4 ms·

Since you seem to know about the subject, how are these not immediately found and shut down? It seems like the messages they send could be traced to the sims ph

Since you seem to know about the subject, how are these not immediately found and shut down? It seems like the messages they send could be traced to the sims physical location, and having a massive cluster of thousands of sims just sitting in an apartment also seems like an obvious giveaway. And there’s all the traceability required to rent the locations and buy the equipment. It seems like bothering with this is just asking to get caught.

jacquesm 1y ago
Well, they did get caught. But for that to happen immediately would require a detection method that can point out the presence of a farm with only a few samples. SIMs don't know their 'physical location' and triangulation of signals in these bands in the urban environment is non trivial. Whoever did this likely isn't all that happy that their carefully created infra was used to harass officials, which most likely is the single reason this operation got uncovered in the first place. If it would have just been used for low level crime who knows how long they could have continued to do this. Note that these are not unique to NYC or even to the United States, they've been found in other countries as well, the UK has now criminalized possession or operation of these (but the fines are so low that I don't think it will make much difference).
- huflungdung 1y ago
  “Triangulation is non trivial” Uh. No it isn’t. SNR between 5 or so masts gives you the exact location of any cell device. This is how $oldemployer used to track them
  - lozaning 1y ago
    What you're describing is trilateration , not triangulation
    - jandrese 1y ago
      Sure, but when you say "triangulation" people know what you're talking about.
    - Scoundreller 1y ago
      Multilateration if we want to get pedantic
- tbrownaw 1y ago
  > SIMs don't know their 'physical location' and triangulation of signals in these bands in the urban environment is non trivial. IIRC modern cell towers use cool tricks to send stuff for a particular phone to only where that phone is so they can send more total data. Can this not be turned into a precomputed map by taking a test phone everywhere and seeing what settings the tower picks to talk to it?
  - jacquesm 1y ago
    Sure, so now you are at the front door of a quad of four 300 apartment highrises. What is your next move?
    - iberator 1y ago
      With 5g and beamforming and mimo and decent bts software(Ericsson or Hua) you can pinpoint the given phone very accurately (within 20m in urban settings) - without any triangulation, as you know the cell tower sector :) Guess what: you can also measure the azimuth within 0.1 degree, so you could have SOME data at where to look. FYI: That was available back in 2022 as standard. Now it could be even better. :P
      - jacquesm 1y ago
        I've already narrowed it down to four buildings for you, so we can consider that all of those methods worked. What is your next move? I'm not saying it can't be done, clearly it can be done otherwise this article wouldn't exist. But it is not quite as easy as pointing a magic wand (aka an antenna) at a highrise and saying '14th floor, apartment on the North-West corner', though that would obviously make for good cinema.
        pavel_lishin 1y ago
        > I've already narrowed it down to four buildings for you, so we can consider that all of those methods worked. What is your next move? Subpoena the power, water & gas company, and look at apartments that have unusual power usage, coupled with almost zero water & gas usage. Especially look at apartments that don't have a spike in power usage in the morning & evening that corresponds to people having a regular commute. I'm not sure how much power this equipment draws at idle - I'm assuming it's more idle at night, no need to send scammy SMS messages at 3am Eastern - but I'd wager you could track that. Granted, it's not fast, but depending on how quickly the companies bend over backward for such a request & how good your interns are at using Excel, you might be able to get this done before sundown.
mschuster91 1y ago
> Since you seem to know about the subject, how are these not immediately found and shut down? Because - depending on cell tower coverage and the antennas installed on it - the degree of precision is far too low to be useful. In rural installations and the worst case, aka a tower with a dipole antenna on a mountaintop, at 900 MHz the coverage will be around 35 km. Segmented antennas just limit the section of the circle where the endpoints are. In suburban areas, coverage is usually 10-20 km, and urban areas it's 5km and less. Now you know which cell and cell section the user is in... but to actually pinpoint the user? That takes some more work. First, you need a few more towers that the user can reach for triangulation - the more the better - but if the operator of such a setup is even remotely clever and the hardware/firmware supports it, they will have locked the devices to only connect to a single tower (you can see a map at [1] that shows the IDs). If the operator didn't do that but the site is too remote to achieve triangulation, you might need to drive around in a van and use an IMSI catcher, aka a phone tower emulator, and hope that eventually the site's devices register at it. That, however, is a lot of awful work, and is often not legal for police authorities, only for secret services. Now you might ask yourself, what about 911, how can they locate callers precisely? The thing is... it depends. Landlines and VoIP lines are usually mapped to a specific address (which is why VoIP providers give you an explicit warning that, if you do not keep that record up to date, 911 calls will be misrouted!), so that's trivial. Mobile phone callers however, until a few years ago the degree of precision was exactly what I just described - it completely depended on celltower coverage, with the only caveat that a phone will connect to another operator if it shows a stronger signal for 911 calls. Only then, Android introduced Emergency Location Service [2] and Apple introduced Hybridized Emergency Location [3] - these work with the sensors on the phone, most notably GPS/GLONASS/Beidou, but also SSIDs of nearby WiFi APs and specific Bluetooth beacons. Downside of that is, of course, the 911 dispatch needs an integration with Apple and Google's services, users can disable it for privacy reasons, and older phones won't have anything - so in these cases, 911 dispatchers are straight out of luck and again reduced to the above range of precision. [1] https://opencellid.org/ https://opencellid.org/ [2] https://www.android.com/safety/emergency-help/emergency-location-service/ https://www.android.com/safety/emergency-help/emergency-loca... [3] https://www.apple.com/newsroom/2018/06/apple-ios-12-securely-and-automatically-shares-emergency-location-with-911/ https://www.apple.com/newsroom/2018/06/apple-ios-12-securely...
toast0 1y ago
They could probably be quickly found if someone is looking for them, but carriers don't necessarily care that much about these. Add a couple layers of indirection with MVNOs and there's a lot of meh to spread around. If the reporting around this is accurate, sounds like someone(s) was swatting through these, which brought the attention needed to find this group.

jacquesm 1y ago

Well, they did get caught. But for that to happen immediately would require a detection method that can point out the presence of a farm with only a few samples. SIMs don't know their 'physical location' and triangulation of signals in these bands in the urban environment is non trivial. Whoever did this likely isn't all that happy that their carefully created infra was used to harass officials, which most likely is the single reason this operation got uncovered in the first place. If it would have just been used for low level crime who knows how long they could have continued to do this. Note that these are not unique to NYC or even to the United States, they've been found in other countries as well, the UK has now criminalized possession or operation of these (but the fines are so low that I don't think it will make much difference).

huflungdung 1y ago
“Triangulation is non trivial” Uh. No it isn’t. SNR between 5 or so masts gives you the exact location of any cell device. This is how $oldemployer used to track them
- lozaning 1y ago
  What you're describing is trilateration , not triangulation
  - jandrese 1y ago
    Sure, but when you say "triangulation" people know what you're talking about.
  - Scoundreller 1y ago
    Multilateration if we want to get pedantic
tbrownaw 1y ago
> SIMs don't know their 'physical location' and triangulation of signals in these bands in the urban environment is non trivial. IIRC modern cell towers use cool tricks to send stuff for a particular phone to only where that phone is so they can send more total data. Can this not be turned into a precomputed map by taking a test phone everywhere and seeing what settings the tower picks to talk to it?
- jacquesm 1y ago
  Sure, so now you are at the front door of a quad of four 300 apartment highrises. What is your next move?
  - iberator 1y ago
    With 5g and beamforming and mimo and decent bts software(Ericsson or Hua) you can pinpoint the given phone very accurately (within 20m in urban settings) - without any triangulation, as you know the cell tower sector :) Guess what: you can also measure the azimuth within 0.1 degree, so you could have SOME data at where to look. FYI: That was available back in 2022 as standard. Now it could be even better. :P
    - jacquesm 1y ago
      I've already narrowed it down to four buildings for you, so we can consider that all of those methods worked. What is your next move? I'm not saying it can't be done, clearly it can be done otherwise this article wouldn't exist. But it is not quite as easy as pointing a magic wand (aka an antenna) at a highrise and saying '14th floor, apartment on the North-West corner', though that would obviously make for good cinema.
      - pavel_lishin 1y ago
        > I've already narrowed it down to four buildings for you, so we can consider that all of those methods worked. What is your next move? Subpoena the power, water & gas company, and look at apartments that have unusual power usage, coupled with almost zero water & gas usage. Especially look at apartments that don't have a spike in power usage in the morning & evening that corresponds to people having a regular commute. I'm not sure how much power this equipment draws at idle - I'm assuming it's more idle at night, no need to send scammy SMS messages at 3am Eastern - but I'd wager you could track that. Granted, it's not fast, but depending on how quickly the companies bend over backward for such a request & how good your interns are at using Excel, you might be able to get this done before sundown.

mschuster91 1y ago

> Since you seem to know about the subject, how are these not immediately found and shut down? Because - depending on cell tower coverage and the antennas installed on it - the degree of precision is far too low to be useful. In rural installations and the worst case, aka a tower with a dipole antenna on a mountaintop, at 900 MHz the coverage will be around 35 km. Segmented antennas just limit the section of the circle where the endpoints are. In suburban areas, coverage is usually 10-20 km, and urban areas it's 5km and less. Now you know which cell and cell section the user is in... but to actually pinpoint the user? That takes some more work. First, you need a few more towers that the user can reach for triangulation - the more the better - but if the operator of such a setup is even remotely clever and the hardware/firmware supports it, they will have locked the devices to only connect to a single tower (you can see a map at [1] that shows the IDs). If the operator didn't do that but the site is too remote to achieve triangulation, you might need to drive around in a van and use an IMSI catcher, aka a phone tower emulator, and hope that eventually the site's devices register at it. That, however, is a lot of awful work, and is often not legal for police authorities, only for secret services. Now you might ask yourself, what about 911, how can they locate callers precisely? The thing is... it depends. Landlines and VoIP lines are usually mapped to a specific address (which is why VoIP providers give you an explicit warning that, if you do not keep that record up to date, 911 calls will be misrouted!), so that's trivial. Mobile phone callers however, until a few years ago the degree of precision was exactly what I just described - it completely depended on celltower coverage, with the only caveat that a phone will connect to another operator if it shows a stronger signal for 911 calls. Only then, Android introduced Emergency Location Service [2] and Apple introduced Hybridized Emergency Location [3] - these work with the sensors on the phone, most notably GPS/GLONASS/Beidou, but also SSIDs of nearby WiFi APs and specific Bluetooth beacons. Downside of that is, of course, the 911 dispatch needs an integration with Apple and Google's services, users can disable it for privacy reasons, and older phones won't have anything - so in these cases, 911 dispatchers are straight out of luck and again reduced to the above range of precision. [1] https://opencellid.org/ https://opencellid.org/ [2] https://www.android.com/safety/emergency-help/emergency-location-service/ https://www.android.com/safety/emergency-help/emergency-loca... [3] https://www.apple.com/newsroom/2018/06/apple-ios-12-securely-and-automatically-shares-emergency-location-with-911/ https://www.apple.com/newsroom/2018/06/apple-ios-12-securely...

toast0 1y ago

They could probably be quickly found if someone is looking for them, but carriers don't necessarily care that much about these. Add a couple layers of indirection with MVNOs and there's a lot of meh to spread around. If the reporting around this is accurate, sounds like someone(s) was swatting through these, which brought the attention needed to find this group.