Monthly Archives: March 2015

Catching IMSI Catchers: Part 1

I had picked up a GSM/GPRS shield for my Arduino a while back without any specific plans for it — I just thought it would be cool to have a project in the future that was able to communicate wireless over the Internet for either report purposes or to react to events (texts, tweets, etc).

After reports came out regarding local law enforcement’s use of IMSI catching devices like the Harris Stingray, I decided to start experimenting with the shield as means of at least detecting the use of IMSI catching devices.  Since I believe in the balance of power between law enforcement and citizens, and strongly believe in privacy rights,  I wish there were countermeasures (blacklisting after discovery?) that could be developed, but perhaps that is the next step after accurate detection of the devices in the first place.  The project is still under development, but so far here are my assumptions and how they figure into my plan of action.

Assumptions & Background Knowledge

IMSI catchers generally broadcast an extraordinarily strong signal in order to ensure that target cell phones in the area opt to connect to it versus other, real, cell phone towers.  This means signal strength analysis is important to identifying an IMSI catcher.

Further, most, if not all IMSI catchers interrupt service to some degree.  Since they aren’t part of the true cell phone network, typically issues arise when receiving calls and/or texts.  This information should also be possible to leverage during the IMSI catcher identification process.  I’m thinking an SMS notification service like Amazon’s SNS could be useful in this case to have the Arduino trigger texts to itself (since data typically still operates even when connected to an IMSI catcher) and see if they are actually delivered in a timely manner or not.  This could indicate whether the Arduino is connected to a false tower.

We also know there are multiple physical deployment options for IMSI catchers, from stationary devices, to ground-based semi-mobile (i.e. surveillance vans), to airborne (i.e. drones & specially equipped planes (with assistance from the CIA).  Since may of these can be mobile, I think my detection of the devices will have to be from stationary position(s) such that it is possible to detect the movement of the “tower” through signal strength changes and/or triangulation.

It may also be an interesting exercise to toggle through a number of directional antennae (or a single, rotating directional antenna) to see if the direction of the tower or IMSI device could be deduced, potentially leading to the ability to confront and shame law enforcement personnel utilizing the device (say, from a surveillance van) against innocent individuals’ devices (i.e. my Arduino “phone” which has never even made a call).

Out of convenience, and for lack of an adapter for my phone’s existing nano SIM card, I picked up a prepaid GSM SIM from the local Dollar General for about $10 for the kit, and $35 for the first month of service.

Next Steps

I plan to get acquainted with the GSM shield and commands to see what I need to do to create a device that can alert to and log the presence of potentially fake GSM towers, preferably with GPS coordinates marking the location of detection, and possible base station locations.

More to come as this project progresses.  I also recently picked up an RTL-SDR device that should allow straight up spectrum analysis in GSM frequency ranges, so that may change the direction of this project as well.

Since novel legal techniques are being used to suppress information regarding the use of these devices by law enforcement (non-disclose agreements between law enforcement and the manufacturer, which somehow trump Constitutional concerns, WTF?) it is time for this citizen to take matters into his own hands to at least reveal the extent of surveillance being performed on the average American using Stingray-like IMSI capturing devices.  It has become clear from the Snowden revelations that the court system cannot be relied upon to protect citizens, or even to provide information with respect to FOIA requests.  The only alternative is to play the same game the government is playing, utilizing technology, but play it back harder in order to force transparency in these programs.

On Curiosity

I tend to have a breadth of interests from which my hobbies spawn:  computer science, finance/economics, welding, construction, electronics, coins, cooking.  The common theme that ties them all together is that they rely on an understanding of how things are built or created.  I have a thirst for knowledge about how things work in the world around me — I love learning new stuff about how a product operates.  This curiosity is probably the biggest driver in the personal projects I take on, from repairing my own plumbing after a burst pipe, to building an ugly Christmas sweater that lights up and plays music.

The reason I feel these things are important, besides being interesting to me, is that it allows an individual to be much more self-reliant in a number of areas. Frequently, too, there is overlap or transferable skills between two subjects interest.  Sometimes this overlap leads to really great “mashups” where concepts from one subject area flow into or are applicable to another.  These sort of mashups are from where innovation often spawns.

What amazes me is how few people share that genuine curiosity about the world, or at least the drive to learn and discover more about it.  It is just amazing to me that, with the wealth of information we have at our finger tips, that there isn’t a concerted, individual effort towards expanding upon one’s base of knowledge.   Instead, I frequently encounter people who are actively committed to ignorance, when I either start talking about how something works or suggest they look it up.  Even when it comes to something as trivial as cooking (that thing we do to take raw food to a processed state for consumption, which originally expanded our food offerings in ancient man by allowing humans to eat previous unsafe foods, which then allowed our brains to grow due to a better diet), I know many people who are paralysed even with a recipe, because “I don’t know how to cook!”.  Well, have you ever tried looking up any of the techniques in a recipe?  Watched a YouTube video on knife skills?   Done anything at all to remedy that hole in one’s personal skill set?  The answer is usually no.

We focus very much on educational outcomes in this country, typically based off math and reading test scores.  Such a focus on metrics seems to have purged the educational system of a lot of that curiosity and drive for knowledge.  I don’t know what the solution is that will make people want to learn more — it is a matter of “You can lead a horse to water but you cannot make him drink.”, except we are now all horses surrounding an ever-expanding trough that is capable of intellectually hydrating every one of us.  Scarcity has effectively been removed from knowledge — we no longer rely on purely academics, or on physical books.  We can copy and send a wealth of information around the world in a number of keystrokes.

Yet, so many Americans are content watching sports, the next episode of “Married at First Sight”, the Kardashians or binge-watching House of Cards.  The irony being that a very large number of these same Americans aren’t content with their economic circumstance, yet with this wealth of information available to anyone with a smart phone or connection to the Internet, so few even attempt to engage in ad hoc learning on their own.  I imagine some of it is a fear of failure, but failure is requisite to success.  Without it, success cannot be defined.

With each failure (perhaps a meal that is edible, but you wouldn’t serve to guests) comes knowledge gained and lessons learned for the next time one engages in the activity at hand.  Over time, aggregate successes and failures are what makes up knowledge and expertise.  Mix two things with clashing flavors?  You just discovered a new way not to make a meal.  The next time you won’t repeat that combination.  Implement some piece of software inefficiently and performance ends up suffering?  You’ll be more performance-cognizant on the next app.

Comparatively, what does consuming huge amounts of purposeless TV get you?  Pop culture trivia facts, and small-talk points with other people who spend their time that way.  There is little innovation that can spawn from this sort of thing since it basically is regurgitation of content.

I guess it’s time I end this rant before I become an old man and start yelling at kids to get off my lawn.  In all seriousness though, I wish there were a better way to convey that personal success often hinges on personal hobbies and interests.  If you’re not pursuing something worthwhile that increases your wealth of applicable knowledge, then you’re stagnating;  it may not even be apparent that it is helping you towards some future goal, but in the aggregate it may assist you.   I’m not saying turn off the TV and pick up a book (it’s rare that I read actual books any more); I’m suggesting folks contemplate how spending their time and whether it has value.   I understand sometimes there is a need to relax and do mindless activities, but it shouldn’t be an everyday occurrence.