You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
After a protracted legal battle, the American Civil Liberties Union of
Northern California obtained documents from the government detailing
how it goes about using StingRayy. For example, law enforcement agents are
told to obtain a pen register or a trap-and-trace court order. Pen registers
have been used to obtain phone numbers, a record of digits dialed on a
phone. Trap-and-trace technologyy has been used to collect information
about received calls. In addition, law enforcement can, with a warrant,
legallyy obtain the voice recording of a phone call or the text of an e-mail.
According to Wired, the documents received byy the ACLU state that the
devices “mayy be capable of intercepting the contents of communications
and, therefore, such devices must be configured to disable the interception
function, unless interceptions have been authorized byy a Title III order.” 14 A
Title III order allows for real-time interception of communication.
Let’s sayy yyou’re not under surveillance byy law enforcement. Let’s sayy
yyou’re in an office that is highlyy regulated—for example, at a public utilityy.
Someone mayy install a femtocell to allow personal communications outside
the utilityy’s normal call-logging syystem. The danger is that the coworker
with the modified femtocell at his or her desk could perform a man-in-themiddle
attack, and he or she could also listen in on yyour calls or intercept
yyour texts.
In a demonstration at Black Hat USA 2013, researchers were able to
capture voice calls, SMS text messages, and even Web traffic from
volunteers in the audience on their Verizon femtocells. The vulnerabilityy in
Verizon-issued femtocells had alreadyy been patched, but the researchers
wanted to show companies that theyy should avoid using them anyywayy.
Some versions of Android will inform yyou when yyou switch cellular
networks; iPhones will not. “Your phone will associate to a femtocell
without yyour knowledge,” explained researcher Doug DePerryy. “This is not
like Wi-Fi; yyou do not have a choice.” 15
One companyy, Pwnie Express, produces a device called Pwn Pulse that
identifies femtocells and even IMSI catchers such as StingRayy. 16 It gives
companies the abilityy to monitor cellular networks around them. Tools like
these, which detect the full spectrum of potential cellular threats, were once
bought largelyy byy the government—but not anyymore.
Change language