Hacker News Reader

Comment by pmoriarty | Hacker News Reader

I was walking around San Francisco the other day and suddenly noticed that my phone had switched from its usual AT&T provider to "China something" (maybe "ChinaNet"? I don't remember exactly what it was, and it was only there briefly). And then I got a text saying:

  Welcome to the test network.  Your IMSI is IMSI:  346234543252301

Not very stealth in this case. And I'm still not sure what it was. It went back to AT&T after I walked around some more.

View on HN

This was likely someone running a test / dev network using OpenBTS, which is open-source software for GSM base stations. The exact phrasing of that message is the default registration message for the software: https://github.com/ttsou/openbts-p2.8/blob/master/apps/OpenB...

Why would it take over as my provider? Aren't there any safety measures to guard against that?

2G networks have basically one way auth. The phone auths to the network but the network doesn't auth to the phone. This is an oversimplification but basically how it works.

Correct. Authentication of the network was added in UMTS/3G.

Nope, none at all. That's how law enforcement like it.

This is not entirely true. LTE is authenticated. If you force your device to not allow any base station using an older protocol (to prevent downgrade attacks), you should be fairly safe. The problem is that most phones will accept a base station that says "No, sorry, can't do LTE, how about this unauthenticated 2G AP instead?" If you are ok with your phone not having network in rural areas, setting it to LTE-only is a reasonable mitigation (assuming your device supports this).

Unfortunately, I don't believe iOS allows selecting the protocol. Android certainly can.

Just checked and iPhone does not seem to have LTE only option.

Are you saying that companies are required to enable this by default?

Some of the other comments are that a 2G tower tells a phone whether it's allowed on or not, but that the phone doesn't have any verification in the other direction. That's just the design of 2G cell networks. It's not an optional setting.

Other comments say that LTE networks authenticate in both directions, so you're safe if you can set your phone to LTE-only.

It's not taking over, rather your phone selects the strongest network subject to partner roaming agreements.

Doors it follow that everyone wandering into that radius for the same text?

Not really, GSM basically connects to the strongest signal with the right codes.

This is a good DefCon talk about how to spoof carrier networks:

https://m.youtube.com/watch?v=xKihq1fClQg

Could conceivably have been a temporary test network, run by a Chinese mobile manufacturer. Typically they'd be doing on-location testing of their hardware. I used to do a lot of this kind of work with Chinese and Korean companies and we'd frequently pitch up in a city in the US, Europe or Asia with case loads of GSM test gear.

Also illegal. Call FCC.

I filed a complaint with the FCC regarding a suspected jamming device. I'm pretty sure they didn't even read it. They forwarded the complaint to my wireless carrier, who sent a reply saying that the complaint had nothing to do with them and that my original complaint had reported a jammer. The FCC closed the complaint and considers it satisfied.

This is the gold standard example of the FCC's behavior towards cellular spectrum. They have a very different mission when it comes to HAM spectrum.

Cellular spectrum: Grandstand and extract cash from the carriers.

Ham spectrum: Antenna-laden vans canvasing neighborhoods for radio pirates.

It is despicable.

> Antenna-laden vans canvasing neighborhoods for radio pirates.

Got any photos, or links to accounts of these? I did a quick google image search because you think someone would have caught one in the wild by now, but no.

Here is a video of the inside of one. https://www.youtube.com/watch?v=QIGAOLJh-XE

Wow. Well, thanks for that! That's pretty bizarre!

I don't! I only have stories from radio pirates.

In this case, the complaint is unauthorized radio operation.

Cool, this is the agency I want to have on the job of regulating the Internet so it is "neutral".

There's ways [1] to set up a rogue BTS / IMSI catcher that is seemingly legal [2] - by using US amateur radio bands (that are used as GSM bands in other parts of the world), not using encryption and spitting out your callsign once in a while.

[1] - https://www.youtube.com/watch?v=xKihq1fClQg

[2] - You should not take legal advice from strangers on the Internet.

Sometimes there are reserved parts of the spectrum for test networks you can get assigned for a limited time, the CCC had a GSM (and some 3G I think) network for many years.

Using the 33cm band is a nice trick.

Reply on news.ycombinator.com