Fake Cell Towers Monitoring Calls and Texts

[Commodore]

Link

Seventeen fake cellphone towers were discovered across the U.S. last week, according to a report in Popular Science.
Rather than offering you cellphone service, the towers appear to be connecting to nearby phones, bypassing their encryption, and either tapping calls or reading texts.

Not the NSA, cloud security firm SilverSky CTO/SVP Andrew Jaquith told us. “The NSA doesn’t need a fake tower,” he said. “They can just go to the carrier” to tap your line.

So what do you guys think of this? These mysterious towers do seem kind of strange, but what is stranger to me is that no one seems to know who built them (or at least no one is willing to admit they know). It makes sense that these towers don't belong to the NSA, but they are centered around military bases, so could it be some sort of anti-terrorism measure? A test of some new intelligence gathering technology? A foreign power spying on the US military?

It also seems like it shouldn't be that hard to find out who built the towers, since someone had to buy the land or get a permit to build them.

 

[warpus]

Yeah, like the NSA would admit that the towers belong to them, if they did.

I bet that they don't need the towers for what we think they'd use them for. And if it isn't them, it's got to be some government agency. I mean, assuming that it's not as simple as just looking up who owns and operates the towers. If you try to do that and men in suits get in touch with you, it's some sort of a government agency operating them.

Or it's something as silly as google or some billionaire building these towers for some sort of R&D enterprise. Which sounds silly maybe, but google has been known to do silly large-scale things that may or may not pan out.

 

[Commodore]

Or it's something as silly as google or some billionaire building these towers for some sort of R&D enterprise. Which sounds silly maybe, but google has been known to do silly large-scale things that may or may not pan out.

Someone in the comments section of the article suggested something similar to this. They said these towers might be used to gather information for targeted advertising and they just put them near military bases to make people think it is part of some government spy program.

 

[SS-18 ICBM]

Is this legal? Assuming it was a private entity, that is.

 

[brennan]

Follow the link to the popular science report for more information.

The towers are reported as being present around known military bases. So they could just be a system the army uses itself to ensure personnel have good comms around their bases.

 

[Commodore]

Follow the link to the popular science report for more information.

The towers are reported as being present around known military bases. So they could just be a system the army uses itself to ensure personnel have good comms around their bases.

Except these towers are actively bypassing encryption and monitoring calls and texts. That sounds like a lot more than just ensuring good comms to me.

 

[brennan]

Actually, i'm not convinced. Here's the original report.

the version of the Android OS that comes standard on the Samsung Galaxy SIII leaks data to parts unknown 80-90 times every hour. That doesn't necessarily mean that the phone has been hacked,
...
Once the phone connects with the interceptor, a variety of “over-the-air” attacks become possible, from eavesdropping on calls and texts to pushing spyware to the device.

That there'e anything actually going on seems to be undemonstrated. Except by the guy who wants to sell his super-anti-snooper-phones. Which apparently doesn't work in this case:

the Cryptophone set off alerts showing that the phone’s encryption had been turned off

 

[Commodore]

Actually, i'm not convinced. Here's the original report.

That there'e anything actually going on seems to be undemonstrated. Except by the guy who wants to sell his super-anti-snooper-phones. Which apparently doesn't work in this case:

Way to cherry-pick quotes from the report. I can do that too:

So when Goldsmith and his team drove by the government facility in July, he also took a standard Samsung Galaxy S4 and an iPhone to serve as a control group for his own device.

”As we drove by, the iPhone showed no difference whatsoever. The Samsung Galaxy S4, the call went from 4G to 3G and back to 4G. The CryptoPhone lit up like a Christmas tree.”

Though the standard Apple and Android phones showed nothing wrong, the baseband firewall on the Cryptophone set off alerts showing that the phone’s encryption had been turned off, and that the cell tower had no name – a telltale sign of a rogue base station. Standard towers, run by say, Verizon or T-Mobile, will have a name, whereas interceptors often do not.

Turning off a phone's encryption has nothing to do with enhancing communication quality and everything to do with spying. I think you are being a little too skeptical on this one.

 

[bhsup]

How crappy must a phone OS be if a remote tower can just flip off its security measures? Any word on BB10? Is it affected?

 

[Commodore]

How crappy must a phone OS be if a remote tower can just flip off its security measures? Any word on BB10? Is it affected?

No word on BlackBerry OS. It looks like this was only tested with iOS and Android.

It would also stand to reason, if this is some sort of spying conspiracy, that those OS's may have intentionally been designed to have their security measures flipped off by interceptor towers.

 

[Zelig]

This is nothing new, law enforcement has been using Stingrays for years and fighting tooth and nail not to reveal their process/methods to the judicial system.

How crappy must a phone OS be if a remote tower can just flip off its security measures? Any word on BB10? Is it affected?

Any phone/OS is susceptible, it's how CDMA/GSM/HSPA/LTE/etc. work.

Any encrypted data (https, secure VPN, secure VOIP, pretty much any data-based messaging service) isn't susceptible. Prior to BB10 all data on BB OS was encrypted and used BIS, so would not have been affected. BB10 dropped BIS for consumer devices and only does encrypted data for enterprise customers using BES.

Moral of the story: Assume cellular networks are like public wifi, encrypt everything.

 

[peter grimes]

Well this is very interesting:

For some time now, the American Civil Liberties Union (ACLU) has been on a quest to better understand the use and legality of “stingrays." These devices, which are also known as international mobile subscriber identity (IMSI) catchers, or fake cell towers, can be used to track phones or, in some cases, intercept calls and text messages.

The “Stingray” itself is a trademarked product manufactured by a Florida-based company, the Harris Corporation. (It has since come to be used as a generic term, like Xerox or Kleenex.) Harris is notoriously secretive about the capabilities of its devices and generally won’t talk to the press about their capabilities or deployments.
Earlier in March, the ACLU filed a motion for public access request, requesting documents and information related to stingray use by nearly 30 Florida police and sheriff's departments.

Source: http://arstechnica.com/tech-policy/...whether-theyre-using-fake-cell-tower-devices/
Note that the article references events over a year ago. I'll bet these things are US government, not foreign. Maybe not federal, but state or local even.

How this isn't a breach of 4th amendment stuff is beyond me.

 

[brennan]

Way to cherry-pick quotes from the report. I can do that too:

Gosh, snap! I quoted from that part too! And provided everyone a direct link. Not sure you can accuse me of cherry picking tbh.

Turning off a phone's encryption has nothing to do with enhancing communication quality and everything to do with spying. I think you are being a little too skeptical on this one.

Sceptical that the only alleged evidence that there's anything going on comes from the guy with a product to sell?

The article is like one of those ads that has a tiny disclaimer at the top 'advertisement feature'.

As Bhsup says, how come the guy's super-anti-snooper-phone with a custom written OS that has hundreds of vulnerabilities removed just gets its encryption turned off? (allegedly *cough*)

I smell a rat. that's all i'm saying.

 

[Commodore]

Gosh, snap! I quoted from that part too! And provided everyone a direct link. Not sure you can accuse me of cherry picking tbh.

Sceptical that the only alleged evidence that there's anything going on comes from the guy with a product to sell?

The article is like one of those ads that has a tiny disclaimer at the top 'advertisement feature'.

As Bhsup says, how come the guy's super-anti-snooper-phone with a custom written OS that has hundreds of vulnerabilities removed just gets its encryption turned off? (allegedly *cough*)

I smell a rat. that's all i'm saying.

He never claimed his OS will be able to stop interceptors, only that it will notify you when your encryption has been turned off, something iOS and Android will not do. Knowing your encryption has been disabled is a huge advantage over those who might try to spy on you because you know not to say or text anything until you know your encryption has been turned back on.

That is the purpose of his OS: to let you know when you are potentially being spied on. That is a hell of a lot more than Apple or Google will do for you.

It also doesn't follow that he is only doing this to get everyone to buy his product, since he even states most people don't need that level of protection. If he were only trying to push his product on everyone, he would have framed his findings in such a way that everyone was at risk and needed to purchase his system to protect themselves. So it seems your skepticism stems from a lack of understanding the purpose of the OS.

 

[bhsup]

Yeah, but maybe it only gets turned off because he wrote a crappy OS and Apple and Google did a better job?

 

[Commodore]

Yeah, but maybe it only gets turned off because he wrote a crappy OS and Apple and Google did a better job?

Did you read the report? These quotes should make it a little clearer that the problem does not lie with his programming skills:

Though the baseband OS is a “black box” on other phones, inaccessible to manufacturers and app developers, patent-pending software allows the GSMK CryptoPhone 500 to monitor the baseband processor for suspicious activity.

“If you've been intercepted, in some cases it might show at the top that you've been forced from 4G down to 2G. But a decent interceptor won't show that,” says Goldsmith. “It'll be set up to show you [falsely] that you're still on 4G. You'll think that you're on 4G, but you're actually being forced back to 2G.”

So basically, a sophisticated enough interceptor can turn off your encryption without you or your device (no matter what OS it has) even knowing it. I don't think a government or corporation would have any trouble achieving that level of sophistication.

This also wasn't a one-time test. This guy apparently does these tests on a regular basis to work out the kinks in his system.

 

[peter grimes]

And the map I'm the article is crowd sourced from his clients in real time. That's important.

I'm surprised no one has any thoughts on the connection to a local law enforcement agency.?

 

[Zelig]

Again, this is nothing new: http://arstechnica.com/gadgets/2010/12/15-phone-3-minutes-all-thats-needed-to-eavesdrop-on-gsm-call/

Since at least four years ago, a laptop and four $15-dollar phones is all you need to listen in to GSM calls.

 

[The_J]

Yeah, just wanted to say something related: People should be aware that phone calls are normally neither encrypted nor do they require any authentification.
Every moron with a tiny bit of technical skills and with access to a bit of hardware can set up their own cell tower.
I think at the Chaos Communication Congress in Berlin they do this every year.


If these are around military bases...are there any letigimate towers in this area then?
I'd suspect that these locations aren't exactly in the middle of a city.

 

[Zelig]

Yeah, just wanted to say something related: People should be aware that phone calls are normally neither encrypted nor do they require any authentification.

Mobile voice calls are encrypted, just not well.