4 ms·

How illegal is this from an FCC or cell phone carrier perspective? I would have guessed LTE traffic was "HTTPS" levels of encrypted?

xen2xen1 4y ago
No, IIRC it isn't anywhere near real encryption.
- nicce 4y ago
  Hmm… LTE stands for 4G and they use 128-EEA2 (AES-CTR) or 128-EIA2 (AES-CMAC) which are kinda same as TLS 1.2 and TLS 1.3. Where the latter suppors chacha additionally. GCM on TLS gives greater performance and the integrity can be confirmed earlier, but there are no serious security problems on algorithm side.
  - bryancoxwell 4y ago
    Important to note that the encryption you mention applies to user data traveling between the UE and the eNodeB. Some control plane data between the UE and eNB is unencrypted and no encryption of user data is done between the eNB and the network (unless it’s done at a higher layer).
  - jiggunjer 4y ago
    Nah, 4g stands for 4g.
    - nicce 4y ago
      LTE is industry jargon for the fastest type of 4G
  - offmycloud 4y ago
    LTE stands for Long-Term Evolution
jcrawfordor 4y ago
Modern LTE features a fairly high level of traffic security, although downgrade attacks remain a major problem. The article addresses this point: "The target of LTESNIFFER is to capture the wireless packets between the base station and the user. It can only obtain encrypted packets in most cases because it can’t know the cryptographic keys of users. However, some packets are transferred in plaintext by design." One of the reasons you here about cell-site simulators ("stingrays") a lot less these days is that improving security standards in the cellular network has made them less useful, although they are still widely employed and particularly rely on forcing downgrades to 3G. Elsewhere, the article notes that one of the difficult things about sniffing LTE is that even the parameters used for the radio connection are encrypted, so some of them have to be inferred and guessed. That encryption isn't really intended as a security feature, we're talking about the modulation mode, but comes out of the fact that LTE revisions have erred on the side of caution with encrypting as much of the management traffic as practical. Much of this is a result of lessons learned with previous cellular protocols and protocols like WiFi, where unencrypted/unauthenticated management traffic has often become an attack vector.
- yosito 4y ago
  I sometimes notice that my connection has been downgraded to 3G despite being in an area that regularly has full 4G coverage. Should I be suspicious of an attack? Is there any way to protect oneself from this type of attack?
  - oceanplexian 4y ago
    Tunnel everything on your phone over Wireguard back to a trusted location, and don’t use phone or SMS; stick to VoIP over the VPN tunnel. Any kind of stingray is effectively rendered useless in this scenario.
    - WelcomeShorty 4y ago
      Not even close. The use case for "Stingray" like devices is to determine the proximity and or ID of a device|user based on the IMSI | IMEI.
jabbany 4y ago
IANAL but, IIRC any sniffing seems to be fine in general? You'd only get in trouble if you transmitted anything. I don't even think you need a license to just listen to stuff. Also I think the paper mentions that many types of packets are in fact encrypted, and only certain control packets are sent in the clear. This seems to be not any more concerning than other Internet related protocols which also send a lot of coordination information in cleartext.
- kube-system 4y ago
  If someone doesn’t like what you’re doing, wiretap charges are legally plausible.
  - autoexec 4y ago
    If all you're doing is passively listening to what's around you who would ever know?
    - kube-system 4y ago
      You could ask the same question about any wiretap. People usually get caught by creating some sort of evidence that they committed the crime. Maybe a recording, maybe they told someone, maybe they acted on the information, etc.
  - aeonik 4y ago
    When I got my ham radio license they told us that listening is never against the law. decrypting anything or transmitting on unlicensed frequencies are major offenses, on the other hand.
    - kube-system 4y ago
      That’s probably a bit of a generalization — they likely said that thinking about the FCC rules that a new ham would be dealing with. Since the focus of those test/classes is to get an FCC license. As I understand, telecom traffic is a big exception to this because of wiretap laws which are not FCC regulations, they’re criminal law which the FCC doesn’t really have anything to do with. Try searching radioreference forums for “pager decoding” as a counter example. I didn’t spend a lot of time searching FCCs site but they do mention this parenthetically in this article: https://www.fcc.gov/consumers/guides/interception-and-divulgence-radio-communications https://www.fcc.gov/consumers/guides/interception-and-divulg... Of course, you should be able to follow wiretap law by listening to your own devices. They same way people use wireshark legally: run it on your own network.

xen2xen1 4y ago

No, IIRC it isn't anywhere near real encryption.

nicce 4y ago
Hmm… LTE stands for 4G and they use 128-EEA2 (AES-CTR) or 128-EIA2 (AES-CMAC) which are kinda same as TLS 1.2 and TLS 1.3. Where the latter suppors chacha additionally. GCM on TLS gives greater performance and the integrity can be confirmed earlier, but there are no serious security problems on algorithm side.
- bryancoxwell 4y ago
  Important to note that the encryption you mention applies to user data traveling between the UE and the eNodeB. Some control plane data between the UE and eNB is unencrypted and no encryption of user data is done between the eNB and the network (unless it’s done at a higher layer).
- jiggunjer 4y ago
  Nah, 4g stands for 4g.
  - nicce 4y ago
    LTE is industry jargon for the fastest type of 4G
- offmycloud 4y ago
  LTE stands for Long-Term Evolution

jcrawfordor 4y ago

Modern LTE features a fairly high level of traffic security, although downgrade attacks remain a major problem. The article addresses this point: "The target of LTESNIFFER is to capture the wireless packets between the base station and the user. It can only obtain encrypted packets in most cases because it can’t know the cryptographic keys of users. However, some packets are transferred in plaintext by design." One of the reasons you here about cell-site simulators ("stingrays") a lot less these days is that improving security standards in the cellular network has made them less useful, although they are still widely employed and particularly rely on forcing downgrades to 3G. Elsewhere, the article notes that one of the difficult things about sniffing LTE is that even the parameters used for the radio connection are encrypted, so some of them have to be inferred and guessed. That encryption isn't really intended as a security feature, we're talking about the modulation mode, but comes out of the fact that LTE revisions have erred on the side of caution with encrypting as much of the management traffic as practical. Much of this is a result of lessons learned with previous cellular protocols and protocols like WiFi, where unencrypted/unauthenticated management traffic has often become an attack vector.

yosito 4y ago
I sometimes notice that my connection has been downgraded to 3G despite being in an area that regularly has full 4G coverage. Should I be suspicious of an attack? Is there any way to protect oneself from this type of attack?
- oceanplexian 4y ago
  Tunnel everything on your phone over Wireguard back to a trusted location, and don’t use phone or SMS; stick to VoIP over the VPN tunnel. Any kind of stingray is effectively rendered useless in this scenario.
  - WelcomeShorty 4y ago
    Not even close. The use case for "Stingray" like devices is to determine the proximity and or ID of a device|user based on the IMSI | IMEI.

jabbany 4y ago

IANAL but, IIRC any sniffing seems to be fine in general? You'd only get in trouble if you transmitted anything. I don't even think you need a license to just listen to stuff. Also I think the paper mentions that many types of packets are in fact encrypted, and only certain control packets are sent in the clear. This seems to be not any more concerning than other Internet related protocols which also send a lot of coordination information in cleartext.

kube-system 4y ago
If someone doesn’t like what you’re doing, wiretap charges are legally plausible.
- autoexec 4y ago
  If all you're doing is passively listening to what's around you who would ever know?
  - kube-system 4y ago
    You could ask the same question about any wiretap. People usually get caught by creating some sort of evidence that they committed the crime. Maybe a recording, maybe they told someone, maybe they acted on the information, etc.
- aeonik 4y ago
  When I got my ham radio license they told us that listening is never against the law. decrypting anything or transmitting on unlicensed frequencies are major offenses, on the other hand.
  - kube-system 4y ago
    That’s probably a bit of a generalization — they likely said that thinking about the FCC rules that a new ham would be dealing with. Since the focus of those test/classes is to get an FCC license. As I understand, telecom traffic is a big exception to this because of wiretap laws which are not FCC regulations, they’re criminal law which the FCC doesn’t really have anything to do with. Try searching radioreference forums for “pager decoding” as a counter example. I didn’t spend a lot of time searching FCCs site but they do mention this parenthetically in this article: https://www.fcc.gov/consumers/guides/interception-and-divulgence-radio-communications https://www.fcc.gov/consumers/guides/interception-and-divulg... Of course, you should be able to follow wiretap law by listening to your own devices. They same way people use wireshark legally: run it on your own network.