300
Evidence of cell phone surveillance detected at anti-ICE protest (san.com)
submitted 1 year ago by to c/technology@lemmy.ml
35 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 23 points 1 year ago (8 children)

I don't understand why cell phones don't authenticate the towers they connect to. Is this really just a "standards lag behind modern security" thing, or is it on purpose to allow these Stingray devices to be used?

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 7 points 1 year ago* (1 child)

    why cell phones don’t authenticate the towers they connect to.

    I believe it's because they assume it's not necessary because it was until now

    • prohibitively expensive, but now a "tower" is less than 2k EUR e.g. https://www.crowdsupply.com/ukama/ukama
    • prohibitively complex, see above, namely you don't need to be a TelCo engineer to get it going
    • probably illegal, namely you needed (and I bet still need in most places) wireless band allocation before you could deploy anything

    ... so I imagine there was no authentication because there was no practical threat beside few "fun" examples in CCC or DEF Con.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 year ago

    The use of Stingray by US law enforcement has been challenged on grounds that the law enforcement agencies have no spectrum license. Those challenges seem not to have found success.

    On the other hand, prisons in the US have been stopped from operating cell phone jammers on prison grounds, on the same complaint of no spectrum license.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 1 year ago

    I don't know the specific methods, but 3G, 4G and 5G do authenticate bidirectionaly, just 2G doesn't, partially why Android now has "Disable 2G" toggle.
    Also probably why they said they can downgrade you to 2G to intercept communication.

    What's happening here is probably similar to anyone being able to send Wi-Fi deauthentification frame to your device to disconnect you. Unless you're using WPA3.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 year ago (2 children)

    IMEI/IMSI are collected (and immediately linked, hence deanonymized even if SIM was inserted only once) by cell tower operators. Just not bring your device, period.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •