Hacker News Reader

Comment by brianpgordon | Hacker News Reader

Do phones not do any kind of cryptographic verification that the cell tower is real and that mobile data is sent securely between the phone and the tower?

In 2016?

View on HN

For 3G/4G networks there is strong mutual authentication between the device and the network, for 2G(GSM) networks only the device is authenticated so these interception devices work by jamming the 3G/4G bands forcing the device onto the (fake) 2G network.

Could have sworn that even though a more recent network is the preferred one at that time, the older ones are still connected and listening to provide a smoother handover experience.

Depending on the device you may be able to tell it to use newer network only though (my somewhat aging Android device can opt for UMTS only for example).

Which makes me wonder how Stingray/Hailstorm works. Does Harris Corp have a universal key for LTE?

Best i can tell, stingray is a passive device.

It just use a directional antenna to listen for the "keepalive" exchange between cell tower and device, focusing on a specific IMSI.

Also, even if your device is currently using LTE or similar, the GSM (or whatever 2G radio it has) will still be on and talking to the relevant network (unless you specifically tell the device otherwise, and the OEM allowed you to). This to provide a smoother handover should the LTE signal drop too low.

Hailstorm on the other hand is basically a jammer tuned to 3G and 4G frequencies, thus forcing any devices in range to drop down to 2G. For the general public a jammer would be a big nono, but law enforcement is a different matter.

IMSI catchers (like Stingray) are not fully passive devices. They have an operation mode where they broadcast a signal that appears to come from a legitimate cell phone tower. This captures traffic from all devices within range, targeted or not. This is why they are often called "cell site simulators" because that accurately describes how they are often used. For more information, check out this EFF page.

https://www.eff.org/sls/tech/cell-site-simulators

...but how? Comments above imply that 3G and 4G are protected with strong encryption/authentication. How is a Stingray capturing metadata from calls and SMS?

I was under the impression that Hailstorms either have valid cell tower certificates (dunno if wireless carriers are complicit) or they exploit the vast quantity of modem firmware bugs.

http://www.ee.columbia.edu/~roger/ShmooCon_talk_final_011620...

I thought Stingray was active because you can detect it if you have the right firmware.

http://www.slate.com/blogs/future_tense/2014/12/31/snoopsnit...

Also, I thought Hailstorm was LTE only (and doesn't degrade to 2g).

https://insidersurveillance.com/deciphering-harris-hailstorm...

there's a feature in cell modems that can indicate radio link encryption/auth..put on tinfoil hat...and it's disabled in pretty much all phone firmware

http://www.jmeds.eu/index.php/jmeds/article/view/Enabling_th...

https://github.com/PrivacyCollective/Android-CipheringIndica...

What's the point of such a feature anyway? I don't want my phone to even connect to such tower, just tell me there is no service available.

Not even to connect in an emergency? Maybe "no service, click to attempt unsecure connection" would be better.

If you're willing to give up service when connecting to an untrusted source, then just use an always-on VPN and VOIP for voice + some tcp based messenger for SMS.

https://code.google.com/p/android/issues/detail?id=5353

And in the world of TLS, this is called a downgrade attack and treated as a serious problem...

Indeed! A very good advice that read on this topic was this one:

As a rule of thumb, any security protocol that contains lots of "MAY" parts (options) in its specification is suspicious. Even more so if the security layer itself is optional. Ideally, a security protocol contains no "MAY" parts, not even "SHOULD" parts, but only "MUST" parts.

(Not sure where I read this, or who wrote that. So I'm paraphrasing it here. Maybe it's common sense without a single attributable source.)

Indeed. But I haven't come across any phones that let you specifically disable 2G(GSM). Most let you disable 4G or 3G, or let you prioritise one over the other, but disabling 2G altogether seems to be missing.

My Blackberry Priv lets me select any combination of LTE, 3G, and 2G. I currently have it set to use LTE and 3G only. That's the only phone I've seen with that feature, though.

On Android dial [star]#[star]#4636#[star]#[star] in the phone app and you can change what types of cell networks can be connected to. Apparently doesn't work on all phones, but definitely works on my stock Nexus 5X on Android 7.

The cell tower is trusted, and the preferred cell tower is the one with the strongest signals. That's literally the entire selection strategy.

Cell towers also choose the encryption that the cell phone should use. I don't think any currently available phone notifies you when no (A5/0) or weak (A5/1) encryption is used.

And then there is the whole "notification fatigue" issue, where people will dismiss or ok notifications because they get so many in a day.

For UMTS and LTE, yes.

GSM is the problem here. Jam the others, and the phone falls back to 2g.

2g needs to die.

It is. It's being shutdown. I believe all/most carriers are doing so, which is problematic for lots of cheap iot solutions.

https://www.business.att.com/content/other/2G-Sunset-FAQ_201...

Elsewhere in the world UMTS is being retired while GSM is being retained because of all the devices (switches, sensors, etc) that use it.

Kinda weird too considering you can run GSM in the HSPA guard bands without a large degradation of HSPA performance.

Typically HSPA is 5mhz+5mhz FDMA, but the carrier is only 3.6mhz+3.6mhz and can be slimmed to 4.2mhzx4.2mhz on Ericsson equipment. NSN equipment can go as low as 3.8x3.8.

In a slim HSPA situation you can run multiple 0.2x0.2 GSM channels.

LTE I've seen all over deployed in 5mhzx5mhz, but I've never seen the 3mhzx3mhz or 1.4mhzx1.4mhz configurations in the wild (they would overload easy).

Best i can tell, it is for cost reasons.

Non-phone GSM devices are widely operated because of low cost and low data speed needs (most of them just ping a SMS in some direction or other).

UMTS deployments are more likely to be for bandwidth needs, and thus more likely to have moved to LTE setups already.

Sprint has 3x3 deployed on band 26 in some boundary areas of the ibez. There have been some sites spotted in Columbus, Ohio along the ibez boundary that are 3x3 instead of the 5x5 Sprint has deployed everywhere else that's not within 100 km of Canada or Mexico.

This probably has to do with the historic split between 2G/3G technologies among the major cellular carriers in the US. In the US if you want or need true nationwide coverage (say you are selling a retail IoT device and your customers expect it to work nearly anywhere) you pretty much have to go with AT&T or Verzion and switching a 2G or 3G device between them is impossible. This gives those companies a lot of power to dictate to customers what technologies they can use with their networks.

Since LTE is the lowest common denominator technology between all carriers (and LTE is the only cellular technology with hardware that supports all cellular frequency bands in the US) the cellular market in the US is being pushed very strongly in an all-LTE direction. With the inclusion of Cat-M1 and Cat-NB1 modes in LTE release 13[0], LTE will soon be usable even for low-power IoT devices. AT&T and Verizon are already racing to support those standards on their networks.[1]

[0] https://www.qualcomm.com/invention/technologies/lte/lte-iot

[1] http://www.fiercewireless.com/tech/verizon-at-t-both-claim-l...

The mess that is US mobile protocols and frequencies is what makes me cringe when the rest of the world these days looks to USA for the "latest" in mobile.

Damn it, Nokia had a Symbian phone you could use as a basic desktop for emails and surfing back when iPhone and Android barely did video out (and had to kill the phone screen to do so at least on Android). The mobile world basically came to a standstill, if not went backwards almost a decade, because everyone turned to the odd duck out to lead them into the future...

Actually only AT&T is scheduled for a 2G sunset right now. Also I think one of the Northern European countries is choosing to maintain the GSM network and then retire UMTS. They're going to have a GSM for IOT and LTE for mobile communications. It's kind of insane. Wish I could find a source...

Less insane when you consider the DDOS attacks from GSM connected IOT devices should be less bad than UMTS/LTE connected ones :) .

2020, where the baseline packet wind of billions of compromised GSM IoT devices is an expected and handled feature of the internet.

And a root nameserver DDOS is just like a coronal mass ejection?

"I was born before there were network storms, son. You could load Wikipedia whenever you wanted. Truly, it was the best of times."

I don't think many GSM carriers allow internet originated, mobile terminated traffic, even for IoT. Mass compromise of IoT is going to be way less trivial for GSM capable devices than things on standard wifi.

What I'm trying to say is that while your quip is entertaining:

a) it's impractical to scan/compromise IoT devices remotely without a stupid design (by IoT standards stupid, btw- not regular internet design- we're talking REALLY REALLY STUPID).

b) I would bet my mortgage that the logic you are presenting was never considered by the relevant carriers. They're not that smart.

> They're going to have a GSM for IOT and LTE for mobile communications. It's kind of insane.

I don't think this is that insane. I doubt there are many devices that only support UMTS, but there are tons that only support GSM, including many in embedded systems that can't easily be upgraded. So by using most of your spectrum for LTE, you get spectrum efficiency, and supporting GSM you can support everything that doesn't do LTE (just not at high speeds).

I think it is KPN in The Netherlands.

Not quite true. Verizon is planning to sunset 2G in 2019 [1], and is making efforts to get customers off 2G before that (similar to what AT&T has been doing). They are also rumored to be planning to shutter 3G in 2021. This leaves only T-mobile and Sprint in the US market providing longer-term 2G support, and their coverage is not great if you need to deploy devices outside major metro areas.

[1] https://www.wirelessweek.com/news/2016/07/verizon-targeting-...

Verizon and Sprint CDMA is technically a 3G technology, not 2G.

Don't lots of phones still send SMS & voice calls over GSM/CDMA? I know VoLTE is appearing, but slowly & only on a couple flagship devices, and quality degrades faster with loss of signal...

Haven't actually seen the signal degradation issues you speak of, probably offset by being able to use a lower band than GSM or HSPA for my carrier.

Carriers have made it a policy to not whitelist imported devices for voLTE. IMEI needs to be whitelisted at carrier AND carrier file installed in phone needs to have support turned on. Either thing missing, no voLTE for you.

EDIT: Forgot to mention, non-voLTE still signals with LTE for incoming calls and SMS, it'll handover to HSPA/CDMA/GSM within about 2 seconds of the signal coming in. Unfortunately I don't have specifics of this process.

Actually i think most SMS is handled via "WAP" these days, meaning that it is carried as a short duration data connection rather than as a special packet in the cells control channel (GSM, dunno about how CDMA implemented it).

the GPRS setting is blocked on featurephones. Still opts for CSD sending there. Newer devices send over 'IMS' (which is voLTE, and also part of HSPA+)

It was a funny loophole to get unlimited SMS on T-Mobile back when they just changed name from Voicestream.

I guess it depends on where in the world one lives.

I'm not American, and thus my phone is free of carrier tampering.

I even learned about the SMS over GPRS (thanks) thing because a relative of mine once owned a phone where we had to turn it off to actually get reliable SMS delivery, as it defaulted to GPRS mode.

That doesn't solve anything as long as your phone supports 2G and falls back to it when 3G/4G are unavailable (i.e. when being deliberately jammed).

There was a very informative (terrifying?) talk at Defcon 2012 where it was demonstrated how easily you can pretend to be a GSM base station. Not sure if any of the vulnerabilites have been addressed yet, four years later.

You can watch the talk here: https://www.youtube.com/watch?v=xKihq1fClQg

You're using GSM here which is from 1991. It may be 2016, but your phone still primarily uses or falls-back to 1991 era protocols. Protocols which are the de facto global standard for cellular communication.

And sadly had cryptographic modes that were intentionally weak because the cold war...

In fact argument was because of the cold war encryption should be strong. But later was intentionally tailored to allow wiretapping.

It's a collective action problem. How do you incentivize an upgrade while allowing for seamless fallback? For billions of devices made by thousands of manufacturers? Which access hundreds of different carrier networks around the world?

I think you need some industry leader to push for this. Apple could do it, or possibly Google although they have a hard time exerting influence over Android device manufacturers.

Apple and Google aren't going to do anything. If you want someone to change it talk to Ericsson, Nokia and Qualcomm.

Well, here's the deal. They can't do anything as it would be a potential quality of service issue to the end user if GSM were disabled currently. Can't blame the vendors either, they built the hardware years ago that operators continue to operate. It's like wanting to blame Ford and Chevy because you bought a car from the 1950's and it doesn't have airbags.

T-Mobile and AT&T are the national carriers supporting GSM through most of their footprint, AT&T is phasing out their network at the end of the year. T-Mobile moved to A5/3 to try to slow down eavesdropping a bit. There are more rural carriers who aren't in a rush to upgrade and probably still use the older ciphers.

Currently, I am on T-Mobile. There are a few areas that never saw HSPA deployed, and voLTE is not supported on all devices and also suffers separate outages. GSM is needed in those situations as fallback.

Operators would prefer to not have customers complain about outages due to accidentally having GSM turned off. So many phones don't have the option to disable.... though I'd argue now with low band LTE, the footprint is becoming larger than GSM.

I would expect Apple to whitelist 'disable 2G' option sometime in the future for AT&T sims. If not just disabling it outright (unless gov pressure gets in the way)

EDIT: as noted below, some manufacturers/OS you can set 3G only. Android is pokey about it on some devices. With Blackberry 10, I have the option to change network generations on T-Mobile, but not if I put an AT&T sim in.

Interesting, you could set Android phones to 3G only since I can remember (2010).

I just checked my phone and I can indeed do that ("3G only"), though if I wanted 4G, the only option is to enable "4G/3G/2G".

You may be able to disable it through the data settings menu. On sprint it's

    *#*#data#*#*

For my phone it is

    *#*#service#*#*

then Service Settings in the menu.

Indeed, there are more options there, cool!

You have to remember that GSM, which provides fall back for most providers, was framed as a standard in Europe in the 90s. So when you wonder "why is this so insecure?", the answer is not naivete on the designers' parts.

Reply on news.ycombinator.com