6 ms·

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks. I don't know how often unauthorized IMSI catchers are used in the wild, but I doubt it's a relevant percentage of the total amount of IMSI catchers out there. Thanks to mmWave and beam forming, 5G allows operators to practically track you down to the exact centimeter in 3D space. Furthermore, depending on how willing the firmware of your modem is, the signal used to transfer GPS coordinates to the carrier for emergency response situations can also be triggered remotely by carrier hardware. Basically, who needs IMSI catchers when you can just see all of the information you'd get from them remotely on a computer screen on the other side of the country? Of course this is great to protect against criminals that are looking to find your personal phone number or whatever by showing up to your doorstep, but for the vast majority of cases, IMSI catchers are defeated because they're no longer necessary.

lxgr 2y ago
> depending on how willing the firmware of your modem is, the signal used to transfer GPS coordinates to the carrier for emergency response situations can also be triggered remotely by carrier hardware Do you know if (at least some) basebands actually limit network-side location requests to emergency call/text situations only?
- jeroenhd 2y ago
  All I know is that some don't. I don't know brands or if there are even common modems that are filtering for this. If you don't have a Faraday cage and cell site equipment, you're going to have a hard time verifying any of this. The modem is closed source, the SIM card is closed source, and various firmware blobs to make phones work are all closed source. I believe Qualcomm has debug interfaces on some chipsets, which might catch these messages, but verifying that they catch all use cases is impossible unless you have knowledge of the actual mechanism used (or usable) to activate the modem. This is one of the reasons I'm hoping for the open source phone community to succeed. So far, the modem stack is usually proprietary (with hardware kill switches in the most paranoid phones), but it only takes a small group of Linux enthusiasts to actually catch the phone network in the act. Of course, the trouble is that you'll need to be the target of government surveillance to be even at risk of any of this. If you're not a criminal or a human rights activist, the government is probably not pointing its secret spying equipment at you, and whatever criminal enterprise hacked its way into the carrier network won't either. If you are being tracked by either of those, I think developing open source modem firmware is probably the least of your concerns. I honestly wouldn't be surprised if the standard was written to make this kind of surveillance possible and that any modem refusing to cooperate would be spec incompliant. You can read most of the 3GPP spec for free on sites like https://portal.3gpp.org/ https://portal.3gpp.org/ but I don't have the time or interest to dig through the unreadable stream of abbreviations and industry terms to find out. It's all rather pointless anyway when 5G and to an extend 4G can geolocate you about as well as GPS can, barring reflections and such.
  - lxgr 2y ago
    Agreed – it's not really a personal concern I have (I have no illusions about the chances that none of the apps I grant location access to are selling it to the highest bidder), but I'm still curious. I can also imagine some legitimate use cases, such as pinging the location of somebody that had an accident and is possibly unable to call 911 themselves. And same here – I've read a few of the 3GPP specs, but they make legalese sound like plain English, and of course never tell the full story including actual manufacturer decisions.
    - vv_ 2y ago
      > And same here – I've read a few of the 3GPP specs, but they make legalese sound like plain English, and of course never tell the full story including actual manufacturer decisions. They are technical standards designed to ensure interoperability (though not always successfully — cough VoLTE cough) rather than exhaustive guides on how to implement features. They have been developed over a long period of time and have become quite complicated to read, especially if you are not familiar with the specific nomenclature. However, with enough time and willpower you can make sense of them quite quickly. PS. The software behind these standards is probably the most complex we have in the world. At least I am not aware of anything else that is as complicated.
  - fc417fc802 2y ago
    Also worth noting that if the carrier is cooperating then you can do better than static snapshots. Tracking signal strength of a target moving between towers will give you quite a precise historic path (within a few seconds or minutes depending on velocity).
  - autoexec 2y ago
    > If you're not a criminal or a human rights activist, the government is probably not pointing its secret spying equipment at you If there's one thing we know for certain about the US and domestic spying it's that they're targeting literally everyone. They were caught copying all internet traffic going over the AT&T backbone in the early 2000s and decades later Snowden showed us they never stopped pointing their secret spying equipment at us. The best you can hope for is that if you don't become an activist or commit enough crimes they won't pay much attention to the massive and ever-growing troves of data they have on you personally.
Nokinside 2y ago
It's common to discover IMSI-catchers in national capitals around the world. There are many interesting targets. Washington, D.C. mobile traffic is probably the most spied in the world. Especially now when it's run by technological cavemen and overly confident techbros. Israeli, Russians, Chinese, French and everyone.
- aerostable_slug 2y ago
  The Soviet/Russian station in San Francisco was heavily involved in SIGINT back in the days of microwave radio trunks and analog mobile phones, and I would imagine the Chinese have taken the throne from them today.
  - Nokinside 2y ago
    Few years back suspected Israeli IMSI-catcher was fond in DC https://www.politico.com/story/2019/09/12/israel-white-house-spying-devices-1491351 https://www.politico.com/story/2019/09/12/israel-white-house... APNewsBreak: US suspects cellphone spying devices in DC https://apnews.com/general-news-d716aac4ad744b4cae3c6b13dce12d7e https://apnews.com/general-news-d716aac4ad744b4cae3c6b13dce1...
- AStonesThrow 2y ago
  Back in the mid-80s, it was an open secret that some AMPS transmissions could be received on ordinary TV tuners which were capable up to Channel 83 or so. My father being a DXer and installer of a home-built Yagi and rotator system, I discovered this fairly easily. All he told me was to just guard the privacy of these people I was snooping on, because they were supposed to be private conversations after all. I never heard anything of substance anyway. It was one of the more boring surveillance activities of my misspent youth.
rival_elf 2y ago
> Criminal IMSI catchers are pretty much dead, This isn't true, there are major incidents related to IMSI-catchers going on globally right now. E.g. last week from Japan: https://newsonjapan.com/article/145466.php https://newsonjapan.com/article/145466.php, https://commsrisk.com/amateur-detectives-find-numerous-fake-base-stations-circling-japan/ https://commsrisk.com/amateur-detectives-find-numerous-fake-..., and mass arrests happening in Thailand related to the operation of them recently. To see news related to them, search "Fake Base Stations" or "SMS Blaster", as this is how they're commonly referred to in the media now. Other notable highlights from the last few years include: the news from Paris a few years ago where police detonated a car with an imsi-catcher in it because they thought it was a bomb, but actually the driver was being paid to send out sms spam via 2g downgrade attacks: https://commsrisk.com/paris-imsi-catcher-mistaken-for-bomb-was-actually-used-for-health-insurance-sms-phishing-scam/ https://commsrisk.com/paris-imsi-catcher-mistaken-for-bomb-w.... Also the attempt to disrupt the federal elections in the Phillippines using a kind of "SMS blaster" that takes advantage of unauthenticated emergency alert messages, so a step beyond the "classic" imsi catching attack that we haven't seen used in the wild before.
jorvi 2y ago
5G beamforming is not that accurate a proxy signal, and mmWave is phone vaporware, instead only significantly used for point-to-point connections. Line-of-sight requirements make it dead in the water for anything else.
- buckle8017 2y ago
  Verizon has actually deployed mmWave 5G fairly widely.
  - donnachangstein 2y ago
    Sprint deployed WiMAX (remember that?) fairly widely, lot of good that did them. mmWave is as dead as dead. The cellular Betamax. iPhone 16e (the everyman's iPhone) doesn't support it, and neither did the SE before it. VZW will be converting those base stations into birdhouses in 5-7 years.
    - esseph 2y ago
      That's sad for Apple, then. A poor decision on their part. Examples of Android phones that often support mmWave 5G: Samsung: Many Galaxy S and Z series models, including recent releases. Google: Pixel phones, especially the Pro models. OnePlus: Various 5G phones, including the 10 Pro, 10T, and Nord series. (etc) Apple should get their shit together.
      - adrr 2y ago
        It never worked unless you were walking on the street. Expensive too, I heard $20 per antenna. Millimeter is good for fixed antenna and delivering internet last mile to homes. Verizon bought into it millimeter while TMobile focused on mid bands, why T-Mobile is faster on average than Verizon. People use their phones indoors.
        esseph 2y ago
        Absolutely correct on all the above. T-Mobile is also using mmwave and retaining it in urban cores, but returning a lot of the spectrum. There's a LOT of spectrum work being done at the FCC right now... Or was...
PantaloonFlames 2y ago
Is this a US-centric view? Presumably crossing national borders, as noted in the article, it would be more effective to catch IMSIs. When there are lots of countries clustered together in a smaller geographical space, ie, not the USA, it might be relevant. But I don't know.
bigfatkitten 2y ago
> Criminal IMSI catchers are pretty much dead Quite the opposite. They are more popular than ever, in the form of SMS blasters. https://commsrisk.com/first-uk-arrests-of-imsi-catching-sms-blasting-smishing-fraudsters/ https://commsrisk.com/first-uk-arrests-of-imsi-catching-sms-...
vv_ 2y ago
> Furthermore, depending on how willing the firmware of your modem is, the signal used to transfer GPS coordinates to the carrier for emergency response situations can also be triggered remotely by carrier hardware. It should be feasible for an operator to issue a command to the (e)UICC (SIM) in the phone to fetch the current location from the modem and send it back via SMS. At least this was the case for a relatively long time. Not that it _really_ matters because most people willfully give away their location information to Google anyways. There's a reason why Google has the best Wi-Fi AP -> Location database that they provide commercially. Send them a list of Wi-Fi BSSID's and their associated RSSI's and you'll get a fairly accurate location. In comparison, using Cell ID's for geolocationing is finicky. In dense urban environments, you're likely looking at ~500 m radius of accuracy - at least based on the commercially available options.
- vv_ 2y ago
  For "Lawful Interception" you might want to read: https://www.etsi.org/deliver/etsi_ts/133100_133199/133106/14.00.00_60/ts_133106v140000p.pdf https://www.etsi.org/deliver/etsi_ts/133100_133199/133106/14... https://www.etsi.org/deliver/etsi_ts/101600_101699/101671/02.15.01_60/ts_101671v021501p.pdf https://www.etsi.org/deliver/etsi_ts/101600_101699/101671/02...
- dfc 2y ago
  What command command can you send to the UICC to get the location? I did not think any phones honored those requests from the SIM.
- trod1234 2y ago
  The reason Google has the best Wi-Fi AP location database is because they knowingly violated wiretapping laws, when they rolled out Streetview, and they were only fined a cool 13 million for it. https://epic.org/documents/investigations-of-google-street-view/ https://epic.org/documents/investigations-of-google-street-v... They were ordered to destroy any data related to the collection from Streetview, and they did it seems, but they may not have deleted any of the data that had already been copied/integrated to other separate services like GiS, where they may have simply just moved that wiretapping to the edge devices to facilitate geo-location similar to how Apple uses Wi-Fi points as landmarks as a plausible (we aren't wiretapping), while still physically mapping based on radio signal, and also indirectly on calls through AI. https://www.courthousenews.com/google-must-face-claims-of-ai-powered-wiretapping-california-judge-rules/ https://www.courthousenews.com/google-must-face-claims-of-ai... The only learned lesson they had seemed to be that you don't make a public-facing API that allows searches of locations based on BSSID, or MAC address to the general public (which is what they had for Streetview).
wkat4242 2y ago
mmWave is used almost nowhere though. Here in Europe phone manufacturers don't even bother including the antennas anymore.

lxgr 2y ago

> depending on how willing the firmware of your modem is, the signal used to transfer GPS coordinates to the carrier for emergency response situations can also be triggered remotely by carrier hardware Do you know if (at least some) basebands actually limit network-side location requests to emergency call/text situations only?

jeroenhd 2y ago
All I know is that some don't. I don't know brands or if there are even common modems that are filtering for this. If you don't have a Faraday cage and cell site equipment, you're going to have a hard time verifying any of this. The modem is closed source, the SIM card is closed source, and various firmware blobs to make phones work are all closed source. I believe Qualcomm has debug interfaces on some chipsets, which might catch these messages, but verifying that they catch all use cases is impossible unless you have knowledge of the actual mechanism used (or usable) to activate the modem. This is one of the reasons I'm hoping for the open source phone community to succeed. So far, the modem stack is usually proprietary (with hardware kill switches in the most paranoid phones), but it only takes a small group of Linux enthusiasts to actually catch the phone network in the act. Of course, the trouble is that you'll need to be the target of government surveillance to be even at risk of any of this. If you're not a criminal or a human rights activist, the government is probably not pointing its secret spying equipment at you, and whatever criminal enterprise hacked its way into the carrier network won't either. If you are being tracked by either of those, I think developing open source modem firmware is probably the least of your concerns. I honestly wouldn't be surprised if the standard was written to make this kind of surveillance possible and that any modem refusing to cooperate would be spec incompliant. You can read most of the 3GPP spec for free on sites like https://portal.3gpp.org/ https://portal.3gpp.org/ but I don't have the time or interest to dig through the unreadable stream of abbreviations and industry terms to find out. It's all rather pointless anyway when 5G and to an extend 4G can geolocate you about as well as GPS can, barring reflections and such.
- lxgr 2y ago
  Agreed – it's not really a personal concern I have (I have no illusions about the chances that none of the apps I grant location access to are selling it to the highest bidder), but I'm still curious. I can also imagine some legitimate use cases, such as pinging the location of somebody that had an accident and is possibly unable to call 911 themselves. And same here – I've read a few of the 3GPP specs, but they make legalese sound like plain English, and of course never tell the full story including actual manufacturer decisions.
  - vv_ 2y ago
    > And same here – I've read a few of the 3GPP specs, but they make legalese sound like plain English, and of course never tell the full story including actual manufacturer decisions. They are technical standards designed to ensure interoperability (though not always successfully — cough VoLTE cough) rather than exhaustive guides on how to implement features. They have been developed over a long period of time and have become quite complicated to read, especially if you are not familiar with the specific nomenclature. However, with enough time and willpower you can make sense of them quite quickly. PS. The software behind these standards is probably the most complex we have in the world. At least I am not aware of anything else that is as complicated.
- fc417fc802 2y ago
  Also worth noting that if the carrier is cooperating then you can do better than static snapshots. Tracking signal strength of a target moving between towers will give you quite a precise historic path (within a few seconds or minutes depending on velocity).
- autoexec 2y ago
  > If you're not a criminal or a human rights activist, the government is probably not pointing its secret spying equipment at you If there's one thing we know for certain about the US and domestic spying it's that they're targeting literally everyone. They were caught copying all internet traffic going over the AT&T backbone in the early 2000s and decades later Snowden showed us they never stopped pointing their secret spying equipment at us. The best you can hope for is that if you don't become an activist or commit enough crimes they won't pay much attention to the massive and ever-growing troves of data they have on you personally.

Nokinside 2y ago

It's common to discover IMSI-catchers in national capitals around the world. There are many interesting targets. Washington, D.C. mobile traffic is probably the most spied in the world. Especially now when it's run by technological cavemen and overly confident techbros. Israeli, Russians, Chinese, French and everyone.

aerostable_slug 2y ago
The Soviet/Russian station in San Francisco was heavily involved in SIGINT back in the days of microwave radio trunks and analog mobile phones, and I would imagine the Chinese have taken the throne from them today.
- Nokinside 2y ago
  Few years back suspected Israeli IMSI-catcher was fond in DC https://www.politico.com/story/2019/09/12/israel-white-house-spying-devices-1491351 https://www.politico.com/story/2019/09/12/israel-white-house... APNewsBreak: US suspects cellphone spying devices in DC https://apnews.com/general-news-d716aac4ad744b4cae3c6b13dce12d7e https://apnews.com/general-news-d716aac4ad744b4cae3c6b13dce1...
AStonesThrow 2y ago
Back in the mid-80s, it was an open secret that some AMPS transmissions could be received on ordinary TV tuners which were capable up to Channel 83 or so. My father being a DXer and installer of a home-built Yagi and rotator system, I discovered this fairly easily. All he told me was to just guard the privacy of these people I was snooping on, because they were supposed to be private conversations after all. I never heard anything of substance anyway. It was one of the more boring surveillance activities of my misspent youth.

rival_elf 2y ago

> Criminal IMSI catchers are pretty much dead, This isn't true, there are major incidents related to IMSI-catchers going on globally right now. E.g. last week from Japan: https://newsonjapan.com/article/145466.php https://newsonjapan.com/article/145466.php, https://commsrisk.com/amateur-detectives-find-numerous-fake-base-stations-circling-japan/ https://commsrisk.com/amateur-detectives-find-numerous-fake-..., and mass arrests happening in Thailand related to the operation of them recently. To see news related to them, search "Fake Base Stations" or "SMS Blaster", as this is how they're commonly referred to in the media now. Other notable highlights from the last few years include: the news from Paris a few years ago where police detonated a car with an imsi-catcher in it because they thought it was a bomb, but actually the driver was being paid to send out sms spam via 2g downgrade attacks: https://commsrisk.com/paris-imsi-catcher-mistaken-for-bomb-was-actually-used-for-health-insurance-sms-phishing-scam/ https://commsrisk.com/paris-imsi-catcher-mistaken-for-bomb-w.... Also the attempt to disrupt the federal elections in the Phillippines using a kind of "SMS blaster" that takes advantage of unauthenticated emergency alert messages, so a step beyond the "classic" imsi catching attack that we haven't seen used in the wild before.

jorvi 2y ago

5G beamforming is not that accurate a proxy signal, and mmWave is phone vaporware, instead only significantly used for point-to-point connections. Line-of-sight requirements make it dead in the water for anything else.

buckle8017 2y ago
Verizon has actually deployed mmWave 5G fairly widely.
- donnachangstein 2y ago
  Sprint deployed WiMAX (remember that?) fairly widely, lot of good that did them. mmWave is as dead as dead. The cellular Betamax. iPhone 16e (the everyman's iPhone) doesn't support it, and neither did the SE before it. VZW will be converting those base stations into birdhouses in 5-7 years.
  - esseph 2y ago
    That's sad for Apple, then. A poor decision on their part. Examples of Android phones that often support mmWave 5G: Samsung: Many Galaxy S and Z series models, including recent releases. Google: Pixel phones, especially the Pro models. OnePlus: Various 5G phones, including the 10 Pro, 10T, and Nord series. (etc) Apple should get their shit together.
    - adrr 2y ago
      It never worked unless you were walking on the street. Expensive too, I heard $20 per antenna. Millimeter is good for fixed antenna and delivering internet last mile to homes. Verizon bought into it millimeter while TMobile focused on mid bands, why T-Mobile is faster on average than Verizon. People use their phones indoors.
      - esseph 2y ago
        Absolutely correct on all the above. T-Mobile is also using mmwave and retaining it in urban cores, but returning a lot of the spectrum. There's a LOT of spectrum work being done at the FCC right now... Or was...

PantaloonFlames 2y ago

Is this a US-centric view? Presumably crossing national borders, as noted in the article, it would be more effective to catch IMSIs. When there are lots of countries clustered together in a smaller geographical space, ie, not the USA, it might be relevant. But I don't know.

bigfatkitten 2y ago

> Criminal IMSI catchers are pretty much dead Quite the opposite. They are more popular than ever, in the form of SMS blasters. https://commsrisk.com/first-uk-arrests-of-imsi-catching-sms-blasting-smishing-fraudsters/ https://commsrisk.com/first-uk-arrests-of-imsi-catching-sms-...

vv_ 2y ago

> Furthermore, depending on how willing the firmware of your modem is, the signal used to transfer GPS coordinates to the carrier for emergency response situations can also be triggered remotely by carrier hardware. It should be feasible for an operator to issue a command to the (e)UICC (SIM) in the phone to fetch the current location from the modem and send it back via SMS. At least this was the case for a relatively long time. Not that it _really_ matters because most people willfully give away their location information to Google anyways. There's a reason why Google has the best Wi-Fi AP -> Location database that they provide commercially. Send them a list of Wi-Fi BSSID's and their associated RSSI's and you'll get a fairly accurate location. In comparison, using Cell ID's for geolocationing is finicky. In dense urban environments, you're likely looking at ~500 m radius of accuracy - at least based on the commercially available options.

vv_ 2y ago
For "Lawful Interception" you might want to read: https://www.etsi.org/deliver/etsi_ts/133100_133199/133106/14.00.00_60/ts_133106v140000p.pdf https://www.etsi.org/deliver/etsi_ts/133100_133199/133106/14... https://www.etsi.org/deliver/etsi_ts/101600_101699/101671/02.15.01_60/ts_101671v021501p.pdf https://www.etsi.org/deliver/etsi_ts/101600_101699/101671/02...
dfc 2y ago
What command command can you send to the UICC to get the location? I did not think any phones honored those requests from the SIM.
trod1234 2y ago
The reason Google has the best Wi-Fi AP location database is because they knowingly violated wiretapping laws, when they rolled out Streetview, and they were only fined a cool 13 million for it. https://epic.org/documents/investigations-of-google-street-view/ https://epic.org/documents/investigations-of-google-street-v... They were ordered to destroy any data related to the collection from Streetview, and they did it seems, but they may not have deleted any of the data that had already been copied/integrated to other separate services like GiS, where they may have simply just moved that wiretapping to the edge devices to facilitate geo-location similar to how Apple uses Wi-Fi points as landmarks as a plausible (we aren't wiretapping), while still physically mapping based on radio signal, and also indirectly on calls through AI. https://www.courthousenews.com/google-must-face-claims-of-ai-powered-wiretapping-california-judge-rules/ https://www.courthousenews.com/google-must-face-claims-of-ai... The only learned lesson they had seemed to be that you don't make a public-facing API that allows searches of locations based on BSSID, or MAC address to the general public (which is what they had for Streetview).

wkat4242 2y ago

mmWave is used almost nowhere though. Here in Europe phone manufacturers don't even bother including the antennas anymore.