Discussion
Loading...

Post

  • About
  • Code of conduct
  • Privacy
  • Users
  • Instances
  • About Bonfire
evacide
@evacide@hachyderm.io  ·  activity timestamp 3 months ago

I've spent not-insignificant amount of time at protests in the US, looking for signs of IMSI catchers and never found anything, so when I saw this, my ears perked up:

https://san.com/cc/exclusive-evidence-of-cell-phone-surveillance-detected-at-anti-ice-protest/

  • Copy link
  • Flag this post
  • Block
Mikael Thalen
@mikaelthalen@mastodon.social replied  ·  activity timestamp 3 months ago
@evacide I suggest checking out the research paper for Marlin. Researchers analyzed 3GPP standards and compiled the first-ever list of 53 pre-authentication IMSI-exposing messages for 2G, 3G, 4G, and 5G-NSA https://www.cise.ufl.edu/~butler/pubs/ndss25-tucker-marlin.pdf
  • Copy link
  • Flag this comment
  • Block
Tim Ward ⭐🇪🇺🔶 #FBPE
@TimWardCam@c.im replied  ·  activity timestamp 3 months ago
@evacide Once Upon A Time in the 2G days I worked on software that would, amongst various other interesting things, catch IMSIs. This was, I was told, destined for use by foreign security services abroad ... I didn't ask any further questions. For my own testing I put serious attenuators on the antenna sockets and checked that you could barely receive the signal in the street outside my house (and I set it to an Australian MCC/MNC so that no passing Brits' phones would register).

Imagine my horror when I got a support request: "the attached logs don't look right to us - can you tell us what's going on please?" with the footnote "this was from field testing in a shopping centre in Slough."

  • Copy link
  • Flag this comment
  • Block
James Mitchell
@wotsac@mastodon.social replied  ·  activity timestamp 3 months ago
@evacide this happened practically in my back yard. I'd been meaning to set up a Rayhunter already, so I'll be doing that this week and giving it a shot
  • Copy link
  • Flag this comment
  • Block
Noortje Van Leeuwen
@Noortjevee@mstdn.social replied  ·  activity timestamp 3 months ago
@evacide
Mine did also , although we dont have ice protests...

I knew there was a reason i kept taking my phona faraday cage along.

  • Copy link
  • Flag this comment
  • Block
Toni Aittoniemi
@gimulnautti@mastodon.green replied  ·  activity timestamp 3 months ago
@evacide Damn. That’s KGB level stuff. 😬
  • Copy link
  • Flag this comment
  • Block
Ike
@ike@pkm.social replied  ·  activity timestamp 3 months ago

cc: #Tukwila#Seattle

Read the linked article regarding protests and cell tower spoofing by ICE against protesters

#ICE#Protest

  • Copy link
  • Flag this comment
  • Block
Linux Is Best
@Linux@mastodon.au replied  ·  activity timestamp 3 months ago
@evacide

Reasons why I told people not to bring phones with them when they protest.

Digital Cameras, yes, but not phones.

  • Copy link
  • Flag this comment
  • Block
Falling forward 🌵
@AnnyJoe@mastodon.world replied  ·  activity timestamp 3 months ago
@evacide
For the folks who didn't catch the reference to Rayhunter

Meet Rayhunter: A New Open Source Tool from EFF to Detect Cellular Spying

https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying?language=en

  • Copy link
  • Flag this comment
  • Block
CaliCarol
@jawarajabbi@mastodon.online replied  ·  activity timestamp 3 months ago
@evacide

These fools are gonna grab these guys.

#uspol#ICE

  • Copy link
  • Flag this comment
  • Block
Simply Simon
@Salty@mastodon.nz replied  ·  activity timestamp 3 months ago
@evacide He says he saw bursts of requests for devices to send their IMSI, but although he (separately) mentions that there is a 2G-downgrade attack he does not say that he noticed this attack in this context.

In 3G+ standards the network must authenticate back to the SIM, a feature specifically designed to make this attack much more difficult. Have US carriers just given up the crown jewels crypto keys to their networks?

Note that network operations that involve requesting IMSI from the device are a legitimate part of the operation of the network. Bursts of authentication-related signalling might simply be a symptom of a locally congested site.

  • Copy link
  • Flag this comment
  • Block
evacide
@evacide@hachyderm.io replied  ·  activity timestamp 3 months ago
@Salty I am not yet certain this isn't a false positive, but it's certainly worth digging into.
  • Copy link
  • Flag this comment
  • Block
Simply Simon
@Salty@mastodon.nz replied  ·  activity timestamp 3 months ago
@evacide Indeed. Of course I would never say *never* but the only time we have for sure experienced a false base station attack here in NZ it was 100% accomplished using 2G downgrade. Unfortunately we can't get handset vendors to disable 2G in firmware because one of our competitors still runs a 2G network and by regulation it must be possible to make emergency calls on any transmitting network ... so ... yeah, we all remain vulnerable to that.
  • Copy link
  • Flag this comment
  • Block
Farshid Hakimy / فرشید
@farshidhakimy@chaos.social replied  ·  activity timestamp 3 months ago
@Salty @evacide newer android phones do have an option to disable 2G. They will only connect to a 2G network when dialing an emergency number and no other network is available.
  • Copy link
  • Flag this comment
  • Block
GhostOnTheHalfShell
@GhostOnTheHalfShell@masto.ai replied  ·  activity timestamp 3 months ago
@evacide

I long for the day of a simple digital camera.

There is just too much to telemetry. It doesn’t help that Ripple (the company) and Horowitz have donated the money to police departments for surveillance drones and an operation center.

We don’t need the world’s wealthiest men provisioning police forces. It should be seen as a very bad optics.

If only because crypto is so heavily enmeshed with international crime and we’re talking things like human trafficking.

  • Copy link
  • Flag this comment
  • Block
PKPs Powerfromspace1
@Powerfromspace1@mstdn.social replied  ·  activity timestamp 3 months ago
@evacide standard operating procedure for ICE and state and local

Welcome to the mass surveillance police state on steroids

  • Copy link
  • Flag this comment
  • Block
Muro deGrizeco
@murodegrizeco@toad.social replied  ·  activity timestamp 3 months ago
@evacide

BLM protest in downtown Palo Alto, number of years ago.

I strolled past, noted an unmarked van with a lot of stubby antennas on top, door cracked open, dude inside minding a rack of electronics. I assumed it was a ISMI catcher or a stingray thing.

  • Copy link
  • Flag this comment
  • Block
Patrick Morris Miller
@kentenmakto@mastodon.ie replied  ·  activity timestamp 3 months ago
@evacide Wonder how hard it would be to whip up a gizmo that squawked fake IMSIs in job lots. Idly curious, y'know.
  • Copy link
  • Flag this comment
  • Block
Jeffrey Haas
@jhaas@a2mi.social replied  ·  activity timestamp 3 months ago
@evacide Anecdata: During IETF 56, 2003, in SF at the start of Desert Storm, there were protests outside of the conference hotel. A number of conference attendees who spend rather too much time on their phones noted peculiar interruptions in service - especially SMS.
  • Copy link
  • Flag this comment
  • Block
flythe10
@flythe10@mastodon.social replied  ·  activity timestamp 3 months ago
@evacide burner phones are worth the $19 bucks.
  • Copy link
  • Flag this comment
  • Block
Dataclysm
@Dataclysm@mstdn.social replied  ·  activity timestamp 3 months ago
@evacide

Speaking as a member, is there a role for EFF in raising awareness of this?

  • Copy link
  • Flag this comment
  • Block
Northern Scrub
@northernscrub@mastodonapp.uk replied  ·  activity timestamp 3 months ago
@evacide I thought stingrays were old news? I remember reading something about third party poisoning not that long ago, something about governments dressing up as contractors and sticking compromised switchgear up at tower sites. We had one here, only it was a Chinese faux-police station doing it
  • Copy link
  • Flag this comment
  • Block
Log in

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About · Code of conduct · Privacy · Users · Instances
Bonfire social · 1.0.0-rc.3.1 no JS en
Automatic federation enabled
  • Explore
  • About
  • Members
  • Code of Conduct
Home
Login