California Police Used Stingrays in Planes to Spy on Phones (opens in new tab)

I'm still curious why they haven't decided that the fact that cell site simulators are possible is a super-grave bug!

It's one thing to say "we think it might be legal to use a cell site simulator in some specific circumstances", but another thing to say "our cell phone infrastructure allows anyone to successfully pretend to be a tower and spy on people, and we're not going to try to fix that".

Mine was that I thought this might stop once it became common knowledge - that courts would find it massively unconstitutional and it would end.

From looking at the FAA registry[1] and googling, it looks like the Anaheim police department operates 3 aircraft: N226PD, an AS350 helicopter; N326PD, another AS350 helicopter; N508BH, a Cessna 208B.

N508BH, the Cessna, is probably the one they're using for surveillance (See the 2012 OC Register article, "$2.2 million Cessna will help fight crime"[2]).

FlightAware shows that N508BH flies to northern california a lot. You can also see what looks like a probable surveillance flight path at http://flightaware.com/live/flight/N508BH/history/20151128/2...

Three aircraft for a California city with population 350K isn't crazy--Glendale and Burbank together have about 300K people, and their police forces have gone in together to create a "joint air support division" that has 4 helicopters[3].

  [1] http://www.faa.gov/licenses_certificates/aircraft_certification/aircraft_registry/releasable_aircraft_download/
  [2] http://www.ocregister.com/articles/air-356706-police-cessna.html
  [3] http://www.mdhelicopters.com/news/pdf/2014/111914.pdf

That quote doesn't mean that department buys or operates airplanes. It means they own at least one specific kind of StingRay that they can mount in aircrafts that happen to be flying in their precinct.

I will say, being from the US, the fact that any branch of the government would use such a device should amaze me, but unfortunately I have to admit I have heard of worse abuses of power.

Anaheim city pop is ~350k. OC pop is ~3 million.

Their biggest tax payer is Disney, so they are flush with money.

To get decent coverage you need to negotiate and pay for space, power, and internet connectivity on thousands of towers/tall buildings all owned by different people and municipalities who see you as somewhere between an annoyance and a revenue stream to exploit. Then you need a field workforce capable of performing maintenance at all of those sites (which requires making appointments and sometimes paying fees to the property owners), a supply chain of spare parts, and the RF expertise and test equipment to measure and do quality control on their coverage all around the cities you're operating in.

Then you need a way to recoup all this cost.

Being a cell carrier takes staggering amounts of money and staggering amounts of schlep. It's not for hobbyists, hackers, or small companies (who are not in fact carriers but just resell and rebrand real carriers' services). There is a reason it's the domain of giant corporations run by the kind of people who make deals (and not write code) for a living.

You're better off assuming the network is hostile and then encrypting at a higher layer, ZRTP, OTR and so on.

In active mode the Stingray will broadcast a consistently strong signal to force targets to connect to it so that it can grab identifiers.

Some detection methods rely on this, as well as fingerprinting the Stingray (they negotiate a drop in encryption and ask the phone to max signal strength)

Current solutions for Android will point out new base stations that stand out and are likely an IMSI catcher:

http://secupwn.github.io/Android-IMSI-Catcher-Detector/

The better method, since the devices change and some are stationary, is to authenticate the real cell phone towers. This would involve either updating the GSM protocol, or having the carriers send out additional settings that make the phone aware of their legitimate sites and only connect to them.

iOS doesn't make these settings available in official API's, but if they did it would be possible to develop apps or features that could detect/avoid IMSI catchers.

The best non-tech solution is to have an anonymous IMSI. The attack relies on linking an IMSI to a real person, or the pattern behavior of a phone to a real person. So - anonymous SIM cards, change them up often, don't have it switched on with any of your real phones or real phones of friends, leave it switched off, etc.

Yes, and yes.

A recent news report mentioned that a "cell tower" moved along with participants in a demonstration (in London IIRC), and also that it switched networks, so obviously someone noticed that.

Time division logic involves keeping track of how far each phone is from the tower. I think GSM uses 50m or 100m bands, ie. phones that are 200m from the tower time their broadcast bursts so as not to conflict with phones that are 100m from the tower. I don't know whether the distance information is available to the phones, or is kept internally in the tower, though. (I'm not an expert on this, I just heard that this need paid for a fair amount of NTP research/development, many years ago.)

Somewhere on my todo is "wire pager to cell phone", I think this would work by having a Asterisk system take the incoming call, send the (nationwide) page, pager is wired to phone, phone displays page as if it's an incoming call (while caller hears ringing), if callee decides to answer the GSM circuits get power and the phone calls the Asterisk box which patches the two together. If someone beats me to it, I'll buy one. Putting a RTL-SDR into the phone would take care of the pager circuit and make other neat things possible.

Also turning off your phone might not actually work:

http://money.cnn.com/2014/06/06/technology/security/nsa-turn...

It is illegal to make or sell or own radio hardware capable of operating on that spectrum, or modify other hardware to work on that spectrum, or hint to your users how they might modify your product to work on that spectrum, unless you are a licensee or have permission from one. Even Motorola can't take its new basebands out of RF-isolated testing facilities before FCC approval.

Theoretically calls are encrypted, however security researches have shown vulnerabilities due to old/incorrectly applied primitives. Not sure exactly which protocol versions this applies to. Stingray might just have asked nicely for the keys.

Commercial IMSI-catchers (made with the cooperation of carriers?) do exist, and there are some hobbyist proofs of concept. It is very hard to get caught doing passive receiving.

Transmit in a way that catches the eyes of carrier network engineers, though, and the federal government will come knocking with criminal charges.

FCC makes exceptions to most things for official purposes. For example, government installations can be licensed to operate cell phone jammers

You're probably thinking of Chris Paget's Defcon 18 talk demonstrating an OpenBTS/USRP/Asterix based 2G IMSI catcher.

Also, it's not entirely illegal to operate on some cellular frequencies which overlap with ham bands, if you're a licensed ham radio operator, which Chris apparently was (KJ6GCG).

He also had to disable encryption (illegal on ham bands), use extremely low power and a highly directional antenna (to ensure he didn't intercept anyone outside of the room), and ensure everyone inside the room was aware of the demonstration (IIRC there were signs outside the room). He also destroyed the USB stick the base station was writing to. Even then it was definitely a legal gray area...

If you can settle for 2G IMSI-catching, there are some old femtocells with SIP backhaul that could be hackable enough. Someone once tried to build a "roam-to-voip-at-home" kind of service out of those. It was just SIP VoIP backhaul without protection preventing spoofing the backhaul network. I can't recall the company but I think they pivoted to shipboard phone service.

How fitting that they called it airplane mode. Looks like you might want to have that enabled when visiting that particular amusement park.

I'm genuinely curious too -- I would certainly think that they'd require either a warrant. Perhaps cooperation from the carriers, including permission to intercept & use their spectrum, might be enough?

I'm not well-versed on how cell carriers & landline carriers differ as far as common-carrier & wiretapping laws go.

It's not illegal unless you have standing to challenge it in court. Standing is used by government (at least in the US) to allow all sorts of likely illegal activities but without a court explicitly making it illegal they can get away with almost anything.

Given the cooperation between telcos and law enforcement, is there much difference?

There was temporary cell service at Burning Man for the first time this year, supposedly to "support" law enforcement. I guess you could interpret that in two different ways...