Hacker News Reader

Comment by AgalmicVentures | Hacker News Reader

You're absolutely right about the various advantages of pagers over cell phones.

On the other hand, all of that medical information goes over the air in plain text. It is trivial to capture and decode POCSAG [1], requiring less than $100 of hardware: a Raspberry Pi 3 has enough horsepower to handle the 2 RTL-SDR's needed to capture both the 929MHz and 931MHz bands.

Modern security simply demands that pagers go away (or at least be heavily modified). This is not a theoretical concern [2][3].

[1] https://github.com/pvachon/tsl-sdr

[2] https://www.rtl-sdr.com/art-installation-eavesdrops-on-hospi...

[3] https://openprivacy.ca/blog/2019/09/09/open-privacy-discover...

View on HN

Unfortunately, it's pretty hard to get all the security benefits of modern technology without the distraction, the sloppy user interface, the complexity (and attack surface) and user hostility -- in a word, without the incredibly poor design -- of modern technology.

A pager-like device with proper encryption isn't extraordinarily challenging. But planned obsolescence or selling ads is pretty hard to do with this sort of technology, so despite plenty of interest from users, there's not that much interest from companies.

To be fair it generally costs money to send a page. It's the expectation of free messaging that creates the need for advertising - unless people are willing to go back to the days of paying per message.

Have you ever used Signal?

Maybe I’m living in the 1970s but I always assumed pagers just showed a phone number and you were supposed to call back?

No, you can definitely send a text message to them, they just don't have the ability to send anything back.

the most basic pagers can only receive callback number. More advanced ones have additional features to display text messages as well.

Except for the 2-way ones

What next? 2-way voice communication!? ;)

If you can send a sequence of digits, you can also send a sequence of letters (a text message) using the same technology.

Does the paged text typically contain information that can identify the patient?

https://www.kansascity.com/news/business/health-care/article...

"An information technology worker from Johnson County recently told The Star about the issue after he stumbled across hospital pager information while playing with an antenna, which he bought to get TV channels on his laptop computer. With a simple program, the antenna picks up radio signals that can be digitized.

Except instead of picking up local TV stations, he started seeing things like this, with the patient's and doctor's names included:

RQSTD RTM: (patient's name) 19 M Origin Unit: EDOF Admitting: (doctor's name) Level of Care: 1st Avail Medical Diagnosis: TONSILAR BLEED, ANEMIA, THROMBOCYTOPENIA

It was the personal patient data of a 19-year-old man, broadcast across the airwaves for anyone to read. And it was coming from a local hospital, which was sending the message to a doctor on a pager."

I looked into some of such cases in Germany, there the answer was definitely yes. Names and addresses, coupled with extremely sensitive medical information.

I'd imagine it to be trivial to also send malicious signals and jam the system.

That sounds like any radio frequency though. Alao a great way to get the FCC knocking on your door sooner or later.

True you could create a trash beacon for any frequency, but as you said it'd be very "loud". Disrupting service with seemingly innocent messages would be much harder to detect though

Oh I see, you're suggesting a very specified attack. Sounds like a smaller scale Stingray or something, but for beepers.

Edit: Yeah I'm not entirely familiar with interference detection, but I would always suspect some HAM somewhere will figure it out and report it.

>the 2 RTL-SDR's needed to capture both the 929MHz and 931MHz bands.

A single R820T can do about 2.56MHz bandwidth, which is enough to handle both bands simultaneously.

Reply on news.ycombinator.com