5 ms·

Modern LTE features a fairly high level of traffic security, although downgrade attacks remain a major problem. The article addresses this point: "The target of

Modern LTE features a fairly high level of traffic security, although downgrade attacks remain a major problem. The article addresses this point: "The target of LTESNIFFER is to capture the wireless packets between the base station and the user. It can only obtain encrypted packets in most cases because it can’t know the cryptographic keys of users. However, some packets are transferred in plaintext by design." One of the reasons you here about cell-site simulators ("stingrays") a lot less these days is that improving security standards in the cellular network has made them less useful, although they are still widely employed and particularly rely on forcing downgrades to 3G. Elsewhere, the article notes that one of the difficult things about sniffing LTE is that even the parameters used for the radio connection are encrypted, so some of them have to be inferred and guessed. That encryption isn't really intended as a security feature, we're talking about the modulation mode, but comes out of the fact that LTE revisions have erred on the side of caution with encrypting as much of the management traffic as practical. Much of this is a result of lessons learned with previous cellular protocols and protocols like WiFi, where unencrypted/unauthenticated management traffic has often become an attack vector.

yosito 4y ago
I sometimes notice that my connection has been downgraded to 3G despite being in an area that regularly has full 4G coverage. Should I be suspicious of an attack? Is there any way to protect oneself from this type of attack?
- oceanplexian 4y ago
  Tunnel everything on your phone over Wireguard back to a trusted location, and don’t use phone or SMS; stick to VoIP over the VPN tunnel. Any kind of stingray is effectively rendered useless in this scenario.
  - WelcomeShorty 4y ago
    Not even close. The use case for "Stingray" like devices is to determine the proximity and or ID of a device|user based on the IMSI | IMEI.
- stacktrust 4y ago
  Not much can be done, other than turning off the phone, https://www.securitymagazine.com/articles/91767-protecting-high-level-personnel-from-imsi-catchers https://www.securitymagazine.com/articles/91767-protecting-h... & https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=imsi&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... > There are more reliable hardware options available for detecting IMSI catchers, which make sense when protecting multiple smartphone users in a single site, like a corporate headquarters or military base. Typically, such a setup involves a fixed, embedded system containing sensor hardware and a cellular modem for continuously monitoring the broadcast signals of the surrounding base stations, along with a database to which data is uploaded for analysis. When an IMSI catcher is detected, alerts can then be sent to all of an organization’s smartphone users. Phones should allow users to define a whitelist of known-good cell tower IDs, which could be loaded for a known geo-location. Why don't cell towers have the equivalent of an SSH host key, so that unknown cell towers trigger a warning before connection?
  - elguyosupremo 4y ago
    Supposing cell towers don't currently have a key; if they did your cell provider would certainly have a way to push new ones to your phone, and under government warrant they'd simply push the key of the stingray to your phone as well, or give the stingray the key of an existing tower.
    - deleted 4y ago
      [deleted]
    - yosito 4y ago
      If your cell provider is going to help stingrays connect to your phone, the government might as well just install the wiretap at the provider and none of this matters.
      - stacktrust 4y ago
        Governments and law enforcement would be the best-case scenario for telco monitoring and phone/endpoint hacking via NSO et al, because there would at least be some legal framework for narrowly targeted lawful intercept. The risk of insecure-by-design telco standards, radio networks and untrustworthy phones is that zero-day and unfixable vulnerabilities could be abused for targeted and mass surveillance by networks of criminal, corrupt or non-state actors. If Clearview AI can scrape billions of human images from public social networks, for commercial facial recognition services, imagine the per-geo economic value of passive radio signal collection and retroactive footprint analysis by AI. https://hn.algolia.com/?query=imsi https://hn.algolia.com/?query=imsi
- fomine3 4y ago
  Some Android phones can be set to 5G/4G (NR/LTE) only in hidden menu like this https://forum.xda-developers.com/t/set-preferred-network-mode-through-hidden-menu.4313747/ https://forum.xda-developers.com/t/set-preferred-network-mod...
- handedness 4y ago
  GrapheneOS supports LTE-only mode for that purpose: https://grapheneos.org/usage#lte-only-mode https://grapheneos.org/usage#lte-only-mode > This feature is not intended to improve the confidentiality of traditional calls and texts, but it might somewhat raise the bar for some forms of interception. It's not a substitute for end-to-end encrypted calls / texts or even transport layer encryption. LTE does provide basic network authentication / encryption, but it's for the network itself. The intention of the LTE-only feature is only hardening against remote exploitation by disabling an enormous amount of both legacy code (2G, 3G) and bleeding edge code (5G).
  - BenjiWiebe 3y ago
    LineageOS on my Samsung Galaxy S5 also has a setting for which network modes to use. Oddly enough, since the 3G shutdown, I have to set it to LTE-only to get service. Auto 3G/LTE results in no service.
    - handedness 3y ago
      Very odd. I wonder what could account for that. Some kind of legacy 3G initial handshake that particular modem needs before it negotiates an LTE connection? I am completely making that up, but something along those lines.
stephen_g 4y ago
I really wish the iPhone let you disable certain bands - I get there's an argument about "you need to be able to use them just in case you need it for an emergency call", but in Australia where I live, the 2G networks have all been shut down and the spectrum re-allocated, and my carrier will shut down 3G around the end of the year an the largest carrier shut 3G down mid 2024. So I can safely disable 2G knowing that I will not need it, since the networks don't exist and while I'm in the country the only possible use would be a downgrade attack. Similarly, I'm happy to turn off 3G given I'm very rarely out of LTE coverage and it's not long until it will be gone anyway. If it's really a problem, they could have an "re-enable bands if needed while attempting an emergency call" option (or have it do it automatically with no option).

yosito 4y ago

I sometimes notice that my connection has been downgraded to 3G despite being in an area that regularly has full 4G coverage. Should I be suspicious of an attack? Is there any way to protect oneself from this type of attack?

oceanplexian 4y ago
Tunnel everything on your phone over Wireguard back to a trusted location, and don’t use phone or SMS; stick to VoIP over the VPN tunnel. Any kind of stingray is effectively rendered useless in this scenario.
- WelcomeShorty 4y ago
  Not even close. The use case for "Stingray" like devices is to determine the proximity and or ID of a device|user based on the IMSI | IMEI.
stacktrust 4y ago
Not much can be done, other than turning off the phone, https://www.securitymagazine.com/articles/91767-protecting-high-level-personnel-from-imsi-catchers https://www.securitymagazine.com/articles/91767-protecting-h... & https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=imsi&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... > There are more reliable hardware options available for detecting IMSI catchers, which make sense when protecting multiple smartphone users in a single site, like a corporate headquarters or military base. Typically, such a setup involves a fixed, embedded system containing sensor hardware and a cellular modem for continuously monitoring the broadcast signals of the surrounding base stations, along with a database to which data is uploaded for analysis. When an IMSI catcher is detected, alerts can then be sent to all of an organization’s smartphone users. Phones should allow users to define a whitelist of known-good cell tower IDs, which could be loaded for a known geo-location. Why don't cell towers have the equivalent of an SSH host key, so that unknown cell towers trigger a warning before connection?
- elguyosupremo 4y ago
  Supposing cell towers don't currently have a key; if they did your cell provider would certainly have a way to push new ones to your phone, and under government warrant they'd simply push the key of the stingray to your phone as well, or give the stingray the key of an existing tower.
  - deleted 4y ago
    [deleted]
  - yosito 4y ago
    If your cell provider is going to help stingrays connect to your phone, the government might as well just install the wiretap at the provider and none of this matters.
    - stacktrust 4y ago
      Governments and law enforcement would be the best-case scenario for telco monitoring and phone/endpoint hacking via NSO et al, because there would at least be some legal framework for narrowly targeted lawful intercept. The risk of insecure-by-design telco standards, radio networks and untrustworthy phones is that zero-day and unfixable vulnerabilities could be abused for targeted and mass surveillance by networks of criminal, corrupt or non-state actors. If Clearview AI can scrape billions of human images from public social networks, for commercial facial recognition services, imagine the per-geo economic value of passive radio signal collection and retroactive footprint analysis by AI. https://hn.algolia.com/?query=imsi https://hn.algolia.com/?query=imsi
fomine3 4y ago
Some Android phones can be set to 5G/4G (NR/LTE) only in hidden menu like this https://forum.xda-developers.com/t/set-preferred-network-mode-through-hidden-menu.4313747/ https://forum.xda-developers.com/t/set-preferred-network-mod...
handedness 4y ago
GrapheneOS supports LTE-only mode for that purpose: https://grapheneos.org/usage#lte-only-mode https://grapheneos.org/usage#lte-only-mode > This feature is not intended to improve the confidentiality of traditional calls and texts, but it might somewhat raise the bar for some forms of interception. It's not a substitute for end-to-end encrypted calls / texts or even transport layer encryption. LTE does provide basic network authentication / encryption, but it's for the network itself. The intention of the LTE-only feature is only hardening against remote exploitation by disabling an enormous amount of both legacy code (2G, 3G) and bleeding edge code (5G).
- BenjiWiebe 3y ago
  LineageOS on my Samsung Galaxy S5 also has a setting for which network modes to use. Oddly enough, since the 3G shutdown, I have to set it to LTE-only to get service. Auto 3G/LTE results in no service.
  - handedness 3y ago
    Very odd. I wonder what could account for that. Some kind of legacy 3G initial handshake that particular modem needs before it negotiates an LTE connection? I am completely making that up, but something along those lines.

stephen_g 4y ago

I really wish the iPhone let you disable certain bands - I get there's an argument about "you need to be able to use them just in case you need it for an emergency call", but in Australia where I live, the 2G networks have all been shut down and the spectrum re-allocated, and my carrier will shut down 3G around the end of the year an the largest carrier shut 3G down mid 2024. So I can safely disable 2G knowing that I will not need it, since the networks don't exist and while I'm in the country the only possible use would be a downgrade attack. Similarly, I'm happy to turn off 3G given I'm very rarely out of LTE coverage and it's not long until it will be gone anyway. If it's really a problem, they could have an "re-enable bands if needed while attempting an emergency call" option (or have it do it automatically with no option).