27 ms·

German researchers discover flaw that could let anyone listen to cell calls

311 points by haakon 12y ago

MichaelCrawford 12y ago
There is a maintenance mode in every cell phone that allows it to be remotely turned on, that is, used as a listening device, without your knowledge. I don't know what authentication is required. I expect that it was designed so that only your cell carrier could enable it, however whatever may have been secret about it, quite likely has leaked out by now. If you don't want to be listened-to, don't have _any_ cell phones anywhere near you. Not just your own - say you want a private conversation in a public place; the phones of other people in your general vicinity could be switched on to listen to you. I learned this from a well-known left-wing radical organization known as the United States Air Force, when I applied for the USAF Cyber Command. Their site had a recruiting video, that depicted a couple officers locking their phones into a grounded metal box - a faraday cage - before entering a secure area, that is, a room where secrets were openly discussed.
- cryptoz 12y ago
  I've been asking everyone I know questions about this to make them realize how intense the total surveillance possibilities are. "How many internet-connected microphones are in the same room as you?" It's astonishing how big that number gets. For me right now, it's ~50. And so many of them are made by different companies, assembled in different countries, etc. The chance that someone, somewhere, can listen to you is nearly 100% if you're in a semi-public space. We're living in a dramatically more invasive surveillance society than 1984 ever predicted (that was just street cameras & one 'telescreen' in your home). And then, add into this mix that we have new market acceptance for devices that intentionally open this behaviour: XBox One, Moto X, Amazon's...whatevertheycallit. There's not only technical capability, but also increasing consumer desire. It's crazy. Further edits: There's a lot more at stake here, too, if you extrapolate from their[1] known capabilities and combine with actors who may also have motives at large scale. Take Facebook's mood-altering study, for example. We know that someone/Facebook has the ability to alter the moods and opinions of large groups of populations. The same actors can also listen/watch those people in real time. Dystopian scenarios of totalitarian governments exercising total population thought-control is more and more plausible as we all trade our privacy and security to giant corporations in exchange for mere convenience in our daily lives. [1]: Who is 'they'? I don't know, but there are many possible 'they's and it might be many of them.
  - MichaelCrawford 12y ago
    Most notebook computers have video cameras built into the display's frame, at the top. These cameras typically have a light that powers on when the camera is in use. However there is nothing at all to indicate that the computer has its audio microphone in use.
    - click170 12y ago
      A quick google search shows that some cameras can be activated without that little LED coming online.
      - MichaelCrawford 12y ago
        I was once paid specifically to figure out a way to activate a camera without turning on the light. However in that case it was for a legitimate purpose.
        spacefight 12y ago
        Out of curiosity - what was that legitimation? Can you tell?
        fluidcruft 12y ago
        One idea: I can easily imagine research studies getting IRB approval for this. The red light could alter the subject's behavior, and video analysis could be part of the metrics (for measuring attention/distraction or gross estimates of gaze, etc).
        everyTime 12y ago
        Really? Because I can't. I can't imagine an IRB-approved research study that requires a software solution (developed under an NDA) to a hardware problem that couldn't be solved with a one-inch square of black electrical tape. For the price of a contracted software developer, you could simply buy a model of laptop (or smart phone), in which the bezel can be pried open without substantial damage, and behind the LED's transparent aperture (but obscuring the LED), you fix a tidbit of black tape or whichever opaque material you may prefer. Or, better yet, for pretty much every situation that doesn't involve eye-movement tracking, simply install a hidden security camera at an opportunistic vantage point.
- maxerickson 12y ago
  There are other reasons that cell phones would not be allowed in such a location. For instance, it makes it more difficult for an insider to remove sensitive information.
  - MichaelCrawford 12y ago
    While I expect you are correct, the USAF recruiting film specifically pointed out that cell phones aren't permitted in secure areas because of that maintenance mode.
    - vegardx 12y ago
      You're not allowed to bring any electronic devices into a secure area. Period. That means, watches, phones, laptops, pedometer and just about anything that has circuits.
      - MichaelCrawford 12y ago
        Lots of good reasons for that. How do you know that a pedometer is really just a pedometer? That's how Bradley Manning made off with 800,00 diplomatic cables. He used a CD label printer to print CD-R blanks so that they looked like the albums from all his favorite bands, put the CD-R media into a portable player, then burned the CDs at his PC after downloading the cables over the Internet. Oddly, he was always searched on the way in, never on the way out.
        orbifold 12y ago
        If they did use a user account system with capabilities (CD burning would be one of them) this couldn't have happened. That probably a million other possibilities.
        MichaelCrawford 12y ago
        Alternatively, they could crack open an Internet RFC or two. Internet Protocol packets have a field for the security classification - unclassified, confidential, secret, top secret, there are other classifications that are themselves classified, as top secret ultra once was - as well as the compartment. I expect Bradley Manning had a top secret clearance, but I doubt he had the same compartment as was required to read diplomatic cables. Quite likely everyone was using commodity routers, such as one can purchase at Fry's. It must be expensive to purchase routers that enforce what has been in the Internet Protocol since the 1970s.
- biafra 12y ago
  Do you know in which part of the phones this is supposed to be in? In every cell phone? Without more details I call BS on this. It might be possible, but stating that every cell phone has it, sounds unlikely to me. I don't think it is part of the GSM specification, so what would be the reason that EVERY cell phone (Also non-GSM phones) has it?
  - MichaelCrawford 12y ago
    I don't know. I don't think the Air Force would just make something like that up. It's not just a USAF policy, not to permit cell phones in secure areas. I know lots of people with clearances, none of them are permitted to bring cell phones into their offices. I applied to the Cyber Command in the Summer of 2008. What kinds of phones were in use at the time, in the United States? And the video did specifically say "every cell phone".
    - eli 12y ago
      That seems like a good policy even if most cell phones were immune to hacking.
      - tormeh 12y ago
        Everything that has the capability to record must be assumed to be recording, I would argue.
    - knd775 12y ago
      How do you know that those policies aren't in place to prevent a person from knowingly recording sensitive data with their phone? Was there anything indicating that it was specifically for the reasons that you gave?
      - MichaelCrawford 12y ago
        This policy is so widespread, and it has been the policy for so long, that I would be quite surprised were such a reason not to have leaked out by now. People with clearances all know about this maintenance mode. None of them ever explain the error of my ways, when I discuss it with them.
- seekingtruth 12y ago
  Stallman proven right again.
- superpoliteuser 12y ago
  http://en.wikipedia.org/wiki/Carrier_IQ http://en.wikipedia.org/wiki/Carrier_IQ
- mortov 12y ago
  My understanding is that it was this facility (in part) which was used to track & monitor ex-US Marine Toby Studabaker when he went "missing" around 12 years ago with 12 year old Shevaun Pennington. He was 'found' in a hotel room in Germany - despite his phone being turned off.
- ars 12y ago
  > that depicted a couple officers locking their phones into a grounded metal box - a faraday cage I once tried that using a metal lunchbox, with a tight fitting metal lid - the phone rang anyway. Anyone else ever tried it? And as a side note, be sure and turn off (or airplane mode) your phone if you do put it in an effective faraday cage, or you will rapidly drain the battery as the phone constantly tries - at full power - to find a base station.
  - MichaelCrawford 12y ago
    One has to also consider the skin effect. Electromagnetic waves penetrate a conductor to a depth comparable to their wavelength, with an intensity that decreases exponentially.
  - shit_parade 12y ago
    plastic bag and tin foil worked for me.
- fulafel 12y ago
  > There is a maintenance mode in every cell phone that allows it to be remotely turned on, that is, used as a listening device, without your knowledge. Sounds tin-foily, any references? This conspiracy theory has been making the rounds for a long time and there's no evidence for it so far. Some problems immediately come to mind: - would eat phone battery quickly to keep radio listening for these things - would be vulnerable to discovery, eg leaks from phone industry engineers, reverse engineering by tinkerers, etc - yet has stayed secret for a long time (assuming this isn't a new thing) More realistic would be exploiting a bug in the phone baseband firmware to get remote code execution, and then reprogramming the phone to do what you want. And reason enough to treat phones like you observed.
  - RaleyField 12y ago
    > would eat phone battery quickly to keep radio listening for these things your phone already listens for incoming call signal, this would be just another type of signal.
    - fulafel 12y ago
      He was talking about turning the phone on remotely.
      - MichaelCrawford 12y ago
        Perhaps I should have been more clear: I wasn't claiming that this maintenance mode turns on the power to a phone, rather that if the phone is already powered on, the maintenance mode silently and invisibly turns on the phone's microphone, then transmits audio back to the cell tower. So if you leave your cell powered on, anyone who knows how to activate that maintenance mode can listen to what you are saying, without your knowledge.
  - TeMPOraL 12y ago
    > More realistic would be exploiting a bug in the phone baseband firmware to get remote code execution, and then reprogramming the phone to do what you want. Or using baseband as intended to get remote code execution, and then on the cell company side wrap it up in a nice GUI or set of scripts, and voilà - you have the "maintenance mode" mentioned.
- spacecowboy_lon 12y ago
  That also to stop the oficers from recording the meeting - a mate of mine worked for qinetiq and they have strict rules on phones being found with a phone with a camera inside his work place woudl have been a gross misconduct offence. I have been for DV clearnce job interviews (The FO at Milton keynes) and you can have NO electronics on your person past the reception area.
- kristoffer 12y ago
  The presence of such a mode has never been proven in any commercially available cell phone. Your anecdotal USAF story does not prove anything either. The story in the link has nothing to do with surveillance at the cell phone level. Its about interception/rerouting in the global phone network.
- peterwwillis 12y ago
  OTA updates are a pretty simple way to load whatever you want on the phone, and that just requires digitally signed SMSes, but signed with DES.
- NietTim 12y ago
  Sources would really be nice with this.
spacefight 12y ago
Of course we can be sure, that those fellows were not the first to learn about that. The hack of belgium telco Belgacom sees more light day by day. This system is broken beyond repair. We need to build it up from the ground, safe.
- MichaelCrawford 12y ago
  Someone is making encrypted Android phones in Switzerland, they said they would cost about $600.00, and should be shipping by now. They can interoperate with regular Android phones if those phones have their app installed. I don't know what happens, if one calls a phone that does not support encryption. Boeing is, or will soon be making such a phone, specifically intended for classified communication. I don't know whether they will be sold to the public.
  - moe 12y ago
    There's also a few Apps for encrypted calls. The good ones are open source, such as RedPhone: https://github.com/WhisperSystems/RedPhone https://github.com/WhisperSystems/RedPhone
eyeareque 12y ago
One more reason to encrypt every bit we send and to use voip instead of the PSTN/Cellular voice.
Animats 12y ago
Signaling System 7 (SS7) is a big security problem. It's the packet-switched control network for the phone system, and it has very little security. It was designed in 1980 to be run only internally between phone switches. The main function of SS7 is call setup. All the switches along the route get their switching commands over SS7, not over the circuit-switched channel. (That went out with SS5, the old audio-tone based system). Call setup is preceded by "translation", turning a destination phone number into a route. That's done with query messages over SS7. This allows outsourced wiretapping. Verisign offers this as a service for telcos, so they don't have to deal with law enforcement themselves. http://www.verisign.com/static/001927.pdf http://www.verisign.com/static/001927.pdf Verisign, which also runs much of the US SS7 network (http://www.verisign.com/stellent/groups/public/documents/data_sheet/005169.pdf http://www.verisign.com/stellent/groups/public/documents/dat...) is well placed to do this. All they have to do for a wiretap is to have the translations for a source or destination number reroute to a wiretap point, which then records while forwarding to the desired destination. As an SS7 provider, they already have all the call metadata. Vulnerabilities come in because more parties now have SS7 access. Cellular roaming and VoIP to landline routing are managed over SS7. So a large number of computers other than dedicated telco switches now have SS7 connections. A break-in at any of those points has wiretapping potential.
- caio1982 12y ago
  It's funny because some developing countries still use the now ancient R2 signalling and wouldn't be directly affected by this (just in connecting networks I'd assume). IIRC Brazil is still a big user of R2, unfortunately for those working with VoIP. Also China.
- dchichkov 12y ago
  A bit of a plug. If anyone is interested in playing with (doing research on) SS7 vulnerabilities, a few years back (five) I've participated in building a pretty cute test toolkit that allows one to sent/receive/parse/play scenarios using SS7/C7/3G/CDMA/.../SCTP/SS7 over IP/... packets on any level of the network. The list of supported protocols is available here: http://www.linkbit.com/platforms http://www.linkbit.com/platforms It follows standards and usually implements 100% of the protocol (including conditional constraints, etc). But also allows one to 'break' stuff and send custom/unsupported/broken fields. It is pretty cute, you can do most of the stuff just in the visual packet editors / flow editors and where necessary revert to python snippets. To get the feel of it, and see some pics: http://docs.linkbit.com/ http://docs.linkbit.com/ edit: and basically yes. as a protocol engineer and somebody very familiar with SS7/C7/GSM/.., once you have the access to the network (which can be done over IP!) I wouldn't be at all surprised, you could misuse it.
upofadown 12y ago
The only interesting thing here is the new attack at the radio level that allows call monitoring. It sounds like it might be easier than setting up a fake tower. It still sounds like it required an active attack though so in practice the difference might be all that important.
at-fates-hands 12y ago
An interesting read on the current state of SS7, circa 2013: http://blog.pt.com/vendors-eol-announcement http://blog.pt.com/vendors-eol-announcement The 3G/4G segment of subscribers will have a distribution of 3.4 billion using 3G (SS7) services and .9 billion using 4G services. The total outcome of this research indicates that a total of 7.65 billion subscribers, out of a total of 8.5 billion subscribers, will remain on SS7-based networks in 2017. Verizon went on to further explain that a final 2G/3G (SS7) sunset timeframe decision has not been made. The good news is vendors are not happy considering the availability of hardware is will decrease significantly over the same time period, hopefully speeding the sunset for this technology. Some service providers are planning on a strategy of consolidating their network, having no support and cannibalizing existing spare equipment for hardware support.
darkhorn 12y ago
In Turkish Ministry of Foreign Affairs it is forbidden to bring cell phones in to meetings. However it is totally okay to bring tablets and laptops into the meetings. Source: my friend works there. Edit: phones are forbidden due to the recent spying events.
- yourad_io 12y ago
  Do they allow 3G tablets or anything that falls in the not-a-phone-but-has-a-SIM/baseband proc? I'm assuming a GSM (or equivalent) baseband is the only thing separating smartphone from smartablet and smartlaptop nowadays, correct? If they allow 3G tablets, then this is a security-theater kind decision, aimed to appease "management", and we must make fun of them. If they ban all baseband-carrying devices, then this is a consistent policy that is paranoid about a very specific thing that, quite frankly, invites a lot of healthy paranoia. I wonder what it'll take to open up those baseband processors.
  - eric_bullington 12y ago
    >I wonder what it'll take to open up those baseband processors. Project OsmocomBB: http://bb.osmocom.org/trac/ http://bb.osmocom.org/trac/
  - darkhorn 12y ago
    They have internet access there. Why would someone use their phone while they have microphones and internet acces in their tablets and laptops... These people are clueless about technology. Also they use Windows.
  - darkhorn 12y ago
    As far as I remember nobady checks wheter you carry a phone into a meeting. It is just forbidden. If they say that phone is forbidden it means literally that phone is forbidden, no matter smart phone or dump phone, tablet with 3G is okay because it is not a phone overall. You may show some slides ets you know... or you might want to connect to the internet...
guelo 12y ago
"anyone" can not listen to your cell calls. Only people that have access to inject commands into the SS7 network that your call is routed through can do that.
- pbhjpbhj 12y ago
  Or those that can create a pico cell that your phone connects to and then MITM your call. I gather the equipment is pretty accessibly priced now.
  - frozenport 12y ago
    The expertise to do these things is the domain of well outfitted organizations, who have other simpler methods of making you talk. Indeed, electronic surveillance of is often used to protect agents from dangerous work.
    - uaygsfdbzf 12y ago
      The technology to do these things is open source and available here: http://osmocom.org/ http://osmocom.org/
      - frozenport 12y ago
        I'm not sure how to hack a mobile phone using this software? The expertise to find these kinds of exploits is hard to develop individually.
        eric_bullington 12y ago
        >The expertise to find these kinds of exploits is hard to develop individually. Yes, but numerous people participating in the Osmocom projects have that expertise. Fortunately, they're interested in building an open-source baseband processor (among other cool things), and not in hacking into anyone's private communications.
deleted 12y ago
[deleted]
tiler 12y ago
A couple of random thoughts on potential applications/uses: 1. Alexandria needs to communicate with Bilbo. Alexandria has the privilege of being trusted by whatever organization she belongs to (be that her country, company, etc) and as such is unmonitored AFAsheKs. Biblo on the other hand is some fugitive-type and is unable, or perhaps unwilling, to enter direct communication with Alexandria for fear of compromising himself or his beloved Alexandria. Bilbo could then monitor Alexandria's calls for an encoded message via a protocol they predetermine. This protocol could take the form of linguistic or audio steganography. One could image all sorts of information being leaked by Alexandria. 2. More realistically this could be tool for bribery. Monitor a set of vulnerable targets, wait until they reveal something, take a bribe to stay quite. 3. Or, for the Machiavellian-minded leak information that was supposedly confidential between two parties.
- jmnicolas 12y ago
  I didn't understand anything. Could you explain it with Alice and Bob instead ?
lazyjones 12y ago
German state-controlled media and the Deutsche Telekom immediately reported that big carriers have already fixed the problem and are no longer allowing "unauthorized" requests for encryption parameters via SS7. ;-) (source: http://heise.de/-2503376 http://heise.de/-2503376 - sorry, German)
skidoo 12y ago
Of course there are insecurities, but this sounds like an opening shot calling for a "new" system to allow better security, or rather, a system even more easily controlled.
peterwwillis 12y ago
Really, none of this is surprising or new. If you're bored/curious, here's some fun reading on exploring/exploiting telecom networks. Spoiler alert: it's really easy and it has been forever. Big ups to Philippe Langlois for all his great research over the years. Interview: Telecom Security Expert Philippe Langlois on GCHQ Spying (http://www.spiegel.de/international/europe/interview-telecom-security-expert-philippe-langlois-on-gchq-spying-a-933870.html http://www.spiegel.de/international/europe/interview-telecom...) Vulnerabilities and Possible Attacks against the GPRS Backbone Network (http://critis06.lcc.uma.es/files/Vulnerabilities%20and%20Possible%20Attacks%20against%20the%20GPRS%20Backbone%20Network.pdf http://critis06.lcc.uma.es/files/Vulnerabilities%20and%20Pos...) Getting in the SS7 kingdom: hard technology and disturbingly easy hacks to get entry points in the walled garden (http://www.hackitoergosum.org/2010/HES2010-planglois-Attacking-SS7.pdf http://www.hackitoergosum.org/2010/HES2010-planglois-Attacki...) Telecom Signaling Attacks on 3G and LTE networks (http://www.slideshare.net/p1sec/telecom-security-from-ss7-to-all-ip-allopenv3zeronights http://www.slideshare.net/p1sec/telecom-security-from-ss7-to...) GSM and 3G Security (https://webcache.googleusercontent.com/search?q=cache:WlEd4HCpl48J:www.blackhat.com/presentations/bh-asia-01/gadiax.ppt+&cd=16&hl=en&ct=clnk&gl=us&client=firefox-a https://webcache.googleusercontent.com/search?q=cache:WlEd4H...) Locating Mobile Phones using Signalling System #7 (http://events.ccc.de/congress/2008/Fahrplan/attachments/1262_25c3-locating-mobile-phones.pdf http://events.ccc.de/congress/2008/Fahrplan/attachments/1262...) SCTPscan - Finding entry points to SS7 Networks & Telecommunication Backbones (https://www.blackhat.com/presentations/bh-europe-07/Langlois/Presentation/bh-eu-07-langlois-ppt-apr19.pdf https://www.blackhat.com/presentations/bh-europe-07/Langlois...) LTE Pwnage: Hacking HLR/HSS and MME Core Network Elements (http://www.slideshare.net/p1sec/p1security-lte-pwnage-v21 http://www.slideshare.net/p1sec/p1security-lte-pwnage-v21) Map of mobile network security (https://srlabs.de/gsmmap/ https://srlabs.de/gsmmap/) Rooting The HLRs Mobile And Critical Infrastructure Insecurity (https://archive.org/details/D3T202201308021200RootingTheHlrsMobileAndCriticalInfrastructureInsecurityPhilippeLanglois https://archive.org/details/D3T202201308021200RootingTheHlrs...) AURORAGOLD Working Group - Shaping understanding of the global GSM/UMTS/LTE landscape - from the Snowden leaks (government employees should probably not click this) (https://s3.amazonaws.com/s3.documentcloud.org/documents/1374178/auroragold-working-group.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/1374...) (https://firstlook.org/theintercept/2014/12/04/nsa-auroragold-hack-cellphones/ https://firstlook.org/theintercept/2014/12/04/nsa-auroragold...)
charlieok 12y ago
I just tried searching this entire comments page for the string “batman”. Incredibly, there were 0 occurrences. So I'll just add: this sounds kinda like that batman movie where they turned every cellphone in the city into a remote listening device (and then declared that nobody should have that kind of power).

311 points by haakon 12y ago

There is a maintenance mode in every cell phone that allows it to be remotely turned on, that is, used as a listening device, without your knowledge. I don't know what authentication is required. I expect that it was designed so that only your cell carrier could enable it, however whatever may have been secret about it, quite likely has leaked out by now. If you don't want to be listened-to, don't have _any_ cell phones anywhere near you. Not just your own - say you want a private conversation in a public place; the phones of other people in your general vicinity could be switched on to listen to you. I learned this from a well-known left-wing radical organization known as the United States Air Force, when I applied for the USAF Cyber Command. Their site had a recruiting video, that depicted a couple officers locking their phones into a grounded metal box - a faraday cage - before entering a secure area, that is, a room where secrets were openly discussed.

cryptoz 12y ago
I've been asking everyone I know questions about this to make them realize how intense the total surveillance possibilities are. "How many internet-connected microphones are in the same room as you?" It's astonishing how big that number gets. For me right now, it's ~50. And so many of them are made by different companies, assembled in different countries, etc. The chance that someone, somewhere, can listen to you is nearly 100% if you're in a semi-public space. We're living in a dramatically more invasive surveillance society than 1984 ever predicted (that was just street cameras & one 'telescreen' in your home). And then, add into this mix that we have new market acceptance for devices that intentionally open this behaviour: XBox One, Moto X, Amazon's...whatevertheycallit. There's not only technical capability, but also increasing consumer desire. It's crazy. Further edits: There's a lot more at stake here, too, if you extrapolate from their[1] known capabilities and combine with actors who may also have motives at large scale. Take Facebook's mood-altering study, for example. We know that someone/Facebook has the ability to alter the moods and opinions of large groups of populations. The same actors can also listen/watch those people in real time. Dystopian scenarios of totalitarian governments exercising total population thought-control is more and more plausible as we all trade our privacy and security to giant corporations in exchange for mere convenience in our daily lives. [1]: Who is 'they'? I don't know, but there are many possible 'they's and it might be many of them.
- MichaelCrawford 12y ago
  Most notebook computers have video cameras built into the display's frame, at the top. These cameras typically have a light that powers on when the camera is in use. However there is nothing at all to indicate that the computer has its audio microphone in use.
  - click170 12y ago
    A quick google search shows that some cameras can be activated without that little LED coming online.
    - MichaelCrawford 12y ago
      I was once paid specifically to figure out a way to activate a camera without turning on the light. However in that case it was for a legitimate purpose.
      - spacefight 12y ago
        Out of curiosity - what was that legitimation? Can you tell?
        fluidcruft 12y ago
        One idea: I can easily imagine research studies getting IRB approval for this. The red light could alter the subject's behavior, and video analysis could be part of the metrics (for measuring attention/distraction or gross estimates of gaze, etc).
        everyTime 12y ago
        Really? Because I can't. I can't imagine an IRB-approved research study that requires a software solution (developed under an NDA) to a hardware problem that couldn't be solved with a one-inch square of black electrical tape. For the price of a contracted software developer, you could simply buy a model of laptop (or smart phone), in which the bezel can be pried open without substantial damage, and behind the LED's transparent aperture (but obscuring the LED), you fix a tidbit of black tape or whichever opaque material you may prefer. Or, better yet, for pretty much every situation that doesn't involve eye-movement tracking, simply install a hidden security camera at an opportunistic vantage point.
maxerickson 12y ago
There are other reasons that cell phones would not be allowed in such a location. For instance, it makes it more difficult for an insider to remove sensitive information.
- MichaelCrawford 12y ago
  While I expect you are correct, the USAF recruiting film specifically pointed out that cell phones aren't permitted in secure areas because of that maintenance mode.
  - vegardx 12y ago
    You're not allowed to bring any electronic devices into a secure area. Period. That means, watches, phones, laptops, pedometer and just about anything that has circuits.
    - MichaelCrawford 12y ago
      Lots of good reasons for that. How do you know that a pedometer is really just a pedometer? That's how Bradley Manning made off with 800,00 diplomatic cables. He used a CD label printer to print CD-R blanks so that they looked like the albums from all his favorite bands, put the CD-R media into a portable player, then burned the CDs at his PC after downloading the cables over the Internet. Oddly, he was always searched on the way in, never on the way out.
      - orbifold 12y ago
        If they did use a user account system with capabilities (CD burning would be one of them) this couldn't have happened. That probably a million other possibilities.
        MichaelCrawford 12y ago
        Alternatively, they could crack open an Internet RFC or two. Internet Protocol packets have a field for the security classification - unclassified, confidential, secret, top secret, there are other classifications that are themselves classified, as top secret ultra once was - as well as the compartment. I expect Bradley Manning had a top secret clearance, but I doubt he had the same compartment as was required to read diplomatic cables. Quite likely everyone was using commodity routers, such as one can purchase at Fry's. It must be expensive to purchase routers that enforce what has been in the Internet Protocol since the 1970s.
biafra 12y ago
Do you know in which part of the phones this is supposed to be in? In every cell phone? Without more details I call BS on this. It might be possible, but stating that every cell phone has it, sounds unlikely to me. I don't think it is part of the GSM specification, so what would be the reason that EVERY cell phone (Also non-GSM phones) has it?
- MichaelCrawford 12y ago
  I don't know. I don't think the Air Force would just make something like that up. It's not just a USAF policy, not to permit cell phones in secure areas. I know lots of people with clearances, none of them are permitted to bring cell phones into their offices. I applied to the Cyber Command in the Summer of 2008. What kinds of phones were in use at the time, in the United States? And the video did specifically say "every cell phone".
  - eli 12y ago
    That seems like a good policy even if most cell phones were immune to hacking.
    - tormeh 12y ago
      Everything that has the capability to record must be assumed to be recording, I would argue.
  - knd775 12y ago
    How do you know that those policies aren't in place to prevent a person from knowingly recording sensitive data with their phone? Was there anything indicating that it was specifically for the reasons that you gave?
    - MichaelCrawford 12y ago
      This policy is so widespread, and it has been the policy for so long, that I would be quite surprised were such a reason not to have leaked out by now. People with clearances all know about this maintenance mode. None of them ever explain the error of my ways, when I discuss it with them.
seekingtruth 12y ago
Stallman proven right again.
superpoliteuser 12y ago
http://en.wikipedia.org/wiki/Carrier_IQ http://en.wikipedia.org/wiki/Carrier_IQ
mortov 12y ago
My understanding is that it was this facility (in part) which was used to track & monitor ex-US Marine Toby Studabaker when he went "missing" around 12 years ago with 12 year old Shevaun Pennington. He was 'found' in a hotel room in Germany - despite his phone being turned off.
ars 12y ago
> that depicted a couple officers locking their phones into a grounded metal box - a faraday cage I once tried that using a metal lunchbox, with a tight fitting metal lid - the phone rang anyway. Anyone else ever tried it? And as a side note, be sure and turn off (or airplane mode) your phone if you do put it in an effective faraday cage, or you will rapidly drain the battery as the phone constantly tries - at full power - to find a base station.
- MichaelCrawford 12y ago
  One has to also consider the skin effect. Electromagnetic waves penetrate a conductor to a depth comparable to their wavelength, with an intensity that decreases exponentially.
- shit_parade 12y ago
  plastic bag and tin foil worked for me.
fulafel 12y ago
> There is a maintenance mode in every cell phone that allows it to be remotely turned on, that is, used as a listening device, without your knowledge. Sounds tin-foily, any references? This conspiracy theory has been making the rounds for a long time and there's no evidence for it so far. Some problems immediately come to mind: - would eat phone battery quickly to keep radio listening for these things - would be vulnerable to discovery, eg leaks from phone industry engineers, reverse engineering by tinkerers, etc - yet has stayed secret for a long time (assuming this isn't a new thing) More realistic would be exploiting a bug in the phone baseband firmware to get remote code execution, and then reprogramming the phone to do what you want. And reason enough to treat phones like you observed.
- RaleyField 12y ago
  > would eat phone battery quickly to keep radio listening for these things your phone already listens for incoming call signal, this would be just another type of signal.
  - fulafel 12y ago
    He was talking about turning the phone on remotely.
    - MichaelCrawford 12y ago
      Perhaps I should have been more clear: I wasn't claiming that this maintenance mode turns on the power to a phone, rather that if the phone is already powered on, the maintenance mode silently and invisibly turns on the phone's microphone, then transmits audio back to the cell tower. So if you leave your cell powered on, anyone who knows how to activate that maintenance mode can listen to what you are saying, without your knowledge.
- TeMPOraL 12y ago
  > More realistic would be exploiting a bug in the phone baseband firmware to get remote code execution, and then reprogramming the phone to do what you want. Or using baseband as intended to get remote code execution, and then on the cell company side wrap it up in a nice GUI or set of scripts, and voilà - you have the "maintenance mode" mentioned.
spacecowboy_lon 12y ago
That also to stop the oficers from recording the meeting - a mate of mine worked for qinetiq and they have strict rules on phones being found with a phone with a camera inside his work place woudl have been a gross misconduct offence. I have been for DV clearnce job interviews (The FO at Milton keynes) and you can have NO electronics on your person past the reception area.
kristoffer 12y ago
The presence of such a mode has never been proven in any commercially available cell phone. Your anecdotal USAF story does not prove anything either. The story in the link has nothing to do with surveillance at the cell phone level. Its about interception/rerouting in the global phone network.
peterwwillis 12y ago
OTA updates are a pretty simple way to load whatever you want on the phone, and that just requires digitally signed SMSes, but signed with DES.
NietTim 12y ago
Sources would really be nice with this.

spacefight 12y ago

Of course we can be sure, that those fellows were not the first to learn about that. The hack of belgium telco Belgacom sees more light day by day. This system is broken beyond repair. We need to build it up from the ground, safe.

MichaelCrawford 12y ago
Someone is making encrypted Android phones in Switzerland, they said they would cost about $600.00, and should be shipping by now. They can interoperate with regular Android phones if those phones have their app installed. I don't know what happens, if one calls a phone that does not support encryption. Boeing is, or will soon be making such a phone, specifically intended for classified communication. I don't know whether they will be sold to the public.
- moe 12y ago
  There's also a few Apps for encrypted calls. The good ones are open source, such as RedPhone: https://github.com/WhisperSystems/RedPhone https://github.com/WhisperSystems/RedPhone

eyeareque 12y ago

One more reason to encrypt every bit we send and to use voip instead of the PSTN/Cellular voice.

Animats 12y ago

Signaling System 7 (SS7) is a big security problem. It's the packet-switched control network for the phone system, and it has very little security. It was designed in 1980 to be run only internally between phone switches. The main function of SS7 is call setup. All the switches along the route get their switching commands over SS7, not over the circuit-switched channel. (That went out with SS5, the old audio-tone based system). Call setup is preceded by "translation", turning a destination phone number into a route. That's done with query messages over SS7. This allows outsourced wiretapping. Verisign offers this as a service for telcos, so they don't have to deal with law enforcement themselves. http://www.verisign.com/static/001927.pdf http://www.verisign.com/static/001927.pdf Verisign, which also runs much of the US SS7 network (http://www.verisign.com/stellent/groups/public/documents/data_sheet/005169.pdf http://www.verisign.com/stellent/groups/public/documents/dat...) is well placed to do this. All they have to do for a wiretap is to have the translations for a source or destination number reroute to a wiretap point, which then records while forwarding to the desired destination. As an SS7 provider, they already have all the call metadata. Vulnerabilities come in because more parties now have SS7 access. Cellular roaming and VoIP to landline routing are managed over SS7. So a large number of computers other than dedicated telco switches now have SS7 connections. A break-in at any of those points has wiretapping potential.

caio1982 12y ago
It's funny because some developing countries still use the now ancient R2 signalling and wouldn't be directly affected by this (just in connecting networks I'd assume). IIRC Brazil is still a big user of R2, unfortunately for those working with VoIP. Also China.
dchichkov 12y ago
A bit of a plug. If anyone is interested in playing with (doing research on) SS7 vulnerabilities, a few years back (five) I've participated in building a pretty cute test toolkit that allows one to sent/receive/parse/play scenarios using SS7/C7/3G/CDMA/.../SCTP/SS7 over IP/... packets on any level of the network. The list of supported protocols is available here: http://www.linkbit.com/platforms http://www.linkbit.com/platforms It follows standards and usually implements 100% of the protocol (including conditional constraints, etc). But also allows one to 'break' stuff and send custom/unsupported/broken fields. It is pretty cute, you can do most of the stuff just in the visual packet editors / flow editors and where necessary revert to python snippets. To get the feel of it, and see some pics: http://docs.linkbit.com/ http://docs.linkbit.com/ edit: and basically yes. as a protocol engineer and somebody very familiar with SS7/C7/GSM/.., once you have the access to the network (which can be done over IP!) I wouldn't be at all surprised, you could misuse it.

upofadown 12y ago

The only interesting thing here is the new attack at the radio level that allows call monitoring. It sounds like it might be easier than setting up a fake tower. It still sounds like it required an active attack though so in practice the difference might be all that important.

at-fates-hands 12y ago

An interesting read on the current state of SS7, circa 2013: http://blog.pt.com/vendors-eol-announcement http://blog.pt.com/vendors-eol-announcement The 3G/4G segment of subscribers will have a distribution of 3.4 billion using 3G (SS7) services and .9 billion using 4G services. The total outcome of this research indicates that a total of 7.65 billion subscribers, out of a total of 8.5 billion subscribers, will remain on SS7-based networks in 2017. Verizon went on to further explain that a final 2G/3G (SS7) sunset timeframe decision has not been made. The good news is vendors are not happy considering the availability of hardware is will decrease significantly over the same time period, hopefully speeding the sunset for this technology. Some service providers are planning on a strategy of consolidating their network, having no support and cannibalizing existing spare equipment for hardware support.

darkhorn 12y ago

In Turkish Ministry of Foreign Affairs it is forbidden to bring cell phones in to meetings. However it is totally okay to bring tablets and laptops into the meetings. Source: my friend works there. Edit: phones are forbidden due to the recent spying events.

yourad_io 12y ago
Do they allow 3G tablets or anything that falls in the not-a-phone-but-has-a-SIM/baseband proc? I'm assuming a GSM (or equivalent) baseband is the only thing separating smartphone from smartablet and smartlaptop nowadays, correct? If they allow 3G tablets, then this is a security-theater kind decision, aimed to appease "management", and we must make fun of them. If they ban all baseband-carrying devices, then this is a consistent policy that is paranoid about a very specific thing that, quite frankly, invites a lot of healthy paranoia. I wonder what it'll take to open up those baseband processors.
- eric_bullington 12y ago
  >I wonder what it'll take to open up those baseband processors. Project OsmocomBB: http://bb.osmocom.org/trac/ http://bb.osmocom.org/trac/
- darkhorn 12y ago
  They have internet access there. Why would someone use their phone while they have microphones and internet acces in their tablets and laptops... These people are clueless about technology. Also they use Windows.
- darkhorn 12y ago
  As far as I remember nobady checks wheter you carry a phone into a meeting. It is just forbidden. If they say that phone is forbidden it means literally that phone is forbidden, no matter smart phone or dump phone, tablet with 3G is okay because it is not a phone overall. You may show some slides ets you know... or you might want to connect to the internet...

guelo 12y ago

"anyone" can not listen to your cell calls. Only people that have access to inject commands into the SS7 network that your call is routed through can do that.

pbhjpbhj 12y ago
Or those that can create a pico cell that your phone connects to and then MITM your call. I gather the equipment is pretty accessibly priced now.
- frozenport 12y ago
  The expertise to do these things is the domain of well outfitted organizations, who have other simpler methods of making you talk. Indeed, electronic surveillance of is often used to protect agents from dangerous work.
  - uaygsfdbzf 12y ago
    The technology to do these things is open source and available here: http://osmocom.org/ http://osmocom.org/
    - frozenport 12y ago
      I'm not sure how to hack a mobile phone using this software? The expertise to find these kinds of exploits is hard to develop individually.
      - eric_bullington 12y ago
        >The expertise to find these kinds of exploits is hard to develop individually. Yes, but numerous people participating in the Osmocom projects have that expertise. Fortunately, they're interested in building an open-source baseband processor (among other cool things), and not in hacking into anyone's private communications.

deleted 12y ago

[deleted]

tiler 12y ago

A couple of random thoughts on potential applications/uses: 1. Alexandria needs to communicate with Bilbo. Alexandria has the privilege of being trusted by whatever organization she belongs to (be that her country, company, etc) and as such is unmonitored AFAsheKs. Biblo on the other hand is some fugitive-type and is unable, or perhaps unwilling, to enter direct communication with Alexandria for fear of compromising himself or his beloved Alexandria. Bilbo could then monitor Alexandria's calls for an encoded message via a protocol they predetermine. This protocol could take the form of linguistic or audio steganography. One could image all sorts of information being leaked by Alexandria. 2. More realistically this could be tool for bribery. Monitor a set of vulnerable targets, wait until they reveal something, take a bribe to stay quite. 3. Or, for the Machiavellian-minded leak information that was supposedly confidential between two parties.

jmnicolas 12y ago
I didn't understand anything. Could you explain it with Alice and Bob instead ?

lazyjones 12y ago

German state-controlled media and the Deutsche Telekom immediately reported that big carriers have already fixed the problem and are no longer allowing "unauthorized" requests for encryption parameters via SS7. ;-) (source: http://heise.de/-2503376 http://heise.de/-2503376 - sorry, German)

skidoo 12y ago

Of course there are insecurities, but this sounds like an opening shot calling for a "new" system to allow better security, or rather, a system even more easily controlled.

peterwwillis 12y ago

Really, none of this is surprising or new. If you're bored/curious, here's some fun reading on exploring/exploiting telecom networks. Spoiler alert: it's really easy and it has been forever. Big ups to Philippe Langlois for all his great research over the years. Interview: Telecom Security Expert Philippe Langlois on GCHQ Spying (http://www.spiegel.de/international/europe/interview-telecom-security-expert-philippe-langlois-on-gchq-spying-a-933870.html http://www.spiegel.de/international/europe/interview-telecom...) Vulnerabilities and Possible Attacks against the GPRS Backbone Network (http://critis06.lcc.uma.es/files/Vulnerabilities%20and%20Possible%20Attacks%20against%20the%20GPRS%20Backbone%20Network.pdf http://critis06.lcc.uma.es/files/Vulnerabilities%20and%20Pos...) Getting in the SS7 kingdom: hard technology and disturbingly easy hacks to get entry points in the walled garden (http://www.hackitoergosum.org/2010/HES2010-planglois-Attacking-SS7.pdf http://www.hackitoergosum.org/2010/HES2010-planglois-Attacki...) Telecom Signaling Attacks on 3G and LTE networks (http://www.slideshare.net/p1sec/telecom-security-from-ss7-to-all-ip-allopenv3zeronights http://www.slideshare.net/p1sec/telecom-security-from-ss7-to...) GSM and 3G Security (https://webcache.googleusercontent.com/search?q=cache:WlEd4HCpl48J:www.blackhat.com/presentations/bh-asia-01/gadiax.ppt+&cd=16&hl=en&ct=clnk&gl=us&client=firefox-a https://webcache.googleusercontent.com/search?q=cache:WlEd4H...) Locating Mobile Phones using Signalling System #7 (http://events.ccc.de/congress/2008/Fahrplan/attachments/1262_25c3-locating-mobile-phones.pdf http://events.ccc.de/congress/2008/Fahrplan/attachments/1262...) SCTPscan - Finding entry points to SS7 Networks & Telecommunication Backbones (https://www.blackhat.com/presentations/bh-europe-07/Langlois/Presentation/bh-eu-07-langlois-ppt-apr19.pdf https://www.blackhat.com/presentations/bh-europe-07/Langlois...) LTE Pwnage: Hacking HLR/HSS and MME Core Network Elements (http://www.slideshare.net/p1sec/p1security-lte-pwnage-v21 http://www.slideshare.net/p1sec/p1security-lte-pwnage-v21) Map of mobile network security (https://srlabs.de/gsmmap/ https://srlabs.de/gsmmap/) Rooting The HLRs Mobile And Critical Infrastructure Insecurity (https://archive.org/details/D3T202201308021200RootingTheHlrsMobileAndCriticalInfrastructureInsecurityPhilippeLanglois https://archive.org/details/D3T202201308021200RootingTheHlrs...) AURORAGOLD Working Group - Shaping understanding of the global GSM/UMTS/LTE landscape - from the Snowden leaks (government employees should probably not click this) (https://s3.amazonaws.com/s3.documentcloud.org/documents/1374178/auroragold-working-group.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/1374...) (https://firstlook.org/theintercept/2014/12/04/nsa-auroragold-hack-cellphones/ https://firstlook.org/theintercept/2014/12/04/nsa-auroragold...)

charlieok 12y ago

I just tried searching this entire comments page for the string “batman”. Incredibly, there were 0 occurrences. So I'll just add: this sounds kinda like that batman movie where they turned every cellphone in the city into a remote listening device (and then declared that nobody should have that kind of power).