Seven Years After Discovering Rogue Stingray Devices In DC, The Federal Gov't Still Doesn't Have Any Idea What To Do About It

(Mis)Uses of Technology

from the tfw-when-you-love-surveillance-way-more-than-countersurveillance dept

Seven years ago, wardriving security researchers discovered rogue cell tower simulators being operated near sensitive locations in Washington, DC, presumably by foreign governments.

The company used their ultrasecure CryptoPhone 500 to search for the interceptors, which can compromise phones through baseband hardware and are believed to have a range of roughly 1 mile. ESD America‘s phones allegedly detected telltale signs of call interception in the vicinity of the White House, the Russian Embassy, the Supreme Court, the Department of Commerce, and the Russell Senate Office Building, among other landmark buildings.

Three years later, Senator Ron Wyden sent a letter to DHS Undersecretary Christopher Krebs, asking him to look into this report. The DHS was told to find out where these were located, who was running them, whether the DHS was already aware of this problem, and what, if anything, the DHS planned to do about it.

The answer — arriving four months later — was “not much.” The DHS agreed the possible use of Stingray-type devices by foreign operatives was indeed the sort of thing it should be concerned about (what with it being in the business of securing the homeland), but didn’t appear to believe it should do much about it itself. It said it had detected several devices during a 90-day operation using ESD America equipment, but had no staffing or funding to do anything more than confirm what ESD America had discovered four years earlier.

Another three years have passed and nothing has changed but the list of federal entities that are apparently unable to do anything about these obvious threats to national security. Dell Cameron has the latest on the federal government (in)activity for Gizmodo:

It has been a matter of public record for decades that phones can be tracked and calls and text messages intercepted using a device called a cell site simulator, which exploits long-standing security vulnerabilities in phones by impersonating a legitimate phone company’s cell towers,” Sen. Ron Wyden wrote Thursday in a letter to the director of national intelligence; heads of the FBI and CISA—the agency charged with defending critical systems; and the presumptive next chair of the Federal Communications Commission.

“While the threat posed by this technology has been clear for years,” Wyden wrote, “the U.S. Government has yet to meaningfully address it.”

Among other concerns in the letter, both the Departments of State and Defense have confirmed to Wyden’s office, he said, “that they lack the technical capacity to detect cell site simulators in use near their facilities.”

“For years.” That’s the problem here. The threat to national security has been at least implied since 2014, when security researchers discovered cell site simulators that didn’t appear to be operated by US agencies. That so many were clustered around sensitive areas of Washington DC suggested surveillance by inappropriately curious, if not actually malevolent, foreign agents or operatives.

And the tech itself is no secret either. Not only are Stingray devices widely used by US government agencies, they’re also widely used by foreign governments — many of which have no legal or moral compunction preventing them from using them as more than phone-tracking devices. The devices can also intercept communications and create attack vectors for cellphone-targeting malware. This is the sort of thing that should have been more than shrugged at by federal agencies.

And it doesn’t take a government to get this dirty work done. Individuals and members of extremist groups can knock together cell tower simulators on the cheap — powerful tools that don’t rely on a support team of techs or a nondescript host vehicle to engage in tracking, eavesdropping, or hacking.

Researchers in the past have assembled devices for as little as $1,000, and have been able to carry out sophisticated attacks beyond the power of those licensed by state and local agencies. In recent years, international vendors have marketed versions small enough to wear undetected, allowing them to slip into the middle of a protest, for example, without raising alarm.

While it’s true the government’s offensive options might be limited, as attempts to knock out unknown cell site simulators might result in cell service disruptions in the immediate area, that doesn’t mean the government is unable to mount a better defense.

Wyden’s letter [PDF] asks who’s really in charge out there, if anyone? While there may be no perfect agency to oversee the security of phone networks, one agency needs to step up and assume some responsibility while the details are sorted out. His letter hints that the FCC may be able to assist here.

If it can’t oversee the entire process, it could at least institute requirements for cell phone providers that would make phones less susceptible to tracking and interception by these devices. Wyden suggests making it easier for phone users to locate and terminate support for 2G and 3G networks, which are more easily exploited by cell site simulators.

Wyden also suggests something practical that could be implemented quickly and at a minimum of expense: encrypting all voice and text communications by federal employees, which would make interception by Stingray devices mostly worthless.

Finally, Wyden wants to know who’s doing anything to protect US government employees and facilities from these attacks, whether they occur in Washington DC, or elsewhere in the world.

These questions need answers. But they also need action. It’s been seven years and we’ve seen very little of either from federal agencies that express their strong concerns about national security when they’re playing offence (engaging in broad, intrusive surveillance, violating/ignoring citizens’ rights) but seem far less concerned when they’re asked to actually, you know, secure the goddamn nation from known threats.

Filed Under: imsi catcher, stingray, washington dc