6 ms·

Why does this work? How simple is it to follow the sms protocol, I thought there were spam filters in place on the phones to prevent receiving any traffic from

Why does this work? How simple is it to follow the sms protocol, I thought there were spam filters in place on the phones to prevent receiving any traffic from towers which are not registered to a well known network provider (or what have you).

jeroenhd 2y ago
SMS is sent in some leftover space in the mobile data channel, there's very little verification to that up until relatively recent standards. If you can pretend to be a 2G/3G tower and jam the real tower, you can force phones to connect to you and you can send whatever calls and texts you want. This is mostly a 2G issue. Modern Android devices, and perhaps iOS devices, have a toggle to disable 2G for this reason. With fully compliant 5G, even police IMSI catchers become pretty difficult to use.
- andyjohnson0 2y ago
  > This is mostly a 2G issue. Modern Android devices, and perhaps iOS devices, have a toggle to disable 2G for this reason. My Android phone, Motorola Edge 20, has a setting for preferred network type. Options are 5G/4G/3G/2G, 4G/3G/2G, 3G/2G, or 2G only. Doesn't seem to be a way to disable 2G or 3G, even though most networks here (UK) no longer support them.
  - jeroenhd 2y ago
    For phones that support it, there's a separate toggle for disabling 2G. I don't think the preference setting you're referring to has the same effect. If I recall correctly, The separate 2G toggle goes down to the modem especially rather than just being configuration. I do have my phone set to 4G+5G only through that same screen, though, as my modem lacks the 2G toggle as well. If there are missing options in the dropdown, try dialing *#*#4636#*#* and see if you can configure it through there. I don't know exactly what determines what configuration is exposed to the UI, it's possible your modem simply lacks support for disabling entire generations of cellular technology.
    - Scoundreller 2y ago
      I believe the SIM supports all kinds of rules for what networks and xG should be visible to the user. I know for a fact a local network has 3G here, but it’s not exposed on my phone to choose, presumably because it knows there’s 4G and 5G and carriers don’t want some dolt camping on 3G and eating more mhz/bit. I used to camp on 3G because Canada sent out too many dumb “emergency alerts” for custody disputes 1000km away, but those only operated over LTE, not 3G. People don’t believe me when I say you can see, and sometimes connect to, US networks from a tall building in Toronto from over the lake because Canadian SIMs have rules/conditions to hide them, but if you put in an overseas SIM, you’ll see them on a scan. Have also had a world of a time with a French SIM refuse to connect to a Canadian tower because it really preferred the US towers (lower roaming costs maybe?).
    - blacksmith_tb 2y ago
      My Pixel 6a has a toggle in settings labeled "Allow 2G". It does have a note saying it may help you connect in situations where reception is poor, and that it may potentially be used for emergency calls even if you turn it off.
    - kiwijamo 2y ago
      I'm not sure the modem makes any difference. I have access four different Android phones and none of them have the option to disable 2G.
  - lxgr 2y ago
    Huh, are you sure that's true? I was under the impression that most European countries were keeping 2G around for legacy applications and voice calls on roaming (until VoLTE roaming and emergency calls finally become equally reliable), shutting down 3G if anything?
  - deleted 2y ago
    [deleted]
  - instagib 2y ago
    Within apple’s lockdown mode you can disable 2G.
- lxgr 2y ago
  I’ve always found that a weird characterization. It’s sent in the signaling channel, but why is that “leftover”? The channel is still established for the SMS, and it’s not like that channel bandwidth would go unused otherwise. It’s like saying “postcards are delivered in the leftover part of the mail truck unused by letters and parcels” :)
  - zinekeller 2y ago
    > I’ve always found that a weird characterization. It’s sent in the signaling channel, but why is that “leftover”? The channel is still established for the SMS, and it’s not like that channel bandwidth would go unused otherwise. In modern standards, it is indeed not a “leftover” (although RCS exists which is another can of worms), but originally it was transmitted in a best-effort manner using what is essentially a "hack" on SS7 (unlike phone calls which is guaranteed reception - or at least not going through).
    - lxgr 2y ago
      I don't think this was ever true, unless I'm misunderstanding what you mean by "best-effort" or "hack". In GSM, SMS are delivered either over the SDCCH (when no voice call is happening simultaneously) or the SACCH (when a voice call is already in progress). In the latter case, you might argue that they're piggy-backing onto existing resources, but in the former, there are definitely dedicated resources being allocated specifically for SMS delivery. SMS delivery has also always been reliable, both on the lower level (both SDCCH and SACCH are reliable) and the upper one (the phone reports successful delivery back to the sending SMSC), so while there are no timing guarantees (is that what you mean by best-effort?), delivery always eventually succeeds once resources are available. The protocol even goes to significant lengths to ensure timely (re)delivery in case various error scenarios, such as a full inbox on a phone or a phone being out of reception. While 140 bytes aren't much, reliability is actually great, until you add spam filtering, roaming, and inter-network delivery to the mix, when things can quickly go off the rails. (One unexpected consequence of how it's implemented is that for mutual reachability, it doesn't only matter what operators the sender and recipient have a contract with, but also in which network the recipient is currently roaming.)
- kiwijamo 2y ago
  Not all Android devices have this toggle. I personally own three Android devices (and have one Android device from work) and none of them have this option. Right now I can see both a Samsung S21 and Samsung A73 provide only the following: 5G/4G/3G/2G; 4G/3G/2G; 3G/2G; 3G only; 2G only. Some people have said it depends on the network operator--however I have access to 4 different phones attached to all three network operators in my country and the options are the same across all three (including the two operators who have no 2G network whatsoever making it even more silly Android insists on keeping 2G enabled if you only want 4G/5G).
LZ2DMV 2y ago
The problem is mostly the insecure defaults. Every modern phone is configured to be backward compatible and connect to an older generation of network if a newer generation is not present (like in the case of being deliberately jammed by an adversary). In 2G, mutual authentication is not existent, it happens only one way - only the network authenticates the handset. If you are close enough to the victim (only screaming louder, i.e. more power than the legitimate network, but from a significant distance doesn't work, because of the RTT of the signal - TDMA-based systems are very time-sensitive in nature), nothing prevents you from operating your own mobile infrastructure and disable any encryption (i.e. in 2G, during the handshake, you just say A5/0 - no encryption, to the handset) - you can not enable encryption anyway, because you do not have the corresponding key that is on the SIM card, only the legitimate carrier has that. Whether or not the victim will be notified about the absence of encryption, depends on the state of a single bit on the SIM card [1]. In 99% of the cases, there is no warning that the handset is currently using A5/0. From now on, you are at the grace of the rogue network operator - they can send you anything from any number, sit in the middle of every call and capture every frame of data. I don't think the current level of technological education of the general public is enough for most of them to know why it is important to force your phone to work only with modern network standards and that is what police and other government agencies interested in operating IMSI catchers exploit. [1] http://blog.taddong.com/2011/02/does-your-phone-warn-you-when-it-is-not.html http://blog.taddong.com/2011/02/does-your-phone-warn-you-whe...
- seabass-labrax 2y ago
  > ...that is what police and other government agencies interested in operating IMSI catchers exploit. Is encryption really significant to whether or not the police are able to monitor cellular phones? As bandwidth is already centrally allocated, there is a limited number of legal cellular network operators, and a competent authority could already compel (indeed, could have already compelled) mobile operators to provide master keys and diversification information under the Snooper Charter 2016[1]. https://www.legislation.gov.uk/ukpga/2016/25/ https://www.legislation.gov.uk/ukpga/2016/25/
  - LZ2DMV 2y ago

jeroenhd 2y ago

SMS is sent in some leftover space in the mobile data channel, there's very little verification to that up until relatively recent standards. If you can pretend to be a 2G/3G tower and jam the real tower, you can force phones to connect to you and you can send whatever calls and texts you want. This is mostly a 2G issue. Modern Android devices, and perhaps iOS devices, have a toggle to disable 2G for this reason. With fully compliant 5G, even police IMSI catchers become pretty difficult to use.

andyjohnson0 2y ago
> This is mostly a 2G issue. Modern Android devices, and perhaps iOS devices, have a toggle to disable 2G for this reason. My Android phone, Motorola Edge 20, has a setting for preferred network type. Options are 5G/4G/3G/2G, 4G/3G/2G, 3G/2G, or 2G only. Doesn't seem to be a way to disable 2G or 3G, even though most networks here (UK) no longer support them.
- jeroenhd 2y ago
  For phones that support it, there's a separate toggle for disabling 2G. I don't think the preference setting you're referring to has the same effect. If I recall correctly, The separate 2G toggle goes down to the modem especially rather than just being configuration. I do have my phone set to 4G+5G only through that same screen, though, as my modem lacks the 2G toggle as well. If there are missing options in the dropdown, try dialing *#*#4636#*#* and see if you can configure it through there. I don't know exactly what determines what configuration is exposed to the UI, it's possible your modem simply lacks support for disabling entire generations of cellular technology.
  - Scoundreller 2y ago
    I believe the SIM supports all kinds of rules for what networks and xG should be visible to the user. I know for a fact a local network has 3G here, but it’s not exposed on my phone to choose, presumably because it knows there’s 4G and 5G and carriers don’t want some dolt camping on 3G and eating more mhz/bit. I used to camp on 3G because Canada sent out too many dumb “emergency alerts” for custody disputes 1000km away, but those only operated over LTE, not 3G. People don’t believe me when I say you can see, and sometimes connect to, US networks from a tall building in Toronto from over the lake because Canadian SIMs have rules/conditions to hide them, but if you put in an overseas SIM, you’ll see them on a scan. Have also had a world of a time with a French SIM refuse to connect to a Canadian tower because it really preferred the US towers (lower roaming costs maybe?).
  - blacksmith_tb 2y ago
    My Pixel 6a has a toggle in settings labeled "Allow 2G". It does have a note saying it may help you connect in situations where reception is poor, and that it may potentially be used for emergency calls even if you turn it off.
  - kiwijamo 2y ago
    I'm not sure the modem makes any difference. I have access four different Android phones and none of them have the option to disable 2G.
- lxgr 2y ago
  Huh, are you sure that's true? I was under the impression that most European countries were keeping 2G around for legacy applications and voice calls on roaming (until VoLTE roaming and emergency calls finally become equally reliable), shutting down 3G if anything?
- deleted 2y ago
  [deleted]
- instagib 2y ago
  Within apple’s lockdown mode you can disable 2G.
lxgr 2y ago
I’ve always found that a weird characterization. It’s sent in the signaling channel, but why is that “leftover”? The channel is still established for the SMS, and it’s not like that channel bandwidth would go unused otherwise. It’s like saying “postcards are delivered in the leftover part of the mail truck unused by letters and parcels” :)
- zinekeller 2y ago
  > I’ve always found that a weird characterization. It’s sent in the signaling channel, but why is that “leftover”? The channel is still established for the SMS, and it’s not like that channel bandwidth would go unused otherwise. In modern standards, it is indeed not a “leftover” (although RCS exists which is another can of worms), but originally it was transmitted in a best-effort manner using what is essentially a "hack" on SS7 (unlike phone calls which is guaranteed reception - or at least not going through).
  - lxgr 2y ago
    I don't think this was ever true, unless I'm misunderstanding what you mean by "best-effort" or "hack". In GSM, SMS are delivered either over the SDCCH (when no voice call is happening simultaneously) or the SACCH (when a voice call is already in progress). In the latter case, you might argue that they're piggy-backing onto existing resources, but in the former, there are definitely dedicated resources being allocated specifically for SMS delivery. SMS delivery has also always been reliable, both on the lower level (both SDCCH and SACCH are reliable) and the upper one (the phone reports successful delivery back to the sending SMSC), so while there are no timing guarantees (is that what you mean by best-effort?), delivery always eventually succeeds once resources are available. The protocol even goes to significant lengths to ensure timely (re)delivery in case various error scenarios, such as a full inbox on a phone or a phone being out of reception. While 140 bytes aren't much, reliability is actually great, until you add spam filtering, roaming, and inter-network delivery to the mix, when things can quickly go off the rails. (One unexpected consequence of how it's implemented is that for mutual reachability, it doesn't only matter what operators the sender and recipient have a contract with, but also in which network the recipient is currently roaming.)
kiwijamo 2y ago
Not all Android devices have this toggle. I personally own three Android devices (and have one Android device from work) and none of them have this option. Right now I can see both a Samsung S21 and Samsung A73 provide only the following: 5G/4G/3G/2G; 4G/3G/2G; 3G/2G; 3G only; 2G only. Some people have said it depends on the network operator--however I have access to 4 different phones attached to all three network operators in my country and the options are the same across all three (including the two operators who have no 2G network whatsoever making it even more silly Android insists on keeping 2G enabled if you only want 4G/5G).

LZ2DMV 2y ago

The problem is mostly the insecure defaults. Every modern phone is configured to be backward compatible and connect to an older generation of network if a newer generation is not present (like in the case of being deliberately jammed by an adversary). In 2G, mutual authentication is not existent, it happens only one way - only the network authenticates the handset. If you are close enough to the victim (only screaming louder, i.e. more power than the legitimate network, but from a significant distance doesn't work, because of the RTT of the signal - TDMA-based systems are very time-sensitive in nature), nothing prevents you from operating your own mobile infrastructure and disable any encryption (i.e. in 2G, during the handshake, you just say A5/0 - no encryption, to the handset) - you can not enable encryption anyway, because you do not have the corresponding key that is on the SIM card, only the legitimate carrier has that. Whether or not the victim will be notified about the absence of encryption, depends on the state of a single bit on the SIM card [1]. In 99% of the cases, there is no warning that the handset is currently using A5/0. From now on, you are at the grace of the rogue network operator - they can send you anything from any number, sit in the middle of every call and capture every frame of data. I don't think the current level of technological education of the general public is enough for most of them to know why it is important to force your phone to work only with modern network standards and that is what police and other government agencies interested in operating IMSI catchers exploit. [1] http://blog.taddong.com/2011/02/does-your-phone-warn-you-when-it-is-not.html http://blog.taddong.com/2011/02/does-your-phone-warn-you-whe...

seabass-labrax 2y ago
> ...that is what police and other government agencies interested in operating IMSI catchers exploit. Is encryption really significant to whether or not the police are able to monitor cellular phones? As bandwidth is already centrally allocated, there is a limited number of legal cellular network operators, and a competent authority could already compel (indeed, could have already compelled) mobile operators to provide master keys and diversification information under the Snooper Charter 2016[1]. https://www.legislation.gov.uk/ukpga/2016/25/ https://www.legislation.gov.uk/ukpga/2016/25/
- LZ2DMV 2y ago