How is this possible? Are phones willing to connect to any cell and blindly trust that text messages from there are genuine and really coming from the numbers they claim to be coming from? Isn't there some cryptographic verification?
mcpherrinm 2 hours ago [-]
2g networks didn't have the phone verify the network, so yes they can do this.
At least as of today, most phones have an option to turn off 2g but that isn't a default.
OptionOfT 22 seconds ago [-]
The only way to truly disable 2g on an iPhone is to enable lock-down mode, which is a step too far for me.
opengrass 2 hours ago [-]
Plausible. Only Rogers still has working 2G.
mcpherrinm 2 hours ago [-]
It doesn't matter what the network is doing; the phone needs to disable 2g. There's various ways to get the phone to downgrade to 2g otherwise, eg https://montsecure.com/files/2021_downgrade.pdf
And if you have a modern enough SIM+phone combo, it won’t even display the 2g network as an available network, nor 3G on my device.
I wonder if this mostly hit international SIMs, since they wouldn’t be running the same level of SIM code to prefer various network locks like a local SIM.
Helps you stay under the radar and gov services over SMS is a lot more advanced outside of Canada if you want to do some fraud.
gruez 42 minutes ago [-]
>And if you have a modern enough SIM+phone combo, it won’t even display the 2g network as an available network, nor 3G on my device.
Source? It might just be that your carrier retired its 2g/3g network, not that the phone/sim refuses 2g/3g connections. If some cell tower popped up claiming to 2g/3g, your phone still might happily connect.
capitalhilbilly 2 hours ago [-]
The original standards weren't expecting anyone but carriers to send messages and ramping up security has been a slow process, so downgrade attacks probably work nicely.
opengrass 2 hours ago [-]
Guessing the spammer doesn't want to overload towers or be foxed within the same 3 so they're driving. Maybe the hats(?) shut off on rotation... or eSIM?
kotaKat 1 hours ago [-]
Well, based on what I'm gleaning from https://www.smsbroadcaster.com/ (yes, they sell these brazenly in the open), I suspect they're doing some SDR shenanigans to bring up fake cell networks and leverage Cell Broadcast instead of just SMS.
They are also interfering with connections and attempting downgrade attacks to do 2G SMS messages as well (and is likely where Canadian carriers were picking up the 'millions' of attacks against its network and failed authentication attempts).
Amusingly this was all also caught because of Telus reviewing those SMS messages that were reported as spam from people on iOS/Android and realizing that the messages weren't being terminated inside the cell network at all when they tried tracing them out and suspected that this was the case.
nubinetwork 3 hours ago [-]
This was hugely overblown in the media... While the device operates like a stingray, they were using it to spam and phish. The whole claim of "we've never seen this type of device before in Canada" is a lie, because the government and law enforcement both use them. I guess it's okay if they do it, but nobody else can...
2 hours ago [-]
mc32 2 hours ago [-]
Yes I think they mean they hadn’t seen it used before outside of sanctioned organizations. Though one could argue some bad actors inside the org likely used it outside of official capacity though not likely with knowledge or approval by superiors.
anigbrowl 2 hours ago [-]
Wouldn't it be great if public officials would say what they in fact mean the first time?
rdevilla 2 hours ago [-]
Torontonians are hardwired to be incapable of speaking like this.
panny 3 hours ago [-]
A government backdoor was found and abused by criminals? No one could have predicted this! :)
QuantumNomad_ 2 hours ago [-]
Isn’t it less of a government backdoor and more of a result of generally old and insecure protocols still being in use for telecom?
Like, the phones happily connect to these fake towers because the signal is strongest from that one and there is no authentication to verify who the tower belongs to, nor encryption of SMSes?
Jolter 2 hours ago [-]
It’s not exactly a back door. It’s a fake radio cell, mimicking your network provider and acting like a man in the middle. In that sense, it’s like a stingray. The differences are
1. The Stingray eavesdrops, but avoids interfering with user traffic
2. The stingray is operated by law enforcement, not by fraudsters looking to steal your money
AngryData 36 minutes ago [-]
In mamy parts of the US, the cops are the fraudsters looking to steal your money. So it isn't that much of a difference.
rafram 2 hours ago [-]
Why would someone use one of these instead of good old fashioned SMS / iMessage / email spam?
mcpherrinm 2 hours ago [-]
There's zero spam filtering interfering this way, and you can target your messages very precisely.
tonyarkles 2 hours ago [-]
And zero record of it ever happening as far as the carrier's concerned.
AirMax98 2 hours ago [-]
Quote from article:
> This wasn’t targeting a single individual or business. It had the ability to reach thousands of devices at once.
This statement reads as AI-assisted — kinda interesting to see, because I am not sure it even is? This type of formal speech language is basically unintelligible from slop now.
bawolff 1 hours ago [-]
This reads like a pretty standard sentence to me. Especially in the context of a police press release trying to explain tech to the public.
I think at some point people see AI everywhere because they look for it everywhere.
fragmede 46 minutes ago [-]
I mean, you used an emdash. Are you an LLM?
topspin 2 hours ago [-]
Charges? Cool. In the US we find huge SIM farms in major cities[1], law enforcement shrugs, and everyone forgets about it.
SIM farm is a different scenario and arguably not even illegal. This story is about scammers operating a DIY stingray that broadcasts phishing messages via SMS to nearby devices.
nerdsniper 46 minutes ago [-]
SIM farms / phone farms aren't inherently illegal. Some are used pro-socially, for example to enumerate hosts in malicious IoT botnets.
walrus01 1 hours ago [-]
People I know in US telecom are not surprised by these SIM farms. These people are either:
a) Doing some weird grey market VoIP thing. 32-in-1 GSM to SIP gateways have been a thing for a very long time in the developing world. Maybe they think they found some arbitrage route for phone traffic to/from the US PSTN that they can profit from. Anyone who interacts with grey market voip stuff will recognize these things immediately.
b) Using them for something like receiving 2FA authentication codes to create bot/socketpuppet social media accounts. In this sort of scenario they'd have live phone numbers/service and the cheapest possible phone plan, and ability to receive incoming SMS. The accounts then get provided to some other group of people who are doing mass advertising/social media manipulation.
toast0 43 minutes ago [-]
c) grey route outbound sms. Even cheap US plans tend to have 'unlimited' sms, sometimes even to selected foreign destinations. Sometimes carrier billed SMS is cheaper than aggregators (but not too often) or may have better routing to difficult destinations.
walrus01 30 minutes ago [-]
Yes, I can definitely see that being plausible, particularly if they've gone to the efforts to make software tooling to spread out the outbound SMS volume around many different SIM and self-rate limit their volume, to avoid getting cut off, rate limited, or account banned.
kotaKat 44 minutes ago [-]
To point A: I remember a long while ago making a 'free VoIP' call and my call routed into a MetroPCS recording telling me my service was suspended for nonpayment. Hung up, redialed, number shot through another dodgy route.
Good times!
nightpool 2 hours ago [-]
"Law enforcement shrugs"? The whole focus of the article is about how the secret service confiscated those devices and charged the SIM farm operators with crimes. Which part of that is shrugging?
htk 1 hours ago [-]
The article is about Canada.
pnw_throwaway 1 hours ago [-]
[flagged]
Joel_Mckay 2 hours ago [-]
Not really, the FCC regularly drops >$300k fines on people not creative enough to figure out a revenue model that doesn't irritate everybody. =3
Rendered at 00:15:01 GMT+0000 (Coordinated Universal Time) with Vercel.
At least as of today, most phones have an option to turn off 2g but that isn't a default.
Android has it as a toggle: https://source.android.com/docs/security/features/cellular-s...
iPhone disables it for phones in lockdown mode.
I wonder if this mostly hit international SIMs, since they wouldn’t be running the same level of SIM code to prefer various network locks like a local SIM.
Helps you stay under the radar and gov services over SMS is a lot more advanced outside of Canada if you want to do some fraud.
Source? It might just be that your carrier retired its 2g/3g network, not that the phone/sim refuses 2g/3g connections. If some cell tower popped up claiming to 2g/3g, your phone still might happily connect.
https://en.wikipedia.org/wiki/Cell_Broadcast
They are also interfering with connections and attempting downgrade attacks to do 2G SMS messages as well (and is likely where Canadian carriers were picking up the 'millions' of attacks against its network and failed authentication attempts).
Amusingly this was all also caught because of Telus reviewing those SMS messages that were reported as spam from people on iOS/Android and realizing that the messages weren't being terminated inside the cell network at all when they tried tracing them out and suspected that this was the case.
Like, the phones happily connect to these fake towers because the signal is strongest from that one and there is no authentication to verify who the tower belongs to, nor encryption of SMSes?
1. The Stingray eavesdrops, but avoids interfering with user traffic
2. The stingray is operated by law enforcement, not by fraudsters looking to steal your money
> This wasn’t targeting a single individual or business. It had the ability to reach thousands of devices at once.
This statement reads as AI-assisted — kinda interesting to see, because I am not sure it even is? This type of formal speech language is basically unintelligible from slop now.
I think at some point people see AI everywhere because they look for it everywhere.
[1] https://www.pbs.org/newshour/nation/how-sim-farms-like-the-o...
a) Doing some weird grey market VoIP thing. 32-in-1 GSM to SIP gateways have been a thing for a very long time in the developing world. Maybe they think they found some arbitrage route for phone traffic to/from the US PSTN that they can profit from. Anyone who interacts with grey market voip stuff will recognize these things immediately.
b) Using them for something like receiving 2FA authentication codes to create bot/socketpuppet social media accounts. In this sort of scenario they'd have live phone numbers/service and the cheapest possible phone plan, and ability to receive incoming SMS. The accounts then get provided to some other group of people who are doing mass advertising/social media manipulation.
Good times!