How a Hacker Proved Cops Used a Stingray to Find Him

Remember that getting subscriber data/metadata from ISPs requires a warrant, and that a single tower location could cover a 6-12 sq. km. area (plenty of space to hide in)

> Rigmaiden eventually pieced together the story of his capture. Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of apartments where Rigmaiden lived.

The take-away here, is that end-to-end protocols by neccessity as currently written send the src IP in the packet. If we'd designed IP to send the src IP as a payload, and had encrypted payload (TLS style) and then only had the destination IP in the outer packet, things might be different.

I've asked this question over the years since the 1980s: Given that we thought source based routing was a thing, its understandable we designed for simpler times with src IP in the packet but given its not a thing now, and privacy is, why do we still send the src IP in the packet? It doesn't mean anything useful, to most agents. NAT/CGN devices don't actually care, they want you to be consistent about which interface you arrive on, and the 5-tuple has it, but other things could be used which have no end-to-end impact. Beyond the NAT/CGN boundary, nobody cares, routing is solely on the destination and the ASN of the transits. Once at the destination, the payload is available, to find the originators address, to return things.

Src IP is not actually neccessary, in the IP layer. (in theory)

I was, for example, using VPN services and Tor well before 2008. And I've never been more than a gray-hat hobbyist sort of "hacker". Anyone seriously into criminal activity who didn't reliably hide their IP address was a fool, even then.

My point isn't to dump on Rigmaiden. It's just that articles like this contribute to the FUD about privacy being impossible now. The reality is that most criminals have horrible OPSEC. Especially when they're just getting started. And then they're careless about historical connections.

Article title: “proved”

EDIT: while we're here, do you have a single "start here" article/site for the basics of less-poor OPSEC?

Whether the law allows or should allow the use of such devices, and whether with or without a warrant is up for debate, but it can't allow hiding their use, not in an open society with due process. It was always bound to be the case that some judge would think so, that some police note would leak this, that some police office would testify about it, that a Snowden would leak it, or that the public would figure it out anyways (especially when it comes to active devices).

So I wouldn't blame bad OPSEC on the part of the police here for anything. (Not that you are. Just saying.)

The defendant in the story, BTW, is not very sympathetic. In general, for test cases, one wants a sympathetic defendant. That's because judges are at least somewhat biased, typically. A judge has to imagine a much more sympathetic defendant and set of circumstances in order to convince themselves to continue with a line of argument that leads to the defendant being cleared on a technicality.

Security through obscurity has limited and unpredictable usefulness. Good OPSEC can delay a leak, maybe. But OPSEC is still much harder for defenders than attackers.

The article doesn't mention it, but SURELY agency planning about this particular secret covered the next steps to take when it leaked.

Ordinarily good OPSEC has defense in depth. Secrets should have limited useful lifetime. "Stingray" as a secret doesn't: once bad actors know their phone locations can be targeted, they can't un-know it.

It should be obvious to the holders of secrets when they leak, so they know they're compromised. Having this "Stingray" crop up in a big mess of bankers' boxes full of court docs isn't obvious.

Security by obscurity needs a plan B ready to roll at any time.

Much better is transparent security, where the tech is well known, the actual secrets have limited useful lifetimes (key-rotation and forward secrecy for example), and reasonable controls exist (search warrants in this case).

If law enforcement executives don't know this, they need to go back to school. But they probably do know it, and they're practicing security-by-obscurity on their plan B.

(I don't defend somebody who stole large quantities of taxpayers' money. Not at all. But the rule of law--search warrants--is vital.)

"Use of stingray technology goes back at least 20 years [ <= 1994]. In a 2009 Utah case, an FBI agent described using a cell site emulator more than 300 times over a decade.... "

"...Shimomura was sitting in the passenger seat of a Raleigh Sprint technician's car, holding a cellular-frequency direction-finding antenna, and watching a 'signal-strength meter display its reading on a laptop computer screen.'"

This sounds, perhaps, functionally equivalent to a modern stingray, but I suspect it was not operating as a cell-site simulator. The hardware/software required at the time to "man in the middle" Mitnick's cellular calls would not have fit comfortably with Shimomura in the passenger seat of a car and would not have run smoothly on a mid-90's era laptop. Also, the bandwidth required to forward the connections would have only been achievable over directional microwave or landline which seems unsuitable for use in a moving vehicle. However, this was the dawn of digital cellular networks. The calls would not have been encrypted in any way at the time so tracking the source of specific emissions using triangulation would have been fairly trivial, especially with the assistance of a Sprint technician with access to the CDMA code Mitnick's handset was using at any given time.

Actually, I just checked and it seems Sprint didn't launch its PCS network until later that year[0] so it's possible the network in question was analog(?), making simply "listening in" even easier, without having to simulate anything.

[0]http://articles.baltimoresun.com/1995-11-16/business/1995320...

"Several months later, in April 2015, the New York Civil Liberties Union (the New York State chapter of the ACLU) managed to do what no one else could: successfully sue to obtain an unredacted copy of the NDA that the FBI had law enforcement agencies sign when they acquired stingrays"

Really the term hacking could use more consistent sub-definitions per type. Social engineering is well established but there isn't even a uniform term for quickly conveying the nuance of say cracking DRM offline vs getting in a server.

[0] https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec...

[1] https://github.com/CellularPrivacy/Android-IMSI-Catcher-Dete...

Like many cases involving stingrays, the charges were essentially dropped once challenged in court.

There should really be some sort of CPU/power budget enforced by one's phone on a per page basis. If there's no user action going on, a page should only be allowed to run a certain number of instructions.

P.S. Yes, people are paying power and time (cpu/personal) to watch ads to pay (?!) for websites and provide private information.

The main drawback have been that people rarely label apartment doorbells anymore, so if you don't know which button to press you're in trouble. Another is getting hold of old friends if you don't know their email address (I don't have Facebook either).

Overall, I'm fairly content with the situation, and am seriously considering not getting a new one. Another benefit is that I'm more likely to bring my laptop if I go somewhere, and thus when I do connect to the internet and have time to kill, I often get work done instead of mindlessly browsing HN/reddit or playing games.

This is a little extreme, but I've started turning off my phone or putting it in airplane mode when not expecting a call.

In addition to not being as distracted, I've had a marked decrease in spam calls - I think they tend to mark phones that repeatedly send them straight to VM as "cold".

I leave it off most of the time, but I have to be on-call for my day job every few weeks and can't really not have a phone then and still keep my job.

It's a shame that phones are so closed and proprietary. I looked into changing a phone's IMEI number, and turns out that's illegal in most places and a serious no-no. How can there even be a law like that??