The “Atlas of Surveillance” has the info – or at least, some of it.
  • FauxLiving@lemmy.world
    0·
    4 days ago

    TLDR: Detecting Stingrays is pretty trivial, they are active in a lot of places.

    I use a software defined radio, mostly to have a cool map using ADS-B… but it also can receive in the ghz frequency bands and capture the unencrypted header information for cellular data.

    That information is largely useless because modern cellular communications don’t expose anything private. However, most cellphones will automatically attempt to use a downgraded connection (5G -> 4G) if they lose connection with the tower.

    Stingay/IMSI catcher/Cell Site Simulator take advantage of this by forcing phones in an area to downgrade their connections to older and less secure frequencies and then exploiting that downgrade to get information about the phones in the area.

    You can detect these downgrade attacks by listening to the traffic and analyzing the packet captures.

    I noticed that my cellphone was losing connection to the tower and I was trying to see if maybe the tower was rebooting or something odd.

    I tuned into the frequency bands and saw that it was still transmitting a strong signal while my phone showed no connection. If I restarted the connection it would connect to the tower, but if not it would lose the connection for 15-20mins. It always happened towards midnight but, oddly, not always at the same time.

    That made me curious so I found the software to packet capture the cellular data and detect downgrade attacks. Sure enough, I’d get a downgrade attack detection and my phone would drop connection.

    After a bit more research I discovered that the connection dropping was a feature, not a bug. GrapheneOS can prevent your cellular modem from downgrading in order to mitigate these kinds of attacks.

    And, also, that you don’t have to buy expensive software defined radios and do all of the annoying packet capture and analysis to detect these things. You can do it with cheap ($20) hardware and free software from the EFF: https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying

    • sunzu2@thebrainbin.org
      0·
      4 days ago

      However, most cellphones will automatically attempt to use a downgraded connection (5G -> 4G) if they lose connection with the tower.

      Is 4g actually less secure?

      I thought it was fine… Down grade attack is done via 2g/3g which have no security

      • FauxLiving@lemmy.world
        0·
        4 days ago

        They downgrade to 2G, whose encryption is cracked trivially with modern hardware and there’s no tower authentication so it’s possible to have the phones connect through the css.

        Disable 2G (or use GrapheneOS) and you’ll mitigate this specific attack.

        3G and 4G have some flaws themselves(from Blackhat ‘17: https://youtu.be/BFkrK5kaH4o)

        • sunzu2@thebrainbin.org
          0·
          4 days ago

          Damn… So 5g only should be used?

          I was operating under idea that 4g was better than 5g for privacy and security. I guess I need to hit the books again

          Never heard being

            • sunzu2@thebrainbin.org
              0·
              4 days ago

              Ohh i am balls deep into privacy game.

              Just trying to sort out if 5g is better over 4g here for daily activities.

              5g uses more battery so I generally stay on 4g but if 4g is less secure, might need to go with 5g

              Also, doesnt 5g provide telco with with you position too?

              IE they can tell you are on 5th floor v 15th

              • FauxLiving@lemmy.world
                0·
                4 days ago

                Yeah, 5G uses beamforming so they know where you are with pretty high accuracy.

                Nothing will prevent them knowing your location, if you’re transmitting a signal it can be located with WWI level technology. But the providers do log that data so it can be available for law enforcement.

    • shortwavesurfer@lemmy.zip
      0·
      4 days ago

      Even if you just have a standard Android operating system, you can prevent downgrade attacks by dialing *#*#4636#*#* and choosing phone information on Android. In there you can choose what your modem will connect to and so you can set it to only connect to say 5G and LTE and if neither of those are available your phone will just have no service.

      • FauxLiving@lemmy.world
        0·
        4 days ago

        That’s a good tip, I did not know that.

        If someone is going to do this, you really only need to disable 2G. The later generations are encrypted and only your carrier (and the intelligence services who’ve compelled the carriers to provide the keys) has access to the important data.