4 ms·
I seem to recall that there's an authentication handshake in place with modern protocols so your phone won't connect to any random "cell tower" to prevent abuse
by jbuzbee 12y ago
I seem to recall that there's an authentication handshake in place with modern protocols so your phone won't connect to any random "cell tower" to prevent abuse like this. Anybody know for sure? But of course if the police or Harris has an agreement with the wireless companies, they may have the authentication credentials pre-loaded allowing them to impersonate said wireless companies at will.
[edit for clarity]
- thefreeman 12y agoI am not sure about the authentication protocol. But along the same lines of thinking, it really seems like this should be detectable with software. For example, what if you used crowd sourced cell tower information to notify users / block transmissions from any cell phone tower newly detected for 24 hours or so. It seems like a temporary tower setup for a few hours should be easily noticeable compared against static, permanent ones. Also, judging by how ridiculously hard the company who makes them is trying to keep them hidden (NDA's, etc.), it seems like they may realize that if the details of the product were known it could be easily circumvented.
- deleted 12y ago[deleted]
- mentat 12y agoSubmitting data to wigle.net using their Android app is one way to start building enough cell tower information to make this very visible.
- hnha 12y agowasn't wigle very unfree? I'd love to contribute to an open cell collection project where I can download everything.
- thefreeman 12y agoI think this might be similar to what we are looking for? http://opencellid.org/ http://opencellid.org/
- chmars 12y agoIMSI catchers ('Stingrays') are indeed detectable, an example is the 'Android IMSI-Catcher Detector (AIMSICD)' project: http://secupwn.github.io/Android-IMSI-Catcher-Detector/ http://secupwn.github.io/Android-IMSI-Catcher-Detector/
- tmosleyIII 12y agoIt would be interesting to test this out
- SeanDav 12y agoI tend to believe that the reason that the company uses NDA's is to give the Authorities plausible deniability. "We couldn't apply for a warrant Your Honor, because we would have been breaking our NDA". The cops probably love the NDA, it is probably a feature of the product!
- ComputerGuru 12y agoI think this might be what you're referring to? https://neosmart.net/blog/2011/how-to-recognize-a-stellar-network-operator/ https://neosmart.net/blog/2011/how-to-recognize-a-stellar-ne...
- jbuzbee 12y agoInteresting... Nice that IOS gives you a warning. I wonder if Android does the same?
- tmosleyIII 12y agoThat doesn't actually happen
- chmars 12y agoIt's called 'Ciphering Indication Feature' – and can be suppressed on the network side … so you can assume that an IMSI catcher ('Stingray') will not let your mobile know that it is using no or weak encryption.
- BuildTheRobots 12y agoIt's actually a bit set on the SIM card, nothing to do with the network. Check out GSM 11.11, 10.3.18
- chmars 12y agoThanks, you are of course right. I should have written network operator. The operator can turn on/off OFM on the SIM.
- BuildTheRobots 12y agoTechnically yes, but if you're talking about a stingray then I don't think they're going to have the ability to alter your sim card without authenticating with it; which is a lot harder than just using a null cipher over the air.
- dfox 12y agoGSM has cryptographic challenge-response authentication, but only handset authenticates itself to the network, not the other way around. Also, network can just not require authentication at all (which is how devices like this work). Having authentication credentials preloaded is impractical for both GSM and UMTS/W-CDMA, as authentication uses secret shared key that is (should be) unique to each customer.
- chmars 12y agoThe police has no agreement with the telcos, in the contrary, IMSI catchers ('Stingrays') are a convenient way for lawful interception without involvement of telcos. From a telco's perspective, IMSI catchers kind of hack their network. In any case, you can build your own IMSI catcher, German hackers – among others – published instructions already years ago.
- tmosleyIII 12y agoThere are agreements in place
- chmars 12y agoDo you have a source for that? Basically, IMSI catching does not require any cooperation with telcos. On the other hand, it is easy to imagine that some telcos might betray their customers – especially under the cover of secrecy.
- tmosleyIII 12y agoThere are sources available that can be found with some digging. I'm just speaking on the stuff that relates to the work I do.