21 ms·

Stingrays and Dirtboxes: how cops can secretly track your phone

278 points by uhtred 6y ago

jeffbee 6y ago
TL;DR it's a radio in your pocket that constantly announces its identity. I'm quite interested in the fact that people don't realize this. Is it a generational split between people who can remember when we did not all have radios in our pockets and those who can't, or ??? The fact that an always-on radio you carry everywhere can be used to track you seems like the #1 most obvious thing about the technology.
- deleted 6y ago
  [deleted]
- jjulius 6y ago
  You can't expect end users with little-to-no technical know-how to have the same common knowledge that you do.
  - TheSpiceIsLife 6y ago
    I watched a doco last night where researchers put a sounding beacon inside a shark. Inside it! They said something like "these sharks are used to cuts and scrapes and heal quickly." It's no wonder people don't immediately associate their phone with a locating beacon.
    - pvaldes 6y ago
      Maybe I'm not translating correctly "sounding beacon", but I would assume that what you see was just an (I don't know the exact term) "electronic tag". This is standard procedure in ecology, veterinary and animal husbandry. We did it sometimes. Is a rice grain size object, and does not left any noticeable scar in fishes.
      - TheSpiceIsLife 6y ago
        All good, I don’t have any issue with attaching or implanting tracking devices for research purposes in what looks like a wholly harmless way. From what they were saying, it emitted a ping every ten minutes, wasn’t entirely clear if it was acoustic or radio. Shark didn’t seem to mind.
  - jeffbee 6y ago
    Well, why not? How can we improve general technological literacy? I don't want people to memorize the protocols, but I do want them to have the foundation of knowledge that would allow them to conclude that if the phone company can connect calls to your mobile handset, then they can also figure out roughly where it is. I'd also like for people to have the basic knowledge required to understand that GPS does not track you. It's the other way around. I'd like everyone to understand that mass and energy are conserved, the Earth orbits the Sun, etc.
    - aylee 6y ago
      Abstracting away all of the details underlying the tech is a double edged sword. On one side, you get massively higher adoption due to a lower barrier to entry. On the other, you now have a massive population of folks who don’t understand the the “fundamentals”. I’m not sure we “need” to improve the general understanding. I mean how many ppl know how to change their own car tires or oil? If anything you just keep creating niches for ppl to make livings in.
      - WarOnPrivacy 6y ago
        "Why does anyone need to know" is a restrictive premise. In my experience, what follows it are less rights, less ability, greater compliance & increased malleability (eg: susceptibility to "election meddling").
    - TheAdamAndChe 6y ago
      The median IQ is 100, meaning half of all people have IQs below 100. Many of them did not grow up in an environment that pushes lifelong learning. Lots of people do what they've been trained to do and nothing more, which is good! Our society needs people like that. But expecting people like that to think for themselves is a sure way to become needlessly frustrated. edit: switched average to median.
      - steffan 6y ago
        The measure that describes what you state would be the median, which is defined as the point at which there are as many values above as below. Averages will skew with large outliers on either side. E.g. if Bezos and I are alone in a room together, the average person in that room has $95B dollars. (Granted, in an n=2 situation, the median isn't meaningful either)
  - amanaplanacanal 6y ago
    This seems like a common tv and movie plot point though. If you don’t want to be found you have to destroy or lose your phone.
  - mixmastamyk 6y ago
    Most folks generally understand how radio works.
- rrose 6y ago
  I feel like you're ignoring a key point here, which is that these stingray devices can MitM your phone by forcing it to send essentially unencrypted messages. That's both more technically complicated and more serious than passive tracking.
  - bob1029 6y ago
    I don't think OP is ignoring any points. It is a statement of fact that we've been carrying around what ultimately amount to high power RFID surveillance devices in our pockets for about 20-30 years now (en masse). There are also many on this board at this very moment who can remember life before any of this technology or concern was a thing. In 1990, if you walked to the store without telling anyone where you were going, you were basically a ghost as far as anyone else was concerned. In 2020, even if you leave all of your digital electronics at home, you will probably be detected by someone else's electronics.
    - rrose 6y ago
      OP is sort of shrugging off the information in this article by saying that it should be common sense that by carrying a phone you are trackable. I don't really disagree with that. But a major point of the article is that not only are you trackable, but you can be actively surveilled or even have your text messages spoofed, which is not common knowledge and isn't really encapsulated by the "radio in your pocket" analogy
  - WarOnPrivacy 6y ago
    > these stingray devices can MitM your phone by forcing it to send essentially unencrypted messages. Earlier Harris equip did that by forcing 2g mode but 2g is being turned off: https://1ot.mobi/resources/blog/a-complete-overview-of-2g-3g-sunsets https://1ot.mobi/resources/blog/a-complete-overview-of-2g-3g... I'm less familiar with the capabilities of current IMEI catchers tho.
    - bigiain 6y ago
      > Earlier Harris equip did that by forcing 2g mode but 2g is being turned off Even if the carriers switch off all their 2G towers (which happened here in .au years back), I wonder how many handsets will still happily connect to a Stingray-type device that offers it a 2G connection?
- op03 6y ago
  Do the math. The odds of someone targeting you (just for kicks) aren't that high. But don't tell Glenn Greenwald that cause then he has to go find something else to scare you with, to capture your attention in our current useless "state of fear" preserving info tsunami ecosystem. But anyway lets do the math... The US has 200 cops per million. Lets say 1% of that million are born douchebags and there is another 1% who have turned douchebagy for whatever reason. So you have 200 cops to deal with 20000 bad guys per million. So in general they have enough going on keeping them occupied. Now even if you assume they don't spend any time doing their job and all of them spend all their time fixating on you and no one else, the chances of them picking on you out of the million other options are still pretty low. What makes it even lower is if you apply the 2% douchebag rule to the cops themselves, you get probably 2 bad apples in that 200. But to indulge you lets apply it also to anyone who has access to the same privacy violating tech - bank managers, google engineers, telco engineers, the military, rich ppl etc. Keep adding whatever category you feel like and applying the 2% rule. You wont raise the odds too badly.
  - tspike 6y ago
    Your comment comes off pretty condescending and dismissive, which clouds a valid point. It's not likely you will be individually targeted by law enforcement. The scarier proposition to me is bulk collection and latent analysis.
    - 8note 6y ago
      I think you can change that to "if you are not politically active, you are unlikely to be targetted" On the other hand, if you are known to criticise police actions, it's likely that they will be targetting you. The BLM leaders probably haven't connected to a real cellphone tower in years
  - vanusa 6y ago
    It doesn't have to target you directly in order to have a significant negative impact on your life.
throwaway0a5e 6y ago
Anyone who cared (for either personal or professional reasons) has been leaving their phone at home for probably close to a decade now.
- 01100011 6y ago
  Absence of normal phone activity which correlates with prohibited activities can also arouse suspicion. If I wanted to prevent the spooks from thinking I was away from my phone, I'd probably use some sort of robot to move the phone around and randomly unlock it using a fake fingerprint. If you do that, your phone actually turns into an alibi, placing you somewhere other than where you actually are.
rhplus 6y ago
Reports of stingray flight patterns go back to at least 2015: https://komonews.com/archive/fbi-behind-mysterious-spy-aircraft-over-seattle-other-us-cities https://komonews.com/archive/fbi-behind-mysterious-spy-aircr... https://bgr.com/2015/06/03/fbi-dirtbox-stingray-spy-plane-program/ https://bgr.com/2015/06/03/fbi-dirtbox-stingray-spy-plane-pr...
arsome 6y ago
Do they even need to bother with a Stingray, can't they basically just pull up whatever provider's law enforcement portal and click a few buttons?
- TheSpiceIsLife 6y ago
  Yeah, different tool though. An active mode IMSI capture device (eg, a Stingray) can: Extracting stored data such as International Mobile Subscriber Identity ("IMSI") numbers and Electronic Serial Number ("ESN") Writing cellular protocol metadata to internal storage Forcing an increase in signal transmission power Forcing an abundance of radio signals to be transmitted Forcing a downgrade to an older and less secure communications protocol if the older protocol is allowed by the target device, by making the Stingray pretend to be unable to communicate on an up-to-date protocol Interception of communications data or metadata Using received signal strength indicators to direction find the cellular device[9] Conducting a denial of service attack Oop, near forgot the reference https://en.wikipedia.org/wiki/Technical_and_further_education https://en.wikipedia.org/wiki/Technical_and_further_educatio... Radio jamming for either general denial of service purposes or to aid in active mode protocol rollback attacks
- jacquesm 6y ago
  No, usually they need some kind of warrant for that.
  - bigiain 6y ago
    I wish I had any confidence that "need a warrant" didn't just mean "Do it without a warrant, and never admit you did it. Parallel reconstruct a different chain of evidence if it pans out." - and then later from court transcripts we read "The defendant got pulled over in a traffic stop for a broken tail light, and the officer discovered {{badthing}}"...
- jdefr89 6y ago
  They will need a warrant usually even with stingray. I worked at said company on said technologies and left because I was comfortable with controls in place that prevent law enforcement from abusing it.
GaryNumanVevo 6y ago
Pro-tip: If you want fairly good OPSEC when going to a protest, get a burner Android phone, put it on airplane mode with WIFI only. Then purchase a couple of Comcast / Xfiniti logins off the web, and use those to connect to "xfiniti-wifi" hotspots. Most cities have them, the speeds are fairly decent too. We're truly living in the panopticon
- samschooler 6y ago
  Through the pandemic, Xfinity is offering anyone free guest access, so for at least the next few months, you don't need to even buy logins. https://corporate.comcast.com/press/releases/comcast-extends-free-public-wifi-access-remainder-of-2020 https://corporate.comcast.com/press/releases/comcast-extends...
  - codemac 6y ago
    Note, this only works on the xfinity "public wifi stations" rather than the xfinity ssid's from home routers. If you want to access the home router networks, you still need to pay for an account.
    - samschooler 6y ago
      Yup thanks for the clarification
- refurb 6y ago
  Maybe I'm being overly paranoid, but if you're arrested, what's stopping the cops from matching the phones MAC to public wifi connections?
  - CharlesW 6y ago
    This might be helpful: https://support.apple.com/en-us/HT211227 https://support.apple.com/en-us/HT211227 > To reduce this privacy risk, iOS 14, iPadOS 14, and watchOS 7 include a feature that periodically changes the MAC address your device uses with each Wi-Fi network. This randomized MAC address is your device's private Wi-Fi address for that network—until the next time it joins with a different address. iOS 14 is in beta, but has been pretty solid for me. https://beta.apple.com/sp/betaprogram/ https://beta.apple.com/sp/betaprogram/
seniorsassycat 6y ago
> stingrays can force phones to downgrade to 2G, a less secure protocol, and tell the phone to use either no encryption or use a weak encryption that can be cracked. Can android, iOS, or an open phone os prevent 2g communication?
- xxpor 6y ago
  On my phone (Galaxy Note 10), there's a toggle to allow 2G or not in the mobile network settings. No debug code needed or anything like that.
- shakna 6y ago
  It happens within the OS for the baseband processor, not within the OS of the actual phone. Unsurprisingly, the details of how the baseband processor work are a highly guarded secret, and trying to reverse engineer anything around it will end up with a heft lawsuit thrown at you.
  - jacquesm 6y ago
    > trying to reverse engineer anything around it will end up with a heft lawsuit thrown at you. Is there an example of that? I can't imagine how reverse engineering anything would get a hefty lawsuit thrown at you. Maybe if you were to publish the results with your name under it, but just the act of reverse engineering?
  - kawsper 6y ago
    These low-level systems can be good attack vectors, on our computer systems if you can attack the BIOS (Intel ME or AMD PSP) it doesn't matter much what defenses the operating system has. Luckily, most of our computers aren't easily remotely connectable, but phone modems are another story.
  - jessaustin 6y ago
    Presumably the creators of these devices have done at least some of that reverse engineering?
- pas 6y ago
kmfrk 6y ago
Title is "How Cops Can Secretly Track Your Phone" on my end. Assuming that was the original one, some comments here seem to suggest they only read the custom title without checking out the actual article.
jdefr89 6y ago
Hey. Someone who briefly worked on the Stingray team here. I left the company that develops the stingray (who’s name is mentioned in the article but I shall not say it) because I didn’t feel comfortable with the ethics of how it could potentially be easily abused without legal permission and/or repercussion. I fear these technologies will become more commonly used against Americans by low level law enforcement without good reason and without responsible usage.
- kome 6y ago
  Thank you for walking away. I hope more people will follow your example and question their work. Not only at Harris Corporation, but in every part of what is called surveillance capitalism.
  - jccc 6y ago
    Is it enough that a few people like this simply turn their backs and walk away to different work? I would think their vacancies would be quickly and easily filled. Is there really a shortage of people willing and able to do this kind of work for these companies and government agencies? I'm asking because I truly don't know. And if not, could we think of some other ways people in these positions could exert some influence for change, even if it's only after they leave those jobs?
    - mellow2020 6y ago
      You can't change rape by being a good rapist. All that serves IMO is to normalize being an accomplice and doing evil things with good intentions. > People have a series of rationalizations. People say for example that science and technology have their own logic, that they are in fact autonomous. This particular rationalization is profoundly false. It is not true that science marches on in defiance of human will, independent of human will, that just is not the case. But it is comfortable, as I said: it leads to the position that "if I don't do it, someone else will." > Of course if one takes that as an ethical principle then obviously it can serve as a license to do anything at all. "People will be murdered; if I don't do it, someone else will." "Women will be raped; if I don't do it, someone else will." That is just a license for violence. - http://tech.mit.edu/V105/N16/weisen.16n.html http://tech.mit.edu/V105/N16/weisen.16n.html
floatingatoll 6y ago
Wi-Fi Calling while in Airplane mode would not be subject to Stingray interception, and would protect IMEI data from airborne bulk capture. Authorities can still set up open SSIDs to capture limited information about phones, but the "fly an airplane over" capture model doesn't work well with Wi-Fi.
- falcolas 6y ago
  You may be underestimating people's lack of care about what open access point people connect to. The traffic itself may be encrypted, but DNS queries, phone hardware addresses, and background traffic might not be.
  - floatingatoll 6y ago
    I’m not trying to offer a comprehensive solution for avoiding government monitoring. I’m just offering a solution for avoiding cellular Stingrays while retaining cellular service. For a more comprehensive solution, you would need to at minimum not carry any electronic devices (signal detection), wear a mask and IR-blocking glasses (face detection), and wear shoe inserts (gait detection) — and even then, they can still seize you and overcome those obstacles at will.
    - falcolas 6y ago
      The context of this article is "Cops tracking your phone", of which the parent comment does not prevent in any meaningful fashion. The rest of the remedies presented here are also mostly unrelated to phone tracking.
      - floatingatoll 6y ago
        Your summary of the context is broader than that of the article. The context of the article is "cops interacting with your cellular radio" in order to capture IMSIs and perform other interactions, using Stingrays and Dirtboxes. Not carrying devices with radios is sufficient to prevent you from being tracked by them. I concede that if you carry a radio-less device and hardwire it to a network, then as in Battlestar Galactica, you have now removed some of the safety that the absence of a radio provided.
t0mmyb0y 6y ago
Almost no agencies upgraded to 4G, way too expensive, about $500k. If on android you can enter a code on device to force ONLY 4G to be used by the device.
BelleOfTheBall 6y ago
I remember this being described in Bruce Schneier's book. When I first read it, I was terrified. Now, seeing them in action, I'm closer to dejected. Most methods of avoiding them aren't easy or practical enough to be used by the layman, hell, most laymen don't even know what stingrays are. These are incredibly tough to protect against on a mass scale.
- Mirioron 6y ago
  What happens when they are used in countries with fewer protections to individuals than the US?
  - mtgx 6y ago
    The bar is already pretty low in the US. The FBI has trained cops to hide the use of stingrays from judges, so who really knows how many times these were illegally used to incriminate someone while telling judges they got anonymous tips or whatever.
    - 8note 6y ago
      So is it possible to set up spying on stingrays, then get them brought up on perjury charges when they say it's from anonymous tips?
  - Sudophysics 6y ago
    Well, use your imagination duh.
  - aerostable_slug 6y ago
    You get assassinated by mercenary teams made up of former special operations soldiers & sailors.[0] 0: https://www.buzzfeednews.com/article/aramroston/mercenaries-assassination-us-yemen-uae-spear-golan-dahlan https://www.buzzfeednews.com/article/aramroston/mercenaries-...
myroon5 6y ago
It's even possible for phones to be tracked while turned off: http://www.washingtonpost.com/world/national-security/nsa-growth-fueled-by-need-to-target-terrorists/2013/07/21/24c93cf4-f0b1-11e2-bed3-b9b6fe264871_story.html http://www.washingtonpost.com/world/national-security/nsa-gr... https://slate.com/technology/2013/07/nsa-can-reportedly-track-cellphones-even-when-they-re-turned-off.html https://slate.com/technology/2013/07/nsa-can-reportedly-trac...
- alain94040 6y ago
  How is this possible?
  - ExThermoGuy 6y ago
    Your phone is never really off.
    - sbierwagen 6y ago
      Heads up: your account has been autobanned, maybe because you're commenting too many times as a new user, or for some other reason.
      - x86_64Ubuntu 6y ago
        How can you tell?
        sbierwagen 6y ago
        Turn on "showdead" in account settings. This will show comments from banned users. I am only guessing they were autobanned. Comment history from the time of the banning doesn't show anything particular egregious that would trigger a manual ban.
  - notyourday 6y ago
    Unless you can physically disconnect the battery, your phone may not actually be fully off. For example, on my Android phone should I drain the battery into oblivion ( let the phone die ) and let it sit for about a week in that state, takes about 90 seconds to become fully functional to the lock screen from the moment it is plugged into a charger. On the other hand if I do hard power off of a phone followed by powering it on, it takes ~35-40 seconds for a phone to get to the lock screen. Out of curiosity I tested several more handsets with similar results. I can only explain that difference by phone not being completely powered off when the battery is inserted unless it does not have any juice at all.
deleted 6y ago
[deleted]
jancsika 6y ago
Protests should shift to "choose-your-own-adventure" style where a blockchain decides which branch to take. Just have a small selection of, say, 4 styles to choose from, where the most extreme includes potential branches with Ghandi-level long-term economic disruption. That way the stingray offers no advantage over the protesters; law enforcement and protesters get the next chapter at exactly the same time, and no single protestor or group of protestors may be targeted to disrupt the decision-making process. That pushes law enforcement either back to pre-protest prevention measures (which won't work for a spontaneous protest like BLM), or to disrupt internet connectivity altogether (which, for the Ghandi-level protest has its own economic implications).
sandstrom 6y ago
Anyone know of any progress in 6G, that would improve privacy in this area? For example randomized (or truly encrypted) IMEI numbers? Also, I found this SIM card which seems to be doing IMEI randomization: https://omertadigital.com/blogs/news/encrypted-sim-cards-what-are-they-what-do-they-do https://omertadigital.com/blogs/news/encrypted-sim-cards-wha...
- hosteur 6y ago
  There are no incentives to improve end user privacy with those who specify telco standards.
- baybal2 6y ago
  > Anyone know of any progress in 6G, that would improve privacy in this area? One of members of numerous 6G working groups is Huawei. If you remember, they recently proposed to replace the whole IP protocol with one where every packet must be cryptosigned by ISP. This SIM feels like a complete BS. IMSI is managed by the phone, not SIM.
- totetsu 6y ago
  There are some interesting blogs articles out there on what has been done in 5g. Basically moving from transmitting a fixed device imsi, to temporary identifiers. https://www.ericsson.com/en/blog/2019/5/fighting-imsi-catchers-5g-cellular-paging-privacy https://www.ericsson.com/en/blog/2019/5/fighting-imsi-catche...
throwaway_drt2 6y ago
I used to work for DRT, they make the "dirtbox" mentioned in the article. I would really encourage journalists to dig more into this company and their products.
- WarOnPrivacy 6y ago
  > I would really encourage journalists to dig more into this company and their products. I guess journalists' disinterest in invasive surveillance is because reporting on it is harder, than reprinting the same 7 headlines as every other news org. It's been a bit better since Edward Snowden dragged news orgs away from authoritarian-friendly journalism and into the surveillance age. However, journalists still seem to do about the bare minimum, while their reporting gives LEO/Gov endless benefit of the doubt.
- ideals 6y ago
  You could contact https://twitter.com/KenKlippenstein https://twitter.com/KenKlippenstein via Signal with any information you didn't see in the article which should be. He seems to be a journalist interested in related fields. No one is going to know unless the people who worked there reach out.
- thimkerbell 6y ago
  Can these do MITM attacks that inject content into what you are reading?
  - thimkerbell 6y ago
    Or could they change the CSS so as to, say, have Amazon's website exhibit underhanded "dark pattern" behavior?
  - ComputerGuru 6y ago
    Not when accessing https resources but the safe answer is yes otherwise. Unless your phone is infected, of course. Baseband isn't as confined as you think.
vanusa 6y ago
So - what countermeasures do people recommend? Is there anything one can carry around that acts like "phone" but is somehow less trackable?
- partdavid 6y ago
  Someone else's phone?
- jijji 6y ago
  you could try to prevent the phone from attaching to the fake cell tower, and only attach to a whitelisted cell tower... that method isnt that easy to do with most phones
  - vanusa 6y ago
    Are there any phones that support tower whitelisting (or blacklisting)? And if so, where would one get such lists?
xkcd-sucks 6y ago
Slightly off topic: Why don't cell networks get shut down more often during large protests etc.? It seems that police use cell phones for internal communications pretty extensively -- Even when there are encrypted radio systems or channels. My guess is that UX of encrypted radio is generally terrible, and that it's a nightmare to distribute keys to all multiple agencies that might be operating in an area. So departments configure encrypted radio for internal use, but when there's large scale activity they need to fall back to cellphones for guaranteed un-eavesdroppable comms
- Nasrudith 6y ago
  Well for one it would be very disruptive and hard to justify. It would interfere with 911 and calling family and would scare and inconvenience the populace turning them against them and a certain safe 'status quo' apathy is what they depend upon. Social dynamics aside more people on the streets makes their job harder regardless of their demeanor - which they will if they need to go in person to check on others. The disruption to service would also be very expensive to businesses which would be encourage flight. "And we lost this multi-million dollar contract sale because the cell service to reach us anywhere went down for three days, a worse case for the company than even if rioters burnt down the whole office. Why are we located in this shithole again?"
- triceratops 6y ago
  > Why don't cell networks get shut down more often during large protests etc.? What problem are you trying to solve, exactly?
  - 8note 6y ago
    The problem that people are allowed to disrupt society? Not everyone values free speech and rights to association
    - triceratops 6y ago
      Protests are supposed to be disruptive. That's literally the point of them. They're trying to bring about a change in the status quo. If you're American, I wonder what your thoughts are about the Boston Tea Party.
Negitivefrags 6y ago
Random story: I once saw an one of the vans for the local ISP driving around wtih a box labeled "Stingray" and got all excited. Picture here: https://imgur.com/a/P1nPSD2 https://imgur.com/a/P1nPSD2 Turns out that "Stingray" is also the name of a system for air-blown optic fiber installation. Personally I would have avoided the reuse of that particular name for anything in telecommunications because it has somewhat dark connotations already!
ChuckMcM 6y ago
FWIW you can do much the same thing with your own SDR setup. One of the more surprising things for me was that the feature that a phone work "internationally" means that a nominally "4G" phones will still answer a GSM tower (talking on a GSM frequency) when the tower says hello. Some phones will let you turn that off. But that said, most smartphones will tell you their WiFi MAC address if you tell them you are an access point. It is more difficult to track a MAC address back to its owner, but it is easy to see if it shows up again near you. My Cisco access point did a variant on this when MAC address filtering was on, it would send you reports of "unknown" MAC addresses which you could log and then later associate with people visiting the office. Bottom line though seems to be to treat protests like DefCon events if you don't want to leak PII. Get a burner phone for such trips.
room505 6y ago
Can a Stingray be used to eavesdrop on someone using an app like Signal for a voice call or message?
- 8note 6y ago
  If you're running e2e encryption, it won't be able to. I imagine that's why the various governments want to bad Huawei -- with Huawei in the base infrastructure, more communications will use E2E encryption and the government mitm attacks will stop working
deleted 6y ago
[deleted]
owlster 6y ago
I've heard faraday cages can prevent transmission and reception of electromagnetic waves.
onenuthin 6y ago
Is there a way to go back and check you phone and see any evidence that it had connected to a stingray or dirtbox? Or is it really untraceable from the user end??

278 points by uhtred 6y ago

TL;DR it's a radio in your pocket that constantly announces its identity. I'm quite interested in the fact that people don't realize this. Is it a generational split between people who can remember when we did not all have radios in our pockets and those who can't, or ??? The fact that an always-on radio you carry everywhere can be used to track you seems like the #1 most obvious thing about the technology.

deleted 6y ago
[deleted]
jjulius 6y ago
You can't expect end users with little-to-no technical know-how to have the same common knowledge that you do.
- TheSpiceIsLife 6y ago
  I watched a doco last night where researchers put a sounding beacon inside a shark. Inside it! They said something like "these sharks are used to cuts and scrapes and heal quickly." It's no wonder people don't immediately associate their phone with a locating beacon.
  - pvaldes 6y ago
    Maybe I'm not translating correctly "sounding beacon", but I would assume that what you see was just an (I don't know the exact term) "electronic tag". This is standard procedure in ecology, veterinary and animal husbandry. We did it sometimes. Is a rice grain size object, and does not left any noticeable scar in fishes.
    - TheSpiceIsLife 6y ago
      All good, I don’t have any issue with attaching or implanting tracking devices for research purposes in what looks like a wholly harmless way. From what they were saying, it emitted a ping every ten minutes, wasn’t entirely clear if it was acoustic or radio. Shark didn’t seem to mind.
- jeffbee 6y ago
  Well, why not? How can we improve general technological literacy? I don't want people to memorize the protocols, but I do want them to have the foundation of knowledge that would allow them to conclude that if the phone company can connect calls to your mobile handset, then they can also figure out roughly where it is. I'd also like for people to have the basic knowledge required to understand that GPS does not track you. It's the other way around. I'd like everyone to understand that mass and energy are conserved, the Earth orbits the Sun, etc.
  - aylee 6y ago
    Abstracting away all of the details underlying the tech is a double edged sword. On one side, you get massively higher adoption due to a lower barrier to entry. On the other, you now have a massive population of folks who don’t understand the the “fundamentals”. I’m not sure we “need” to improve the general understanding. I mean how many ppl know how to change their own car tires or oil? If anything you just keep creating niches for ppl to make livings in.
    - WarOnPrivacy 6y ago
      "Why does anyone need to know" is a restrictive premise. In my experience, what follows it are less rights, less ability, greater compliance & increased malleability (eg: susceptibility to "election meddling").
  - TheAdamAndChe 6y ago
    The median IQ is 100, meaning half of all people have IQs below 100. Many of them did not grow up in an environment that pushes lifelong learning. Lots of people do what they've been trained to do and nothing more, which is good! Our society needs people like that. But expecting people like that to think for themselves is a sure way to become needlessly frustrated. edit: switched average to median.
    - steffan 6y ago
      The measure that describes what you state would be the median, which is defined as the point at which there are as many values above as below. Averages will skew with large outliers on either side. E.g. if Bezos and I are alone in a room together, the average person in that room has $95B dollars. (Granted, in an n=2 situation, the median isn't meaningful either)
- amanaplanacanal 6y ago
  This seems like a common tv and movie plot point though. If you don’t want to be found you have to destroy or lose your phone.
- mixmastamyk 6y ago
  Most folks generally understand how radio works.
rrose 6y ago
I feel like you're ignoring a key point here, which is that these stingray devices can MitM your phone by forcing it to send essentially unencrypted messages. That's both more technically complicated and more serious than passive tracking.
- bob1029 6y ago
  I don't think OP is ignoring any points. It is a statement of fact that we've been carrying around what ultimately amount to high power RFID surveillance devices in our pockets for about 20-30 years now (en masse). There are also many on this board at this very moment who can remember life before any of this technology or concern was a thing. In 1990, if you walked to the store without telling anyone where you were going, you were basically a ghost as far as anyone else was concerned. In 2020, even if you leave all of your digital electronics at home, you will probably be detected by someone else's electronics.
  - rrose 6y ago
    OP is sort of shrugging off the information in this article by saying that it should be common sense that by carrying a phone you are trackable. I don't really disagree with that. But a major point of the article is that not only are you trackable, but you can be actively surveilled or even have your text messages spoofed, which is not common knowledge and isn't really encapsulated by the "radio in your pocket" analogy
- WarOnPrivacy 6y ago
  > these stingray devices can MitM your phone by forcing it to send essentially unencrypted messages. Earlier Harris equip did that by forcing 2g mode but 2g is being turned off: https://1ot.mobi/resources/blog/a-complete-overview-of-2g-3g-sunsets https://1ot.mobi/resources/blog/a-complete-overview-of-2g-3g... I'm less familiar with the capabilities of current IMEI catchers tho.
  - bigiain 6y ago
    > Earlier Harris equip did that by forcing 2g mode but 2g is being turned off Even if the carriers switch off all their 2G towers (which happened here in .au years back), I wonder how many handsets will still happily connect to a Stingray-type device that offers it a 2G connection?
op03 6y ago
Do the math. The odds of someone targeting you (just for kicks) aren't that high. But don't tell Glenn Greenwald that cause then he has to go find something else to scare you with, to capture your attention in our current useless "state of fear" preserving info tsunami ecosystem. But anyway lets do the math... The US has 200 cops per million. Lets say 1% of that million are born douchebags and there is another 1% who have turned douchebagy for whatever reason. So you have 200 cops to deal with 20000 bad guys per million. So in general they have enough going on keeping them occupied. Now even if you assume they don't spend any time doing their job and all of them spend all their time fixating on you and no one else, the chances of them picking on you out of the million other options are still pretty low. What makes it even lower is if you apply the 2% douchebag rule to the cops themselves, you get probably 2 bad apples in that 200. But to indulge you lets apply it also to anyone who has access to the same privacy violating tech - bank managers, google engineers, telco engineers, the military, rich ppl etc. Keep adding whatever category you feel like and applying the 2% rule. You wont raise the odds too badly.
- tspike 6y ago
  Your comment comes off pretty condescending and dismissive, which clouds a valid point. It's not likely you will be individually targeted by law enforcement. The scarier proposition to me is bulk collection and latent analysis.
  - 8note 6y ago
    I think you can change that to "if you are not politically active, you are unlikely to be targetted" On the other hand, if you are known to criticise police actions, it's likely that they will be targetting you. The BLM leaders probably haven't connected to a real cellphone tower in years
- vanusa 6y ago
  It doesn't have to target you directly in order to have a significant negative impact on your life.

throwaway0a5e 6y ago

Anyone who cared (for either personal or professional reasons) has been leaving their phone at home for probably close to a decade now.

01100011 6y ago
Absence of normal phone activity which correlates with prohibited activities can also arouse suspicion. If I wanted to prevent the spooks from thinking I was away from my phone, I'd probably use some sort of robot to move the phone around and randomly unlock it using a fake fingerprint. If you do that, your phone actually turns into an alibi, placing you somewhere other than where you actually are.

rhplus 6y ago

Reports of stingray flight patterns go back to at least 2015: https://komonews.com/archive/fbi-behind-mysterious-spy-aircraft-over-seattle-other-us-cities https://komonews.com/archive/fbi-behind-mysterious-spy-aircr... https://bgr.com/2015/06/03/fbi-dirtbox-stingray-spy-plane-program/ https://bgr.com/2015/06/03/fbi-dirtbox-stingray-spy-plane-pr...

arsome 6y ago

Do they even need to bother with a Stingray, can't they basically just pull up whatever provider's law enforcement portal and click a few buttons?

TheSpiceIsLife 6y ago
Yeah, different tool though. An active mode IMSI capture device (eg, a Stingray) can: Extracting stored data such as International Mobile Subscriber Identity ("IMSI") numbers and Electronic Serial Number ("ESN") Writing cellular protocol metadata to internal storage Forcing an increase in signal transmission power Forcing an abundance of radio signals to be transmitted Forcing a downgrade to an older and less secure communications protocol if the older protocol is allowed by the target device, by making the Stingray pretend to be unable to communicate on an up-to-date protocol Interception of communications data or metadata Using received signal strength indicators to direction find the cellular device[9] Conducting a denial of service attack Oop, near forgot the reference https://en.wikipedia.org/wiki/Technical_and_further_education https://en.wikipedia.org/wiki/Technical_and_further_educatio... Radio jamming for either general denial of service purposes or to aid in active mode protocol rollback attacks
jacquesm 6y ago
No, usually they need some kind of warrant for that.
- bigiain 6y ago
  I wish I had any confidence that "need a warrant" didn't just mean "Do it without a warrant, and never admit you did it. Parallel reconstruct a different chain of evidence if it pans out." - and then later from court transcripts we read "The defendant got pulled over in a traffic stop for a broken tail light, and the officer discovered {{badthing}}"...
jdefr89 6y ago
They will need a warrant usually even with stingray. I worked at said company on said technologies and left because I was comfortable with controls in place that prevent law enforcement from abusing it.

GaryNumanVevo 6y ago

Pro-tip: If you want fairly good OPSEC when going to a protest, get a burner Android phone, put it on airplane mode with WIFI only. Then purchase a couple of Comcast / Xfiniti logins off the web, and use those to connect to "xfiniti-wifi" hotspots. Most cities have them, the speeds are fairly decent too. We're truly living in the panopticon

samschooler 6y ago
Through the pandemic, Xfinity is offering anyone free guest access, so for at least the next few months, you don't need to even buy logins. https://corporate.comcast.com/press/releases/comcast-extends-free-public-wifi-access-remainder-of-2020 https://corporate.comcast.com/press/releases/comcast-extends...
- codemac 6y ago
  Note, this only works on the xfinity "public wifi stations" rather than the xfinity ssid's from home routers. If you want to access the home router networks, you still need to pay for an account.
  - samschooler 6y ago
    Yup thanks for the clarification
refurb 6y ago
Maybe I'm being overly paranoid, but if you're arrested, what's stopping the cops from matching the phones MAC to public wifi connections?
- CharlesW 6y ago
  This might be helpful: https://support.apple.com/en-us/HT211227 https://support.apple.com/en-us/HT211227 > To reduce this privacy risk, iOS 14, iPadOS 14, and watchOS 7 include a feature that periodically changes the MAC address your device uses with each Wi-Fi network. This randomized MAC address is your device's private Wi-Fi address for that network—until the next time it joins with a different address. iOS 14 is in beta, but has been pretty solid for me. https://beta.apple.com/sp/betaprogram/ https://beta.apple.com/sp/betaprogram/

seniorsassycat 6y ago

> stingrays can force phones to downgrade to 2G, a less secure protocol, and tell the phone to use either no encryption or use a weak encryption that can be cracked. Can android, iOS, or an open phone os prevent 2g communication?

xxpor 6y ago
On my phone (Galaxy Note 10), there's a toggle to allow 2G or not in the mobile network settings. No debug code needed or anything like that.
shakna 6y ago
It happens within the OS for the baseband processor, not within the OS of the actual phone. Unsurprisingly, the details of how the baseband processor work are a highly guarded secret, and trying to reverse engineer anything around it will end up with a heft lawsuit thrown at you.
- jacquesm 6y ago
  > trying to reverse engineer anything around it will end up with a heft lawsuit thrown at you. Is there an example of that? I can't imagine how reverse engineering anything would get a hefty lawsuit thrown at you. Maybe if you were to publish the results with your name under it, but just the act of reverse engineering?
- kawsper 6y ago
  These low-level systems can be good attack vectors, on our computer systems if you can attack the BIOS (Intel ME or AMD PSP) it doesn't matter much what defenses the operating system has. Luckily, most of our computers aren't easily remotely connectable, but phone modems are another story.
- jessaustin 6y ago
  Presumably the creators of these devices have done at least some of that reverse engineering?
pas 6y ago

kmfrk 6y ago

Title is "How Cops Can Secretly Track Your Phone" on my end. Assuming that was the original one, some comments here seem to suggest they only read the custom title without checking out the actual article.

jdefr89 6y ago

Hey. Someone who briefly worked on the Stingray team here. I left the company that develops the stingray (who’s name is mentioned in the article but I shall not say it) because I didn’t feel comfortable with the ethics of how it could potentially be easily abused without legal permission and/or repercussion. I fear these technologies will become more commonly used against Americans by low level law enforcement without good reason and without responsible usage.

kome 6y ago
Thank you for walking away. I hope more people will follow your example and question their work. Not only at Harris Corporation, but in every part of what is called surveillance capitalism.
- jccc 6y ago
  Is it enough that a few people like this simply turn their backs and walk away to different work? I would think their vacancies would be quickly and easily filled. Is there really a shortage of people willing and able to do this kind of work for these companies and government agencies? I'm asking because I truly don't know. And if not, could we think of some other ways people in these positions could exert some influence for change, even if it's only after they leave those jobs?
  - mellow2020 6y ago
    You can't change rape by being a good rapist. All that serves IMO is to normalize being an accomplice and doing evil things with good intentions. > People have a series of rationalizations. People say for example that science and technology have their own logic, that they are in fact autonomous. This particular rationalization is profoundly false. It is not true that science marches on in defiance of human will, independent of human will, that just is not the case. But it is comfortable, as I said: it leads to the position that "if I don't do it, someone else will." > Of course if one takes that as an ethical principle then obviously it can serve as a license to do anything at all. "People will be murdered; if I don't do it, someone else will." "Women will be raped; if I don't do it, someone else will." That is just a license for violence. - http://tech.mit.edu/V105/N16/weisen.16n.html http://tech.mit.edu/V105/N16/weisen.16n.html

floatingatoll 6y ago

Wi-Fi Calling while in Airplane mode would not be subject to Stingray interception, and would protect IMEI data from airborne bulk capture. Authorities can still set up open SSIDs to capture limited information about phones, but the "fly an airplane over" capture model doesn't work well with Wi-Fi.

falcolas 6y ago
You may be underestimating people's lack of care about what open access point people connect to. The traffic itself may be encrypted, but DNS queries, phone hardware addresses, and background traffic might not be.
- floatingatoll 6y ago
  I’m not trying to offer a comprehensive solution for avoiding government monitoring. I’m just offering a solution for avoiding cellular Stingrays while retaining cellular service. For a more comprehensive solution, you would need to at minimum not carry any electronic devices (signal detection), wear a mask and IR-blocking glasses (face detection), and wear shoe inserts (gait detection) — and even then, they can still seize you and overcome those obstacles at will.
  - falcolas 6y ago
    The context of this article is "Cops tracking your phone", of which the parent comment does not prevent in any meaningful fashion. The rest of the remedies presented here are also mostly unrelated to phone tracking.
    - floatingatoll 6y ago
      Your summary of the context is broader than that of the article. The context of the article is "cops interacting with your cellular radio" in order to capture IMSIs and perform other interactions, using Stingrays and Dirtboxes. Not carrying devices with radios is sufficient to prevent you from being tracked by them. I concede that if you carry a radio-less device and hardwire it to a network, then as in Battlestar Galactica, you have now removed some of the safety that the absence of a radio provided.

t0mmyb0y 6y ago

Almost no agencies upgraded to 4G, way too expensive, about $500k. If on android you can enter a code on device to force ONLY 4G to be used by the device.

BelleOfTheBall 6y ago

I remember this being described in Bruce Schneier's book. When I first read it, I was terrified. Now, seeing them in action, I'm closer to dejected. Most methods of avoiding them aren't easy or practical enough to be used by the layman, hell, most laymen don't even know what stingrays are. These are incredibly tough to protect against on a mass scale.

Mirioron 6y ago
What happens when they are used in countries with fewer protections to individuals than the US?
- mtgx 6y ago
  The bar is already pretty low in the US. The FBI has trained cops to hide the use of stingrays from judges, so who really knows how many times these were illegally used to incriminate someone while telling judges they got anonymous tips or whatever.
  - 8note 6y ago
    So is it possible to set up spying on stingrays, then get them brought up on perjury charges when they say it's from anonymous tips?
- Sudophysics 6y ago
  Well, use your imagination duh.
- aerostable_slug 6y ago
  You get assassinated by mercenary teams made up of former special operations soldiers & sailors.[0] 0: https://www.buzzfeednews.com/article/aramroston/mercenaries-assassination-us-yemen-uae-spear-golan-dahlan https://www.buzzfeednews.com/article/aramroston/mercenaries-...

myroon5 6y ago

It's even possible for phones to be tracked while turned off: http://www.washingtonpost.com/world/national-security/nsa-growth-fueled-by-need-to-target-terrorists/2013/07/21/24c93cf4-f0b1-11e2-bed3-b9b6fe264871_story.html http://www.washingtonpost.com/world/national-security/nsa-gr... https://slate.com/technology/2013/07/nsa-can-reportedly-track-cellphones-even-when-they-re-turned-off.html https://slate.com/technology/2013/07/nsa-can-reportedly-trac...

alain94040 6y ago
How is this possible?
- ExThermoGuy 6y ago
  Your phone is never really off.
  - sbierwagen 6y ago
    Heads up: your account has been autobanned, maybe because you're commenting too many times as a new user, or for some other reason.
    - x86_64Ubuntu 6y ago
      How can you tell?
      - sbierwagen 6y ago
        Turn on "showdead" in account settings. This will show comments from banned users. I am only guessing they were autobanned. Comment history from the time of the banning doesn't show anything particular egregious that would trigger a manual ban.
- notyourday 6y ago
  Unless you can physically disconnect the battery, your phone may not actually be fully off. For example, on my Android phone should I drain the battery into oblivion ( let the phone die ) and let it sit for about a week in that state, takes about 90 seconds to become fully functional to the lock screen from the moment it is plugged into a charger. On the other hand if I do hard power off of a phone followed by powering it on, it takes ~35-40 seconds for a phone to get to the lock screen. Out of curiosity I tested several more handsets with similar results. I can only explain that difference by phone not being completely powered off when the battery is inserted unless it does not have any juice at all.

deleted 6y ago

[deleted]

jancsika 6y ago

Protests should shift to "choose-your-own-adventure" style where a blockchain decides which branch to take. Just have a small selection of, say, 4 styles to choose from, where the most extreme includes potential branches with Ghandi-level long-term economic disruption. That way the stingray offers no advantage over the protesters; law enforcement and protesters get the next chapter at exactly the same time, and no single protestor or group of protestors may be targeted to disrupt the decision-making process. That pushes law enforcement either back to pre-protest prevention measures (which won't work for a spontaneous protest like BLM), or to disrupt internet connectivity altogether (which, for the Ghandi-level protest has its own economic implications).

sandstrom 6y ago

Anyone know of any progress in 6G, that would improve privacy in this area? For example randomized (or truly encrypted) IMEI numbers? Also, I found this SIM card which seems to be doing IMEI randomization: https://omertadigital.com/blogs/news/encrypted-sim-cards-what-are-they-what-do-they-do https://omertadigital.com/blogs/news/encrypted-sim-cards-wha...

hosteur 6y ago
There are no incentives to improve end user privacy with those who specify telco standards.
baybal2 6y ago
> Anyone know of any progress in 6G, that would improve privacy in this area? One of members of numerous 6G working groups is Huawei. If you remember, they recently proposed to replace the whole IP protocol with one where every packet must be cryptosigned by ISP. This SIM feels like a complete BS. IMSI is managed by the phone, not SIM.
totetsu 6y ago
There are some interesting blogs articles out there on what has been done in 5g. Basically moving from transmitting a fixed device imsi, to temporary identifiers. https://www.ericsson.com/en/blog/2019/5/fighting-imsi-catchers-5g-cellular-paging-privacy https://www.ericsson.com/en/blog/2019/5/fighting-imsi-catche...

throwaway_drt2 6y ago

I used to work for DRT, they make the "dirtbox" mentioned in the article. I would really encourage journalists to dig more into this company and their products.

WarOnPrivacy 6y ago
> I would really encourage journalists to dig more into this company and their products. I guess journalists' disinterest in invasive surveillance is because reporting on it is harder, than reprinting the same 7 headlines as every other news org. It's been a bit better since Edward Snowden dragged news orgs away from authoritarian-friendly journalism and into the surveillance age. However, journalists still seem to do about the bare minimum, while their reporting gives LEO/Gov endless benefit of the doubt.
ideals 6y ago
You could contact https://twitter.com/KenKlippenstein https://twitter.com/KenKlippenstein via Signal with any information you didn't see in the article which should be. He seems to be a journalist interested in related fields. No one is going to know unless the people who worked there reach out.
thimkerbell 6y ago
Can these do MITM attacks that inject content into what you are reading?
- thimkerbell 6y ago
  Or could they change the CSS so as to, say, have Amazon's website exhibit underhanded "dark pattern" behavior?
- ComputerGuru 6y ago
  Not when accessing https resources but the safe answer is yes otherwise. Unless your phone is infected, of course. Baseband isn't as confined as you think.

vanusa 6y ago

So - what countermeasures do people recommend? Is there anything one can carry around that acts like "phone" but is somehow less trackable?

partdavid 6y ago
Someone else's phone?
jijji 6y ago
you could try to prevent the phone from attaching to the fake cell tower, and only attach to a whitelisted cell tower... that method isnt that easy to do with most phones
- vanusa 6y ago
  Are there any phones that support tower whitelisting (or blacklisting)? And if so, where would one get such lists?

xkcd-sucks 6y ago

Slightly off topic: Why don't cell networks get shut down more often during large protests etc.? It seems that police use cell phones for internal communications pretty extensively -- Even when there are encrypted radio systems or channels. My guess is that UX of encrypted radio is generally terrible, and that it's a nightmare to distribute keys to all multiple agencies that might be operating in an area. So departments configure encrypted radio for internal use, but when there's large scale activity they need to fall back to cellphones for guaranteed un-eavesdroppable comms

Nasrudith 6y ago
Well for one it would be very disruptive and hard to justify. It would interfere with 911 and calling family and would scare and inconvenience the populace turning them against them and a certain safe 'status quo' apathy is what they depend upon. Social dynamics aside more people on the streets makes their job harder regardless of their demeanor - which they will if they need to go in person to check on others. The disruption to service would also be very expensive to businesses which would be encourage flight. "And we lost this multi-million dollar contract sale because the cell service to reach us anywhere went down for three days, a worse case for the company than even if rioters burnt down the whole office. Why are we located in this shithole again?"
triceratops 6y ago
> Why don't cell networks get shut down more often during large protests etc.? What problem are you trying to solve, exactly?
- 8note 6y ago
  The problem that people are allowed to disrupt society? Not everyone values free speech and rights to association
  - triceratops 6y ago
    Protests are supposed to be disruptive. That's literally the point of them. They're trying to bring about a change in the status quo. If you're American, I wonder what your thoughts are about the Boston Tea Party.

Negitivefrags 6y ago

Random story: I once saw an one of the vans for the local ISP driving around wtih a box labeled "Stingray" and got all excited. Picture here: https://imgur.com/a/P1nPSD2 https://imgur.com/a/P1nPSD2 Turns out that "Stingray" is also the name of a system for air-blown optic fiber installation. Personally I would have avoided the reuse of that particular name for anything in telecommunications because it has somewhat dark connotations already!

ChuckMcM 6y ago

FWIW you can do much the same thing with your own SDR setup. One of the more surprising things for me was that the feature that a phone work "internationally" means that a nominally "4G" phones will still answer a GSM tower (talking on a GSM frequency) when the tower says hello. Some phones will let you turn that off. But that said, most smartphones will tell you their WiFi MAC address if you tell them you are an access point. It is more difficult to track a MAC address back to its owner, but it is easy to see if it shows up again near you. My Cisco access point did a variant on this when MAC address filtering was on, it would send you reports of "unknown" MAC addresses which you could log and then later associate with people visiting the office. Bottom line though seems to be to treat protests like DefCon events if you don't want to leak PII. Get a burner phone for such trips.

room505 6y ago

Can a Stingray be used to eavesdrop on someone using an app like Signal for a voice call or message?

8note 6y ago
If you're running e2e encryption, it won't be able to. I imagine that's why the various governments want to bad Huawei -- with Huawei in the base infrastructure, more communications will use E2E encryption and the government mitm attacks will stop working

deleted 6y ago

[deleted]

owlster 6y ago

I've heard faraday cages can prevent transmission and reception of electromagnetic waves.

onenuthin 6y ago

Is there a way to go back and check you phone and see any evidence that it had connected to a stingray or dirtbox? Or is it really untraceable from the user end??