4 ms·

Some informed person can probably tell us: are there any technical developments on the horizon which could plausibly make stingrays unviable? From a lay perspec

by abeppu 7y ago

Some informed person can probably tell us: are there any technical developments on the horizon which could plausibly make stingrays unviable? From a lay perspective, it seems like cell tech hasn't been designed to meet some criteria that ought to be achievable. - Are there future cell technology standards being planned which would make it harder for a 3rd party device to impersonate a cell tower? (e.g. the police would actively need the cell network to help them sign something) - Why can't we encrypt calls and texts in a way which doesn't let all this stuff get read? Like (handwaving) either trust the network and encrypt with a key they provide, or else some form end-to-end encryption (where maybe generating keys is part of what happens when you activate a sim card or something)? Like, sure the lawsuits are important, but why did we end up with a system where these tools are possible?

guelo 7y ago
Since the FCC sanctions stingray use for law enforcement I'm sure they make sure that any new mobile radio technology is compliant with police spying requirements.
- upofadown 7y ago
  Last I heard these things were FCC licensed for "emergency use only". The issue is that the FCC can't override federal law and deliberate interference with radio communications is illegal under such law.
tbihl 7y ago
5G is by nature shorter range, which at least makes the surveillance harder to do and more targeted when it happens. But I can't say much for the protocol, having not done much with it.
- xucheng 7y ago
  On the flip side, I think this would make pinpoint the device‘s geo-location much easier.
  - LilBytes 7y ago
    Yeah that seems true, if there's more signal towers in a particular space it'll make triangulation of a person and their device easier to achieve through an increase of reference points.
- LilBytes 7y ago
  I don't see this as being a stop gap, the short comings (not an intended pun) of the range and potential penetration of 5G almost certainly means 4G is going to be around in the long term.
- greyhair 7y ago
  mmWave 5G is shorter range. 5G runs also on sub-6. The spec defines the modulation and the network, it doesn't hard-spec the frequency. So the coverage on low band 5G will be the same as 4G
bootlooped 7y ago
I don't think American carriers care at all about preventing government spying.
- notlukesky 7y ago
  The CEO of Qwest did and he was subsequently jailed. https://www.washingtonpost.com/news/the-switch/wp/2013/09/30/a-ceo-who-resisted-nsa-spying-is-out-of-prison-and-he-feels-vindicated-by-snowden-leaks/ https://www.washingtonpost.com/news/the-switch/wp/2013/09/30... From a YCombinator comment: "The way that Qwest CEO Joseph Nacchio so meaningfully resisted the government that he was convicted of insider trading for telling people his company would be successful when it actually relied on a government contract that was pulled in retaliation, which he couldn't use as a defense in court because of national security concerns? For which he served four years in prison, and Qwest no longer exists? That sort of meaningfully resist? The message to me from that case is clear—if the US government tells you to jump, you answer, how high." https://news.ycombinator.com/item?id=20369120 https://news.ycombinator.com/item?id=20369120
  - Teknoman117 7y ago
    If he's telling the truth, major props to that guy for sticking to his principles regardless of what he had to lose.
blotter_paper 7y ago
> Why can't we encrypt calls and texts in a way which doesn't let all this stuff get read? Like (handwaving) either trust the network and encrypt with a key they provide, or else some form end-to-end encryption (where maybe generating keys is part of what happens when you activate a sim card or something)? We can have E2E encryption on cellphones today, just make calls and send texts over Signal (with other people who also have Signal installed). Here's an article on using SIM cards as a secure element: https://nelenkov.blogspot.com/2013/09/using-sim-card-as-secure-element.html https://nelenkov.blogspot.com/2013/09/using-sim-card-as-secu... I would really like a hardware interface for changing a key, or a mechanism where you flip the card over to expose a separate set of contact plates which have write permissions. Stock Android will allow carriers to fuck with your SIM card sans user permissions.
- 0x0aff374668 7y ago
  Interestingly, at DefCon last year, a presentation was talking about how in Africa there are interposer SIM shims that slip over the top of the simcard and provide additional functionality. Citation needed, but I was impressed they could fit a small MCU in such a thin form factor!
  - blotter_paper 7y ago
    Oooh, I like that idea. I've seen those used to bypass carrier locks, but never considered the possibility of restricting write access with one.
mirimir 7y ago
It used to be that only 2G was vulnerable, but newer devices don't depend on downgrading. But with suitable phones, I gather that one can detect suspicious baseband activity. However, by the time that's obvious, the phone will already be pwned. https://www.tomsguide.com/us/cellphone-tracker-stingray,news-21718.html https://www.tomsguide.com/us/cellphone-tracker-stingray,news... https://www.tomsguide.com/us/imsi-catcher-catcher,news-19438.html https://www.tomsguide.com/us/imsi-catcher-catcher,news-19438...
PeterisP 7y ago
The key factor is the compatibility with international roaming - customers, manufacturers and operators really want the phone to "just work" when you step out of a plane in a random place where the only cell tower in range is run by an operator that was established after your phone was made. There can't be a global list of 'trusted operators' for political reasons (long story), and in order to make calls, your phone needs to work with that operator directly - it can't do end-to-end to your home provider, your data streams won't get routed halway across the world and back for no good reason, they'll route only the billing info and metadata as per the roaming agreements. The other problem IIRC is virtual towers - when operator A gains improved coverage by renting capacity on a tower of operator B, they want the phone to seamlessly connect to that tower as if it's run by operator A (even if it's not) without the phone being able to inform the customer that hey, you're now connected to operator B - because it might rise confusion about roaming charges, and also give bad PR about coverage which might suggest the customer to switch to that competitor. What could work is the combination of (a) your phone being able to cryptographically verify if it's really connected to your 'main' operator or someone they explicitly authorized (isn't this something that 5g and even 4g protocol supports?) and (b) requiring explicit confirmation if connecting to someone that's not. Of course, (a) would mean that police Stingrays would be recognized as legitimate cell towers, they'd need cooperation from the cell network, but's IMHO not really a problem, just some paperwork whenever they need to activate a new batch of intercepting devices.
- acollins1331 7y ago
  Actually it looks like the two problems with your obvious solutions (political and companies being cranky about you noticing you're on a different tower) are complete bullshit and can be solved with very simple legislation. The more complicated and expensive solution doesn't need to happen.
- tomlu 7y ago
  > The key factor is the compatibility with international roaming You could have an encryption setting in the phone, and the handshake with the network could have a bit telling you the setting isn't supported.
- 7y ago

by abeppu 7y ago

guelo 7y ago

Since the FCC sanctions stingray use for law enforcement I'm sure they make sure that any new mobile radio technology is compliant with police spying requirements.

upofadown 7y ago
Last I heard these things were FCC licensed for "emergency use only". The issue is that the FCC can't override federal law and deliberate interference with radio communications is illegal under such law.

tbihl 7y ago

5G is by nature shorter range, which at least makes the surveillance harder to do and more targeted when it happens. But I can't say much for the protocol, having not done much with it.

xucheng 7y ago
On the flip side, I think this would make pinpoint the device‘s geo-location much easier.
- LilBytes 7y ago
  Yeah that seems true, if there's more signal towers in a particular space it'll make triangulation of a person and their device easier to achieve through an increase of reference points.
LilBytes 7y ago
I don't see this as being a stop gap, the short comings (not an intended pun) of the range and potential penetration of 5G almost certainly means 4G is going to be around in the long term.
greyhair 7y ago
mmWave 5G is shorter range. 5G runs also on sub-6. The spec defines the modulation and the network, it doesn't hard-spec the frequency. So the coverage on low band 5G will be the same as 4G

bootlooped 7y ago

I don't think American carriers care at all about preventing government spying.

notlukesky 7y ago
The CEO of Qwest did and he was subsequently jailed. https://www.washingtonpost.com/news/the-switch/wp/2013/09/30/a-ceo-who-resisted-nsa-spying-is-out-of-prison-and-he-feels-vindicated-by-snowden-leaks/ https://www.washingtonpost.com/news/the-switch/wp/2013/09/30... From a YCombinator comment: "The way that Qwest CEO Joseph Nacchio so meaningfully resisted the government that he was convicted of insider trading for telling people his company would be successful when it actually relied on a government contract that was pulled in retaliation, which he couldn't use as a defense in court because of national security concerns? For which he served four years in prison, and Qwest no longer exists? That sort of meaningfully resist? The message to me from that case is clear—if the US government tells you to jump, you answer, how high." https://news.ycombinator.com/item?id=20369120 https://news.ycombinator.com/item?id=20369120
- Teknoman117 7y ago
  If he's telling the truth, major props to that guy for sticking to his principles regardless of what he had to lose.

blotter_paper 7y ago

> Why can't we encrypt calls and texts in a way which doesn't let all this stuff get read? Like (handwaving) either trust the network and encrypt with a key they provide, or else some form end-to-end encryption (where maybe generating keys is part of what happens when you activate a sim card or something)? We can have E2E encryption on cellphones today, just make calls and send texts over Signal (with other people who also have Signal installed). Here's an article on using SIM cards as a secure element: https://nelenkov.blogspot.com/2013/09/using-sim-card-as-secure-element.html https://nelenkov.blogspot.com/2013/09/using-sim-card-as-secu... I would really like a hardware interface for changing a key, or a mechanism where you flip the card over to expose a separate set of contact plates which have write permissions. Stock Android will allow carriers to fuck with your SIM card sans user permissions.

0x0aff374668 7y ago
Interestingly, at DefCon last year, a presentation was talking about how in Africa there are interposer SIM shims that slip over the top of the simcard and provide additional functionality. Citation needed, but I was impressed they could fit a small MCU in such a thin form factor!
- blotter_paper 7y ago
  Oooh, I like that idea. I've seen those used to bypass carrier locks, but never considered the possibility of restricting write access with one.

mirimir 7y ago

It used to be that only 2G was vulnerable, but newer devices don't depend on downgrading. But with suitable phones, I gather that one can detect suspicious baseband activity. However, by the time that's obvious, the phone will already be pwned. https://www.tomsguide.com/us/cellphone-tracker-stingray,news-21718.html https://www.tomsguide.com/us/cellphone-tracker-stingray,news... https://www.tomsguide.com/us/imsi-catcher-catcher,news-19438.html https://www.tomsguide.com/us/imsi-catcher-catcher,news-19438...

PeterisP 7y ago

The key factor is the compatibility with international roaming - customers, manufacturers and operators really want the phone to "just work" when you step out of a plane in a random place where the only cell tower in range is run by an operator that was established after your phone was made. There can't be a global list of 'trusted operators' for political reasons (long story), and in order to make calls, your phone needs to work with that operator directly - it can't do end-to-end to your home provider, your data streams won't get routed halway across the world and back for no good reason, they'll route only the billing info and metadata as per the roaming agreements. The other problem IIRC is virtual towers - when operator A gains improved coverage by renting capacity on a tower of operator B, they want the phone to seamlessly connect to that tower as if it's run by operator A (even if it's not) without the phone being able to inform the customer that hey, you're now connected to operator B - because it might rise confusion about roaming charges, and also give bad PR about coverage which might suggest the customer to switch to that competitor. What could work is the combination of (a) your phone being able to cryptographically verify if it's really connected to your 'main' operator or someone they explicitly authorized (isn't this something that 5g and even 4g protocol supports?) and (b) requiring explicit confirmation if connecting to someone that's not. Of course, (a) would mean that police Stingrays would be recognized as legitimate cell towers, they'd need cooperation from the cell network, but's IMHO not really a problem, just some paperwork whenever they need to activate a new batch of intercepting devices.

acollins1331 7y ago
Actually it looks like the two problems with your obvious solutions (political and companies being cranky about you noticing you're on a different tower) are complete bullshit and can be solved with very simple legislation. The more complicated and expensive solution doesn't need to happen.
tomlu 7y ago
> The key factor is the compatibility with international roaming You could have an encryption setting in the phone, and the handshake with the network could have a bit telling you the setting isn't supported.
7y ago