10 ms·
ICE is using fake cell towers to spy on people's phones
- josefresco 1y agoAdditional context: https://san.com/cc/exclusive-evidence-of-cell-phone-surveillance-detected-at-anti-ice-protest/ https://san.com/cc/exclusive-evidence-of-cell-phone-surveill... >At 8:58 a.m., just before the protest began, SAN began monitoring eight LTE bands present in the area and found no anomalous behavior. At 9:06 a.m., however, a burst of 57 IMSI-exposing commands was detected. >Other bursts, present on four of the LTE frequency bands, appeared roughly every 10 minutes over the next hour, causing Marlin to issue numerous real-time alerts. A post-scan analysis confirmed the detection of 574 IMSI-exposing messages. >It also flagged two “attach reject” messages, a type of cellular rejection sent when a cell phone tries to connect to a network. Attach rejects can occur for valid reasons, such as when a phone with an expired SIM card tries to connect to a network but such messages are rare on properly configured networks. IMSI catchers may use attach reject messages to block or downgrade connections and obtain an IMSI before it is encrypted. SAN observed the two suspicious messages at 9:55 a.m. and 10:04 a.m. at the height of the protest but did not encounter others before or after the demonstration ended. >SAN conducted a follow-up scan during the same time period, the following day, when no protesters were present. Unlike the day prior, Marlin did not issue real-time alerts.
- perihelions 1y agoI.e. the inference is that ICE is unconstitutionally tracking and assembling lists of protestors exercising their First Amendment rights. > "A post-scan analysis confirmed the detection of 574 IMSI-exposing messages." That's roughly 574 unique protestors, give or take. Full-on autocratic tyranny—this is also what Putin's oligarchs did to Ukranians at the Maidan Protests, in Kyiv in 2014. Used IMSI-catchers to assemble lists of everyone present, and intimidate them. https://slate.com/technology/2014/01/ukraine-texting-euromaidan-protesters-kiev-demonstrators-receive-threats.html https://slate.com/technology/2014/01/ukraine-texting-euromai... ("How Did Ukraine’s Government Text Threats to Kiev’s EuroMaidan Protesters?" (2014)).
- MiiMe19 1y ago[flagged]
- perihelions 1y agoThe article I'm replying to is the parent comment's "Exclusive: Evidence of cell phone surveillance detected at anti-ICE protest"; not the HN OP.
- exe34 1y ago"Earlier this year, new media publication Straight Arrow News said it had analysed “mobile network anomalies” around a Washington state protest against ICE raids that were consistent with Stingray use."
- tiahura 1y agoHow do you know there wasn’t a warrant?
- perihelions 1y agoIt'd be flatly unconstitutional to approve a dragnet warrant targeting a protest.
- tiahura 1y agoIn a recently-unsealed search warrant reviewed by Forbes, ICE used such a cell-site simulator in an attempt to track down an individual in Orem, Utah. Maybe you missed it when you read the article?
- perihelions 1y agoThe article[0] I'm replying to is about a political protest in Tukwila, Washington. [0] https://san.com/cc/exclusive-evidence-of-cell-phone-surveillance-detected-at-anti-ice-protest/ https://san.com/cc/exclusive-evidence-of-cell-phone-surveill...
- noselasd 1y agoThose Attach Rejects should have a cause value, possibly telling a bit more on the reject reason. I see those quite frequently, the bulk of them are phones trying to roam in a network they're not allowed to though, and some cause the cell is a bit overloaded, some cause the phone sends a wrong tracking area - not sure that's a phone bug or a common scenario where the phone retains an old tracking area, then it tries to connect to the same tracking area - then the phone discovers it's is now in a different tracking area, and after being rejected, it connects with the correct one.
- 542354234235 1y agoTrue but they happen because of individual phones. If you have bursts of those across dozens of devices, that indicates it is on the network side. Also, cell tower handoffs usually don't require Attach Rejects and are generally normal routine operations.
- notherhack 1y agoSAN doesn't say where the unusual tower traffic originated. Does the Marlin system attempt to geolocate and identify the suspicious transmitters? Could the regular mobile tower operators collect subscriber identities at will via their regular gear, with no stingray vans or warrants required, and save the information for later? That seems to be how it's done with the other subscriber location and communication contents that they collect.
- JumpCrisscross 1y agoThe article describes a search conducted with a warrant. Given the brazen criminality ICE agents are acting with, I’d like to see evidence of malpractice before risking diluting the message.
- boston_clone 1y agoEdited to redact; response was referencing a different article.
- GuinansEyebrows 1y agonot sure if they just edited it very quickly or what, but that sentence no longer appears in the article.
- abirch 1y agoAre you quoting from the Forbes article listed above? "In a recently-unsealed search warrant reviewed by Forbes, ICE used such a cell-site simulator in an attempt to track down an individual in Orem, Utah. The suspect had been ordered to leave the U.S. in 2023, but is believed to still be in the country. Investigators learned last month that before going to Utah, he’d escaped prison in Venezuela where he was serving a sentence for murder, according to the warrant. He’s also suspected of being linked to gang activity in the country, investigators said. When the government got the target’s number, they first got a warrant to get its location. However, the trace wasn’t precise–it only told law enforcement that the target was somewhere in an area covering about 30 blocks. That led them to asking a court for a Stingray-type device to get an accurate location. The warrant was issued at the end of last month and it’s not yet known if the fugitive was found."
- boston_clone 1y agoMy mistake - wrong article ! https://san.com/cc/exclusive-evidence-of-cell-phone-surveillance-detected-at-anti-ice-protest/ https://san.com/cc/exclusive-evidence-of-cell-phone-surveill...
- 1y ago
- boston_clone 1y agoCould folks share more accessible methods for developing counter-Stingray type activities described in this paper, or rather, which ones they themselves have used with varying degrees of success? https://www.cise.ufl.edu/~butler/pubs/ndss25-tucker-marlin.pdf https://www.cise.ufl.edu/~butler/pubs/ndss25-tucker-marlin.p... Ideally, this is something I could hack together in the next few days since ICE is prepping to invade my city.
- therobots927 1y agoI can't help you, I'm just here to thank you for your service.
- allseeingimei 1y agoburner phones and sunglasses are probably easier
- therobots927 1y agoMy understanding of the linked paper is that it details methods of detecting stingrays. Not jamming them...
- boston_clone 1y agoI could've been more clear :) don't think I could engage in prevention without violating some FCC laws. But in general, yes - prevention > detection > awareness > ignorance.
- deleted 1y ago[deleted]
- nisegami 1y ago'no phone' is the only safe option
- 1y ago
- CommanderData 1y agoWasn't this thought impossible with LTE, I thought older bands were only susceptible to this attack.
- betaby 1y ago5G standalone is not transmitting IMEI in plain text ever to my knowledge.
- boston_clone 1y agoisn't this then ripe for a downgrade attack?
- NoiseBert69 1y agoTo LTE? Doesn't work there either. There are IMSI catchers - but they all require GSM. At least on Google Pixels you can turn off 2G with a switch. The phone even shows a message about its insecurity. In Germany I'm running 100% on LTE/5GNR-only for many months now without having a single coverage gap.
- boston_clone 1y agothank you for the explainer; I do need to research for a more complete understanding of this space. looks like iPhones will need to enable Lockdown Mode to disable 2G, at least for iOS 17+ per https://ssd.eff.org/module/attending-protest https://ssd.eff.org/module/attending-protest
- jeroenhd 1y agoClassic 2G stingrays are a lot less complicated, but attempts to secure the IMSI haven't properly been implemented until 5G came around. Even then, the IMSI has been replaced with encryption and temporary identifiers your carrier knows belongs to you, and if law enforcement comes in with a warrant they can get those replacement identifiers from your carrier regardless. You can't get the IMSIs passively anymore, but LTE doesn't make these attacks impossible, just less practical, especially for criminals that don't have warrants on their side.
- allseeingimei 1y agoEvery bus stop and billboard with a CBS logo on it is doing the same thing and has been for a long time. They map your movements by presenting as a cell tower and record the IMEIs of passers by. Forbes won't write a story about that though.
- deleted 1y ago[deleted]
- afavour 1y agoAny citation for that? You seem to have created your account specifically to comment here so I have to assume you're well informed on the topic.
- NoiseBert69 1y agoThat's not how cellular networks work. Your IMEI will never be send in clear over the network. Not even back in old 2G networks. If the gov needs your data they can use standardized lawful interception interfaces. This interface offers all juicy data - not only voice, SMS and your phone number.
- octoberfranklin 1y agoYou're confusing IMEI and IMSI.
- ProllyInfamous 1y agoLots of retail does this with Bluetooth™ beacons (whether just at entry/exits, or at high-trafficked areas). Which is another reason I simply just stopped carrying a cell phone a few years ago. Absolute freedom. ---- I paid my vehicle off early just so I could disable the infotainment's cell-link. My city has OCR cameras on every 4-lane highway (so I'm still tracked) but it sure is wild how important locations are these days.
- xrd 1y agoIt would be amazing if an authoritarian government like that in Venezuela could just "facilitate" (such a funny word these days) getting a single convicted murderer into the US and then turn the US into the same kind of authoritarian government. Whoops, I hope no other country in conflict with the US gets this idea, that pool has expanded significantly lately! I recall reading about the people who slammed planes into the World Trade Center towers. They were not hell bent on destroying buildings, they were hell bent on destroying society of the US, destroying buildings was just a stepping stone. And, sure seems like they succeeded.
- deleted 1y ago[deleted]
- _9ptr 1y agoThat's why the orange man is protecting the border
- xrd 1y agoI just can't wrap my head around why spending $500M to paint the wall is protecting me from a Venezuelan murderer. Do Venezuelan murderers see them like colorful poisonous dart frogs and avoid them somehow? https://factually.co/fact-checks/politics/border-wall-paint-cost-b308b9 https://factually.co/fact-checks/politics/border-wall-paint-...
- vkou 1y agoThey don't, which is why racial profiling is back on the menu. Citizens on the streets don't need to show their papers to ICE, but that's been worked around by yesterday's SCOTUS. Being brown at Home Depot is now sufficient cause to get arrested by ICE.
- brownppllovet 1y ago[flagged]
- 1y ago
- ActorNightly 1y ago"small government"
- zOneLetter 1y agoHow would one go about detecting the IMSI commands? Would an advanced radio receiver be able to see these? I know pretty much nothing about SIGINT but been contemplating spending some time learning about it.
- yencabulator 1y agohttps://github.com/EFForg/rayhunter/ https://github.com/EFForg/rayhunter/
- notherhack 1y ago" So far Rayhunter has not turned up any evidence of cell-site simulators being used to spy on protests in the US — though we have found them in use elsewhere. ... But we’ve received reports from a lot of protests, including pro-Palestine protests, protests in Washington DC and Los Angeles, as well as the ‘No Kings’ and ‘50501’ protests all over the country. So far, we haven’t seen evidence of CSS use at any of them. "
- yencabulator 1y agoSounds like that's now stale information: https://news.ycombinator.com/item?id=45184758 https://news.ycombinator.com/item?id=45184758
- aduffy 1y agoJust wanted to advertise that the EFF recently released an open source tool for detecting cell-site simulators. The hardware is like $20 and it's pretty easy to setup yourself. Worth having around to stay aware of what's out there, especially if you live in one of the places recently targeted by the administration. https://github.com/EFForg/rayhunter/ https://github.com/EFForg/rayhunter/
- jimt1234 1y agoI watched the presentation on Rayhunter at Defcon. Amazing stuff. Major kudos to the team.
- boston_clone 1y agoexactly what I'm looking for - much appreciated!!!
- perihelions 1y agoI wouldn't put it past the US to coerce Microsoft into injecting malicious payloads into these types of projects. EFF is putting complete trust in Microsoft's infrastructure: there's no out-of-band verification not served up by Microsoft itself (is there? It's just GitHub.com's TLS, and in-band SHA-1 hashes stored in the repo itself, which Microsoft controls; it can serve whatever bytes it wants, or different bytes on different requests...) Microsoft has billions of dollars in US intelligence-cloud contracts and should leap at a chance to get an edge in on those. They've done things like this before; they provided incredible (and illegal!) cooperation with the NSA back at the time of the Snowden Leaks[0]. [0] https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-... ("Microsoft handed the NSA access to encrypted messages" (2013))
- throw0101d 1y ago> I wouldn't put it past the US to coerce Microsoft into injecting malicious payloads into these types of projects. EFF is putting complete trust in Microsoft's infrastructure: there's no out-of-band verification not served up by Microsoft itself Isn't a git commit trail basically a Merkle tree of checksums? If any developer tried to do a pull or fetch they'd suddenly get a bunch of strange commit messages, wouldn't they? Also: code signing is / can become a thing.
- trump4eva 1y ago[dead]
- knodi 1y ago[flagged]
- petcat 1y agoEhh I don't know. They were granted two separate warrants by a judge to use the technology to track down and deport an escaped murderer from Venezuela. I really just don't feel strongly enough about this to care. This is quite a bit more restrained than what the CCP does. But hyperbole, I guess.
- harimau777 1y agoSure, but was it a Trump judge? If so, then it doesn't mean much.
- M3L0NM4N 1y agoIt's still highly targeted, not sweeping surveillance.
- chasd00 1y agoi'm kind of surprised it showed up at all let alone on HN. Search warrants and wiretaps are granted and executed all day every day. Now catching ICE setting up one of these with no warrant would be newsworthy but that pretty much guarantees whatever case they're building gets thrown out the window and worse.
- xp84 1y ago> ICE used such a cell-site simulator in an attempt to track down an individual in Orem, Utah. The suspect had been ordered to leave the U.S. in 2023, but is believed to still be in the country. Investigators learned last month that before going to Utah, he’d escaped prison in Venezuela where he was serving a sentence for murder, according to the warrant. He’s also suspected of being linked to gang activity in the country, investigators said. Sounds like a real cool guy. Wiretaps have always been a tool in law enforcement's hands, and if it's subject to a warrant, which the article goes on to say it was, I am completely fine with this. If the ability to tap phone conversations 75 years ago didn't cause us to descend into fascism, I don't automatically think this is scary.
- whatsupdog 1y agoI'm tired of people protecting these murderous criminals who don't give two sh*s about any laws. This lack of empathy (for the victims of these criminals) is appalling.
- JohnMakin 1y agoThe thing that annoys me most about such thoughts is not the callousness - it’s the extremely short sighted opinion that the same tactics won’t eventually be used on them, or people they care about. It never even occurs to them that can happen until it does. Erosion of anyone’s rights is an erosion of everyone’s rights.
- bloomingeek 1y agoAbsolutely, we older types used to argue with the term, "slippery slope". ICE is a classic slippery slope that will most likely be used, eventually, against all of us if the current administration isn't stopped breaking the law.
- xp84 1y ago[flagged]
- tolerance 1y agoAm I wrong for suspecting that the policy that colors the current Administration’s tyranny has its roots in those prior (Bush II, Obama)? Were we not warned of the possible consequences when less sensational or consenting news broke back then?
- bloomingeek 1y agoAbsolutely, we were warned. No one heeded and then came the destruction of the Republican party by the likes of Rush, Newt and Rove who convinced the voting public everyone is evil who doesn't agree with them. Centrist and left leaning voters hoped it would just run it's course and go away, then evangelicals signed up with the Republicans and here we are.
- tolerance 1y agoRight, I’ve heard this story before. But what are we attributing to whom we’d otherwise label incompetent or malicious from among the center and left, from among the electorate and the elected? Or, what absolves them from not being held accountable for not taking heed to these warnings, being passive?
- Terr_ 1y agoThey aren't absolved, but it's pretty normal to put more blame and attention on willful criminals as opposed to neglectful bystanders.
- anecdatas 1y agoThe left was a Cassandra the whole time -- it's been nothing but warnings from the left. The Democrats (note: the Dems are not a left party) refused to listen, assuring everyone it was fine, that we just needed to return to norms and decorum. If we just elected the most proper guy, if we just went a little more rightwards in our policies, all this would be fine. Meanwhile, the left out there pointing at Obama's extrajudicial killings, Bush's whole post 9/11 fiasco, Clinton's "Superpredators" nonsense, etc. etc. and making tons of noise about how this was all going to end. Turns out, the left was right, the Dems were wrong. But the Dems are still fighting to try and shut down the left. Look at how hard the Dem establishment hates Mamdani.
- hk1337 1y agoThis seems like it would be more useful as an Android app you can side load rather than a rust app. If I am understanding correctly, I would need a mobile device? Would this work using the phone as a hotspot? If so, then I guess my previous comment is moot.
- lrvick 1y agoIf your cell phone is connected to cell towers, almost anyone can buy your location. Only option is stay in airplane mode and use wifi.
- pizzly 1y agoHello WiFi Geolocation technologies. https://en.wikipedia.org/wiki/Wi-Fi_positioning_system https://en.wikipedia.org/wiki/Wi-Fi_positioning_system
- kyle_martin1 1y ago[dead]
- notherhack 1y agoThe Forbes article says ICE acquired mobile cellular surveillance equipment and services under the Biden administration, and there have been IMSI catchers detected at demonstrations for a long time, for example at the Dakota Access Pipeline demonstrations in November, 2016[1]. It's not a new thing. [1] https://www.justsecurity.org/34449/investigating-surveillance-standing-rock https://www.justsecurity.org/34449/investigating-surveillanc...
- coderatlarge 1y agoisn’t this essentially a warrantless search of any bystander who happens to connect to the tower? basically random, digital stop-and-frisk?
- EchoReflection 1y ago"In a recently-unsealed search warrant reviewed by Forbes, ICE used such a cell-site simulator in an attempt to track down an individual in Orem, Utah. The suspect had been ordered to leave the U.S. in 2023, but is believed to still be in the country. Investigators learned last month that before going to Utah, he’d escaped prison in Venezuela where he was serving a sentence for murder, according to the warrant. He’s also suspected of being linked to gang activity in the country, investigators said." slippery slope, I know...
- daft_pink 1y agoReally wish Apple would allow us to lock our phones to 5g standalone so we can choose to make fake cell towers a thing of the past. Update: I quickly searched this to see if it was available on the latest version of iOS and you can mostly use it on T-mobile USA with ios 17+. As they have enable support for 5g SA nationwide. if your SIM card has enabled 5G SA provisioning and if you set the iPhone to 5G On, it will not fall back in any area that has good T-mobile reception meaning they would have to turn off T-mobiles towers or you to be in a deadspot for the IMSI catcher to work. If you enter field test mode you can confirm that you are provisioned for NR SA in area that T-mobile has it’s own good towers with good reception. If it shows up you are provisioned. If not you can call t-mobile and ask that they provision it but many newer sims are provisioned with 5g SA by default and you can use 5G On setting instead of auto to only be vulnerable to downgrade attacks in weak signal areas and deadzones. I’m not an expert on this so if I’m wrong please comment.
- nobodywillobsrv 1y agoWhat is the baseline spying by ALL agencies? For non experts this would be useful to know. Just heard something suggesting most comms are fully infiltrated anyway for certain foreign actors but have no idea how to validate those claims myself.