell tower

My understanding has always been that the point of Stingrays was to make cell phones connect to it, and then it would act as a bridge between a real cell tower and connected phones, which allowed them to intercept communications instead of blocking them. This [1] seems to indicate that my understanding is correct. Where is the disconnect here? [1] https://www.wired.com/2015/10/stingray-government-spy-tools-can-record-calls-new-documents-confirm/ https://www.wired.com/2015/10/stingray-government-spy-tools-...

dgzl 8y ago
Aka, Man in the Middle
Bartweiss 8y ago
I had always thought this too, but apparently it's not the default behavior. Stingrays (and presumably other IMSI catchers) don't actually act as a bridge to a legitimate network; they're a terminal connection, and effectively deny service to any devices connected to them. This is the default behavior, and it's how the FBI has claimed they're deployed domestically. The reason they don't cause major outages appears to be that they only accept connections from targeted phones; they could equally easily be used as mobile DoS beacons. And the reason they don't cause targets to abandon their 'broken' phone is that they don't have to run full-time for effective triangulation. For Stingrays to collect calls, as outlined in your link, is effectively a whole new service on top of the basic behavior. The Stingray continues to be an endpoint for the targeted phone, but also extracts the GSM encryption key on the device. It then opens a new connection to a cell tower, and uses the IMSI and stolen encryption to impersonate the real device. From that point on, its a mitm attack. So the only way a Stingray transfers calls is for targeted users, while configured in a mode that's supposedly not employed in the US. Harris is claiming they use a variant of this system to pass 911 calls, Wyden is pointing out that it's completely untested and doesn't even claim to support text-to-speech dialing. (Source: Wikipedia is surprisingly comprehensive, primary source at: https://www.documentcloud.org/documents/1282642-07-08-29-2007-dea-purchase-of-stingray-fishhawk.html https://www.documentcloud.org/documents/1282642-07-08-29-200...)
- deusofnull 8y ago
  Shit, a mobile DoS hub sounds like it would still be a good use case for the cops / FBI / DHS to "shut off" local internet.
  - int_19h 8y ago
    The very first thing I thought when reading the above comment describing how it works is, "I bet something like this would come real handy when suppressing protests".

dgzl 8y ago

Aka, Man in the Middle

Bartweiss 8y ago

I had always thought this too, but apparently it's not the default behavior. Stingrays (and presumably other IMSI catchers) don't actually act as a bridge to a legitimate network; they're a terminal connection, and effectively deny service to any devices connected to them. This is the default behavior, and it's how the FBI has claimed they're deployed domestically. The reason they don't cause major outages appears to be that they only accept connections from targeted phones; they could equally easily be used as mobile DoS beacons. And the reason they don't cause targets to abandon their 'broken' phone is that they don't have to run full-time for effective triangulation. For Stingrays to collect calls, as outlined in your link, is effectively a whole new service on top of the basic behavior. The Stingray continues to be an endpoint for the targeted phone, but also extracts the GSM encryption key on the device. It then opens a new connection to a cell tower, and uses the IMSI and stolen encryption to impersonate the real device. From that point on, its a mitm attack. So the only way a Stingray transfers calls is for targeted users, while configured in a mode that's supposedly not employed in the US. Harris is claiming they use a variant of this system to pass 911 calls, Wyden is pointing out that it's completely untested and doesn't even claim to support text-to-speech dialing. (Source: Wikipedia is surprisingly comprehensive, primary source at: https://www.documentcloud.org/documents/1282642-07-08-29-2007-dea-purchase-of-stingray-fishhawk.html https://www.documentcloud.org/documents/1282642-07-08-29-200...)

deusofnull 8y ago
Shit, a mobile DoS hub sounds like it would still be a good use case for the cops / FBI / DHS to "shut off" local internet.
- int_19h 8y ago
  The very first thing I thought when reading the above comment describing how it works is, "I bet something like this would come real handy when suppressing protests".