5 ms·

Stingrays Go Mainstream: 2014 in Review

dang 12y ago
Url changed from http://venturebeat.com/2015/01/02/eff-law-enforcement-desperately-trying-to-hide-use-of-surveillance-cell-towers/ http://venturebeat.com/2015/01/02/eff-law-enforcement-desper..., which points to this.
guelo 12y ago
In the balance between police secrecy of "sources and methods" and government transparency we need to lean heavily towards transparency because preserving democracy is more important than fighting crime. As technology advances these issues are going to get creepier and scarier and as a society we need to have open debates about the powers that we're willing to grant governments. Every new crime fighting technology needs to be vetted by the public before police get access to them.
dthal 12y ago
I think the solution to this has to be mainly technological, not (primarily) legal. Fake cell towers are not NSA-level technology and it seems that they are being deployed in lots of places [1][2], probably by lots of different parties. If a bunch of people are doing it, changing the law won't help that much. Probably not all of these actors are 'legit' (police or whatever). The networks themselves have to be secured better so that this is impossible, or at least much harder, to pull off. [1]http://www.businessinsider.com/mysterious-fake-cellphone-towers-2014-9 http://www.businessinsider.com/mysterious-fake-cellphone-tow... [2]http://www.foxnews.com/world/2014/12/14/norwegian-security-probes-eavesdropping-tracking-devices-hidden-near-government/ http://www.foxnews.com/world/2014/12/14/norwegian-security-p...
hello_there 12y ago
I think someone knowledgeable should make a DIY guide explaining how to build a "Stingray". Only when "everybody" has one will governments be forced to demand more secure standards.
- marcosdumay 12y ago
  Is it possible to make a wireless network where one can not physically track the connected parties?
  - Intermernet 12y ago
    Using more than one base station will always allow triangulation on a signal. This will physically track the connected party, but will not, alone, identify the party.
- sespindola 12y ago
  I've built one a couple years ago with an USRP1 from Ettus[1] and OpenBTS plus FreeSwitch[2]. It's pretty straightforward if you know what you're doing. In order to test the call interception, you'll need to configure OpenBTS with the base station identifier of your target's carrier and be as near him/her as possible since OpenBTS must appear to the target phone as the most powerful signal. Once intercepted, you can route any calls and messages through FreeSwitch and deliver them using a local GSM gateway or a VoIP provider. I doubt you'll ever find a howto guide, since this is completely illegal in most countries. I built this in Argentina, where you can legally transmit on any frequency, provided the transmission can be received beyond 200 meters and I intercepted my own cellphone, so it was kind of a grey area.
  - sespindola 12y ago
    Forgot the links: [1]: http://www.ettus.com/product/details/USRPPKG http://www.ettus.com/product/details/USRPPKG [2]: http://wush.net/trac/rangepublic/wiki/freeswitchConfig http://wush.net/trac/rangepublic/wiki/freeswitchConfig
Intermernet 12y ago
Not sure if these could be used for an IMSI catcher, but a comment in one of the recent 31C3 presentations led me to this link: http://www.rtl-sdr.com/tag/baby-monitor/ http://www.rtl-sdr.com/tag/baby-monitor/ Baby monitors with SDRs! I didn't know these existed. I find this scary. Awesome, but scary.

dang 12y ago

Url changed from http://venturebeat.com/2015/01/02/eff-law-enforcement-desperately-trying-to-hide-use-of-surveillance-cell-towers/ http://venturebeat.com/2015/01/02/eff-law-enforcement-desper..., which points to this.

guelo 12y ago

In the balance between police secrecy of "sources and methods" and government transparency we need to lean heavily towards transparency because preserving democracy is more important than fighting crime. As technology advances these issues are going to get creepier and scarier and as a society we need to have open debates about the powers that we're willing to grant governments. Every new crime fighting technology needs to be vetted by the public before police get access to them.

dthal 12y ago

I think the solution to this has to be mainly technological, not (primarily) legal. Fake cell towers are not NSA-level technology and it seems that they are being deployed in lots of places [1][2], probably by lots of different parties. If a bunch of people are doing it, changing the law won't help that much. Probably not all of these actors are 'legit' (police or whatever). The networks themselves have to be secured better so that this is impossible, or at least much harder, to pull off. [1]http://www.businessinsider.com/mysterious-fake-cellphone-towers-2014-9 http://www.businessinsider.com/mysterious-fake-cellphone-tow... [2]http://www.foxnews.com/world/2014/12/14/norwegian-security-probes-eavesdropping-tracking-devices-hidden-near-government/ http://www.foxnews.com/world/2014/12/14/norwegian-security-p...

hello_there 12y ago

I think someone knowledgeable should make a DIY guide explaining how to build a "Stingray". Only when "everybody" has one will governments be forced to demand more secure standards.

marcosdumay 12y ago
Is it possible to make a wireless network where one can not physically track the connected parties?
- Intermernet 12y ago
  Using more than one base station will always allow triangulation on a signal. This will physically track the connected party, but will not, alone, identify the party.
sespindola 12y ago
I've built one a couple years ago with an USRP1 from Ettus[1] and OpenBTS plus FreeSwitch[2]. It's pretty straightforward if you know what you're doing. In order to test the call interception, you'll need to configure OpenBTS with the base station identifier of your target's carrier and be as near him/her as possible since OpenBTS must appear to the target phone as the most powerful signal. Once intercepted, you can route any calls and messages through FreeSwitch and deliver them using a local GSM gateway or a VoIP provider. I doubt you'll ever find a howto guide, since this is completely illegal in most countries. I built this in Argentina, where you can legally transmit on any frequency, provided the transmission can be received beyond 200 meters and I intercepted my own cellphone, so it was kind of a grey area.
- sespindola 12y ago
  Forgot the links: [1]: http://www.ettus.com/product/details/USRPPKG http://www.ettus.com/product/details/USRPPKG [2]: http://wush.net/trac/rangepublic/wiki/freeswitchConfig http://wush.net/trac/rangepublic/wiki/freeswitchConfig

Intermernet 12y ago

Not sure if these could be used for an IMSI catcher, but a comment in one of the recent 31C3 presentations led me to this link: http://www.rtl-sdr.com/tag/baby-monitor/ http://www.rtl-sdr.com/tag/baby-monitor/ Baby monitors with SDRs! I didn't know these existed. I find this scary. Awesome, but scary.