3 ms·

2019 article! Quite a bit has changed since then. As I pointed out, Stingrays aren't produced anymore. As to your second point, law enforcement buys units like

2019 article! Quite a bit has changed since then. As I pointed out, Stingrays aren't produced anymore. As to your second point, law enforcement buys units like this to bypass normal due process out of the system (having to go to a judge for every minor crime/investigation). I mentioned in my comment that the network will always have this information, even back to 2G there was additional equipment added to the towers when E911 mandates took effect to get better location information off connected user equipment. Reading about E911 requirements is enlightening to learn more about the 'how': https://urgentcomm.com/2008/07/01/different-strokes/ https://urgentcomm.com/2008/07/01/different-strokes/ https://www.federalregister.gov/documents/2020/01/16/2019-28483/wireless-e911-location-accuracy-requirements https://www.federalregister.gov/documents/2020/01/16/2019-28...

walterbell 4y ago
> Stingrays aren't produced anymore. If there's a 5G protocol vulnerability, it can be exploited with an SDR and custom software, even if no commercial product is sold for this purpose. 2021 Blackhat, https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-5G-IMSI-Catchers-Mirage.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-5G-IMS... > IMSI catcher attack is possible in both 5G NSA and SA networks • 4G RAN security == 5G NSA (false sense of 5G security) • Unfixed radio protocols allow targeted attacks • For end users, no control over choosing the most secure network • No security indicators for connected network > Lack of enforcement of security features in operational networks allow tracking of 5G users easily • Need continuous & proactive security monitoring of 5G RAN configs
- joecool1029 4y ago
  5G SA networks are only becoming more common in the past year. 5G NSA does not benefit from the same enhanced privacy. At the same time SA is starting to get deployed legacy networks are being shut down. One of the reasons it took so long was necessity for user equipment to support NR carrier aggregation, and we're there now. But we are derailing. All the slides you've linked acknowledge the attempts made in 5G to improve privacy and most of the practical attacks rely on implementation mistakes or downgrade attacks (which should be less possible as legacy networks disappear). I originally responded on the topic to note that for the first time on a global standard there was an attempt to encrypt subscriber identifying data. Earlier standards made no such attempt and were broken in other ways. (For example GSM had two replaced cracked/backdoored encryption standards A5/1 and A5/2 which were replaced by A5/3 and the standard never made any attempt to authenticate towers)
  - walterbell 4y ago
    It's good that we have progressed from no protection to broken protection. May we continue to progress in the right direction. Practically, 5G phones today remain vulnerable to IMSI catching.
    - kjellsbells 4y ago
      Worth noting that tje ability to catch an IMSI or SUPI in the clear depends on whether the packet core implements concealed identifiers (SUCI) with real encryption. IIRC there are three possible encryption schemes and one of them is "null encryption". I dont know what happens if the cellular provider simply sets that setting, do phones just say "ok" and continue to connect?
      - walterbell 4y ago
        Related: does the OEM (Apple, Samsung) or baseband radio vendor (Qualcomm) make that decision?

walterbell 4y ago

> Stingrays aren't produced anymore. If there's a 5G protocol vulnerability, it can be exploited with an SDR and custom software, even if no commercial product is sold for this purpose. 2021 Blackhat, https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-5G-IMSI-Catchers-Mirage.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-5G-IMS... > IMSI catcher attack is possible in both 5G NSA and SA networks • 4G RAN security == 5G NSA (false sense of 5G security) • Unfixed radio protocols allow targeted attacks • For end users, no control over choosing the most secure network • No security indicators for connected network > Lack of enforcement of security features in operational networks allow tracking of 5G users easily • Need continuous & proactive security monitoring of 5G RAN configs

joecool1029 4y ago
5G SA networks are only becoming more common in the past year. 5G NSA does not benefit from the same enhanced privacy. At the same time SA is starting to get deployed legacy networks are being shut down. One of the reasons it took so long was necessity for user equipment to support NR carrier aggregation, and we're there now. But we are derailing. All the slides you've linked acknowledge the attempts made in 5G to improve privacy and most of the practical attacks rely on implementation mistakes or downgrade attacks (which should be less possible as legacy networks disappear). I originally responded on the topic to note that for the first time on a global standard there was an attempt to encrypt subscriber identifying data. Earlier standards made no such attempt and were broken in other ways. (For example GSM had two replaced cracked/backdoored encryption standards A5/1 and A5/2 which were replaced by A5/3 and the standard never made any attempt to authenticate towers)
- walterbell 4y ago
  It's good that we have progressed from no protection to broken protection. May we continue to progress in the right direction. Practically, 5G phones today remain vulnerable to IMSI catching.
  - kjellsbells 4y ago
    Worth noting that tje ability to catch an IMSI or SUPI in the clear depends on whether the packet core implements concealed identifiers (SUCI) with real encryption. IIRC there are three possible encryption schemes and one of them is "null encryption". I dont know what happens if the cellular provider simply sets that setting, do phones just say "ok" and continue to connect?
    - walterbell 4y ago
      Related: does the OEM (Apple, Samsung) or baseband radio vendor (Qualcomm) make that decision?