Hacker News Reader

Comment by shereadsthenews | Hacker News Reader

Most people consider the fact that your handset will readily talk to any base station that's on the air to be a feature. Try to imagine how things would work if you had to authenticate and authorize every station on the network. It's true that anyone who gets on the air and speaks the air protocol can screw with your phone. Those people are also violating multiple laws and regulations in the course of doing so.

View on HN

It's not that simple. Both 3G and 4G have mutual authentication. You need to trick the handset into downgrading the protocol if you want it to talk to your own fake base station.

Jamming should be enough. But depending on the frequencies used, one band might not be enough.

I mean you can do authentication without doing it per base station... the real reason we don’t have anything like this is because it’s a lot of work to make this work well worldwide and because a lot of governments are not interested in making spoofing base stations harder on themselves.

There is per-basestation authentication. The basestation receives a key that is derived from your permanent key within your SIM card.

Roaming is a bit special, but this still holds. You then trust both operators, not just your home operator.

Shouldn't we just fix this one layer above? Just like the internet treat the network as hostile and use strong encryption to connect to your network provider. If someone uses a stingray you use their bandwidth but they see nothing because you're running encrypted VoLTE.

It's astart but from my understanding implementing strong encryption on the layer above does little to mitigate physical location tracking issues that arise from spoofed towers.

Nothing short of removing all devices identifiers (IMSI, IMEI, etc) and using an untraceable payment system for network access (eg blinded tokens) will mitigate the location tracking ability of the carriers.

The perfect is the enemy of the good and cops do use stingrays for a reason. But targeted government surveillance is only one privacy threat, and carriers have no compunctions about bulk selling your location to the mass surveillance industry.

This is about unauthorized people tracking you not carriers.

Yes, and I did recognize I was talking about a different vulnerability by saying that the perfect is the enemy of the good. But if we're talking about protocol vulnerabilities, why skip over the deep flaw of having fixed identifiers in the first place?

Heck, simply removing the IMEI so that users don't have to buy a new burner phone (/mifi) along with every burner SIM would be a vast improvement!

Really I'm just pointing out the larger context, as it's important to keep in mind. Shoring this up will make the keystone cops have to go get a warrant, but won't help versus the NSA, parallel construction, or GoogleNexis. It probably won't even make private investigators have to eat lunch in their cars again.

Much of the data you'd want to protect is meta data (location and access times).

If you can't trust your network entry point on mobile, you're really just screwed in many un-patchable ways. Mobile-to-mobile mesh networking could help, but I can't imagine that being widespread unless it's done in a layer outside user control or visibility, taking you back to square one.

>...and because a lot of governments are not interested in making spoofing base stations harder on themselves.

See Norway's fumble[0] for a principal example.

[0] - https://www.thelocal.no/20150309/norway-police-broke-law-wit...

From 3G on, every base station is authenticated and virtually all traffic on the air is encrypted.

There are issues with stingrays - but these happen due to protocol edge-cases before authentication is established. [Edit: this paper uses side channels to collect information, but that's what a sniffer can do]

Every base station is authenticated.

In most countries, all connections are encrypted.

Sorry, I haven't kept up on my phreaking - is there encryption for 3G which hasn't been broken yet?

Not sure about 3G algorithms - but that's why 4G moved on to AES.

What exactly are you trying to say? Worrying customers can easily enforce 4G. Networks should drop 2G and 3G, but still, things are getting better.

I'm saying it doesn't matter whether everything is authenticated and encrypted, it's all vulnerable. Even if 4G wasn't, you can just downgrade and then crack.

Where exactly vulnerable against which type of attacker?

In 4G there are location and identity leaks, and denial of service (which is why smartphones and carriers should drop 2G and 3G).

Or is this a "technology is all bad" kind of comment?

I consider it more to be a 'why oh why do these protocols continue to be designed and specified in such a way as to be known to be vulnerable to eavesdropping' kind of comment.

What? I mean your provider ships you a computer that's dedicated to authentication your device on the network (a sim card) - it shouldn't be infeasible to authenticate the nodes when you can bootstrap off an actual trusted device.

With roaming, your provider could cross sign other providers - and for long range/international roaming you could maybe allow forwarding of encrypted requests for authentication over an untrusted channel.

That would probably be enough for some level of (location) tracking - but there'd be no need to allow any regular traffic over such links. In theory. In practice, that'd probably be too expensive, and you'd get better service and security relying on wlan and something like signal....

Maybe your phone could trust all base stations operated by AT&T and T-Mobile, instead of manually verifying each one.

OK but what you are suggesting is a fully authenticated air interface and a massive PKI deployment, which while not impossible for future protocols face obvious hurdles.

Aren't SIM cards the perfect way to do a PKI?

Right? More like s/massive PKI/_a_ PKI

What happens when you travel internationally?

Just add another root certificate to your local store, like with a web browser.

Yeah I'm sure the cops and the lawyers will stop the bad guys using the power of the law.

Reply on news.ycombinator.com