Slashdot Mirror
FBI's Smartphone Surveillance Tool Explained In Court Battle
concealment writes with news that a court battle has brought to light details on how the FBI's "stingray" surveillance tool works, and how they used it with Verizon's help to collect evidence about an alleged identity thief. Quoting:
"Air cards are devices that plug into a computer and use the wireless cellular networks of phone providers to connect the computer to the internet. The devices are not phones and therefore don’t have the ability to receive incoming calls, but in this case Rigmaiden asserts that Verizon reconfigured his air card to respond to surreptitious voice calls from a landline controlled by the FBI. The FBI calls, which contacted the air card silently in the background, operated as pings to force the air card into revealing its location. In order to do this, Verizon reprogrammed the device so that when an incoming voice call arrived, the card would disconnect from any legitimate cell tower to which it was already connected, and send real-time cell-site location data to Verizon, which forwarded the data to the FBI. This allowed the FBI to position its stingray in the neighborhood where Rigmaiden resided. The stingray then "broadcast a very strong signal" to force the air card into connecting to it, instead of reconnecting to a legitimate cell tower, so that agents could then triangulate signals coming from the air card and zoom-in on Rigmaiden’s location. To make sure the air card connected to the FBI’s simulator, Rigmaiden says that Verizon altered his air card’s Preferred Roaming List so that it would accept the FBI’s stingray as a legitimate cell site and not a rogue site, and also changed a data table on the air card designating the priority of cell sites so that the FBI’s fake site was at the top of the list."
Chris Paget was able to demo similar behavior at DEFCON 18, and he sure didn't need Verizon's help to do so.
Pretty sure the FCC wanted to bust him on stage, actually.
John
This is basically a supply chain attack. People worry about others breaking into their devices, but the user has to trust the device supplier not to tamper with it before they receive it. This situation is analogous to your PC phoning home to Microsoft for updates, then having a special version sent to your machine at the request of the FBI. No matter how careful you are about what software you run or what security software you employ, Microsoft can compromise your machine.
Issuing a custom radio firmware for a data only device, so that it responds to a telephone network signal demonstrates that verizon is willing to place nonstandard firmware on devices on their network, for the express purposes of aiding investigations that lack proper warrants.
This is a very bad thing Verizon. A Very Bad Thing.
Don't underestimate the impact that losing public confidence can have on your business. Being so self-conceited as to feel that you don't have to worry because you have cornered the market would only add fuel to the fire.
Plan you PR damage control messages carefully. Smile, you're on candid camera.
Clearly our technological advances are ahead of the law and it's time for those 2 to sync up in a realistic way.
Ok, so this is a guy who does identity fraud.
I'm not crying for him
He's lucky to even have access to due process as far as I'm concerned However, that your very own devices can be used against you in such ways, which means that the trust you have in your provider is broken, seems unethical.
If the FBI and/or other agencies require such abilities, perhaps then, companies such as Verizon should place this in their contracts something like "authorities can use your devices to track you and/or use your data for any of their investigations as they see fit".
Transparency would be nice.
All I know is that, I've got nothing to hide, so I don't care, but, for those who do, they may have to switch to another provider....
If anybody other than Verizon had done this to somebody, they'd be in jail.
What does this button d$#%* NO CARRIER
That's one of the issues in this case. A Stingray is not discriminating and could impact other cellular devices. The FBI also claims they "throw away" all data that is not pertinent to their investigation, meaning there is no way to determine what they did or did not see regarding other people's communications. (Kind of a damned if you do, damned if you don't situation.)
There is also the difference between wiretaps and pen trace registers. Wiretaps require a warrant, but pen traces don't. The Stingray doesn't record the call or data contents, so it could be claimed to be more like a pen trace. But a Stingray is actively pinging the target's machine to generate data to be used against the owner, which is a completely different use (abuse?) of the technology.
Anything like this would be perfectly legal with a warrant. The real question is if this is legal without one.
John
Clarification: in this case they had a "court order signed by a magistrate". I don't know how that differs from a "warrant", but it does sound like an appropriate level of judicial oversight, and that this was not just a rogue agent fishing for tax evaders.
John
"When they came for the scumbags, I did not speak out, for I was not a scumbag..."
It does look like they configured it in such a way that ONLY the suspect's card attached to the Stingray. That narrow focus may win the day in this case.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
It's a little more complicated than that.
It seems Verizon pushed an update to his specific wireless card. This update allowed it to receive phone calls, thus allowing them to "ping" him in particular. It also set the preferred tower list so that the stingray would always be connected to first.
The fun thing is that by modifying his wireless card, the FBI has "planted" a tracker on him. That requires a warrant. If this guy was such a big deal, then it shouldn't have been hard to get the warrant. The problem is the FBI didn't want anyone, even the judges, to know what cards they held. So even when they got there court order, it wasn't a warrant, and they misled the judge who issued the order. That's a big no no.
So lets pretend that we've just completed writing this code, as opposed to having just completed sabotaging it -Altera
If the FBI's looking for you and gets the proper documentation, then it is legal. full stop
Whether things are fine, or whether you do or don't have something you would like to hide, it becomes irrelevant to the discussion.
Is it just my observation, or are there way too many stupid people in the world?
All you need is openBTS and a USRP. Total investment could be under $500.
HOWEVER... Since you would be operating an unlicensed radio on a licensed spectrum, as well as intercepting/hijacking other people's cell calls you will be breaking many laws including operating without a license, illegal intercept, wire fraud...
You, unlike the FBI, will not have a get out of jail free card. You will rot in jail! But, the tools are readily available to the public and te barrier to entry is surprisingly low.
Well, except that:
They didn't have the appropriate level of oversight, they had some oversight, but not to the standard they required.
I have no reason to believe this was a 'rogue' agent, I fear it's become SOP at the FBI, and the entire agency is skirting the law when it's convenient.
Lost at C:>. Found at C.
That's one of the issues in this case. A Stingray is not discriminating and could impact other cellular devices. The FBI also claims they "throw away" all data that is not pertinent to their investigation, meaning there is no way to determine what they did or did not see regarding other people's communications. (Kind of a damned if you do, damned if you don't situation.)
From what I've read on the issue, the stringray only works if the targeted phone's PRL has been modified to accept the stingray as a "friendly" tower. On or off, unmodified phones aren't going to connect to the stingray, seeing it as a rogue device.
I'm not saying there isn't anything to be concerned about here, just saying that you're focusing on the wrong (and incorrect from what I'm reading) issue. In these circumstances, the stingray appears useless without the service provider's complicity in both tracing location of the target, and uploading modified firmware to the target's phone.
Nobody is disputing the facts of the case. The questions are if the legal protections were adequate in this case, or if the FBI should have done something more.
And the card wasn't "reprogrammed", at least not in the sense of sending an actual new program to it. An artificial list of cell tower IDs was sent to it, prominently featuring the fake tower ID as top priority. This duped his card into always trying to connect to the FBI's Stingray.
It was "reprogrammed" in the same sense that your grandmother equates "data entry" with "programming".
John
Got it, thanks. I missed equating the change to his card as "planting a tracking device", which makes total sense, at least to me. So now, it's up to the court to decide if the law sees those as equivalent activities, requiring equivalent oversight.
Oh well. Better to let 100 scoundrels roam free than to wrongly imprison one man.
John
You have to realize that we are now living in an era when the law is WHATEVER the FBI/TSA and all of the other multitude of three-letter-acronymed agencies SAY it is.. I've given up hope that sanity and Consitutional freedom will return to America anytime soon.. I'm thankful I'm not a kid anymore having to live in what is quickly becoming what the old soviet union was..
THANK YOU, Edward Snowden!! Americans owe you a debt of gratitude (whether they know it or not..)
... 'scuse me, but I see "unauthorized access to a computing system" and "theft of service" all over here. A badge should not be a free pass to commit crimes.
The fibbies might well have a warrent that would allow searching the machine, and a different one that would allow monitoring electronic conversations. But that is not the same as planting malware that creates transmissions. Not that the FBI transgressions are likely to be presented to a Grand Jury.
The interesting thing is this is a criminal trial where illegally obtained evidence and all results thereof can be excluded "fruit of the poisoned vine". So watch the admissibility rulings ...
It never connects to the strongest signal.
That was the beauty of Paget's hack. He used one of the non-domestic cell frequency bands to attack quad-band cell phones (using the ISM band at 900MHz.) Because the phone decided it was roaming, and didn't care about the network ID being set to zero, the phone believed whatever the fake tower told it. The other thing he needed was to send a tower signal that claimed it was getting perfect reception from the subscriber device, so the phone would prefer it above the real towers. No PRL change needed. He also told the phones that the network did not support encryption, so the traffic was sent in the clear, and not only could he intercept it, he could retransmit it over VOIP, acting as a man in the middle.
That was an amazing hack.
John
...aren't also targets for reprogramming and surveillance.
Thats one way to do it.
No wonder that guy on the Verizon commercials had such good coverage...He had an FBI van with a femtocell following him around.
I'm not so sure about some of that.
I watched the video: https://www.youtube.com/watch?feature=player_detailpage&v=DU8hg4FTm0g#t=1314s and didn't see anything on preventing rogue base stations for GSM. Of course, Verizon uses a CDMA network, so they may have extra precautions.
The part about using the 900MHz band didn't have anything to do with roaming. It had to do with legality. The frequency he's using is a ham radio frequency, and he's complying with FCC regs. https://www.youtube.com/watch?feature=player_detailpage&v=DU8hg4FTm0g#t=507s
So lets pretend that we've just completed writing this code, as opposed to having just completed sabotaging it -Altera
Well, then go with "reconfigured" instead of getting mired in the definition of "programmed".
The end result was they broadcast something which caused his card to report his whereabouts, and gets into the realm of things that the FBI + Verizon may or may not be able to do without some proper authorization.
So did an error of omission lead to an error of commission?
It's TFA which says "In order to do this, Verizon reprogrammed the device so that when an incoming voice call arrived, the card would disconnect from any legitimate cell tower to which it was already connected, and send real-time cell-site location data to Verizon, which forwarded the data to the FBI"
Lost at C:>. Found at C.
Um all sorts of AirCards, USB 3G dongles, etc can be made to make and recieve calls.
All the Huwaei 3G usb modems that are sold by telco's here in Aus/NZ i've managed to get to make and recieve calls. (Yeah you need to use a USB headset or something, but you already do for skype and voip.)
Is there any point to it? I don't know, but you can.
Just like most tablets can be made to make/receive phone calls even though they aren't considered phones by the law.
You can tell how powerful someone is by the magnitude of the crime they can commit and be able to get away with.
Did nobody in this thread read about this when it was posted on Slashdot a week or two ago? Everybody is wondering about whether or not they got a warrant, etc. and that was all thoroughly covered last time. The FBI claimed this was covered under an order telling Verizon to provide technical assistance locating the card. The judge who signed that order is pissed, saying it did NOT authorize the FBI to do ANYTHING, and especially it did not authorize them to use a Stingray. The judge's colleagues agree, and are pissed that the FBI was pulling this crap.
So no need for Slashdotters to wonder whether or not the order allowed the Stingray - the very judge who issued the order says it certainly does not. The FBI has since sent a memo to their agents saying the same thing, that a Stingray requires an order that specifically mentions a Stingray, not a "technical assistance" order.