7 ms·
Three men are facing charges in Toronto SMS Blaster arrests
- nubinetwork 6mo agoThis was hugely overblown in the media... While the device operates like a stingray, they were using it to spam and phish. The whole claim of "we've never seen this type of device before in Canada" is a lie, because the government and law enforcement both use them. I guess it's okay if they do it, but nobody else can...
- panny 6mo agoA government backdoor was found and abused by criminals? No one could have predicted this! :)
- Jolter 6mo agoIt’s not exactly a back door. It’s a fake radio cell, mimicking your network provider and acting like a man in the middle. In that sense, it’s like a stingray. The differences are 1. The Stingray eavesdrops, but avoids interfering with user traffic 2. The stingray is operated by law enforcement, not by fraudsters looking to steal your money
- QuantumNomad_ 6mo agoIsn’t it less of a government backdoor and more of a result of generally old and insecure protocols still being in use for telecom? Like, the phones happily connect to these fake towers because the signal is strongest from that one and there is no authentication to verify who the tower belongs to, nor encryption of SMSes?
- Affric 6mo agoWell said but by the time mobile phone towers were built we had been tapping phone lines for a long time. Hard to not think that to an extent default insecurity for telecoms was a choice.
- sitharus 6mo agoWhen it was developed it was assumed that the cost of cellular equipment and, in some countries, the regulatory hurdles required to get authorisation to purchase radio transmitters that operate on licensed bands would make it almost impossible to do this. I worked in a company that had a base station emulator in their testing lab in 2008. I can’t recall the cost but it was well over $10,000 and only worked with direct antenna coupling, it couldn’t broadcast. Now we have software defined radios.
- Nasrudith 6mo agoDo you honestly believe that teleco companies wouldn't receive government backlash about 'the children' if they were to implement an actually secure standard?
- mc32 6mo agoYes I think they mean they hadn’t seen it used before outside of sanctioned organizations. Though one could argue some bad actors inside the org likely used it outside of official capacity though not likely with knowledge or approval by superiors.
- anigbrowl 6mo agoWouldn't it be great if public officials would say what they in fact mean the first time?
- rdevilla 6mo agoTorontonians are hardwired to be incapable of speaking like this.
- bigiain 6mo agoAnd law enforcement are trained to speak a language with sounds like english, but isn't, and which makes no sense. https://www.mcsweeneys.net/articles/an-interactive-guide-to-ambiguous-grammar https://www.mcsweeneys.net/articles/an-interactive-guide-to-... (A long-ish read, but totally worth it. the "punch line" is beautiful.)
- rdevilla 6mo agoPoetry.
- philipallstar 6mo agoSpeed and brownness were involved in a jumping‑related incident with a lazy dog and a fox.
- raverbashing 6mo agoI would say Canadians but British Columbians (yes this is the actual term) are even worse
- hluska 6mo ago
- deleted 6mo ago[deleted]
- tamimio 6mo agoTo add, ISED literally goes around in cars to scan for non registered BTS (or even non conforming ones) and report them, sometimes (or a lot of times) they catch false positives when the interference happens to be a strong LED lol. The gov uses the tech to ID individuals however, especially in group gatherings or around certain locations, always look around for big vans with no windows :), I either don’t take my phone or it’s always on airplane mode until I want to disable it briefly before activating it again.
- kevin_thibedeau 6mo ago> hugely overblown Did they graciously forward emergency calls and text messages to the real phone network?
- echelon 6mo agoHopefully nobody in the area was an oncall surgeon, engineer, etc.
- cucumber3732842 6mo agoThe fact that they didn't get busted in no time at all seems to point strongly in that direction. With the amount invested in this operation that would just be common sense.
- dnnddidiej 6mo agoMight as well start a telco at that point.
- lxgr 6mo ago“Please enter your 16 digit payment card number to be connected to an emergency operator”…
- hluska 6mo agoThe claim was that this was the first time that a device like this has been used in fraud but go ahead, misread things and become outraged. I’m sure that in this case the fraudsters properly forwarded all 911 calls so no harm, no foul hey?
- yieldcrv 6mo agoprosecutors have never seen them because the DA has never brought a case against the agencies that use them so it’s an accurate statement the government isn’t one thing, it’s people that don’t work for all agencies
- dreamlayers 6mo agoHow is this possible? Are phones willing to connect to any cell and blindly trust that text messages from there are genuine and really coming from the numbers they claim to be coming from? Isn't there some cryptographic verification?
- opengrass 6mo agoGuessing the spammer doesn't want to overload towers or be foxed within the same 3 so they're driving. Maybe the hats(?) shut off on rotation... or eSIM?
- capitalhilbilly 6mo agoThe original standards weren't expecting anyone but carriers to send messages and ramping up security has been a slow process, so downgrade attacks probably work nicely.
- mcpherrinm 6mo ago2g networks didn't have the phone verify the network, so yes they can do this. At least as of today, most phones have an option to turn off 2g but that isn't a default.
- opengrass 6mo agoPlausible. Only Rogers still has working 2G.
- Scoundreller 6mo agoAnd if you have a modern enough SIM+phone combo, it won’t even display the 2g network as an available network, nor 3G on my device. I wonder if this mostly hit international SIMs, since they wouldn’t be running the same level of SIM code to prefer various network locks like a local SIM. Helps you stay under the radar and gov services over SMS is a lot more advanced outside of Canada if you want to do some fraud.
- 6mo ago
- rafram 6mo agoWhy would someone use one of these instead of good old fashioned SMS / iMessage / email spam?
- yard2010 6mo agoRest assured the state behind this attack does it as well. Why not both?
- mcpherrinm 6mo agoThere's zero spam filtering interfering this way, and you can target your messages very precisely.
- tonyarkles 6mo agoAnd zero record of it ever happening as far as the carrier's concerned.
- sofixa 6mo agoIdk about zero, my Android device has SMS spam filtering, putting them in a separate inbox, hiding the notification, and with big red warnings if I indeed open them.
- pocksuppet 6mo agoCan't be blocked by the provider, doesn't require a subscription with a provider, can falsify the sender, can send to everyone in range instead of guessing numbers.
- numpad0 6mo agoThe conspiracy explanation would be that the primary purpose is IMEI/IMSI data collection and/or wireless bug planting, and scamming is secondary purpose and/or deep sampling operation. Though, this is just my hallucination.
- topspin 6mo agoCharges? Cool. In the US we find huge SIM farms in major cities[1], law enforcement shrugs, and everyone forgets about it. [1] https://www.pbs.org/newshour/nation/how-sim-farms-like-the-one-found-near-the-un-could-collapse-telecom-networks https://www.pbs.org/newshour/nation/how-sim-farms-like-the-o...
- Joel_Mckay 6mo agoNot really, the FCC regularly drops >$300k fines on people not creative enough to figure out a revenue model that doesn't irritate everybody. =3
- nightpool 6mo ago"Law enforcement shrugs"? The whole focus of the article is about how the secret service confiscated those devices and charged the SIM farm operators with crimes. Which part of that is shrugging?
- htk 6mo agoThe article is about Canada.
- pnw_throwaway 6mo ago[flagged]
- chatmasta 6mo agoSIM farm is a different scenario and arguably not even illegal. This story is about scammers operating a DIY stingray that broadcasts phishing messages via SMS to nearby devices.
- walrus01 6mo agoPeople I know in US telecom are not surprised by these SIM farms. These people are either: a) Doing some weird grey market VoIP thing. 32-in-1 GSM to SIP gateways have been a thing for a very long time in the developing world. Maybe they think they found some arbitrage route for phone traffic to/from the US PSTN that they can profit from. Anyone who interacts with grey market voip stuff will recognize these things immediately. b) Using them for something like receiving 2FA authentication codes to create bot/socketpuppet social media accounts. In this sort of scenario they'd have live phone numbers/service and the cheapest possible phone plan, and ability to receive incoming SMS. The accounts then get provided to some other group of people who are doing mass advertising/social media manipulation.
- AirMax98 6mo ago[flagged]
- bawolff 6mo agoThis reads like a pretty standard sentence to me. Especially in the context of a police press release trying to explain tech to the public. I think at some point people see AI everywhere because they look for it everywhere.
- stephen_g 6mo agoYeah, I mean if you think about why do LLMs use this kind of phrasing so much, it's just because it was already a common sentence construction in the training data written by humans!
- fragmede 6mo agoI mean, you used an emdash. Are you an LLM?
- caymanjim 6mo agoLLM would have used it properly and omitted the spaces.
- tamimio 6mo agoIt’s there to prevent “public panic” ie they weren’t after you specifically or after xyz group, but just random mass attacks, or to prevent more cases and parties to be involved
- dumpsterdiver 6mo agoAre you trying to make a point that we should remain open to the possibility that humans can express themselves eloquently?
- SadErn 6mo ago[dead]
- cnst 6mo agoThese things just prove that the entire "security" industry is a sham. At one point, every bank would ensure that your password COULD NOT be saved by your browser, because sEcUrItY. Which is precisely the scenario where typing your password into a site like this is possible.
- numpad0 6mo agoOh so it's happening in Canada too? I've seen it reported on media in another place few months back. Someone's shipping a standardized kit of Stingray with battery and PSU to be installed in the back of German station wagons. The kits are suspected to be spamming phishing texts, at least some in Chinese. The cars are driven as unregistered taxis paid for on Chinese platforms, avoiding taxes while also justifying its driving routes and expenses that involve tourist destinations. It's not clear to me if this Chinese authority/PLA doing or if it's another one of those southern Chinese warlord thing, both sounds plausible.
- xiconfjs 6mo agoDo you have any source for this? It‘s not about trust in your information but do get deeper into this topic.
- numpad0 6mo agoI was misremembering a bit, it was about exactly one year ago. No English sources for the case I saw that I'm aware of. A rather interesting and Tom Clancy part of this whatever op is that, someone did a bit of digging and discovered that all instances of this across regions and nations use the exact same model of that black air circulator fan that aren't exactly sold everywhere. So as janky as they look, it's clearly a disciplined military style operation by some organized group than just local gangs buying parts and improvising as they go. 1: https://www.itmedia.co.jp/news/articles/2504/15/news133.html https://www.itmedia.co.jp/news/articles/2504/15/news133.html
- red_admiral 6mo agoAnd Switzerland: (German) https://www.srf.ch/sendungen/kassensturz-espresso/kassensturz/cyberkriminalitaet-sms-blaster-neue-perfide-betrugsmasche-in-der-schweiz https://www.srf.ch/sendungen/kassensturz-espresso/kassenstur... There too, the person arrested was a Chinese citizen.
- nubinetwork 6mo agoI've also heard of this happening in NZ. https://www.1news.co.nz/2024/10/03/sms-blaster-found-for-first-time-in-nz-alleged-scammer-arrested/ https://www.1news.co.nz/2024/10/03/sms-blaster-found-for-fir...
- ndisn 6mo ago>Dafeng Lin, 27, of Hamilton, Junmin Shi, 25, of Markham, and Weitong Hu, 21, of Markham
- alister 6mo agoIn Brazil, people get so much SMS spam and phone call spam that many people turn off notifications for all text messages and phone calls and use only Whatsapp (even for voice calls). But once in a while my iPhone in Brazil will get spam as a unblockable "system message". I'm not sure if I'm using the correct term. I'm mean that it looks just like an Apple system notification and it disappears without a trace afterward, but the content is obviously spam. I wonder how they are able to do this.
- compounding_it 6mo ago>use only Whatsapp WhatsApp here in India has so much spam now. With ads, I am starting to think these spam are just ads sold by WhatsApp.
- ExpertAdvisor01 6mo agoProbably they use flash sms(class 0 messages)
- anilakar 6mo ago> that it looks just like an Apple system notification and it disappears without a trace afterward Probably so-called SMS flash messages. They're shown as overlay popups on Android too.
- ronsor 6mo ago> unblockable "system message" This is a "flash SMS" message: https://nickvsnetworking.com/flash-sms-messages/ https://nickvsnetworking.com/flash-sms-messages/
- kotaKat 6mo agoThe nice thing on iOS at least is that they make it known it's a flash message. You'll get a full screen modal dialogue including a "Why did I get this message?" link that informs you about it and also informs you that sometimes they're used for scams. https://i.imgur.com/lrSrm0n.jpeg https://i.imgur.com/lrSrm0n.jpeg Android just gives you a generic popup that says "Class 0 message" in my testing.
- awei 6mo agowould encrypting sms and using some kind of authorized certificate authorities, maybe the ones from the country's phone carriers, alleviate this issue?
- lxgr 6mo ago3G and beyond use mutual authentication between your phone and home network, so this only works while phones still happily connect to 2G (GSM) networks if nothing better is around (or is getting jammed at the same time).
- SwtCyber 6mo agoMakes me wonder whether phones should expose more information when they attach to a suspicious or downgraded cell tower