Hacker News Reader

Comment by mLuby | Hacker News Reader

If we had a crowd-sourced database of cell towers (picture & coordinates) wouldn't it then be straightforward to know (and report) when your phone wasn't connecting to a legitimate tower?

I for one want to make sure the criminals aren't intercepting my signal with home-made stingrays; the police have other lawful ways to get what they need.

View on HN

No, because the cell carriers have "tower in a box" kits that they make available to various people. These are real towers, but they move often. If you go to a large event (something like burning man, though I don't know if they do for that specific event) there is a good chance the carrier has scattered a few of these around the venue because the fixed location towers (often miles away) would be overwhelmed and nobody would be able to use their phones.

Agreed - there are companies that specialize in ad-hoc towers to provide service. Example: Mobilitie in Chicago. Very important piece of mobile data infrastructure, but a rogue tower is still a real security risk.

Mind you, it would be straightforward to use such a database to find out whether you're connected to a mobile or fixed cell station.

People are way ahead of you:

https://cellularprivacy.github.io/Android-IMSI-Catcher-Detec...

Not sure if those apps works as well as advertised.

https://www.zdnet.com/article/stingray-detector-apps-andorid...

Edit: fully removing amp from link

Non-AMP link: https://www.zdnet.com/article/stingray-detector-apps-andorid...

Fixed, thanks.

Considering all the stuff that's open public information, it's a bit surprising that cell tower locations aren't.

It's kind of sensitive information with regards to communications infrastructure. Not too dissimilar from various details of sensitive sites not being disclosed to reduce the risk of a coordinated attack.

Not saying it's effective, but I can understand the reasoning.

Regarding effectiveness, localizing an access point is trivial, so it's a matter of motivation.

Tower data is public record. Here’s a search aggregator: http://www.antennasearch.com

The issue is that the baseband should be handshaking cryptographically with your provider’s towers to prevent MITM attempts, and no downgrade should be possible. Between eSIM and 5G, honestly surprised it’s not a standard yet.

Antennasearch is a good resource, and somehow the database update functions still work, but it appears unmaintained, somewhat janky, and the copyright notice reads 2004-2009. I resent the popup windows and the google maps integration is broken. Luckily, there are several community efforts to map the cell coverage.

Check out https://opencellid.org/ which is an open source WiGLE-esque cell location collection. You can contribute with the TowerCollector[1] android app (also on fdroid).

Mozilla also operates Mozilla Location Services[2] as an API for developers. People can contribute location anonymized data to Mozilla by a settings menu checkbox, or using their special app.

WiGLE[3] of course includes cell tower detection in their wireless geographic logging suite.

[0] https://opencellid.org/

[1] https://github.com/zamojski/TowerCollector/

[2] https://location.services.mozilla.com/

[3] https://www.wigle.net/

Are they not registered with the FCC?

A sibling comment noted the FCC rules for antenna structures. FCC regulates some of this, and the cell towers should all be on that list. That said, I don't know how to easily access the FCC information aside from a service like antennasearch or some other thing. There are also paid services for this sort of thing. IF you are searching for towers, also make use of a fiber search, as all these towers need fiber to run, unless they use backhauls or something which seems less likely. The towers are usually owned by something like COMTECH III, LLC and then the entities leasing the tower space operate everything else.

In addition to the FCC, FAA, there should be a massive public paper trail for tower construction. The locality, state, and feds are involved in this.

So, in a roundabout way, I think your thoughts were: "If FCC regulated and lists this, why the tower search crap?" The reason is that if you get the FCC, state, and local to OK your tower and use it for long range deer hunting, the FAA maps will still show your 220ft deer stand, but there are likely no cellular transceivers on the tower. On a cell tower there could easily be 2 today, and then 4 next month.

So the location and use of the towers doesn't always coincide with the cellular network equipment hanging off it, which is what would need to be monitored.

Also I'd wager that the open sensor method of opencellid, MLS, WiGLE will give you better data. If you are doing your own research, it would be greatly helpful to compare to the official lists, but you'll need to verify it anyhow.

If anybody is doing this work I would be interested in knowing more about this landscape.

Interesting stuff.

I believe only those antenna structures that are registered with FCC are public data, and that's only those that are tall enough (200ft), or close enough to an airport, to require a study by the FAA. IOW most urban and suburban cell sites, which tend to be mounted to existing low-rise building structures, aren't included.

https://www.fcc.gov/wireless/support/antenna-structure-regis...

Exact cell site locations would be considered competitive strategic information by most carriers, who spend a lot of time, money and energy selecting the right cell sites to cover the right markets at the right cost. Also, they change all the time, eg when leases expire, when customer traffic patterns changes, when there are upgrades, etc.

I don’t buy that. I’m sure the way that they select the sites in the first place is probably proprietary, but once you start broadcasting radio frequencies, it’s trivial to pinpoint the location of the towers, so there’s absolutely nothing stopping anyone, particularly a competitor, from mapping them out quite easily.

Costs $$$ to have techs drive around the land with that kind of gear...

Sure, but if a company is thinking about expanding into another area, they're already going to be doing that, whether or not they need to also know about their competitor's towers.

Encryption helps against IMSI-Catchers, but you can also just implement a form of secure tower identification if ISP want to keep their secrets. The mexican cartels could do it if the urban legends are true.

edit: And as others have said, it compares a bit to wanting to keep the location of a lighthouse a secret.

What is the cartel secure tower identification story?

https://www.npr.org/2011/12/09/143442365/mexico-busts-drug-c...

I think this was an example of such a network.

This is categorically untrue. They are not a secret due to the approvals required at a local level and by the FCC.

Many carriers lease space on the same towers, or have agreements to lease space from others in certain markets. You almost never get the site placement you want: you are operating in a built environment and have to work within those constraints.

The problem is that knowing the co-ordinates of the tower does nothing to defend against Stingray-like devices: coordinates aren’t a means of authentication.

I'm not sure what approvals you're talking about. For individual small sites in already-built structures, neutral-host sites, or for leasing agreements with other operators where you're just putting a new cabinet in an existing site, what approvals are needed that would publish cell site locations?

check this out http://www.cellreception.com/towers/

Reply on news.ycombinator.com