4 ms·

ErrataSec hit it in one IMO: http://blog.erratasec.com/2015/07/proxyham-conspiracy-is-nonsense.html http://blog.erratasec.com/2015/07/proxyham-conspiracy-is-no

ErrataSec hit it in one IMO: http://blog.erratasec.com/2015/07/proxyham-conspiracy-is-nonsense.html http://blog.erratasec.com/2015/07/proxyham-conspiracy-is-non...

jonah 11y ago
"An even funner talk, which I've long wanted to do, is to do the same thing with cell phones. Take a cellphone, pull it apart, disconnect the antenna, then connect it to a highly directional antenna pointed at a distant cell tower -- several cells away. You'd then be physically nowhere near where the cell tower thinks you are." That would be interesting.
- dzhiurgis 11y ago
  Wouldn't it be easier to get $20 USB modem with dedicated antenna connector? You'd still need to be careful about device IMEI, how you get your SIM card and load with credits.
- contingencies 11y ago
  If it became known to be deployed, what's the bet some Erlang hacker upgrades the cell tower firmware to detect probable directional antennae? How would that potentially work? Well, I'm no radio engineer but I know it's possible. Normally you receive signals of varying strength as users move throughout your cell. I'm fairly certain that sub-cell positioning metrics are already developed on the change between these various known signal states and directions. One would simply pick outliers (eg. with constant signal strength, or constant direction).
  - lawnchair_larry 11y ago
    Why Erlang?
    - DiabloD3 11y ago
      I assume he was referring to how a series of popular telephone switches from Ericsson had their software written in Erlang. The towers themselves would just be a mishmash of DSPery and C/C++, however. Probably, anyways.
    - hamiltonkibbe 11y ago
      An Erlang is a unit of load on a cell tower (or more generally in any telephony circuit). Edit: Not sure if this is what the parent was referring to, but if the tower software was written in Erlang, it's certainly an interesting coincidence.
  - kw71 11y ago
    This would be really easy by correlating signal strength measurements from several towers. Then, an analysis of these data would reveal unusual patterns that differ from what would result with the common isotropic antenna. This kind of correlation is already in use by mobile networks to narrow the location of emergency calls from handsets that are not sending GPS or other positional data.
  - x0054 11y ago
    What about people like me, who live with in range of just one cell tower. When ever I am within range of my cell tower at home, my signal always comes from the same direction, and roughly with the same signal strength. So far I have yet to be disconnected, though who knows, maybe I am flagged for suspicious activity :)
- gopalv 11y ago
  > You'd then be physically nowhere near where the cell tower thinks you are This wouldn't work with TDM networks (like GSM). The cellphone periodically has to produce a timing advance offset, so that the phone can send the signals ahead of its time slot, to arrive at the tower when its time-slot is active. So effectively, your phone measures light-path distance between the tower and your phone periodically, with the help of the tower (this happens in 1/2 km steps). This however isn't triangulation, so all my attempts to use TA + tower location to make a fake GPS (way back in 2004) ended up giving me erratic movements as I went up and down (and behind buildings). Faking Timing Advance would be near impossible, because it uses light speed (on the given day's humidity etc).
mahouse 11y ago
I personally think the arstechnica link should be replaced with this one.

ErrataSec hit it in one IMO: http://blog.erratasec.com/2015/07/proxyham-conspiracy-is-nonsense.html http://blog.erratasec.com/2015/07/proxyham-conspiracy-is-non...

jonah 11y ago

"An even funner talk, which I've long wanted to do, is to do the same thing with cell phones. Take a cellphone, pull it apart, disconnect the antenna, then connect it to a highly directional antenna pointed at a distant cell tower -- several cells away. You'd then be physically nowhere near where the cell tower thinks you are." That would be interesting.

dzhiurgis 11y ago
Wouldn't it be easier to get $20 USB modem with dedicated antenna connector? You'd still need to be careful about device IMEI, how you get your SIM card and load with credits.
contingencies 11y ago
If it became known to be deployed, what's the bet some Erlang hacker upgrades the cell tower firmware to detect probable directional antennae? How would that potentially work? Well, I'm no radio engineer but I know it's possible. Normally you receive signals of varying strength as users move throughout your cell. I'm fairly certain that sub-cell positioning metrics are already developed on the change between these various known signal states and directions. One would simply pick outliers (eg. with constant signal strength, or constant direction).
- lawnchair_larry 11y ago
  Why Erlang?
  - DiabloD3 11y ago
    I assume he was referring to how a series of popular telephone switches from Ericsson had their software written in Erlang. The towers themselves would just be a mishmash of DSPery and C/C++, however. Probably, anyways.
  - hamiltonkibbe 11y ago
    An Erlang is a unit of load on a cell tower (or more generally in any telephony circuit). Edit: Not sure if this is what the parent was referring to, but if the tower software was written in Erlang, it's certainly an interesting coincidence.
- kw71 11y ago
  This would be really easy by correlating signal strength measurements from several towers. Then, an analysis of these data would reveal unusual patterns that differ from what would result with the common isotropic antenna. This kind of correlation is already in use by mobile networks to narrow the location of emergency calls from handsets that are not sending GPS or other positional data.
- x0054 11y ago
  What about people like me, who live with in range of just one cell tower. When ever I am within range of my cell tower at home, my signal always comes from the same direction, and roughly with the same signal strength. So far I have yet to be disconnected, though who knows, maybe I am flagged for suspicious activity :)
gopalv 11y ago
> You'd then be physically nowhere near where the cell tower thinks you are This wouldn't work with TDM networks (like GSM). The cellphone periodically has to produce a timing advance offset, so that the phone can send the signals ahead of its time slot, to arrive at the tower when its time-slot is active. So effectively, your phone measures light-path distance between the tower and your phone periodically, with the help of the tower (this happens in 1/2 km steps). This however isn't triangulation, so all my attempts to use TA + tower location to make a fake GPS (way back in 2004) ended up giving me erratic movements as I went up and down (and behind buildings). Faking Timing Advance would be near impossible, because it uses light speed (on the given day's humidity etc).

mahouse 11y ago

I personally think the arstechnica link should be replaced with this one.