Recently the Department of Homeland Security confirmed for the first time that it is aware of unauthorized cell-site simulators, the surveillance tools often called stingrays or IMSI Catchers, in various parts of Washington DC. Similarly governments in Canada and elsewhere have discovered unauthorized use of IMSI Catchers by malicious actors and foreign intelligence agencies near politically sensitive buildings like Parliament Hill in Ottawa, Canada and Pierre Elliott Trudeau International Airport in Montreal.
While it's not surprising that foreign intelligence groups or criminal actors would be cell-snooping in the nation's capital, the DHS statement is the first US government acknowledgement that sensitive political communications, not to mention those of anyone in DC, are at risk of interception by devices that are currently unaccounted for. In spite of this realization though, observers find it unlikely that any group will move to defuse the threat in the foreseeable future.
The DHS statement came in the form of a response to senator Ron Wyden, who had inquired about rogue cell-site simulators in a November letter. DHS acting undersecretary Christopher Krebs wrote, "Use of IMSI catchers by malicious actors to track and monitor cellular users is unlawful and threatens the security of communications, resulting in safety, economic, and privacy risks. ... Overall, [DHS's National Protection and Programs Directorate] believes the malicious use of IMSI catchers is a real and growing risk." The agency added that NPPD "has observed anomalous activity in the Nation Capital Region that appears to be consistent with IMSI catchers. NPPD has not validated or attributed such activity to specific entities or devices."
After the DHS admission, three ranking House members sent a letter to the Federal Communications Commission demanding that the FCC "take immediate action under federal law to address the prevalence of what could be hostile, foreign cell-site simulators—or stingrays—surveilling Americans in the nation's Capital." But that seems unlikely, to say the least, thanks to how stingray devices are used—and by whom.
More recent unearthing has attributed some of these malicious actors as Israeli intelligence operators. (1)
How IMSI Catchers/Stingrays Work
Cell-site simulators, called IMSI catchers because they capture devices' International Mobile Equipment Identity codes, masquerade as legitimate mobile network cell towers to trick nearby cell phones into connecting. Once linked, they can track a cell phone's location, or even surveil its messages and phone calls.
They're powerful tools that leverage flaws in wireless network protocols and cell phone software. And while the telecom industry could significantly reduce their efficacy by plugging holes in various wireless standards, incentives to do so are mixed. In the US and around the world, law enforcement and intelligence agencies use stingrays for investigations, often under opaque circumstances. Which may explain DHS reticence to this point: While rogue cell-site simulators like those in Washington are a potential national security threat, the US government uses those very same tools.
For now, high profile citizens, HNWIs, VIPs and anyone concerned with their communication around the country can only go about their business knowing with increased certainty that their cell phones are at risk of surveillance by rogue cell-site simulators.
Wireless Providers Are Complicit
Since IMSI catchers must simultaneously connect to the target mobile phone and the original cell tower, it is possible for network operators to detect IMSI catcher activity. In the words of security researcher Karsten Nohl, “The network operator, in any given country, knows where IMSI catchers are operating.”
However, network operators have thus far been silent on the issue of IMSI catchers, as far as the public is concerned. Verizon has denied any knowledge of the use of dirtboxes by the U.S. Marshals Service. Since some of the largest users of IMSI catchers are likely to be government agencies themselves, there is little incentive for network operators to highlight IMSI catcher use to government authorities. In fact, operators have instead continuously asserted the security of their wireless networks.
Although IMSI catchers have been in use by government agencies for many years, the availability of affordable software-defined radios and expertise to build IMSI catchers have made them more easily accessible than ever to hobbyists. Since it still costs upwards of $1,500 to build or purchase an IMSI catcher, basic threat modelling suggests that the general public has little to fear from the use of IMSI catchers with regards to their everyday communications. However, the use of IMSI catchers by government agencies may eventually be of significant concern. Unrestrained use of the devices could lead to gross violations of privacy, especially given programs such as the U.S. Marshals Service’s dragnet plane surveillance, coupled with the capabilities of advanced IMSI catchers.
In addition, IMSI catchers may be a popular tool for corporate espionage. Whilst the price tag of commercial level and advanced level IMSI catchers is certainly too steep for personal use, it may not be a large deterrent for business opportunists seeking to capitalize on information that could be worth millions of dollars. Finally, the use of IMSI catchers by foreign intelligence services and criminal organizations is of great concern to government agencies, especially given the fact that very little is known about the extent of their use. Fortunately, even as use of IMSI catchers has been growing more prevalent, the range of solutions has also been growing rapidly.
The Solution: Secure Communications With A Secure Device
Given this revelation what can you do? You are a High-Net Worth Individual, a CEO of a multinational corporation, a criminal lawyer working with sensitive, high-needs clients who expect total privacy, or someone working in one of the many industries that require secure communication.
You need to get in touch us at SecureCrypt, and immediately begin using a secure mobile device, for secure encrypted communications on a private global network.
SecureCrypt does what no other secure communications provider does and extensively protects the network connections, along with hardware/firmware protections, and application level protections.
SecureCrypt powered phones, installed with our anti-surveillance SIMs can detect the presence of IMSI Catchers/Stingrays. Our SIMs come with multiple IMSIs and multiple Mobile Network Identities (PLMNs) to always keep you secure on any cellular network. We also protect against APN Redirection, DNS Manipulation, MiTM attacks, Denial of Service attacks, Malware and trojan delivery, and much more. We also use encrypted SIM to SIM communications, with an added VPN onboard our encrypted SIMs to further secure your communications at the network level.
Free apps cannot provide this. All data including metadata is encrypted both at rest and in transit with 512-bit ECC (Elliptic Curve Cryptography)
The only way to protect against this threat, and other electronic eavesdropping techniques is to use a provider and device that has network level protections, hardware/firmware level protections, and software level protections. SecureCrypt ensures all security aspects and concerns are addressed starting from the operating system, network infrastructure, device, software, data transmission and servers.
SecureCrypt’s proprietary advanced security features are not available elsewhere. All data, including metadata is encrypted at all times at rest and in transit with 512-bit Elliptic Curve Cryptography. SecureCrypt is the only choice for those who operate in sensitive industries to secure their communications.
SecureCrypt is also FIPS 140-2 compliant for government use.
Speak to one of our highly knowledgeable staff members who will gladly assist getting your communications secured with SecureCrypt.
(1) https://www.politico.com/story/2019/09/12/israel-white-house-spying-devices-1491351