4 ms·

>The trouble with 5G is that it will be the final nail in the coffin of location privacy, And yet it's first deployed set of standards that encrypts IMSI? (thi

>The trouble with 5G is that it will be the final nail in the coffin of location privacy, And yet it's first deployed set of standards that encrypts IMSI? (this is pushing Stingrays to obsolescence, Harris stopped making them) https://www.thalesgroup.com/en/worldwide-digital-identity-and-security/mobile/magazine/5g-sim-security-and-privacy-imsis https://www.thalesgroup.com/en/worldwide-digital-identity-an... < from one of the world's primary producers of SIM cards. In a densified enough network (cities) the carrier knows where users are within a few meters by correlating timing advance from the towers. This is independent of any software installed on user equipment. mmwave spectrum in the most populated areas (stadiums/train stations) brings this to centimeter-level due to physics, but we're just splitting hairs. This should be a key area of focus on privacy legislation, on 'who' should be allowed to access this data (LEO with a warrant). Even if user device lacks the hardware, the network side can have hardware installed to measure precise location of user equipment Other wireless technologies independent of the cellular network can be used for correlation and privacy relies on the device randomizing macaddr for beacons, both Bluetooth and WiFi. GNSS (except for Beidou, which is disabled in firmware in the US) are one-way comms unless the phone is snitching on you.

walterbell 4y ago
https://www.eff.org/deeplinks/2019/01/5g-protocol-may-still-be-vulnerable-imsi-catchers https://www.eff.org/deeplinks/2019/01/5g-protocol-may-still-... > this attack provides a new way to track a user’s location not just over 3G and 4G, but even over 5G. Location tracking seems to be the most common use for IMSI catchers by American law enforcement and this vulnerability could provide the next generation of CSSs with a way to track user location, even over 5G. > It’s important to keep in mind here that, for cases of lawful intervention from law enforcement agencies, there are better ways than this attack technique to get location information, such as getting a warrant and getting the information directly from the phone companies. People working outside the legal system, such as spies and criminals, cannot get warrants and cannot typically work directly with the phone companies.
- swores 4y ago
  > criminals, cannot get warrants and cannot typically work directly with the phone companies. Colour me skeptical on the latter. What kind of criminal is tech savvy enough to want location data, but can't think of either using a fake business to buy the data (if it's legally allowed to be sold by the phone company), or bribing a phone company employee, or becoming / having one of your criminal team become an employee there, or commit another crime such as hacking into the phone company to steal data, or...?
  - walterbell 4y ago
    IMSI catchers enable realtime scale/volume harvesting. Blackhat 2020, Detecting Fake 4G Base Stations in Real Time, https://news.ycombinator.com/item?id=32237621 https://news.ycombinator.com/item?id=32237621
- joecool1029 4y ago
  2019 article! Quite a bit has changed since then. As I pointed out, Stingrays aren't produced anymore. As to your second point, law enforcement buys units like this to bypass normal due process out of the system (having to go to a judge for every minor crime/investigation). I mentioned in my comment that the network will always have this information, even back to 2G there was additional equipment added to the towers when E911 mandates took effect to get better location information off connected user equipment. Reading about E911 requirements is enlightening to learn more about the 'how': https://urgentcomm.com/2008/07/01/different-strokes/ https://urgentcomm.com/2008/07/01/different-strokes/ https://www.federalregister.gov/documents/2020/01/16/2019-28483/wireless-e911-location-accuracy-requirements https://www.federalregister.gov/documents/2020/01/16/2019-28...
  - walterbell 4y ago
    > Stingrays aren't produced anymore. If there's a 5G protocol vulnerability, it can be exploited with an SDR and custom software, even if no commercial product is sold for this purpose. 2021 Blackhat, https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-5G-IMSI-Catchers-Mirage.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-5G-IMS... > IMSI catcher attack is possible in both 5G NSA and SA networks • 4G RAN security == 5G NSA (false sense of 5G security) • Unfixed radio protocols allow targeted attacks • For end users, no control over choosing the most secure network • No security indicators for connected network > Lack of enforcement of security features in operational networks allow tracking of 5G users easily • Need continuous & proactive security monitoring of 5G RAN configs

walterbell 4y ago

https://www.eff.org/deeplinks/2019/01/5g-protocol-may-still-be-vulnerable-imsi-catchers https://www.eff.org/deeplinks/2019/01/5g-protocol-may-still-... > this attack provides a new way to track a user’s location not just over 3G and 4G, but even over 5G. Location tracking seems to be the most common use for IMSI catchers by American law enforcement and this vulnerability could provide the next generation of CSSs with a way to track user location, even over 5G. > It’s important to keep in mind here that, for cases of lawful intervention from law enforcement agencies, there are better ways than this attack technique to get location information, such as getting a warrant and getting the information directly from the phone companies. People working outside the legal system, such as spies and criminals, cannot get warrants and cannot typically work directly with the phone companies.

swores 4y ago
> criminals, cannot get warrants and cannot typically work directly with the phone companies. Colour me skeptical on the latter. What kind of criminal is tech savvy enough to want location data, but can't think of either using a fake business to buy the data (if it's legally allowed to be sold by the phone company), or bribing a phone company employee, or becoming / having one of your criminal team become an employee there, or commit another crime such as hacking into the phone company to steal data, or...?
- walterbell 4y ago
  IMSI catchers enable realtime scale/volume harvesting. Blackhat 2020, Detecting Fake 4G Base Stations in Real Time, https://news.ycombinator.com/item?id=32237621 https://news.ycombinator.com/item?id=32237621
joecool1029 4y ago
2019 article! Quite a bit has changed since then. As I pointed out, Stingrays aren't produced anymore. As to your second point, law enforcement buys units like this to bypass normal due process out of the system (having to go to a judge for every minor crime/investigation). I mentioned in my comment that the network will always have this information, even back to 2G there was additional equipment added to the towers when E911 mandates took effect to get better location information off connected user equipment. Reading about E911 requirements is enlightening to learn more about the 'how': https://urgentcomm.com/2008/07/01/different-strokes/ https://urgentcomm.com/2008/07/01/different-strokes/ https://www.federalregister.gov/documents/2020/01/16/2019-28483/wireless-e911-location-accuracy-requirements https://www.federalregister.gov/documents/2020/01/16/2019-28...
- walterbell 4y ago
  > Stingrays aren't produced anymore. If there's a 5G protocol vulnerability, it can be exploited with an SDR and custom software, even if no commercial product is sold for this purpose. 2021 Blackhat, https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-5G-IMSI-Catchers-Mirage.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-5G-IMS... > IMSI catcher attack is possible in both 5G NSA and SA networks • 4G RAN security == 5G NSA (false sense of 5G security) • Unfixed radio protocols allow targeted attacks • For end users, no control over choosing the most secure network • No security indicators for connected network > Lack of enforcement of security features in operational networks allow tracking of 5G users easily • Need continuous & proactive security monitoring of 5G RAN configs