Slashdot Mirror
Mysterious, Phony Cell Towers Found Throughout US
Trachman writes: Popular Science magazine recently published an article about a network of cell towers owned not by telecommunication companies but by unknown third parties. Many of them are built around U.S. military bases. "Interceptors vary widely in expense and sophistication – but in a nutshell, they are radio-equipped computers with software that can use arcane cellular network protocols and defeat the onboard encryption. ... Some interceptors are limited, only able to passively listen to either outgoing or incoming calls. But full-featured devices like the VME Dominator, available only to government agencies, can not only capture calls and texts, but even actively control the phone, sending out spoof texts, for example."
We could listen to AMPS cell phone calls by tuning to the high UHF channels and tuning between channels... Ahhh anyone remember the joy of pressing the outer tuning ring and going back and forth???
Mostly random stuff.
Um, where did the article go?
Google shows that the article did exist, but no longer
https://www.google.com/search?q=%22Interceptors+vary+widely+in+expense+and+sophistication+%E2%80%93+but+in+a+nutshell%2C+they+are+radio-equipped+computers%22&oq=%22Interceptors+vary+widely+in+expense+and+sophistication+%E2%80%93+but+in+a+nutshell%2C+they+are+radio-equipped+computers%22
You know, cellular networks use radio, folks. When you're transmitting electromagnetic radiation using the fabric of spacetime as your communications medium, it becomes rather quite difficult to prevent interception. Learn to use encryption and quit your whining.
The article says ...
What we find suspicious is that a lot of these interceptors are right on top of U.S. military bases.
The summary says ...
Many of them are built around U.S. military bases.
Way to slant the summary to make it look like Chinese towers rather than our towers.
No doubt the NSA owns at least half of them.
Looks like an off-the-budget pet-project of NSA has been outed!
The linked to article has been taken down, it seems.
A google search for "Interceptors vary widely in expense and sophistication – but in a nutshell, they are radio-equipped" indicates that the article was published long enough for Google to scrape it.
So, a guy who has developed a "secure" phone travels across the country and happens to find a widespread network of phony cell towers? Let's get a few of these phones together... say three to a location... and triangulate these devices down to the building/tower that they are mounted on.
I've got a rock that keeps tigers away if anyone's interested...
It's a thinly veiled ad for a supposedly "secure" cell phone.
intercept non-approved communications about kjhfgdt kans hwwpfu alowk nh ar akhde.
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
Source.
Mysterious Phony Cell Towers Could Be Intercepting Your Calls
Wed, 08/27/2014 - 11:00
Unencrypted Connection Les Goldsmith Like many of the ultra-secure phones that have come to market in the wake of Edward Snowden's leaks, the CryptoPhone 500, which is marketed in the U.S. by ESD America and built on top of an unassuming Samsung Galaxy SIII body, features high-powered encryption. Les Goldsmith, the CEO of ESD America, says the phone also runs a customized or "hardened" version of Android that removes 468 vulnerabilities that his engineering team team found in the stock installation of the OS.
His mobile security team also found that the version of the Android OS that comes standard on the Samsung Galaxy SIII leaks data to parts unknown 80-90 times every hour. That doesn't necessarily mean that the phone has been hacked, Goldmsith says, but the user can't know whether the data is beaming out from a particular app, the OS, or an illicit piece of spyware. His clients want real security and control over their device, and have the money to pay for it.
To show what the CryptoPhone can do that less expensive competitors cannot, he points me to a map that he and his customers have created, indicating 17 different phony cell towers known as “interceptors,” detected by the CryptoPhone 500 around the United States during the month of July alone. Interceptors look to a typical phone like an ordinary tower. Once the phone connects with the interceptor, a variety of “over-the-air” attacks become possible, from eavesdropping on calls and texts to pushing spyware to the device.
“Interceptor use in the U.S. is much higher than people had anticipated,” Goldsmith says. “One of our customers took a road trip from Florida to North Carolina and he found 8 different interceptors on that trip. We even found one at South Point Casino in Las Vegas.”
Who is running these interceptors and what are they doing with the calls? Goldsmith says we can’t be sure, but he has his suspicions.
“What we find suspicious is that a lot of these interceptors are right on top of U.S. military bases. So we begin to wonder – are some of them U.S. government interceptors? Or are some of them Chinese interceptors?” says Goldsmith. “Whose interceptor is it? Who are they, that's listening to calls around military bases? Is it just the U.S. military, or are they foreign governments doing it? The point is: we don't really know whose they are.”
Ciphering Disabled Les Goldsmith
Interceptors vary widely in expense and sophistication – but in a nutshell, they are radio-equipped computers with software that can use arcane cellular network protocols and defeat the onboard encryption. Whether your phone uses Android or iOS, it also has a second operating system that runs on a part of the phone called a baseband processor. The baseband processor functions as a communications middleman between the phone’s main O.S. and the cell towers. And because chip manufacturers jealously guard details about the baseband O.S., it has been too challenging a target for garden-variety hackers.
“The baseband processor is one of the more difficult things to get into or even communicate with,” says Mathew Rowley, a senior security consultant at Matasano Security. “[That’s] because my computer doesn't speak 4G or GSM, and also all those protocols are encrypted. You have to buy special hardware to get in the air and pull down the waves and try to figure out what they mean. It's just pretty unrealistic for the general community.”
But for governments or other entities able to afford a price tag of “less than $100,000,” says Goldsmith, high-quality interceptors are quite realistic. Some interceptors are limited, only able to passively listen to either outgoing or incoming calls. But full-featured
The fact that these towers are found next to military bases speaks volumes.
The military needs to there own version of everything to make sure things work in times of national crisis, emergency, or security. They need to have their own infrastructure to insure communications. They need to control their communications around bases and know who is saying or doing what. They need to be able to anticipate attacks. Nobody should have any expectation of privacy on or next to a military base.
Quite frankly, I'm glad to see this.
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
Interceptors look to a typical phone like an ordinary tower. Once the phone connects with the interceptor, a variety of “over-the-air” attacks become possible, from eavesdropping on calls and texts to pushing spyware to the device.... Interceptors vary widely in expense and sophistication – but in a nutshell, they are radio-equipped computers with software that can use arcane cellular network protocols and defeat the onboard encryption.
There are a number of positions in the military whose job is to put up or take down cell towers and any other telecommunications infrastructure at a moment's notice. They do it in warzones, on boats, on airplanes, at political rallies, during conventions and wargames. Is it so surprising that they keep permanent ones near or on their bases?
I would not be the slightest bit surprised to find half a dozen shady looking cell towers in a military base. Some soldiers shoot guns for a living, some fly drones, some pull cables, others do this.
A few news sites and tech sites have:
"Android security mystery 'fake' cellphone towers found in U.S." (28 AUG 2014)
http://www.welivesecurity.com/...
Fake, phone-attacking cell-towers are all across America (Sep 1, 2014)
http://boingboing.net/2014/09/...
"The fake "interceptor" towers force your phone to back \\down to an easy-to-break 2G connection, then goes to work"
"..the baseband firewall on the Cryptophone set off alerts showing that the phones encryption had been turned off, and that the cell tower had no name a telltale sign of a rogue base station."
Fake cell phone towers may be spying on Americans calls, texts (September 03, 2014)
http://rt.com/usa/184636-fake-...
Domestic spying is now "Benign Information Gathering"
The price has dropped to city, state and federal budget level for some of the tower like products.
The problem is more people now understand just how their low cost cell phone works as a gps becon, text, photo, calls list and voice, voice print collector.
The costs for voice systems like this in Ireland, South America where mil only historically. Now any regional, city, gov with funding can have a go at years of "warrantless surveillance".
The only issue is the upgrade to next gen costs and keeping details away from press with local FOIA like requests for city and state budgets.
Forcing 2g only signal use was the old news, now the next gen is ready for todays cell users in real time (beyond location tracking).
As 2g is removed in a few years, the new warrantless cell surveillance products are been made ready.
Domestic spying is now "Benign Information Gathering"
Is this article some kind of joke I don't quite get?
Sheesh, evil *and* a jerk. -- Jade
Can I just say,
From the mouths of ANYONE who isn't an American.
STOP FUCKING GEO-REDIRECTING LINKS FOR FOREIGNERS YOU ASSHOLES.
Jesus christ fuck me gently it's the worst god damned thing to do on any web page, I think it might actually be worse than "this content is not available in your region" - because at least it takes us (mostly) to what we wanted.
http://www.popsci.com/article/...
takes me to
http://www.popsci.com.au/?src=...
Thanks dipshits.
this might be another secret plan of #US govt.
Small cell hardware can be offered some concealment as signs, trees, big cactus, wider flag poles, bell towers, thin onto brick walls or fake wood sidings, water towers, added rooftop enclosures, fake tinted glass, in a new chimney box, fake dormers, cupola.
It just depends on who is paying and what fits in with the surrounding area.
Domestic spying is now "Benign Information Gathering"
In totally unrelated news: The US Military uses self signed certs on pico cells to provide service in rural bases to customers from different providers. Media Whoring "crypto-phone" company jumps to far fetched conclusions in advertising fodder..
Detected "mystery towers" could be configuration glitches or SDR enthusiasts playing with OpenBTS. After the FCC was fooled into opening an investigation, said enthusiasts should now expect to be probed by the FBI.
I, for one, welcome our robot overlords. Too soon? They aren't robots yet?
I, for one, welcome our shadowy human overlords.
The other question is then what where telco teams and gov teams doing when they scan for allocated spectrum issues? Own tower, competitor networks, new interfering hardware to be located and that local 'fake' mobile tower should kind of show up on normal regional cell maintenance work. What do telco staff do? Just let the 'fake' mobile devices work alongside their own expensive networks 24/7 over years? Thats their brands network thats been used by some fake device...
Are new staff instructed only to worry about hardware and consumer grade issues? Fake networks are to be left alone and not explored?
Domestic spying is now "Benign Information Gathering"
Cell towers are usually owned or shared by telco firms, brands, providers that try to encrypt their users and are kind of easy to spot with hardware.
The "Phony" cell towers do not respond or act in the same way. They are fake but still fool a users phone into making a network connection.
Tame consumer grade hardware is fooled into seeing just another cell tower.
Domestic spying is now "Benign Information Gathering"
...it's just another brick in the wall.
For some reason people aren't breaking out the hammers. It's as if they just don't care, or fail to understand the implications at least, of all this surveillance and monitoring.
And this is news....how? This is the same government which brought the TSA, and they are certainly useless.
Of course the US military has cell towers on their own bases. They are using those to track calls made on base that might violate security. Why is a PFC or Airman calling China or Pakistan - why is a contractor sending large amounts of data to a dropbox account? Time for somebody to ask a few questions. You have no - zero - rights to disclose military information outside of channels. In addition by running their own towers they also have the power to shut them down - or jam outside towers during a national security incident.
The answer to the question is very simple when you use your thinking cap people.
so you mean to tell me that the telcos that spend millions, billions on spectrum licensing don't spot rogue basestations mooching on their frequency allocations ? Or were all of these in unlicensed spectrum ?
Nullius in verba
Every significant US Military base has a device that records every single phone call in and out and cell phones.
It stores the calls for a number of days.
Normally it just purges the old data as new calls are recorded.
But if something suspicious occurs the calls can be checked and saved.
Pretty much a airplane black box for telecommunications.
Calling a Bomb threat in to a US Military base is a REALLY bad idea, even with a burner cell phone outside the gate.
Mysterious, Phony Cell Towers
Aren't all cell towers phone-y?
systemd is Roko's Basilisk.
... ha ha, still LOL about it!
The kids today need to learn the lessons we did when the operator could very obviously listen in to every call and would sometimes even break in and say something. The technology has changed but the capability is not just still there, it's easier. Never say anything on a phone that you would hate to see in a newspaper (or on a blog) - that most definitely includes credit card numbers.
Looks like Apple has built in detection from IOS 5 (though being Apple it might well have an off switch for legal intercept type applications):
http://9to5mac.com/2011/06/07/...
And it looks like some developers have gotten together to do something for Android with a project called Android IMSI-Catcher Detector (AIMSICD)
https://secupwn.github.io/Andr...
http://seclists.org/fulldisclo...
Has anyone tried this?
blindly antisocialist = antisocial
If this applies to CDMA technology as well.
Enforcing OP sec, at the least.
Take one out of action. See who responds. It's not that hard.
Make sure your lawyer is on speeddial.
E
The article may be military disinformation to disguise the fact that it is indeed a military communications network. Whether it also eavesdrops is another question.
I remember a call I was on where there were people chatting in the background, when I asked who they were the responder said he was talking to a friend on a military base, I'm guessing shortwave, and why and how they were picking up the signal of a landline and that was on the military network arises interesting questions regarding privacy laws and the scope of military activities regarding domestic surveillance as well as how the technology.
And this is news....how? This is the same government which brought the TSA, and they are certainly useless.
And the Slashdot sheeple want to put that government in charge of health care.
If they can't run airport security, what the hell makes you think they can run health care? Look how fucked up the VA health care system is.
I know what you are talking about as I had to install one at a military base. Ours supported only US Government cell phones and unless your personal phone was able to see a carrier you would have no signal. This does require coordination with the carriers to make sure you don't interfere with them. These pico-cells are "smart" in that they communicated with the towers when it comes to hand-over, etc.
I was in the military and we could not operate all willy-nilly. A lot of our equipment, specifically radar, was way over-powered. However, the FCC rules only apply to the 12 mile limit (or whatever it may be now) of shore. The systems that we did use within that 12 mile limit had active FCC licensing. The one exception is that the operators, we did not have an FCC license. IIRC, in the commercial world we would have to have had them.
Somebody missed the concept of "burner phone" - a real burner phone gets used once, or to call only one person for a short period of time.
Buying a phone for cash and using it like normal isn't very clever.
Anyone in the know on whether or not the so called rogue towers are simple benign cell phone signal boosters?
... and we can't find out who built the towers and who paid the freaking bill?
It little behooves the best of us to comment on the rest of us.
At my parent's house, which is in the middle of nowhere with neighbours about 1000 feet away, there is a protected wifi network that appears at maximum signal strength (using inSSIDer, the bar is a perfectly straight line with no variation) no matter where I walk on the property. The strange thing is that it's only there for a few hours a day, not all the time.
Could there be some sort of stingray device that also does something with wifi? Or are there now long-range/satellite wifi networks? Any idea what could be .happening? It doesn't appear to be a virus since I've experimented with multiple devices and even routers.
The house has frequently been under police watch in the past, so some sort of active monitoring is within the realm of possibility, but I've just never heard of anything like what I see here.
Cities like Chicago are installing cellphone tracking devices to monitor pedestrian traffic. http://readwrite.com/2014/09/0... http://articles.chicagotribune... There's one at the top of a light pole in front of the Board of Trade on Jackson St. It looks like a small, black, round trash can.
Want to see how important they are? Break one and see how fast it takes company 'x' to get out and repair it.
apples to oranges: the VA has been a civil-service dumping ground useful for nepotism, political payoffs, and hiding the incompetent for generations now. Civilian heath care is still (mostly) in the hands of organizations (hospitals, universities, etc.) who actually give a crap about providing high-quality health care and can be easily sued (go ahead; try suing the VA and let me know how you make out).
As long as I've been able to read (early 1960s) there have been occasional news articles about some incompetent MD or administrator at the VA who finally screws one too many pooches and the harrumphing goes on until the headlines go away. Like the idiot during the first gulf war who told a TV journalist on-camera that these wounded soldiers don't deserve the latest prosthetic technology, and so what, anyway. Big fuss, one disappeared jerk, the VA sails on...and soldiers continued to get old-technology prosthetics. Sigh. Insert Walter Reed conditions, wait times, etc., and you find, as they saying goes, "twas ever thus".
Some of these towers are transmitting.. so shouldn't that necessarily involve a license from the FCC? What about the phone companies? They're they ones who have licensed the spectrum. Shouldn't they care that someone is transmitting on their frequencies?
I would hope that these towers are in the FCC's database:
http://wireless2.fcc.gov/UlsApp/AsrSearch/asrRegistrationSearch.jsp
Without actual locations, though, it's really hard to know. The map in the article is not detailed enough. Anyone have a better source?
Acutally, most of the spectrum that's commercially available is dual-use. I haven't looked at this particular example, but we have a $300B problem that the FCC is giving away spectrum that used to be shared, and so the military is forced to redesign hardware to fit in newer, narrower frequency allocations.
you guys ever consider they could be commercial espionage relate -def contractors spying on competitors products in the field let alone foreign govt data capture ops or in the event of a conflict they would be used to jam or give out EMP type burst to fry military electronics?