How to Block Stingray Devices | Hacker News Reader

How to Block Stingray Devices

oaklandmofo.com

109 pointsjohnny31357 comments

When sincerely concerned about stingray devices it might be a better idea to either invest in a professional detection appliance or to install applications such as AIMSICD. ( foss/free) If you only deny 2g connectivity; it provides no certainty against being stung and you won't know if you are a target.

https://github.com/CellularPrivacy/Android-IMSI-Catcher-Dete...

Do you have information on professional detection equipment?

Detection apps are known to be ineffective. It's mostly because IMSI catchers comply with the standard. Your baseband will fall for that - there's not much useful information to be passed to the operating system - or even an app.

Most firms who sell lawfull interception appliances also sell the appliances required to protect, detect or mitigate against it. Usually they only sell their appliances to law enforcement, the militairy and intelligence agencies after signing a NDA. The legality is often dubious, and atleast some are nothing but a expensive user friendly box around GNU radio, osmocom and very little code of their own. ( But my knowledge could be dated. ) If you so desire mail me for a list of names, but i'd rather not post them here connected to my identity.

I won't contact you in that matter. I get an idea from what you've said, thank you.

While the idea behind the app is great, that one specifically is abandoned and should be considered non-working.

I have struggled to come up with a way of asking this neutrally, and I believe in a right to privacy and think "nothing to hide, nothing to fear" is nonsense, but seriously... wtf are people doing that they are "sincerely concerned about stingray devices"?

The article mentions attending protests as one such "suspicious" activity.

They live in areas with crime. And don't want to get their phones picked up in others' investigations.

Probably reading articles about the massive proliferation of private and State Stingrays...

> So they stand between you and the tower and sift through the transmission first. This means they can now intercept data on that transmission. I don’t know what they can do with it, and there is no real clear information on what data they can get. They do say metadata and access the cellphones internal storage, so that is enough to want to block the Stingray.

Cellphones internal storage? Seriously?

"Service update" SMS messages can write certain things to the SIM card and other aspects of the phone without user interaction.

(this machinery is rather hard to google for and I'm not sure if it has a better name in the official GSM documents)

That's interesting, it sounds like something that was being repeatedly sent to my Motorola flip phone in China in 2007. I had the ability to reject this SMS/MMS thankfully.

No, that was most likely spam. You cant even see service updates(OTA), just like silent sms(type0) they are invisible to the user.

https://github.com/CellularPrivacy/Android-IMSI-Catcher-Dete...

I do not know the specifics of the Stingray, but I can tell you more similair "lawfull interception" devices exist. These devices "talk" with your Baseband; the radio in your phone that runs it's own OS. Many of these can do DMA to with the memory of your "phone" / ordinary soc. Theoretically, a exploited baseband could allow the lawfull interception device to read and write to your internal storage and more. I have not read about this happening in the wild yet.

I can't speak for Google devices but per Apple's iOS security whitepaper (page 41) [1]:

"To protect the device from vulnerabilities in network processor firmware, network interfaces including Wi-Fi and baseband have limited access to application processor memory. When USB or SDIO is used to interface with the network processor, the network processor can’t initiate Direct Memory Access (DMA) transactions to the application processor. When PCIe is used, each network processor is on its own isolated PCIe bus. An IOMMU on each PCIe bus limits the network processor’s DMA access to pages of memory containing its network packets or control structures."

[1]: https://www.apple.com/business/site/docs/iOS_Security_Guide....

PS4 PCI-E accesses were protected with an IO MMU too, but they managed to screw it up. So that doesn't necessarily mean that it's safe.

Indeed even Apple's MMU was bypassed by Google Project Zero [1], but it still significantly increases the cost of exploitation.

[1]: https://googleprojectzero.blogspot.com/2017/10/

Oh, totally. It's an important part of modern defense in depth. 'Just because they said they turned on the IOMMU doesn't make it bulletproof' is all I'm saying.

It does mean that SDIO or USB-only access is safe.

Of course, it's not 100% safe, but the lack of DMA moves the control over safety from the modem firmware to the application processor.

You'd be surprised how unsafe those are too, even though they aren't RDMA protocols. USB and SDIO stacks aren't really designed with malicious input in mind; it's like the 90s all over again if you think of those as the network protocols they are.

That's right, any kind of communication opens up some form of attack surface. Eliminating DMA is still worthwhile by reducing its total size, and shifting more of the implementation to the softare stack gives the device owner (hopefully the user) more control over the attack surface.

On modern phones Stingray devices are just one of the many tools that can be used to gain access to private communications and data. Any app requiring access permissions to everything is a potential vulnerability that can be exploited by 3rd parties (not to mention closed blobs etc); in this context smartphones are all things considered much more vulnerable than old 2G ones. Not being a target of interest for the police myself, I will rather trust my old obsolete 2G only dumb phone because the chances of it being spied upon by Google, Microsoft, Apple, Facebook etc. and associated parties are zero, zero, zero and zero.

What exactly are the practical consequences of being spied on by GMAF, compared to law enforcement?

You'll see a targeted advertisement, in place of an untargeted one?

The problem with being spied upon by law enforcement is that it's not you who decides whether or not you're an interesting person. They do.

Law enforcement agencies can (and do) purchase ad targeting profile data, and can also force warrantless searches of commercial databases, at least in the US.

They also can legally (and do) intercept things like backup replication streams of the big providers (they did this to yahoo years ago, for example).

My rule of thumb is that if any big consumer cloud service has it, then law enforcement does too.

Since the data is gathered using gray-area / illegal techniques, it will never be used in legitimate ways in court, which means it will only ever be used to further violate the rights of private citizens.

> Law enforcement agencies can (and do) purchase ad targeting profile data

Ad targeting profile data isn't typically sold in a way that's particularly useful to LE. It's the most valuable thing the ad networks own. I can't call up Facebook [1], and ask to buy your demographic profile. I can call up Facebook, and ask to buy the ability to show ads to people fitting your demographic profile.

Data from big providers, that ends up in the hands of law enforcement, is gathered through one of two ways:

1. Legitimate requests for access, with a judge signing off on it, an associated paper trail, and some pushback from the companies.

2. NSLs, with a secret judge signing off on it, and nearly no paper trail, and some pushback from the companies.

As far as I'm aware, #1 dwarfs #2 in frequency of access, and is also a completely legal, above-board way for LE to operate.

Stingrays, on the other hand, are much more like #2.

I mean, if you're not going to go through the trouble of protecting yourself from a Stingray, I understand. I occasionally jaywalk, and don't always cook my meat to 'well-done', wear mixed fabrics, and may have played hokey during my last dentist appointment. It's a risk/hazard sort of thing.

But if type #2 LE access is what you're concerned about, then you should probably look into dealing with Stingrays.

[1] Actually, I guess I can, as we discover with the train wreck of a platform partners program. And I am shocked that it is that much of a train wreck. Still, I can't buy your profile from Apple, or Google, or Microsoft.

"What exactly are the practical consequences of being spied on by GMAF, compared to law enforcement?"

Should law enforcement order them to relinquish all data about someone wrapped in a gag order, they get all information they need without that someone even noticing.

You believe you are not of interest to LE, and therefore have no need to protect yourself from a Stingray.

I disagree, but if we were to accept that premise, then you shouldn't really concern yourself with NSLs, either.

So, besides LE taking an interest in you, what are the actual consequences of FAMG spying on you?

I think I am not of interest to LE today, but who knows what could happen in a few years from now. Should the wrong people get in power I don't want them to know what's in my head as much as I don't want any potential employer to know about my ideas. The point is that whatever information they collect today about people, it stays in their servers forever, ready to be scraped through AI to build a profile.

It’s worth pointing out that even the author admits that the newer Stingray II has 3G/4G support. I think this is probably related to known insecurities in the AKA protocol, as researchers have recently found [1]. It looks like call interception isn’t so straight forward anymore, but IMSI capture and approximate location capture are alive and well.

So unless you can verify that only Stingray I is deployed in the vicinity, I think it’s a stretch to say that the Stingray product “doesn’t care” about anything other than 2G.

[1] https://www.blackhat.com/docs/us-17/wednesday/us-17-Borgaonk...

Works on some mediatek based phones

https://play.google.com/store/apps/details?id=kz.galan.antis...

What might me important for some reader: shutting off 2G services means that you won't have telephone voice services, if your operator doesn't support voLTE.

No, there's also 3G as well, remember. My phone allows 2G, 3G, 2G and 3G, 3G and 4G, or 2G and 3G and 4G network selections in its settins menu (Android 7, Sony)

Don't all phones have this in "Settings"?

e.g. Settings-Connections-MobileNetworks-NetworkMode

Also, will my phone even bother with 2G if LTE, 4G, or 3G is available?

You can force a phone into 2G handshaking, that's how stingrays work.

Okay, thanks for the explanation.

Meanwhile, setting my Samsung Galaxy S9 to no-2G gives me a warning message that cannot be dismissed: "This setting turns off 2G service. If 2G service is off, some app..." (the remainder can't be viewed).

> (the remainder can't be viewed).

Sounds like terrific UI design

Samsung takes something that works. Then goes out of their way to make it worse.

Especially given that you can't even expand the message to read all of its intended contents.

Maybe it saves a few milliseconds of battery life every charge.

Also like their QA team is slacking, if they have one.

> if they have one

I believe they have a single QA person who is paid minimum wage and whose desk is in a broom closet somewhere, judging from my own experiences...

Sadly just because you have a QA department doesn't mean much. Your investment is only as good as the people you invest in (at least in this case). "Oh I sit around all day using a phone?"

Rotate.

I could imagine that they'll eventually receive a firmware update allowing them to have conduct more modern modes of operation. That said, given that the target network also has 2G besides 3g; it can be configured in a "compatible" mode; one that can and is being exploited in the wild. 3g only networks are not suceptible to that particular type of attack. However, a similair scenario also exists for 3g/4g networks. TL;DR Locking your baseband to the most modern technology decreases the odds for being intercepted/stung but certainly does not guarantee any safety.

Stingrays already work with 4g. And 5g has many of the same flaws, likely on purpose. We can only hope common criminals will start massively exploiting them if we want real change to happen.

What flaws are there, exactly? Missing mutual authentication are the main cause for 2G's security issues. There are no trivial MitM attacks on 3G and 4G - besides denial of service that may result in downgrades. There are location and identity leaks, but that's user tracking at best. Not to compare with 2G.

What am I missing here?

There is no problem for a stasi wannabe to use legal process to extort the base station credentials from the phone company. There should be defences against carrier assisted MITM, like signed NONCEs and per-carrier station public key registers with accountable station data (location, station photos, etc)

If you question lawful interception, then your problem is not the technical standard that allows it, but your have a problem with society and the laws it implements.

There are good reasons to have security endpoints in the core network instead of the base stations. But it doesn't affect lawful interception at all.

They can jam the other frequencies so that they aren't available.

If you are having trouble accessing the ##4636## menu (I had on my international S9+) this app got me into the menu: https://play.google.com/store/apps/details?id=com.samseen.ne...

Honestly, I'd rather take my chances of being spied on by the local police department rather than install a very suspicious looking app from the play store.

"contains ads"

Is that relevant, if your apps only communicate with encrypted messages (https only and so on)?

Yes. For example, stingrays could still locate your phone and deny you service.

Isn't that also true for non-stingray connections?

For an example of location from today's news: https://www.mcclatchydc.com/news/investigations/article21901...

Mods: Please fix title, "Stingray" not "Stringray"

Oops. That was a Paris in the the Spring. Fixed now—thanks!

https://www.google.com/search?q=%22paris+in+the+the+spring%2...

Dude doesn’t explain why stingrays are only good on 2G

Also, how to do it on iOS?

2G doesn't have mutual authentication, thereby Man-in-the-Middle attacks are trivial. From 3G on, attackers cannot simply fake the real network.

Reply on news.ycombinator.com