3 ms·

> capability to geolocate millions of individuals I guess Starlink could easily geolocate every 4G/5G phone IMIE with huge direct-to-celll attennas

by est 2y ago

mike_hearn 2y ago
Modern mobile phone protocols do not expose your IMEI encrypted, they have a multi-step process in which temporary identifiers are used to identify the device to most of the network. So this is not necessarily the case.
- yapyap 2y ago
  even with SS7 ?
  - betaby 2y ago
    Last time I saw SS7 in production about a decade ago. Which operator uses SS7 today?
    - immibis 2y ago
      All? But it's something internal to networks and between networks, not between a network and a user device, so I don't see the relevance to IMEI catchers which intercept the radio link. Answer delayed by hours due to HN rate limiting.
      - betaby 2y ago
        > All? None? As I said I have not seen SS7 for a decade+ in USA/Canada. IMEI catches has nothing to do with SS7.
        amiga386 2y ago
        You may not have seen it, but do you care to explain this Veritasium video of 3 months ago where they specifically gain (not entirely legal) access to the SS7 network to hack Linus Sebastian's phone? https://www.youtube.com/watch?v=wVyu7NB7W6Y https://www.youtube.com/watch?v=wVyu7NB7W6Y Are you saying the SS7 messages they're looking at of a Canadian telephone subscriber just aren't there? And this is the EFF saying in July 2024 that the FCC should really make telcos address vulnerabilities in SS7: https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable... Are you saying they're just wrong, those SS7 networks don't exist in the USA? I mean, the article links the FCC request-for-comment on SS7 networks. Just as a quote: https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf The Signaling System 7 (SS7) and Diameter protocols play a critical role in U.S. telecommunications infrastructure supporting fixed and mobile service providers in processing and routing calls and text messages between networks, enabling interconnection between fixed and mobile networks, and providing call session information such as Caller ID and billing data for circuit switched infrastructure. Over the last several years, numerous reports have called attention to security vulnerabilities present within SS7 networks and suggest that attackers target SS7 to obtain subscribers’ location information. This is dated March 2024. It's talking about the very thing you say you haven't seen for more than a decade. To me, it sounds like that thing (the SS7 network) is alive and well in the USA, and the federal government is concerned about its lax security allowing spies to discover phone users' location information - the very topic we're discussing. It sounds like you're talking mince.
        betaby 2y ago
        Key word here is '_and_'. Yes, I have not seen SS7 in a decade. On over hand Diameter is widely used everywhere.
        amiga386 2y ago
        You just sound like an unreliable witness. If your claim is that there is literally no SS7 in US and Canadian telephone networks, then that is straight-up wrong. It exists in every network that still supports 2G/3G wireless protocols and classic PSTN standards. It was replaced in 4G/5G and SIP, but that requires your operator only supports those protocols and doesn't continue to support the old protocols. If it does, it will still have SS7 signalling and will still be susceptible to attacks (though it is free to run its own security to block them). If your claim is that you haven't seen SS7 in a decade, then sure, maybe you haven't. But given there is actual, ongoing spying, impersonation, etc., that can be demonstrated in North America in 2024, and everyone involved says "it's due to SS7", and you're out here saying it's-so-rare-you-haven't-seen-in-a-decade, then what exactly is happening? What are the hackers using then, when the experts say they're exploiting SS7, if you insist it's not there? Why did the GSMA publish this security paper in 2019? https://www.gsma.com/solutions-and-impact/technologies/security/gsma_resources/ir-82-ss7-security-network-implementation-guidelines-v5-0/ https://www.gsma.com/solutions-and-impact/technologies/secur... Why are they promoting a Code of Conduct for GT lessees? https://www.gsma.com/solutions-and-impact/technologies/security/gtleasing/ https://www.gsma.com/solutions-and-impact/technologies/secur...
  - mike_hearn 2y ago
    Happy new year! SS7 only gets into the picture after the handset has connected to the home network, from what I understand (n.b. not a telco engineer). The IMEI is exposed to the network, but only to your network and only after the handset sets up an encrypted and authenticated connection with it. 5G uses a thing called a GUTI to identify handsets, not an IMEI. Think of it like a GUTI being a temporary IPv6 address allocated for a few hours by DHCP, and the IMEI being like a browser cookie. IMEI is exposed to your home network and networks you roam onto, but merely being in range of a tower doesn't expose it, and it's never transmitted in the clear over the air. Also, within a network most of the components don't get access to the IMEI either.
reversethread 2y ago
https://www.he360.com/ https://www.he360.com/ Has been doing this for a while.
- 9cb14c1ec0 2y ago
  Oh wow! I wonder how well it works in a crowded urban environment as opposed to the less crowded areas their examples of poachers and illegal fishing vessels operate in?
  - reversethread 2y ago
    Poachers and illegal fishing vessels are better PR than foreign dissidents. :9 The federal government wouldn't pay hundreds of millions of dollars[0] to catch one or two fishing boats. [0] https://www.usaspending.gov/award/CONT_AWD_N6600122C0065_9700_-NONE-_-NONE- https://www.usaspending.gov/award/CONT_AWD_N6600122C0065_970...

> capability to geolocate millions of individuals I guess Starlink could easily geolocate every 4G/5G phone IMIE with huge direct-to-celll attennas

by est 2y ago

> capability to geolocate millions of individuals I guess Starlink could easily geolocate every 4G/5G phone IMIE with huge direct-to-celll attennas

mike_hearn 2y ago

Modern mobile phone protocols do not expose your IMEI encrypted, they have a multi-step process in which temporary identifiers are used to identify the device to most of the network. So this is not necessarily the case.

yapyap 2y ago
even with SS7 ?
- betaby 2y ago
  Last time I saw SS7 in production about a decade ago. Which operator uses SS7 today?
  - immibis 2y ago
    All? But it's something internal to networks and between networks, not between a network and a user device, so I don't see the relevance to IMEI catchers which intercept the radio link. Answer delayed by hours due to HN rate limiting.
    - betaby 2y ago
      > All? None? As I said I have not seen SS7 for a decade+ in USA/Canada. IMEI catches has nothing to do with SS7.
      - amiga386 2y ago
        You may not have seen it, but do you care to explain this Veritasium video of 3 months ago where they specifically gain (not entirely legal) access to the SS7 network to hack Linus Sebastian's phone? https://www.youtube.com/watch?v=wVyu7NB7W6Y https://www.youtube.com/watch?v=wVyu7NB7W6Y Are you saying the SS7 messages they're looking at of a Canadian telephone subscriber just aren't there? And this is the EFF saying in July 2024 that the FCC should really make telcos address vulnerabilities in SS7: https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable... Are you saying they're just wrong, those SS7 networks don't exist in the USA? I mean, the article links the FCC request-for-comment on SS7 networks. Just as a quote: https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf The Signaling System 7 (SS7) and Diameter protocols play a critical role in U.S. telecommunications infrastructure supporting fixed and mobile service providers in processing and routing calls and text messages between networks, enabling interconnection between fixed and mobile networks, and providing call session information such as Caller ID and billing data for circuit switched infrastructure. Over the last several years, numerous reports have called attention to security vulnerabilities present within SS7 networks and suggest that attackers target SS7 to obtain subscribers’ location information. This is dated March 2024. It's talking about the very thing you say you haven't seen for more than a decade. To me, it sounds like that thing (the SS7 network) is alive and well in the USA, and the federal government is concerned about its lax security allowing spies to discover phone users' location information - the very topic we're discussing. It sounds like you're talking mince.
        betaby 2y ago
        Key word here is '_and_'. Yes, I have not seen SS7 in a decade. On over hand Diameter is widely used everywhere.
        amiga386 2y ago
        You just sound like an unreliable witness. If your claim is that there is literally no SS7 in US and Canadian telephone networks, then that is straight-up wrong. It exists in every network that still supports 2G/3G wireless protocols and classic PSTN standards. It was replaced in 4G/5G and SIP, but that requires your operator only supports those protocols and doesn't continue to support the old protocols. If it does, it will still have SS7 signalling and will still be susceptible to attacks (though it is free to run its own security to block them). If your claim is that you haven't seen SS7 in a decade, then sure, maybe you haven't. But given there is actual, ongoing spying, impersonation, etc., that can be demonstrated in North America in 2024, and everyone involved says "it's due to SS7", and you're out here saying it's-so-rare-you-haven't-seen-in-a-decade, then what exactly is happening? What are the hackers using then, when the experts say they're exploiting SS7, if you insist it's not there? Why did the GSMA publish this security paper in 2019? https://www.gsma.com/solutions-and-impact/technologies/security/gsma_resources/ir-82-ss7-security-network-implementation-guidelines-v5-0/ https://www.gsma.com/solutions-and-impact/technologies/secur... Why are they promoting a Code of Conduct for GT lessees? https://www.gsma.com/solutions-and-impact/technologies/security/gtleasing/ https://www.gsma.com/solutions-and-impact/technologies/secur...
- mike_hearn 2y ago
  Happy new year! SS7 only gets into the picture after the handset has connected to the home network, from what I understand (n.b. not a telco engineer). The IMEI is exposed to the network, but only to your network and only after the handset sets up an encrypted and authenticated connection with it. 5G uses a thing called a GUTI to identify handsets, not an IMEI. Think of it like a GUTI being a temporary IPv6 address allocated for a few hours by DHCP, and the IMEI being like a browser cookie. IMEI is exposed to your home network and networks you roam onto, but merely being in range of a tower doesn't expose it, and it's never transmitted in the clear over the air. Also, within a network most of the components don't get access to the IMEI either.

reversethread 2y ago

https://www.he360.com/ https://www.he360.com/ Has been doing this for a while.

9cb14c1ec0 2y ago
Oh wow! I wonder how well it works in a crowded urban environment as opposed to the less crowded areas their examples of poachers and illegal fishing vessels operate in?
- reversethread 2y ago
  Poachers and illegal fishing vessels are better PR than foreign dissidents. :9 The federal government wouldn't pay hundreds of millions of dollars[0] to catch one or two fishing boats. [0] https://www.usaspending.gov/award/CONT_AWD_N6600122C0065_9700_-NONE-_-NONE- https://www.usaspending.gov/award/CONT_AWD_N6600122C0065_970...