ICE is using fake cell towers to spy on people's phones
202 comments
·September 9, 2025aduffy
EvanAnderson
Discussion about Rayhunter from 6 mos. ago: https://news.ycombinator.com/item?id=43283917
perihelions
I wouldn't put it past the US to coerce Microsoft into injecting malicious payloads into these types of projects. EFF is putting complete trust in Microsoft's infrastructure: there's no out-of-band verification not served up by Microsoft itself (is there? It's just GitHub.com's TLS, and in-band SHA-1 hashes stored in the repo itself, which Microsoft controls; it can serve whatever bytes it wants, or different bytes on different requests...)
Microsoft has billions of dollars in US intelligence-cloud contracts and should leap at a chance to get an edge in on those. They've done things like this before; they provided incredible (and illegal!) cooperation with the NSA back at the time of the Snowden Leaks[0].
[0] https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-... ("Microsoft handed the NSA access to encrypted messages" (2013))
throw0101d
> I wouldn't put it past the US to coerce Microsoft into injecting malicious payloads into these types of projects. EFF is putting complete trust in Microsoft's infrastructure: there's no out-of-band verification not served up by Microsoft itself
Isn't a git commit trail basically a Merkle tree of checksums? If any developer tried to do a pull or fetch they'd suddenly get a bunch of strange commit messages, wouldn't they?
Also: code signing is / can become a thing.
untitaker_
I think GP is talking about a scenario where Microsoft would serve either malicious source tree or binaries to just one user, not all of them. that would be fairly hard to detect. but in such scenarios we'd also have to start asking questions about the state of the entire CA ecosystem.
perihelions
I don't know why you'd trust a checksum structure your adversary has complete control over.
That Merkle tree prevents the naive case where the adversary tries to serve a version of a repo, to a client who already has an older version, differing in a part the client already has. (The part the client has local checksums for). They shouldn't do that. The git client tells the server what commits it doesn't have, so this is simple to check.
Code signing could be a safeguard if people did it, but here they don't so it's moot. I found no mention of a signing key in this repo's docs.
The checksum tree could be a useful audit if there were a transparency log somewhere that git tools automatically checked against, but there isn't so it's moot. We put full trust in Microsoft's versions.
Lots of things could be helpful, but here and now in front of us is a source tree fully in Microsoft's control, with no visible safeguards against Microsoft doing something evil to it. Just like countless others. It's the default state of trust today.
some_furry
> Also: code signing is / can become a thing.
To that end, I started a project last month so that code signing can be done in multiple geographical locations at once: https://github.com/soatok/freeon
RS-232
Technically a Merkle DAG
therein
GP was probably referring to the binary releases on the GitHub repo.
aduffy
You’re welcome to read the code yourself once you check it out, it’s not very big. Supply chain attacks are a thing but I don’t think this is one.
untitaker_
I don't think there are many options to host sourcecode and binaries in a way that is safe against an adversary like the US, and especially in such a way that technically illiterate users are protected. Because you'd have to assume that CAs are not off-limits either then.
junebash
Would be a shame if someone used this to track down the ICE towers and vandalize them.
dylan604
For $20, it's cheap enough to add to a drone for a targeting purpose
Imustaskforhelp
This "shame" is/would be a badge of honor, my friend.
dylan604
This shame feels like something that would get one extraordinarily renditioned to some black site where nobody would ever know about the shame
dredmorbius
ThatsThePoint.jpg
riedel
IMSI catchers have been popular by police all over the world. Here are some other tools [0] [1].
Edit: Interesting also the collection of network security via gsmmap [2]
[0] https://gitweb.stoutner.com/?p=PrivacyCell.git;a=summary
[1] https://github.com/srlabs/snoopsnitch [2] https://gsmmap.org/
dang
Related:
Rayhunter – Rust tool to detect cell site simulators on an orbic mobile hotspot - https://news.ycombinator.com/item?id=43283917 - March 2025 (23 comments)
jimt1234
I watched the presentation on Rayhunter at Defcon. Amazing stuff. Major kudos to the team.
anonymousiam
So does the EFF detector discriminate between Stingrays that are operating legally and those that are operating illegally?
I wonder what their lawyers think of this.
https://bja.ojp.gov/program/it/privacy-civil-liberties/autho...
aduffy
There is nothing wrong with running a receive-only hotspot. Not sure what you’re implying here.
like_any_other
If you have any precedent or ruling indicating that it is illegal for Americans to check for the presence of surveillance, please present it. Otherwise, I'm not aware of any duty of private citizens to remain willfully blind to their government's actions.
nxobject
Should it?
trympet
lol spot the fed
boston_clone
exactly what I'm looking for - much appreciated!!!
josefresco
Additional context: https://san.com/cc/exclusive-evidence-of-cell-phone-surveill...
>At 8:58 a.m., just before the protest began, SAN began monitoring eight LTE bands present in the area and found no anomalous behavior. At 9:06 a.m., however, a burst of 57 IMSI-exposing commands was detected.
>Other bursts, present on four of the LTE frequency bands, appeared roughly every 10 minutes over the next hour, causing Marlin to issue numerous real-time alerts. A post-scan analysis confirmed the detection of 574 IMSI-exposing messages.
>It also flagged two “attach reject” messages, a type of cellular rejection sent when a cell phone tries to connect to a network. Attach rejects can occur for valid reasons, such as when a phone with an expired SIM card tries to connect to a network but such messages are rare on properly configured networks. IMSI catchers may use attach reject messages to block or downgrade connections and obtain an IMSI before it is encrypted. SAN observed the two suspicious messages at 9:55 a.m. and 10:04 a.m. at the height of the protest but did not encounter others before or after the demonstration ended.
>SAN conducted a follow-up scan during the same time period, the following day, when no protesters were present. Unlike the day prior, Marlin did not issue real-time alerts.
notherhack
SAN doesn't say where the unusual tower traffic originated. Does the Marlin system attempt to geolocate and identify the suspicious transmitters?
Could the regular mobile tower operators collect subscriber identities at will via their regular gear, with no stingray vans or warrants required, and save the information for later? That seems to be how it's done with the other subscriber location and communication contents that they collect.
noselasd
Those Attach Rejects should have a cause value, possibly telling a bit more on the reject reason.
I see those quite frequently, the bulk of them are phones trying to roam in a network they're not allowed to though, and some cause the cell is a bit overloaded, some cause the phone sends a wrong tracking area - not sure that's a phone bug or a common scenario where the phone retains an old tracking area, then it tries to connect to the same tracking area - then the phone discovers it's is now in a different tracking area, and after being rejected, it connects with the correct one.
perihelions
I.e. the inference is that ICE is unconstitutionally tracking and assembling lists of protestors exercising their First Amendment rights.
> "A post-scan analysis confirmed the detection of 574 IMSI-exposing messages."
That's roughly 574 unique protestors, give or take.
Full-on autocratic tyranny—this is also what Putin's oligarchs did to Ukranians at the Maidan Protests, in Kyiv in 2014. Used IMSI-catchers to assemble lists of everyone present, and intimidate them.
https://slate.com/technology/2014/01/ukraine-texting-euromai... ("How Did Ukraine’s Government Text Threats to Kiev’s EuroMaidan Protesters?" (2014)).
MiiMe19
[flagged]
perihelions
The article I'm replying to is the parent comment's "Exclusive: Evidence of cell phone surveillance detected at anti-ICE protest"; not the HN OP.
xp84
[flagged]
perihelions
IMSI catchers aren't observing things in plain sight; they're invasive searches that the Fourth Amendment prohibits outside of narrowly-defined circumstances.
The First Amendment precludes protected political speech from being used as a basis for such a search.
The Fourth Amendment further prohibits dragnet searches of indefinite groups of people, such as a protest, because it requires a warrant to "particularly describe" the "persons or things to be seized". (The "Particularity Clause").
I fully agree with your comment in the different case, which is not this case, where government merely passively observes things happening in a public space. IMSI catchers are different; one way being, in that a Stingray *actively interacts with* a device, without authorization, by sending it corrupted packets. (So I understand). A second way being that it violates general social expectations of what's in "public" and what's in "private"; by analogy, if police used laser microphones to listen in on faraway conversations; or in public crowds, used terahertz radiation to look under people's clothes; those are non-public searches, any pedantic interpretations of physics notwithstanding.
some_guy_nobel
Courts have repeatedly held that the government cannot chill lawful protest activity by imposing undue surveillance or intimidation. Sure, there is no explicit “right to anonymity,” but the Supreme Court has recognized in cases like NAACP v. Alabama (1958) that forced disclosure of membership lists can violate First Amendment rights, because it deters participation and chills association.
Of course, the Fourth Amendment also has clauses against “unreasonable searches and seizures.” I'm not a constitutional lawyer, but it's easy to see, from modern cases like Carpenter v. United States (2018) (which limited warrantless cellphone location tracking) why this could be perceived poorly.
But the Constitution tries to ensure that risk doesn’t come from government retaliation against lawful expression. I would ask why you're so keen to allow it.
const_cast
> What part of the constitution guarantees me the right to be anonymous while I protest?
The fourth amendment: unreasonable searches and seizures. This is an unreasonable search.
Also, protests aren't civil disobedience. Civil disobedience is civil disobedience. Protests are explicitly protected by the first amendment and you can protest all day long.
boston_clone
Start at the Fourth Amendment. (I guess the First would be more appropriate place to start, but the Fourth is quite pertinent.)
Also,
> [...] if you disagree with me and think the government is fascist and thus can't be trusted not to throw you in prison just for saying things they don't like
this is happening:
https://www.msn.com/en-us/crime/general/tourist-refused-entr...
edited for phrasing / completeness
tiahura
How do you know there wasn’t a warrant?
lordhumphrey
Whether an action has gotten a legal thumbs-up or not is of little relevance here.
I'd like to leave the question of why that's true as an exercise for the reader, but your comment makes it sound as if you have trouble with this concept, so let's be explicit - a state operating autocratically can, and often will, rubberstamp whatever it decides it wants to do.
Had a quick look for the numbers from FISA to give you an example of this. https://www.motherjones.com/criminal-justice/2013/06/fisa-co... says that they denied 11 requests for surveillance warrants out of 33,900 requests over 33 years of operation.
That's a pass rate of 99.07%!
So allow me to say - a warrant wouldn't have changed anything, they give them out like nothing.
In the article though, it does say: "ICE did not respond to requests for comment from SAN. It is not clear whether ICE or any other law enforcement agency obtained a warrant to use an IMSI catcher — commonly referred to as a “Stingray” — to conduct surveillance."
perihelions
It'd be flatly unconstitutional to approve a dragnet warrant targeting a protest.
vkou
When you treat with someone you know to be a compulsive liar, the onus of proof is on them.
If this government has not proven that they had one, you'd be mad to trust that they did.
There are no consequences to it for lying, or for not following the law, or not acting in good faith. It has a well-documented history of doing all three, and is headed by a convicted criminal.
throwawayq3423
A warrant for several thousand people at a spontaneous event ?
analognoise
Can we stop sanewashing these people?
They clearly don't care for legality, constitutionality, anything positive or good.
xrd
It would be amazing if an authoritarian government like that in Venezuela could just "facilitate" (such a funny word these days) getting a single convicted murderer into the US and then turn the US into the same kind of authoritarian government.
Whoops, I hope no other country in conflict with the US gets this idea, that pool has expanded significantly lately!
I recall reading about the people who slammed planes into the World Trade Center towers. They were not hell bent on destroying buildings, they were hell bent on destroying society of the US, destroying buildings was just a stepping stone. And, sure seems like they succeeded.
kps30
Castro did that. Google Mariel Boatlift of 1980.
But the US is not in decline because of whatever anyone from outside does. It's following the same cycle all Hegemons go through over 100-200 years. Whether its Greece, Babylon, Eygpt, Rome, Islamic Caliphates or all the later European powers. They all went through a similar a cycle - rise - dominate - decline. See Oswald Spengler - Rise and Fall of the West written 100 years ago.
bloomingeek
You're referring to history, which nobody gives a care about it seems. Here in the US, it's as if we're living in a bad sci-fi/horror movie the last ten years. People argue about politics, forgetting to hold politicians accountable to any laws. Most of SCOTUS is a party stooge and the POTUS is a mafia type thug, basically blackmailing corporations and law firms. Trouble is, this "cycle" will most likely have world wide repercussions and in a lot of cases already has.
null
dpkirchner
It would be extremely easy:
https://www.nbcnews.com/news/amp/rcna206917
> Mexico’s security chief confirmed Tuesday that 17 family members of cartel leaders crossed into the U.S. last week as part of a deal between a son of the former head of the Sinaloa Cartel and the Trump administration.
I don't know how Republicans continue to support this administration. Maybe they just don't know he's aiding criminals?
like_any_other
> He believed that was the case because the former cartel boss, whose lawyer said in January he had entered negotiations with U.S. authorities, had been pointing fingers at members of other criminal organizations likely as part of a cooperation agreement.
> “It is evident that his family is going to the U.S. because of a negotiation or an offer that the Department of Justice is giving him,” Garcia Harfuch said.
Looks like they're getting protection in exchange for testimony against other cartels.
autoexec
> . Maybe they just don't know he's aiding criminals?
I mean, our president is a criminal himself. Repeatedly violating the law and the constitution while in office. At this point those supporting the regime must doing it out of either cowardice or malice
dylan604
> I mean, our president is a criminal himself. Repeatedly violating the law and the constitution while in office
Allegedly. No convictions have come from any of the accusations as POTUS.
pjc50
The Venezuelan murderer doesn't actually have to exist for that to happen.
xrd
Good point, you could, for example, accuse someone of being equivalently dangerous, say in the MS-13 gang, illegally deport him without due process, and then hold up a doctored photo with those initials tattooed on his hands and insist he had those tattoos on his hands.
Then, just do whatever the hell you want all the name of protecting people from crime and protecting jobs.
What am I saying, that's completely ridiculous and could never happen in a "law and order" country like the US.
null
apwell23
>I recall reading about the people who slammed planes into the World Trade Center towers. They were not hell bent on destroying buildings, they were hell bent on destroying society of the US, destroying buildings was just a stepping stone. And, sure seems like they succeeded.
nah someone made all that up after the fact
vlabakje90
Al Zawahiri's Knights Under the Prophet’s Banner argued that spectacular attacks should provoke U.S. overreach, bleed it economically, and expose its weakness. That was published in 2001. After 9/11, but only by two months.
GLdRH
That's why the orange man is protecting the border
xrd
I just can't wrap my head around why spending $500M to paint the wall is protecting me from a Venezuelan murderer. Do Venezuelan murderers see them like colorful poisonous dart frogs and avoid them somehow?
https://factually.co/fact-checks/politics/border-wall-paint-...
dylan604
It's funny to me how Build That Wall was such a key part of Trump 45 but is a giant nothing burger for Trump 47. How could it be that it is so much less important just 4 years later, oh, right, never mind
vkou
They don't, which is why racial profiling is back on the menu.
Citizens on the streets don't need to show their papers to ICE, but that's been worked around by yesterday's SCOTUS. Being brown at Home Depot is now sufficient cause to get arrested by ICE.
maxerickson
Begs the question.
tolerance
Am I wrong for suspecting that the policy that colors the current Administration’s tyranny has its roots in those prior (Bush II, Obama)? Were we not warned of the possible consequences when less sensational or consenting news broke back then?
kristopolous
I was certainly talking about exactly this.
Trust me, people thought you were some wild crazy freak.
See here's how it works, watch:
There's going to be concentration camps. The volume of deportation required demands it. There always needs to be two sides agreeing in a deportation, the sending and the receiving. If there's a bottleneck at the receiving or an incompetence in the sending then you warehouse. It's inherent to any logistics.
No that feeling you have that I'm crazy, that's what I'm talking about.
Anyways... See you in a year or so and I'll link back to this.
tolerance
The general consensus in response to this suggests a non-trivial shift in the Overton window in the last 20 years.
How about we rain check...see you in 5–10?
stuartjohnson12
I normally try to avoid commenting on politics because this account is tied to my identity and therefore my profession and it's generally not advisable to tie those things together.
So it is with no degree of lightness that I say that I agree and this concerns me gravely.
potato3732842
The time to be concerned was 10-15yr ago when these tactics were being normalized (if you take issue with the means) and the policies that teed up the current immigration showdown were being figured out (if you take issue with the end).
h4ck_th3_pl4n3t
The solution to the warehouse cost problem is pretty easy, you just need to burn them because ashes are more compact, ergo less transportation costs.
You just don't want to realize that this has nothing to do with ethics anymore. It's about control and money.
bloomingeek
Absolutely, we were warned. No one heeded and then came the destruction of the Republican party by the likes of Rush, Newt and Rove who convinced the voting public everyone is evil who doesn't agree with them. Centrist and left leaning voters hoped it would just run it's course and go away, then evangelicals signed up with the Republicans and here we are.
tolerance
Right, I’ve heard this story before. But what are we attributing to whom we’d otherwise label incompetent or malicious from among the center and left, from among the electorate and the elected?
Or, what absolves them from not being held accountable for not taking heed to these warnings, being passive?
anecdatas
The left was a Cassandra the whole time -- it's been nothing but warnings from the left. The Democrats (note: the Dems are not a left party) refused to listen, assuring everyone it was fine, that we just needed to return to norms and decorum. If we just elected the most proper guy, if we just went a little more rightwards in our policies, all this would be fine.
Meanwhile, the left out there pointing at Obama's extrajudicial killings, Bush's whole post 9/11 fiasco, Clinton's "Superpredators" nonsense, etc. etc. and making tons of noise about how this was all going to end.
Turns out, the left was right, the Dems were wrong. But the Dems are still fighting to try and shut down the left. Look at how hard the Dem establishment hates Mamdani.
Terr_
They aren't absolved, but it's pretty normal to put more blame and attention on willful criminals as opposed to neglectful bystanders.
AnishLaddha
since reagan, actually: https://en.wikipedia.org/wiki/Unitary_executive_theory
John Yoo is probably the most influential lawyer of the 21st century.
cheald
The use of Stingrays to conduct mass surveillance dates back decades, yes.
potato3732842
>Were we not warned of the possible consequences when less sensational or consenting news broke back then?
People were screeching about this stuff then but they were brushed off by as "conspiracy weirdos" or "yeah they're probably doing it but who cares because it'd be unconstitutional" or "they won't use it on petty criminals" depending upon the exact year and political context you brought it up in.
xp84
> ICE used such a cell-site simulator in an attempt to track down an individual in Orem, Utah. The suspect had been ordered to leave the U.S. in 2023, but is believed to still be in the country. Investigators learned last month that before going to Utah, he’d escaped prison in Venezuela where he was serving a sentence for murder, according to the warrant. He’s also suspected of being linked to gang activity in the country, investigators said.
Sounds like a real cool guy.
Wiretaps have always been a tool in law enforcement's hands, and if it's subject to a warrant, which the article goes on to say it was, I am completely fine with this. If the ability to tap phone conversations 75 years ago didn't cause us to descend into fascism, I don't automatically think this is scary.
TheJoeMan
I'm totally against running Stingrays willy-nilly at protests, but this story seems like a non-issue. They had a warrant to track someone down, narrowed it to 30 blocks, then used the Stingray for final location tracking. Doesn't sound like they were logging IMEI's or interested in traffic.
whatsupdog
I'm tired of people protecting these murderous criminals who don't give two sh*s about any laws. This lack of empathy (for the victims of these criminals) is appalling.
JohnMakin
The thing that annoys me most about such thoughts is not the callousness - it’s the extremely short sighted opinion that the same tactics won’t eventually be used on them, or people they care about. It never even occurs to them that can happen until it does.
Erosion of anyone’s rights is an erosion of everyone’s rights.
bloomingeek
Absolutely, we older types used to argue with the term, "slippery slope". ICE is a classic slippery slope that will most likely be used, eventually, against all of us if the current administration isn't stopped breaking the law.
chasd00
> I'm tired of people protecting these murderous criminals who don't give two sh*s about any laws. This lack of empathy (for the victims of these criminals) is appalling.
wait, are you talking about this guy and the people they killed in Venezuela or ICE?
whatsupdog
Isn't it obvious? How many people has ICE killed extra judicially?
zOneLetter
How would one go about detecting the IMSI commands? Would an advanced radio receiver be able to see these? I know pretty much nothing about SIGINT but been contemplating spending some time learning about it.
JumpCrisscross
The article describes a search conducted with a warrant. Given the brazen criminality ICE agents are acting with, I’d like to see evidence of malpractice before risking diluting the message.
rhcom2
The argument with Stringrays is that even with a warrant to target an individual the police end up sucking up a large amount of random people's location and cell phone data.
Like license plate readers and facial recognition, you're out in the world without the expectation of privacy but I think for most people that feels different when a giant automated system is sucking everything up without recourse.
tiahura
[flagged]
abirch
A warrant against a criminal. This is the case that most people support.
cosmicgadget
Even if that tool queries everyone in the neighborhood?
buellerbueller
I do not support having my cell phone location data sucked up by the government in general while exercising my First Amendment right to protest. That this particular government is doing it is frankly, terrifying.
abirch
I agree with you about cell phone data being sucked up when exercising your rights. I love the EFF: https://ssd.eff.org/module/attending-protest
This particular article was about using Stringray with a warrant. I'm sure that the government is abusing Stingray but it'd be nice to have evidence first.
coldtea
Warrants can also be malpractice when the law is in the hands of authoritative types.
MangoToupe
I hardly think the courts are above malpractice. They seemed fine with the patriot act, for instance. Citizens United is the definition of malpractice in my book, essentially legalizing corruption.
chasd00
The Patriot Act was an eye opener to me. Fear has to be, by far, an authoritarian's best tool against the masses. I was shocked "we the people" let the Patriot Act happen, i was also shocked when people locked themselves up for a year voluntarily during covid. All you need is a way to produce fear in the population and they'll do and believe anything you say. Anything.
boston_clone
Edited to redact; response was referencing a different article.
abirch
Are you quoting from the Forbes article listed above?
"In a recently-unsealed search warrant reviewed by Forbes, ICE used such a cell-site simulator in an attempt to track down an individual in Orem, Utah. The suspect had been ordered to leave the U.S. in 2023, but is believed to still be in the country. Investigators learned last month that before going to Utah, he’d escaped prison in Venezuela where he was serving a sentence for murder, according to the warrant. He’s also suspected of being linked to gang activity in the country, investigators said.
When the government got the target’s number, they first got a warrant to get its location. However, the trace wasn’t precise–it only told law enforcement that the target was somewhere in an area covering about 30 blocks. That led them to asking a court for a Stingray-type device to get an accurate location.
The warrant was issued at the end of last month and it’s not yet known if the fugitive was found."
boston_clone
My mistake - wrong article !
https://san.com/cc/exclusive-evidence-of-cell-phone-surveill...
GuinansEyebrows
not sure if they just edited it very quickly or what, but that sentence no longer appears in the article.
exe34
"Earlier this year, new media publication Straight Arrow News said it had analysed “mobile network anomalies” around a Washington state protest against ICE raids that were consistent with Stingray use."
allseeingimei
Every bus stop and billboard with a CBS logo on it is doing the same thing and has been for a long time. They map your movements by presenting as a cell tower and record the IMEIs of passers by. Forbes won't write a story about that though.
afavour
Any citation for that? You seem to have created your account specifically to comment here so I have to assume you're well informed on the topic.
NoiseBert69
That's not how cellular networks work.
Your IMEI will never be send in clear over the network. Not even back in old 2G networks.
If the gov needs your data they can use standardized lawful interception interfaces. This interface offers all juicy data - not only voice, SMS and your phone number.
octoberfranklin
You're confusing IMEI and IMSI.
null
notherhack
The Forbes article says ICE acquired mobile cellular surveillance equipment and services under the Biden administration, and there have been IMSI catchers detected at demonstrations for a long time, for example at the Dakota Access Pipeline demonstrations in November, 2016[1]. It's not a new thing.
[1] https://www.justsecurity.org/34449/investigating-surveillanc...
lrvick
If your cell phone is connected to cell towers, almost anyone can buy your location.
Only option is stay in airplane mode and use wifi.
pizzly
Hello WiFi Geolocation technologies. https://en.wikipedia.org/wiki/Wi-Fi_positioning_system
CommanderData
Wasn't this thought impossible with LTE, I thought older bands were only susceptible to this attack.
jeroenhd
Classic 2G stingrays are a lot less complicated, but attempts to secure the IMSI haven't properly been implemented until 5G came around. Even then, the IMSI has been replaced with encryption and temporary identifiers your carrier knows belongs to you, and if law enforcement comes in with a warrant they can get those replacement identifiers from your carrier regardless.
You can't get the IMSIs passively anymore, but LTE doesn't make these attacks impossible, just less practical, especially for criminals that don't have warrants on their side.
NoiseBert69
They can use standardized lawful interception interfaces to get all this data.
No big need to dig down deep into the radio and protocol layer.
betaby
5G standalone is not transmitting IMEI in plain text ever to my knowledge.
boston_clone
isn't this then ripe for a downgrade attack?
NoiseBert69
To LTE? Doesn't work there either.
There are IMSI catchers - but they all require GSM. At least on Google Pixels you can turn off 2G with a switch. The phone even shows a message about its insecurity.
In Germany I'm running 100% on LTE/5GNR-only for many months now without having a single coverage gap.
yinznaughty
You can collect IMSI passively over LTE: https://github.com/SysSec-KAIST/LTESniffer
You can just jam everyone in the area and see who reconnects.
kotaKat
Couldn’t I just grab a Baicells eNB off eBay and point it at my own Open5GS installation and passively sniff IMSIs of users scanning around anyways that try to attach and reject? It feels like I could build some kind of “sniffer” fairly easily these days as well.
boston_clone
Could folks share more accessible methods for developing counter-Stingray type activities described in this paper, or rather, which ones they themselves have used with varying degrees of success?
https://www.cise.ufl.edu/~butler/pubs/ndss25-tucker-marlin.p...
Ideally, this is something I could hack together in the next few days since ICE is prepping to invade my city.
therobots927
I can't help you, I'm just here to thank you for your service.
allseeingimei
burner phones and sunglasses are probably easier
dredmorbius
"Israel targeted top Iranian leaders by hacking, tracing their bodyguards’ phones — report"
<https://www.timesofisrael.com/israel-targeted-top-iranian-le...>
I'm listing the Times of Israel first as it's an Israeli publication, though it cites the following NY Times article which researched the story:
"Targeting Iran’s Leaders, Israel Found a Weak Link: Their Bodyguards"
Despite all the precautions, Israeli jets dropped six bombs on top of the bunker soon after the meeting began, targeting the two entrance and exit doors. Remarkably, nobody in the bunker was killed. When the leaders later made their way out of the bunker, they found the bodies of a few guards, killed by the blasts.
The attack threw Iran’s intelligence apparatus into a tailspin, and soon enough Iranian officials discovered a devastating security lapse: The Israelis had been led to the meeting by hacking the phones of bodyguards who had accompanied the Iranian leaders to the site and waited outside...
<https://www.nytimes.com/2025/08/30/us/politics/israel-iran-a...>
(Archive / paywall: <https://archive.is/XdZet>)
It's not just your phone, it's the phones of those around you. Whether or not you have a security detail.
This is one factor which makes pervasive surveillance so absolutely insidious.
therobots927
My understanding of the linked paper is that it details methods of detecting stingrays. Not jamming them...
boston_clone
I could've been more clear :) don't think I could engage in prevention without violating some FCC laws. But in general, yes - prevention > detection > awareness > ignorance.
nisegami
'no phone' is the only safe option
chasd00
that's what i would do, just leave the phone at home. Bring a camcorder and post your social media engagement dopamine hit when you get back home. No need for constant connectivity, people protested pretty effectively in the 60s before cell service even existed.
fsflover
My phone has hardware kill switches, so I can be sure the modem is off when I need it.
mdhb
No phone actually stands out a lot in real life surveillance systems and will very quickly get you a bunch of additional attention because it’s so unusual.
Not usually that I’m aware of as a single data point in any system but if there are other reasons to thing you’re trying to act surreptitiously you are going to be very close to the top of the list of people of interest.
There’s a lot to be said in 2025 for appearing uninteresting to anyone who might be watching.
boston_clone
I leave mine at home, but you're right; I should also get some counter-facial recognition paint.
However, my endeavor here is more focused on awareness and transparency for the masses than subterfuge for the individual.
Just wanted to advertise that the EFF recently released an open source tool for detecting cell-site simulators. The hardware is like $20 and it's pretty easy to setup yourself. Worth having around to stay aware of what's out there, especially if you live in one of the places recently targeted by the administration.
https://github.com/EFForg/rayhunter/