Cops, Feds spaff $100m on Stingray cellphone snooping gear – and there's sod all oversight American crimefighters spend huge amounts of cash on Stingray-like devices that impersonate cellphone towers to snoop on people – and with little or no oversight. That's the findings of an 18-month US congressional study, which revealed the Department of Justice (DoJ) has spent $71m on 310 cellphone-tracking units between 2010 …
an anti-Stingray card could be played. But in the real world, maybe leave your phone at home when you go for a demonstration (removing the SIM card or Airplane mode for the less-than-totally-paranoid). Also, burners and stolen phones. Were this a movie, there would be a buffer overrun exploit where the heroic rebel could control the fascist authorities' evil snooping device, leading them to arrest a rival agency's cop, working undercover.
Actually, this has a really easy solution. If it cannot be managed in app then a small portable device ought to be able to detect the use of a stingray and report it. It should be quite interesting if you were in a crowd of protesters and you could show a stingray active and maybe its location. Engineering or software should be trivial
This post has been deleted by its author
"If it cannot be managed in app then a small portable device ought to be able to detect the use of a stingray and report it."
What does that mean? Either you're talking out your ass or provide some substance to this statement.
I don't understand a bit about GSM, but couldn't you detect the amount of towers and the probability of their distances. What's the odds of 2 towers within 1000ft.?
What's the odds of 2 towers within 1000ft.?
Not from the same telecom but different telecoms is a definite. Where I live all of AT&T's and Verizon's are close together because of the terrain.
It is more complicated than that. Carriers will bring in portable towers to handle excess traffic for large events. Law enforcement could easily set up shop in such an environment with none the wiser even with detection equipment. It probably would take someone on the inside of all of the providers in a given area to verify that there is not a wolf among the sheep and they might be bound by law not to give up the information.
What I do not understand is how this is different from any other wire tap situation. Why is this not covered by existing law? I should have every expectation that my phone conversation is private by default and would think that tapping a cell phone call is not de facto different than tapping a land line. My guess is that the reason that cases have been dropped rather than give up info about this tech is law enforcement suspects that it would come up short against those laws and so avoids it being brought up in court rather than give up this (possibly, probably) illegal practice.
"Why is this not covered by existing law? I should have every expectation that my phone conversation is private by default and would think that tapping a cell phone call is not de facto different than tapping a land line."
Rather than looking at wire tapping laws, it might be better to look at radio broadcasting laws. I suspect they are quite different and probably the ones actually being used.
There are Apps, at least for Android, which use the WiFi features for confidential communications called MESH radio.
One Google Play App is called SERVAL.
SERVAL is also the name used for the many projects developing this technology. Just Google 'SERVAL'.
And the best part is neither GCHQ or the NSA can eavesdrop on traffic, just like Harris.
I guess it would work when there are a couple of targeted IMEIs.
On a large scale ??? Meh. The laundry van with a series of hangers to hide the antennas next to the semi with a 300KVA generator running ... may be a bit of a giveaway.
To actively follow a whole crowd that may require a few extra amps a car alternator may not have.
At the start of a demonstration call your buddy next to you so the Stingray has to handle both ends of the conversation and leave the line open. Not sure the device will be able to handle that many duds.
At DEFCON, 2 years ago I looked over some ISMI Catcher apps. (you can find them on github)
There were 4 fake towers running at the event during that one hour. It's not hard to detect them.
There are other questions though. The people that use them/are near, catch a good deal of radiation. Back when police radar was new, some of them caused cancer to the patrolmen. I would expect to see complications for the users of such devices.
If you wanted to go out and hunt stingray-style IMSI catchers, there are a few techniques I can suggest:
a) look at the broadcast data. GSM broadcast data is all "in the clear" for example global paging, neighbour cell lists and the like. A simulated basestation will stick out like a sore thumb especially if you probe the paging by calling an MS attached to the (real) network.
b) suspect failure of TMSI hand-in to the cell - this is designed to fall back to IMSI procedures to reveal the handset's identity.
c) challenge the network - get GPRS attached and make sure the network is authentic - it should firewall you in the same way as the real network. There are usually some subtle properties that are hard to get "just right".
You'll probably want to do all this stuff on a secondhand mobile phone with a PAYG SIM bought with cash in a corner shop with no CCTV . A phone with an aerial socket will be handy - you can attach a yagi antenna for some direction-finding.
Happy hunting!
"You'll probably want to do all this stuff on a secondhand mobile phone with a PAYG SIM bought with cash in a corner shop with no CCTV ."
Good luck finding such a shop. A CCTV at the till is SOP for most shops (no matter how small, thanks to $200 DIY kits) to help with identifying hoodlums and robbers.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
