Hacker News Reader

>The trouble with 5G is that it will be the final nail in the coffin of location privacy,

And yet it's first deployed set of standards that encrypts IMSI? (this is pushing Stingrays to obsolescence, Harris stopped making them) https://www.thalesgroup.com/en/worldwide-digital-identity-an... < from one of the world's primary producers of SIM cards.

In a densified enough network (cities) the carrier knows where users are within a few meters by correlating timing advance from the towers. This is independent of any software installed on user equipment. mmwave spectrum in the most populated areas (stadiums/train stations) brings this to centimeter-level due to physics, but we're just splitting hairs. This should be a key area of focus on privacy legislation, on 'who' should be allowed to access this data (LEO with a warrant). Even if user device lacks the hardware, the network side can have hardware installed to measure precise location of user equipment

Other wireless technologies independent of the cellular network can be used for correlation and privacy relies on the device randomizing macaddr for beacons, both Bluetooth and WiFi. GNSS (except for Beidou, which is disabled in firmware in the US) are one-way comms unless the phone is snitching on you.

https://www.eff.org/deeplinks/2019/01/5g-protocol-may-still-...

> this attack provides a new way to track a user’s location not just over 3G and 4G, but even over 5G. Location tracking seems to be the most common use for IMSI catchers by American law enforcement and this vulnerability could provide the next generation of CSSs with a way to track user location, even over 5G.

> It’s important to keep in mind here that, for cases of lawful intervention from law enforcement agencies, there are better ways than this attack technique to get location information, such as getting a warrant and getting the information directly from the phone companies. People working outside the legal system, such as spies and criminals, cannot get warrants and cannot typically work directly with the phone companies.

> criminals, cannot get warrants and cannot typically work directly with the phone companies.

Colour me skeptical on the latter. What kind of criminal is tech savvy enough to want location data, but can't think of either using a fake business to buy the data (if it's legally allowed to be sold by the phone company), or bribing a phone company employee, or becoming / having one of your criminal team become an employee there, or commit another crime such as hacking into the phone company to steal data, or...?

IMSI catchers enable realtime scale/volume harvesting.

Blackhat 2020, Detecting Fake 4G Base Stations in Real Time, https://news.ycombinator.com/item?id=32237621

2019 article! Quite a bit has changed since then. As I pointed out, Stingrays aren't produced anymore.

As to your second point, law enforcement buys units like this to bypass normal due process out of the system (having to go to a judge for every minor crime/investigation). I mentioned in my comment that the network will always have this information, even back to 2G there was additional equipment added to the towers when E911 mandates took effect to get better location information off connected user equipment. Reading about E911 requirements is enlightening to learn more about the 'how':

https://urgentcomm.com/2008/07/01/different-strokes/

https://www.federalregister.gov/documents/2020/01/16/2019-28...

> Stingrays aren't produced anymore.

If there's a 5G protocol vulnerability, it can be exploited with an SDR and custom software, even if no commercial product is sold for this purpose.

2021 Blackhat, https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-5G-IMS...

> IMSI catcher attack is possible in both 5G NSA and SA networks

  • 4G RAN security == 5G NSA (false sense of 5G security)
  • Unfixed radio protocols allow targeted attacks 
  • For end users, no control over choosing the most secure network
  • No security indicators for connected network

> Lack of enforcement of security features in operational networks allow tracking of 5G users easily

  • Need continuous & proactive security monitoring of 5G RAN configs

5G SA networks are only becoming more common in the past year. 5G NSA does not benefit from the same enhanced privacy. At the same time SA is starting to get deployed legacy networks are being shut down. One of the reasons it took so long was necessity for user equipment to support NR carrier aggregation, and we're there now.

But we are derailing. All the slides you've linked acknowledge the attempts made in 5G to improve privacy and most of the practical attacks rely on implementation mistakes or downgrade attacks (which should be less possible as legacy networks disappear). I originally responded on the topic to note that for the first time on a global standard there was an attempt to encrypt subscriber identifying data. Earlier standards made no such attempt and were broken in other ways. (For example GSM had two replaced cracked/backdoored encryption standards A5/1 and A5/2 which were replaced by A5/3 and the standard never made any attempt to authenticate towers)

It's good that we have progressed from no protection to broken protection. May we continue to progress in the right direction.

Practically, 5G phones today remain vulnerable to IMSI catching.

Worth noting that tje ability to catch an IMSI or SUPI in the clear depends on whether the packet core implements concealed identifiers (SUCI) with real encryption. IIRC there are three possible encryption schemes and one of them is "null encryption". I dont know what happens if the cellular provider simply sets that setting, do phones just say "ok" and continue to connect?

Related: does the OEM (Apple, Samsung) or baseband radio vendor (Qualcomm) make that decision?

On one hand, this technology has all sorts of good uses, like helping emergency services find someone calling them inside a building or helping you navigate in skyscrapers where GPS doesn't work well. On the other hand, humans are steaming piles of shit and probably can't be trusted to use this technology properly for just "good" uses. I guess there's no way to reverse course, but it makes me sad that my son might grow up without privacy, where his mistakes are never forgotten.

They'll be forgotten unless he decides to criticize the police, the ruling party, or Verizon. Or spends a lot of time walking near people who do.

It’s inevitable that the advance of technology will both improve the world and potentially be a vector of potential misuse.

Ultimately, it has always been like that, since the dawn of civilization. The answer is not fighting technological advances, but regulating the use of technology from law enforcement (and the government, and bad actors) instead.

This only applies to places with UWB (mmWave) which is very few places. Prior to 5G, the network was borderline unusable in these crowded places and people used Wi-Fi (which has similar location tracking concerns). For the average user this hasn't changed anything.

For very privacy-conscious users, you can always turn off UWB.

Can you? Can you really?

Does it matter? If you do, you'll be using Wifi in those places, which has similar privacy problems, right? And if you disable both, you barely have coverage in those places, which doesn't seem better.

Ordinary mobile network use is not all that location-private. Wifi is worse. Looks like the mmwave 5g is even worse than that. Exact location privacy rarely directly matters to me personally but it doesn't follow that there is no risk of society-scale bad effects, or impact on other people that I ought to be concerned about. What I questioned, though, was whether it will really be practical for anyone to choose how much they engage with this. It's not so hard to turn wifi off when out and on when at home, lots of people do mote because it can be a nuisance than out of privacy concern. Will it really be equally easy to choose which bits of 5g spectrum a phone uses? If you think so, I have a a bridge for sale...

Privacy vs coverage in crowded places seems like a valid (though uncomfortable) choice.

In crowded places like trains or planes, where it matters most for me personally, you already don't have a location privacy once you've boarded: your seat is known.

Add to this "smart" washing machines, fridges, dishwashers, air conditioners, irons, stoves, etc. and of course cars and TVs, all happily phoning home the user's personal data with their always on internal module that nobody can disable or filter, since they don't make use anymore of the user's home network.

I expect in a few years even shoes will connect somewhere while being powered and recharged by walking. And of course free gait analysis through internal pressure sensors and accelerometers, apps for running or dancing (turn on a IoT device by doing a tip-tap, find your ideal dancing partner, etc) will be the way manufacturers will sell them to the masses, at the price of more and more personal data being surrendered.

I don't care much about what people do with their privacy, that's their business, but how can I enter someone's house, shop or car knowing that there will be no less than a half dozen devices listening to my voice or shooting a picture of me without asking?

Note that I absolutely love the good that 5G and further technologies can bring. It's just some of their uses that concern me.

Microwave your shoes for 5 seconds, kill that chip. ;) For everything else, no idea.

>how can I enter someone's house, shop or car knowing that there will be no less than a half dozen devices listening to my voice or shooting a picture of me without asking?

There are solutions to that problem: https://xkcd.com/1807/

How long until we start seeing HN headlines like; How I turned my home into a faraday cage to stop all those pesky IoT devices phoning home.

This already exists. For a project I worked with a 'house of the future' style project. Which was build in a way that it was a faraday cage that had an option of letting selected frequencies through.

IT would be very hard to screen against 5G connected household appliances without rendering cellphones using the same frequencies also useless.

Which 5G does these are talking about? The sub 6GHz 5G aka relabeled LTE or the mmWave/UWB 5G? Because the UWB does not really penetrate anything, so it might be working good in lab, but useless in practice.

It's not in the general, constant sense that you have to worry about, but rather in specific applications. When you're out in public, "they" will have 3-meter-accuracy, more than enough. But when you're in stores, and malls, and other venues where UWB is set up, then that's where real problems begin. They'll be able to track which advertisements you linger around, and which sections you visit.

It's going to be a whole new category of passive location tracking.

My opinion is that in-building tracking doesn't have to be an issue, and the people who care don't linger watching advertisements in Malls. More power to someone who finds a way to use that data to make buildings like Grocery stores more efficient, like getting room temp products first and frozen things last during the walk.

There are companies doing this already, but with their current CCTV systems. You don't even have to buy equipment, just the software, and you get e-commerce metrics for brick and mortar stores

It works on stadiums and other similar hugely crowded open venues, which is the point of it, AFAICT.

> relabeled LTE

To be pedantic, LTE stands for “Long-term evolution” and was always intended to be the foundation of future cell network standards.

I won’t get too into the details, but generations 1-4 dealt primarily with modulation techniques, and OFDM (the technique used in LTE) is more or less the best we know how to do over wireless.

To add some confusion, the “nth generation” features have been described by the International Telecommunication Union (e.g. IMT-2020 for the 5th gen), while the standards are developed by the 3rd Generation Partnership Project. Previously the standards had their own names (UMTS in 3G, LTE in 4G) but now the 3GPP is labeling their current releases of standards “5G” too, and yeah they include some concepts that go back even to 3G.

To add further to the confusions, 3G network systems has been made obsolete by not being supported anymore by the 4G/5G operators around the world and somehow they would revert back to EDGE network systems (2.5G) if the wireless signals are bad [1].

[1]https://www.wired.com/story/3g-service-sunset-what-it-means

Lol, it's all about that sweet sweet spectrum

Yeah, accurate positioning is the inevitable end result of massive-MIMO. You need to know where the handset is to point the antenna beam towards it.

And it needs to update fast enough that it can be in a vehicle on the highway or a high speed train and still maintain connectivity.

The need to have more users on the same spevtrum requires sharper antenna beamwidths and smaller cells. All of which either require more precise positioning or make it possible.

All of this is linked with the technology used. Sadly I only see legistlation limiting what can be collected and used being a counter for this getting exploited.

besides the standard bandwidth improvements, it's pretty clear that this is why the major telcos were pushing 5G so hard, so they could sell that more precise location data to any and all comers.