4 ms·

2g networks didn't have the phone verify the network, so yes they can do this. At least as of today, most phones have an option to turn off 2g but that isn't a

2g networks didn't have the phone verify the network, so yes they can do this. At least as of today, most phones have an option to turn off 2g but that isn't a default.

opengrass 6mo ago
Plausible. Only Rogers still has working 2G.
- Scoundreller 6mo ago
  And if you have a modern enough SIM+phone combo, it won’t even display the 2g network as an available network, nor 3G on my device. I wonder if this mostly hit international SIMs, since they wouldn’t be running the same level of SIM code to prefer various network locks like a local SIM. Helps you stay under the radar and gov services over SMS is a lot more advanced outside of Canada if you want to do some fraud.
  - gruez 6mo ago
    >And if you have a modern enough SIM+phone combo, it won’t even display the 2g network as an available network, nor 3G on my device. Source? It might just be that your carrier retired its 2g/3g network, not that the phone/sim refuses 2g/3g connections. If some cell tower popped up claiming to 2g/3g, your phone still might happily connect.
    - Scoundreller 6mo ago
      source = Rogers SIM in me phone my Telus/Bell SIM shows the 3G network tho
      - lxgr 6mo ago
        Unfortunately, I think there's no way for a SIM card to indicate to the phone that it would like it to please never connect to any 2G (or any non-mutually-authenticated) network. Absent that, maybe this happens via a carrier profile (or equivalent mechanism)?
        Scoundreller 6mo ago
        Ah, so the attack might depend on whether your phone is set to allow roaming or not. Maybe. But I only have an option for data roaming on/off, not roaming entirely.
        lxgr 6mo ago
        I don't think that matters, since the phone has no way of knowing from the SIM card alone whether it should still connect to 2G networks or not. It sounds like a good idea to at least restrict 2G connections to non-roaming scenarios, but then you have the next practical problem: How does your baseband know that you're abroad? Sure, all solvable at the application layer (the phone could use location heuristics to figure out where it is etc.), but not trivial and full of edge cases that could easily result in your phone mysteriously not connecting while abroad or, worse, not being able to make an emergency call or similar.
        Scoundreller 6mo ago
        I also kinda figure there’s some magic running to “stick” to your home network where available/visible because of international border areas and people historically getting regularly upset about being roaming charges despite never leaving their home country.
        lxgr 6mo ago
        SIMs can define both their home network (both implicitly since the IMSI starts with MCC/MNC of the issuer/home network, and explicitly in the form of a list of "equivalent networks", which is useful for MVNOs with their own MNC that don't want the "roaming" icon to show up) and a ranked list of preferred roaming networks. The phone should usually define those. Of course, in some situations you might only get signal from across the border, and then none of these mechanisms can help.
        Scoundreller 6mo ago
- mcpherrinm 6mo ago
  It doesn't matter what the network is doing; the phone needs to disable 2g. There's various ways to get the phone to downgrade to 2g otherwise, eg https://montsecure.com/files/2021_downgrade.pdf https://montsecure.com/files/2021_downgrade.pdf Android has it as a toggle: https://source.android.com/docs/security/features/cellular-security/disable-2g https://source.android.com/docs/security/features/cellular-s... iPhone disables it for phones in lockdown mode.
- llm_nerd 6mo ago
  Which is interesting in that they very publicly shut down the 3G network last year.
  - Scoundreller 6mo ago
    Probably some IoT/M2M contracts. Telus/Bell has really cut down on the spectrum allotted to their 3G that’s still up, and I doubt much is still assigned on Rogers’ 2G side.
- stephen_g 6mo ago
  That's incredible, here in Australia they not only shut down all 2G networks almost a decade ago, but they've already shut down 3G as well! Although now looking at Wikipedia there are a lot more 2G networks sticking around than I realised, still hard for me to believe given what's happened here!
  - wil421 6mo ago
    You do realize it’s a fake 2g/3g network and most phones don’t care. They will happily connect to whatever they support.
    - lxgr 6mo ago
      Only if they’re not already connected to a better network, no?
      - voxic11 6mo ago
        Funny enough its the tower that tells the cellphone modem which network is "better" and it does this in an unencrypted cell reselection message. So it is easy to force a phone to select 2G. https://efforg.github.io/rayhunter/heuristics.html#lte-sib67-downgrade-v2 https://efforg.github.io/rayhunter/heuristics.html#lte-sib67...
        lxgr 6mo ago
        Huh, I was going to say that this can't possibly be the case for the newer standards, but it seems like it really is the case even in 4G/LTE... Hopefully devices at least ignore it when 2G is deactivated entirely, for those where that's possible.
    - stephen_g 6mo ago
      Of course I realise that, but that’s irrelevant to my point. The point was that I’m surprised how many real 2G networks there still are, and that one still exists in Canada at all.
OptionOfT 6mo ago
The only way to truly disable 2g on an iPhone is to enable lock-down mode, which is a step too far for me.
- xamuel 6mo ago
  Agree. I do a lot of travel and in 3rd-world countries it is quite common to get 2g spam, it's really unacceptable that Apple doesn't offer a way to turn off 2g short of lockdown mode.
  - lxgr 6mo ago
    Are you sure it's not sourced from the visited network? In that case, 3G or beyond wouldn't help you, as mutual authentication does not imply end-to-end authentication of all traffic between you and your home provider.
    - xamuel 5mo ago
      It happens specifically when I wander out of network coverage. If I stay in my airbnb where I have coverage, then 0 spam
- akimbostrawman 6mo ago
  It's always amusing to me how apple tries to hide basic security features behind there super duper totally secure mode which nobody will enable because it destroys usability. Meanwhile GrapheneOS in the default mode is as much or much more secure (and private duh) than there marketing mode with little to no usability decrease.
  - mayhemducks 6mo ago
    I was curious about this so I looked around a bit. My interpretation is that GrapheneOS still has not cracked this nut. Neither has iPhone, unless you enable "Lockdown Mode" https://github.com/GrapheneOS/os-issue-tracker/issues/3952 https://github.com/GrapheneOS/os-issue-tracker/issues/3952 https://github.com/GrapheneOS/os-issue-tracker/issues/6076 https://github.com/GrapheneOS/os-issue-tracker/issues/6076

2g networks didn't have the phone verify the network, so yes they can do this. At least as of today, most phones have an option to turn off 2g but that isn't a default.

opengrass 6mo ago

Plausible. Only Rogers still has working 2G.

Scoundreller 6mo ago
And if you have a modern enough SIM+phone combo, it won’t even display the 2g network as an available network, nor 3G on my device. I wonder if this mostly hit international SIMs, since they wouldn’t be running the same level of SIM code to prefer various network locks like a local SIM. Helps you stay under the radar and gov services over SMS is a lot more advanced outside of Canada if you want to do some fraud.
- gruez 6mo ago
  >And if you have a modern enough SIM+phone combo, it won’t even display the 2g network as an available network, nor 3G on my device. Source? It might just be that your carrier retired its 2g/3g network, not that the phone/sim refuses 2g/3g connections. If some cell tower popped up claiming to 2g/3g, your phone still might happily connect.
  - Scoundreller 6mo ago
    source = Rogers SIM in me phone my Telus/Bell SIM shows the 3G network tho
    - lxgr 6mo ago
      Unfortunately, I think there's no way for a SIM card to indicate to the phone that it would like it to please never connect to any 2G (or any non-mutually-authenticated) network. Absent that, maybe this happens via a carrier profile (or equivalent mechanism)?
      - Scoundreller 6mo ago
        Ah, so the attack might depend on whether your phone is set to allow roaming or not. Maybe. But I only have an option for data roaming on/off, not roaming entirely.
        lxgr 6mo ago
        I don't think that matters, since the phone has no way of knowing from the SIM card alone whether it should still connect to 2G networks or not. It sounds like a good idea to at least restrict 2G connections to non-roaming scenarios, but then you have the next practical problem: How does your baseband know that you're abroad? Sure, all solvable at the application layer (the phone could use location heuristics to figure out where it is etc.), but not trivial and full of edge cases that could easily result in your phone mysteriously not connecting while abroad or, worse, not being able to make an emergency call or similar.
        Scoundreller 6mo ago
        I also kinda figure there’s some magic running to “stick” to your home network where available/visible because of international border areas and people historically getting regularly upset about being roaming charges despite never leaving their home country.
        lxgr 6mo ago
        SIMs can define both their home network (both implicitly since the IMSI starts with MCC/MNC of the issuer/home network, and explicitly in the form of a list of "equivalent networks", which is useful for MVNOs with their own MNC that don't want the "roaming" icon to show up) and a ranked list of preferred roaming networks. The phone should usually define those. Of course, in some situations you might only get signal from across the border, and then none of these mechanisms can help.
        Scoundreller 6mo ago
mcpherrinm 6mo ago
It doesn't matter what the network is doing; the phone needs to disable 2g. There's various ways to get the phone to downgrade to 2g otherwise, eg https://montsecure.com/files/2021_downgrade.pdf https://montsecure.com/files/2021_downgrade.pdf Android has it as a toggle: https://source.android.com/docs/security/features/cellular-security/disable-2g https://source.android.com/docs/security/features/cellular-s... iPhone disables it for phones in lockdown mode.
llm_nerd 6mo ago
Which is interesting in that they very publicly shut down the 3G network last year.
- Scoundreller 6mo ago
  Probably some IoT/M2M contracts. Telus/Bell has really cut down on the spectrum allotted to their 3G that’s still up, and I doubt much is still assigned on Rogers’ 2G side.
stephen_g 6mo ago
That's incredible, here in Australia they not only shut down all 2G networks almost a decade ago, but they've already shut down 3G as well! Although now looking at Wikipedia there are a lot more 2G networks sticking around than I realised, still hard for me to believe given what's happened here!
- wil421 6mo ago
  You do realize it’s a fake 2g/3g network and most phones don’t care. They will happily connect to whatever they support.
  - lxgr 6mo ago
    Only if they’re not already connected to a better network, no?
    - voxic11 6mo ago
      Funny enough its the tower that tells the cellphone modem which network is "better" and it does this in an unencrypted cell reselection message. So it is easy to force a phone to select 2G. https://efforg.github.io/rayhunter/heuristics.html#lte-sib67-downgrade-v2 https://efforg.github.io/rayhunter/heuristics.html#lte-sib67...
      - lxgr 6mo ago
        Huh, I was going to say that this can't possibly be the case for the newer standards, but it seems like it really is the case even in 4G/LTE... Hopefully devices at least ignore it when 2G is deactivated entirely, for those where that's possible.
  - stephen_g 6mo ago
    Of course I realise that, but that’s irrelevant to my point. The point was that I’m surprised how many real 2G networks there still are, and that one still exists in Canada at all.

OptionOfT 6mo ago

The only way to truly disable 2g on an iPhone is to enable lock-down mode, which is a step too far for me.

xamuel 6mo ago
Agree. I do a lot of travel and in 3rd-world countries it is quite common to get 2g spam, it's really unacceptable that Apple doesn't offer a way to turn off 2g short of lockdown mode.
- lxgr 6mo ago
  Are you sure it's not sourced from the visited network? In that case, 3G or beyond wouldn't help you, as mutual authentication does not imply end-to-end authentication of all traffic between you and your home provider.
  - xamuel 5mo ago
    It happens specifically when I wander out of network coverage. If I stay in my airbnb where I have coverage, then 0 spam
akimbostrawman 6mo ago
It's always amusing to me how apple tries to hide basic security features behind there super duper totally secure mode which nobody will enable because it destroys usability. Meanwhile GrapheneOS in the default mode is as much or much more secure (and private duh) than there marketing mode with little to no usability decrease.
- mayhemducks 6mo ago
  I was curious about this so I looked around a bit. My interpretation is that GrapheneOS still has not cracked this nut. Neither has iPhone, unless you enable "Lockdown Mode" https://github.com/GrapheneOS/os-issue-tracker/issues/3952 https://github.com/GrapheneOS/os-issue-tracker/issues/3952 https://github.com/GrapheneOS/os-issue-tracker/issues/6076 https://github.com/GrapheneOS/os-issue-tracker/issues/6076