3 ms·

This made me wonder whether it would be possible to build a Wi-Fi-only, roaming-only carrier for computers. Your carrier is already capable of redirecting your

This made me wonder whether it would be possible to build a Wi-Fi-only, roaming-only carrier for computers. Your carrier is already capable of redirecting your SMS messages to other carriers, that's what they do when you're abroad and roaming with a foreign operator. You could make a fake carrier that speaks the right protocols on the roaming side, but communicates with the customer over the internet (using an API or a proprietary app) instead of LTE or GSM. This would essentially work like an SS7 redirection attack, but with the full knowledge and consent of the "victim." You could alleviate the security impact here by requiring SIM card authentication, just like a normal carrier does, which could be performed through the internet and an USB reader just fine. Carriers would probably hate this and might not be willing to sign roaming agreements with such a company. I wonder whether a gray-hat route would be possible here, especially if the company was outside US jurisdiction.

immibis 1y ago
> Carriers would probably hate this and might not be willing to sign roaming agreements with such a company. This is THE problem with your idea. Congress would have to pass a law forcing them to do it, or they won't. You'd probably have more luck physically keeping someone's SIM card, keeping it installed in a phone, and watching for new texts. Perhaps you could make a box that simulates 10 phones at once.
- miki123211 1y ago
  > congress would have to pass a law forcing them to do it Well, I'm not so sure about that. SS7 redirection attacks exist, so clearly shenanigans like these are very hard to stop for carriers. The question here is whether such "attacks" are legal if performed with the consent of the customer, but against the wishes of their carrier. One could also do some "legal optimization" here, and ally themselves with a major carrier outside the US. There are plenty of those, and all of them have access to the networks (SS7 and IPX) on which roaming happens.
  - immibis 1y ago
    "SS7 redirection attacks" means, more concretely, "hacking into some phone company that's connected to the one you want to redirect, and using that system to send false data to the one you want to redirect". It's BGP hijacking but for the phone system. If Comcast is connected to Verizon, and I want to hack your connection to Google, and you're on Verizon, one of my options is to hack Comcast and have Comcast tell Verizon that Comcast has a really fast connection to Google. It might let me intercept your traffic if circumstances are good; it's also fraudulent and illegal through and through. If caught, I will go straight to federal prison. (Of course the analogy isn't 100%. The set of things you can do by hacking one side of a SS7 link is not identical to the set of things you can do by hacking one side of a BGP link - in particular, there's no BGP roaming. But it's a similar principle.)
Marsymars 1y ago
> This made me wonder whether it would be possible to build a Wi-Fi-only, roaming-only carrier for computers. This has been essentially been tried multiple times, e.g. by FreedomPop and Republic Wireless.

immibis 1y ago

> Carriers would probably hate this and might not be willing to sign roaming agreements with such a company. This is THE problem with your idea. Congress would have to pass a law forcing them to do it, or they won't. You'd probably have more luck physically keeping someone's SIM card, keeping it installed in a phone, and watching for new texts. Perhaps you could make a box that simulates 10 phones at once.

miki123211 1y ago
> congress would have to pass a law forcing them to do it Well, I'm not so sure about that. SS7 redirection attacks exist, so clearly shenanigans like these are very hard to stop for carriers. The question here is whether such "attacks" are legal if performed with the consent of the customer, but against the wishes of their carrier. One could also do some "legal optimization" here, and ally themselves with a major carrier outside the US. There are plenty of those, and all of them have access to the networks (SS7 and IPX) on which roaming happens.
- immibis 1y ago
  "SS7 redirection attacks" means, more concretely, "hacking into some phone company that's connected to the one you want to redirect, and using that system to send false data to the one you want to redirect". It's BGP hijacking but for the phone system. If Comcast is connected to Verizon, and I want to hack your connection to Google, and you're on Verizon, one of my options is to hack Comcast and have Comcast tell Verizon that Comcast has a really fast connection to Google. It might let me intercept your traffic if circumstances are good; it's also fraudulent and illegal through and through. If caught, I will go straight to federal prison. (Of course the analogy isn't 100%. The set of things you can do by hacking one side of a SS7 link is not identical to the set of things you can do by hacking one side of a BGP link - in particular, there's no BGP roaming. But it's a similar principle.)

Marsymars 1y ago

> This made me wonder whether it would be possible to build a Wi-Fi-only, roaming-only carrier for computers. This has been essentially been tried multiple times, e.g. by FreedomPop and Republic Wireless.