New exploit turns Samsung Galaxy phones into remote bugging devices

As many as 600 million phones vulnerable to remote code execution attack.

by Dan Goodin - Jun 16, 2015 3:16pm PDT  Ars Technica

Enlarge

Ryan Welton

As many as 600 million Samsung phones may be vulnerable to attacks that allow hackers to surreptitiously monitor the camera and microphone, read incoming and outgoing text messages, and install malicious apps, a security researcher said.

The vulnerability is in the update mechanism for a Samsung-customized version of SwiftKey, available on the Samsung Galaxy S6, S5, and several other Galaxy models. When downloading updates, the Samsung devices don't encrypt the executable file, making it possible for attackers in a position to modify upstream traffic—such as those on the same Wi-Fi network—to replace the legitimate file with a malicious payload. The exploit was demonstrated Tuesday at the Blackhat security conference in London by Ryan Welton, a researcher with security firm NowSecure. A video of his exploit is here.

SamsungKeyboardExploit

Phones that come pre-installed with the Samsung IME keyboard, as the Samsung markets its customized version of SwiftKey, periodically query an authorized server to see if updates are available for the keyboard app or any language packs that accompany it. Attackers in a man-in-the-middleposition can impersonate the server and send a response that includes a malicious payload that's injected into a language pack update. Because Samsung phones grant extraordinarily elevated privileges to the updates, the malicious payload is able to bypass protections built into Google's Android operating system that normally limit the access third-party apps have over the device.

Surprisingly, the Zip archive file sent during the keyboard update isn't protected by transport layer security encryption and is therefore susceptible to man-in-the-middle tampering. The people designing the system do require the contents of that file to match a manifest file that gets sent to the phone earlier, but that requirement provided no meaningful security. To work around that measure Welton sent the vulnerable phone a spoofed manifest file that included the SHA1 hash of the malicious payload. He provided more details about the exploit and underlying vulnerability here and here.

Welton said the vulnerability exists regardless of what keyboard a susceptible phone is configured to use. Even when the Samsung IME keyboard isn't in use, the exploit is still possible. The attack is also possible whether or not a legitimate keyboard update is available. While SwiftKey is available as a third-party app for all Android phones, there's no immediate indication they are vulnerable, since those updates are handled through the normal Google Play update mechanism.

For the time being, there's little people with vulnerable phones can do to prevent attacks other than to avoid unsecured Wi-Fi networks. Even then, those users would be susceptible to attacks that use DNS hijacking, packet injection, or similar techniques to impersonate the update server. There is also no way to uninstall the underlying app, even when Galaxy owners use a different keyboard. In practical terms, the exploit requires patience on the part of attackers, since they must wait for the update mechanism to trigger, either when the phone starts, or during periodic intervals.

FURTHER READING

ACLU ASKS FEDS TO PROBE WIRELESS CARRIERS OVER ANDROID SECURITY UPDATES

"Defective" phones from AT&T, Verizon, Sprint, T-Mobile pose risks, ACLU says.

Welton said he has confirmed the vulnerability is active on the Samsung Galaxy S6 on Verizon and Sprint networks, the Galaxy S5 on T-Mobile, and the Galaxy S4 Mini on AT&T. Welton has reported to bug to Samsung, Google, and the US CERT, which designated the vulnerability CVE-2015-2865. The bug has its origins in the software developer kit provided by SwiftKey, but it also involves the way Samsung implemented it in its Galaxy series of phones.

Update: In an e-mailed statement, SwiftKey officials wrote: "We’ve seen reports of a security issue related to the Samsung stock keyboard that uses the SwiftKey SDK. We can confirm that the SwiftKey Keyboard app available via Google Play or the Apple App Store is not affected by this vulnerability. We take reports of this manner very seriously and are currently investigating further."

The researcher said Samsung has provided a patch to mobile network operators, but he has been unable to learn if any of the major carriers have applied them. As Ars has reported in the past, carriers have consistently failed to offer security updates in a timely manner.

Post updated in the fourth paragraph to add details about transport layer security and to add comment from SwiftKey in the second-to-last paragraph.

Cisco WASTC Conference, June 15-19 in Pomona

  

Do you feel like you work in a VACUUM?  

  

Do your Co-Workers think you are Strange?                                                                             

WASTC Academy Conference 2015

is not just about great Professional Development [of course we include that]-It is about getting to spend some time with people like you [and we are the best], so WASTC has scheduled time to do just that!

Breakfast & Lunch Every day

Appreciation Event, Thursday at 5:00 [food, band, industry representatives]

After Hours Networking Room to brush up on your technology or just hang out in the evenings getting some downtime with peers. 

  

Come join the fun -see flyer for the PD part.

Hope to see you there,

  

Karen

--

Karen Stanton
Cisco Networking Academy
ASC ITC Ohlone
WASTC Coordinator
Western Academy Support & Training Center-WASTC
www.wastc.org
661 362 5363
karen.stanton@wastc.org

MPICT

  www.mpict.org

NYT: Google Introduces Wireless Service Called Project Fi

By CONOR DOUGHERTY APRIL 22, 2015  New York Times

Google's new phone service, Project Fi, will be available only to people using Google’s Nexus 6 phone. Credit Google, via Associated Press
Now you can Google a phone call.

On Wednesday, Google unveiled its long-awaited phone service, called Project Fi, putting the search giant in competition with Verizon, AT&T and other wireless service providers. In addition to new turf, the service is an attempt to blend several communication tools and the multiplying ways of calling people — cellular calls, online calls like those offered by Skype — into a single phone number and service.

For now, Project Fi could be considered an experiment. It will be available only to people using Google’s Nexus 6 phone, limiting its reach.

Analysts see the new service as a bid to reimagine phone calls so that they have greater overlap with Google’s expanding world of devices and services.

Unlike your typical cell service, Project Fi will mix traditional wireless technology, where calls are routed through cellular towers, with the wireless Internet service found in Starbucks, airports and elsewhere. Google has teamed with Sprint and T-Mobile to provide the traditional wireless service, and said it had about a million wireless hot spots for the rest.

“Wherever you’re connected to Wi-Fi — whether that’s at home, your favorite coffee shop or your Batcave — you can talk and text like you normally do,” wrote Nick Fox, Google’s vice president of communications products, in a blog post. “If you leave an area of Wi-Fi coverage, your call will seamlessly transition from Wi-Fi to cell networks so your conversation doesn’t skip a beat.”

In addition to changing networks, the service will move users’ phone numbers between screens, so they can talk and text on phones, tablets or laptops. And as with most things Google does, the service is meant to be cheap.

Traditional cellphone carriers like AT&T and Verizon charge customers upward of $100 a month for their services, including phone calls and mobile data. Google’s service will be $20 a month for basic voice and text service, along with a flat $10 per gigabyte of cellular data.

“Since it’s hard to predict your data usage, you’ll get credit for the full value of your unused data,” according to the blog post. “Let’s say you go with 3GB for $30 and only use 1.4GB one month. You’ll get $16 back, so you only pay for what you use.”

In many ways, the wireless service is similar to the Google Fiber Internet service that has been introduced in a handful of American cities, including the Kansas City area and Austin, Tex.

Google is piggybacking on giant physical networks that are owned by other companies, creating a barrier that, for now at least, limits Google’s competitive threat to traditional carriers. But Google has a long history of trying to cut out middlemen — including Internet service providers, online stores and delivery businesses — that stand between the company and users.

With the wireless service, Google will be operating on what is called a mobile virtual network operator, or MVNO, which provides a service on other mobile carriers’ networks.

“It’s always an interesting business because you are dependent on the companies who you are trying to compete with,” said Jan Dawson, chief analyst at Jackdaw Research. “And they will only support you if they think you’re targeting a niche they can’t target themselves.”

Over the last few years, Google has been reshaping itself around mobile devices that have become the primary way people use the Internet.

On Tuesday, the company adjusted its bread-and-butter search engine in such a way that websites that are optimized for mobile phone screens will get a boost in mobile search rankings. It also has been working with mobile application developers to create new services that allow mobile users to seamlessly bounce between the traditional web and the apps on their phone.

But Google has remained two steps away from mobile users. Unlike Apple, which makes its own phones and essentially dictates the terms of its service to mobile carriers, Google’s Android mobile software is distributed to phone manufacturers, who adjust it to their liking, and then through wireless carriers, who bundle their own services on top.

Nexus devices, which are made for Google and run a “pure” form of Android, brought the company one step closer to the user, but their sales are much smaller than those of other Android smartphone makers, like Samsung.

The new service gives Google “freedom and more control over the experience, and can offer something like Apple offers, where they control the whole package,” Mr. Dawson said.

How to Unlock Your Phone

BY SASCHA SEGAN
FEBRUARY 11, 2015 05:45PM EST  PC Magazine

Do you need to know how to unlock your phone? We have details for all the major U.S. carriers right here.


Mobile phone carriers don't want you to leave, especially if they helped pay for your phone. Most of the phones sold in the U.S. (except for Verizon phones) are "locked," meaning they can't be taken to another carrier without being unlocked. From the carriers' perspective, it's a way to stop customers from leaving before they've paid out their contract or installment plan.

Because we're a country fragmented between the GSM and CDMA technologiesand several different frequency bands, unlocking a phone doesn't mean you can use it on any other U.S. carrier. But depending on the phone, you may be able to use it on a different U.S. carrier, or with foreign carriers for lower rates than you would pay roaming on your own provider.

It also helps to unlock a used phone before you sell it on a site like eBay. That will raise the price you get, because more people will be able to buy and use your phone.

In late 2013, the U.S. wireless carrier association (CTIA) agreed to adopt standardsthat would allow subscribers to unlock their paid-off phones by February 11, 2015. That's made things easier, but there are still a lot of requirements and caveats.

Why Unlock Your Phone?

The simplest reason to unlock your phone is to use it on another GSM network. That could be AT&T, T-Mobile, one of the virtual carriers that uses those networks, or a foreign GSM carrier. AT&T and T-Mobile now give service plan discounts for bringing your own phone.

The reason to use an unlocked phone while traveling abroad is because you can use either a global SIM card or a local carrier's SIM card, which would offer much lower rates than roaming with your U.S. carrier. You'd lose your standard U.S. phone number for the duration of the trip, though.

U.S. GSM virtual carriers compatible with unlocked phones include Cricket, MetroPCS, Simple Mobile, Straight Talk, H2O Wireless, Black Wireless, Ready SIM, and many others.

Large CDMA carriers, in general, do not accept unlocked phones. That means you can't move an unlocked phone over to Verizon, Sprint, Boost, or Virgin.

However, some small virtual carriers on Sprint's network will accept unlocked Sprint phones (and only Sprint phones) - carriers like Ting, Expo Mobile, EcoMobile, and Credo Wireless. The small virtual carrier Page Plus accepts unlocked Verizon phones.

There are third-party sites that purport to sell "unlock codes," but they're generally pretty shady. Avoid them.

How To Unlock an AT&T Phone

AT&T's unlocking policy depends on what kind of customer you are.

If you aren't an AT&T customer and you're trying to unlock an AT&T phone that you bought used, the phone must be fully paid off, not attached to a contract, and not reported lost or stolen.

If you're a postpaid customer, that all has to be true, and you also have to have had service for 60 days. If you're a prepaid customer, kick that up to six months.

If you fulfill these requirements, go to AT&T's Unlocking Page to submit a request. AT&T will send you instructions on how to unlock your phone within two days.

How to Unlock a T-Mobile Phone

T-Mobile's unlocking rules require you to use your phone for a certain amount of time and pay it off before unlocking. Also, you can only request two unlock codes a year.

Phones on monthly plans must have been active for 40 days and either completely paid off if they're on a no-contract plan, or at least 18 months into a 24-month contract. Prepaid smartphones must have been active for a year or have used $100 in refills.

If you fulfill those requirements, call 1-877-746-0909 or use the online chat on TMobile.com and ask to unlock your phone. They'll send you instructions within two days.

How to Unlock a Sprint, Boost or Virgin Phone

Sprint, Boost, and Virgin (which are all parts of Sprint) now all have the same unlocking policies. You only need to bother unlocking Sprint phones if they also contain a GSM radio (like the iPhone 6 does) or if you're moving them to a Sprint-based virtual carrier like Ting or Credo Wireless.

Sprint has a complex, confusing set of unlocking policies. You can read Sprint'smain unlocking policy, prepaid unlocking policy, and unlocking FAQ for details, but here are the basics.

If you just want to use a Sprint world phone (such as an iPhone 6) with a foreign SIM card when you travel abroad, it basically just needs to be a live device on an account that's been active for 90 days. This form of unlocking won't allow it to be used on non-Sprint U.S. networks. Go to sprint.com/sww to get this unlock.

To unlock a Sprint phone, the phone must be fully paid off or out of contract, and not reported as lost or stolen. If it's prepaid, such as a Virgin or Boost phone, the phone must have been used for 12 months.

But wait! Unless you bought your phone after February 19, 2015, only iPhone 5s, 5c, 6, and 6 Plus models are truly unlockable on Sprint, Virgin, or Boost. According to Sprint, phones bought before February 19 will require a code to move to another Sprint-compatible carrier, not a true SIM unlock.

Phones bought after February 19, 2015 may be fully SIM unlockable, but remember, because of that year-long active requirement, you probably won't be able to SIM-unlock most Virgin or Boost phones until 2016. You will be able to CDMA unlock them to use on another Sprint-based carrier, or international unlock them for internation SIM use, though.

Call 844-665-6327 to unlock your Sprint phone, 888-322-1122 to unlock a Virgin phone or 866-402-7366 to unlock a Boost phone.

This Reddit thread helps decode what Sprint is doing.

How to Unlock a U.S. Cellular Phone

U.S. Cellular's unlocking policy says that it will unlock any postpaid phone that is paid off or out of contract, and any prepaid phone that was activated more than 12 months ago. 3G devices can be unlocked by calling 888-944-9400, but for LTE devices, you must stop in at a U.S. Cellular store.

How to Unlock a Verizon Phone

Verizon 4G LTE phones are sold unlocked. You can use them on any supported carrier on demand.

If you have a Verizon 3G Global Ready device, most of them are unlocked; any locked devices can be unlocked by request by calling 888-294-6804. If your phone asks for an unlocking code, try "000000" or "123456" before calling for help.

Verizon's full phone unlocking policy is online.

How to Unlock Other Carriers' Phones
Cricket will unlock GSM phones that have been in use for 6 months (either current Cricket or former Aio phones). Stop into a store, call 800-274-2538, or chat online.

MetroPCS will unlock any GSM phone that's been active for 90 days; stop into a store or call 888-863-8768.

Phones from TracFone and Straight Talk that were put on the market after January 2014 can be unlocked after 12 months of use as per the company'sunlocking policy. Call your brand's customer service number to ask.

Starting today, wireless carriers have to unlock your phone

Once you've paid off your contract, carriers can't say no.

by Jon Brodkin - Feb 11 2015, 6:31am PST Ars Technica

Sam Dal Monte / flickr

Major wireless carriers in the US have promised to unlock customers' phones or tablets once they've paid off their contracts, beginning today. This is the result of an agreement the carriers made with FCC Chairman Tom Wheeler in late 2013; the deadline to comply with all portions of the agreement arrived today.

The two key provisions are as follows:

• Postpaid Unlocking Policy. Carriers, upon request, will unlock mobile wireless devices or provide the necessary information to unlock their devices for their customers and former customers in good standing and individual owners of eligible devices after the fulfillment of the applicable postpaid service contract, device financing plan, or payment of applicable early termination fee.
• Prepaid Unlocking Policy. Carriers, upon request, will unlock prepaid mobile wireless devices no later than one year after initial activation, consistent with reasonable time, payment or usage requirements.

Carriers must also post unlocking policies on their websites (here are links for AT&T, Verizon, Sprint, and T-Mobile), provide notice to customers when their devices are eligible for unlocking, respond to unlock requests within two business days, and unlock devices for deployed military personnel.

As lawmakers argue, carriers have until 2015 to unlock all off-contract phones.

The requirements are part of the CTIA Wireless Association's Consumer Code followed by the four major nationwide carriers and others. Carriers were required to follow any three of the six requirements by May 11, 2014, and all of them by today.

Unlocking a phone allows it to be used on any compatible network, regardless of carrier.

Wheeler pressured carriers to unlock consumers' phones after a strange turn of events made it a violation of the Digital Millennium Copyright Act for consumers to unlock their own devices. Congress and President Obama took action last year to let customers unlock their own phones, but that didn't require carriers to do so on customers' behalf.

Actually getting a phone unlocked in practice can be a frustrating experience, as our own Lee Hutchinson can confirm. Let us know if your carrier gives you any trouble.

5G Network Requirements: 10 Gig, Ultra-Low-Latency?

1/28/15 at 6:00 AM by Joan Engebretson Telecompetitor

The wireless industry is considering 5G performance targets of 10 Gbps and 1 millisecond-latency, said the senior director of technology for wireless association GSMA on an investor conference call organized by Bernstein financial analysts last week. Those targets will require the use of higher frequency spectrum, along with considerable innovation in antenna technology and the use of new signaling and modulation schemes, said senior director Dan Warren.

“Ten gigabits per second requires a lot of spectrum and a lot of antennas,” said Warren in a transcript of the conference call shared with Telecompetitor. Because of these challenges and because carriers worldwide are still making considerable investment in LTE, Warren doesn’t expect 5G deployment to occur until 2025, with some trial deployments occurring sooner.

5G Network Requirements

The portion of the radio spectrum where there is sufficient spectrum available for 5G is in the high-frequency millimeter wave band – and that frequency band is challenged to provide long-distance coverage, Warren said.

“To get decent range out of the millimeter wave, you need to have… one antenna per individual pointing at a very specific individual endpoint,” explained Warren. If, for example, a network operator wanted to support 200 connections on a cellsite, it would need 200 antennas on top of that cellsite.

Warren noted that some fixed wireless equipment already supports service over comparatively long distances by tightly focusing antenna beams. But what will complicate matters for 5G will be the need to provide that capability in a mobile environment.

“The kind of technologies which vendors are working on at the moment are ways of tracking or predicting where a device is going to move next and then pointing the beam so it remains focused on the individual device,” Warren explained.

5G Applications

The GSMA currently envisions two specific applications that are likely to require the high bandwidth and low latency of 5G, Warren said. These include autonomous driving and augmented or immersive Internet.

Autonomous driving could eliminate the need for drivers, with technology handling vehicle navigation. Such cars are likely to have in-car entertainment, and ubiquitous coverage along roadways will be critical, Warren said.

“Otherwise there’s a rather awkward handover experience where your car tells you that you need to grab hold of the wheel again,” said Warren.

Augmented or immersive Internet would be similar to virtual reality technology that enables users to see a virtual 3-D world by donning special goggles. In addition relevant pieces of information would be displayed for the end user. “So if I was looking at an individual, it might have their name and their Facebook status,” Warren said.

Augmented Internet is one of the applications that could drive the need for low latency as a means of preventing what Warren called “cyber sickness” – a form of motion sickness. “The human eye and the human brain are sensitive on a visual basis to anything where latency is more than one or two milliseconds,” Warren explained. Without that he said, “the experience where an individual moves their head wearing an augmented reality display is that the image doesn’t keep up with their movement and it essentially makes them feel nauseous.”

Meeting the latency target will be challenging because of the laws of physics, Warren said. But he added that “it’s much easier to do if you’re doing it very close to the end users, which then means that you have to really rethink the way that content is delivered… It’s actually a change in network topology.”

Because augmented Internet screen size would be relatively small, however, bandwidth requirements would be relatively low, Warren noted.

Wi-Fi and the IoT

Other interesting points from the conference call with Warren include:

• 5G and unlicensed wireless technology such as advanced Wi-Fi will be coupled more tightly from the start, unlike with what occurred with 4G
• The Internet of Things could drive the need for the “antithesis” of 5G – a low-power network with very large range capable of delivering very small amounts of bandwidth in order to support sensor networks.

Report: Google to Sell Wireless Phone Service

BY STEPHANIE MLOT  PC Magazine
JANUARY 22, 2015 10:10AM EST

The Web giant is reportedly in talks with Sprint and T-Mobile to provide mobile phone plans to consumers.


Google's next step toward world domination: selling wireless service.
The Web giant is reportedly in talks with Sprint and T-Mobile to provide mobile phone plans to consumers.

First reported by The Information, the project, codenamed "Nova," has been internally tested and is expected to launch later this year under the direction of Google exec Nick Fox.

By becoming a mobile virtual network operator (MVNO), Google does not have to build and maintain a network, The Wall Street Journal said. Instead, it would resell service on the Sprint and T-Mobile networks, which get new users without any marketing costs.

Google has dropped hints about "Nova," according to the Journal. In a recent letter to the Federal Communication Commission, the company suggested that higher-frequency spectrum might be used for "the next generation of unlicensed broadband services."

Nova would reportedly rely largely on Wi-Fi networks, but switch to cellular networks when Wi-Fi is not available, the paper said.

Google is no stranger to the mobile business: Its Android operating system powers more than 80 percent of smartphones around the world. And as more people gain access to the Web—through services like Google's own Project Loon—the Internet behemoth cashes in via searches, video streaming, emails, and texts.

Spokespeople from Sprint and Google declined to comment on the rumors, while T-Mobile did not immediately respond to PCMag's request.

Sprint and T-Mobile, meanwhile, last year eyed a possible merger, allowing the nation's third and fourth largest carriers to compete against the top two: AT&T and Verizon. Mixed reactions and financial disagreements meant the proposed unioneventually failed; longtime Sprint CEO Dan Hesse also got the boot, and was replaced by Marcelo Claure.

For more, see PCMag's roundup of the Fastest Mobile Networks 2014, as well asHow Google Wireless Could Change America.

Marriott Says They'll Stop Blocking Customer Device Wi-Fi

by Karl Bode 11:20AM Thursday Jan 15 2015 DSL Reports

Back in October we noted that Marriott agreed to pay a $600,000 fine to the FCC for blocking user access to their own tethered phones or mobile hotspots, instead forcing convention center attendees to use Marriott's pricey Wi-Fi. At the time we noted how this was a pretty clear example of Marriott simply using technology in an uncompetitive fashion, though in filings since Marriott has attempted to argue they were only looking out for the welfare and security of their customers.



Hotels have since petitioned the FCC for clarity on when it is or isn't ok to block Wi-Fi since, they argue, this is common practice for hospitals, at some corporate campuses, or at events like Defcon.

The law prevents companies from "willfully or maliciously” interfering with “any radio communications of any station licensed or authorized” by the government, something Marriott insists shouldn't apply to Wi-Fi.

Of course the deck was stacked against Marriott, with Google, Microsoft, and the nation's biggest carriers all filing their own comments against Marriott's plans. Facing those deep pocketed companies, the ire of regulators, and consumer outrage, Marriott has now posted a company statement saying they'll no longer block Wi-Fi devices:

quote:Marriott International listens to its customers, and we will not block guests from using their personal Wi-Fi devices at any of our managed hotels. Marriott remains committed to protecting the security of Wi-Fi access in meeting and conference areas at our hotels. We will continue to look to the FCC to clarify appropriate security measures network operators can take to protect customer data, and will continue to work with the industry and others to find appropriate market solutions that do not involve the blocking of Wi-Fi devices.

Which is good, since this is a fight Marriott was simply not going to win.

New generation of 802.11ac devices keeps networks fast even with lots of users

MU-MIMO will be hitting the market over the next few months.
by Peter Bright - Jan 7 2015, 7:15pm PST  ars technica

LAS VEGAS—Wi-Fi networks promise to get faster still this year with the release of hardware supporting an important optional feature of the 802.11ac wireless specification, MU-MIMO. At CES this week, companies, including D-Link and Netgear, announced MU-MIMO-compatible devices powered by Qualcomm's range of Wi-Fi chipsets.

Traditional Wi-Fi is a broadcast technology. If a base station is talking to a device on the network, every other device on the same network has to wait its turn. So while typical 802.11ac offers fast headline speeds of 1.3Gbps or more, that bandwidth ends up being shared. If there are three computers connected to the base station, then on average they each get only 325Mbps of bandwidth.

MU-MIMO ("multi-user multiple input multiple output") means that those three computers could each get close to the 1.3Gbps of bandwidth simultaneously, through a process called beamforming.

A MU-MIMO router measures the time it takes for a client to receive data on the network, and by comparing the different timings from the different antennas, the base station can figure out which direction the client lies in. Using this information, the base station can then modulate the signals transmitted from its antennas so that the signal is strongest in the direction of the client and reduced everywhere else.

This means that instead of broadcasting the signal equally in all directions, the base station is only sending it in the client's direction. Here's where the "multi user" aspect kicks in: the base station cansimultaneously send a signal beam to a second client, provided that the client isn't in the same direction as the first client.

MU-MIMO only works in the downstream direction, from the base station to the client. That's because it needs a bunch of spatially separated antennas and complex signal processing; most clients, especially small ones such as smartphones, don't have space.

802.11ac MU-MIMO supports transmission in up to four different directions simultaneously. While devices located close together, in the same direction, will still have to share bandwidth, devices that are spatially separated should be able to receive at close to the maximum speed possible.

Both the clients and access points need to support MU-MIMO. The changes on the client side are small (such that a driver or firmware update may be sufficient to upgrade existing 802.11ac adapters to support MU-MIMO), the greater complexity on the access point end means that new hardware will be required. The alien-looking D-Link AC3100 and AC5300 routers, shipping later this year, will support the specification, as will some forthcoming Netgear devices.

FBI says search warrants not needed to use “stingrays” in public places

Feds' position on decoy cell-site towers continues anti-privacy theme.

by David Kravets - Jan 5 2015, 11:25am PST  Ars Technica


Tim Parkinson

The Federal Bureau of Investigation is taking the position that court warrants are not required when deploying cell-site simulators in public places. Nicknamed "stingrays," the devices are decoy cell towers that capture locations and identities of mobile phone users and can intercept calls and texts.

The FBI made its position known during private briefings with staff members of Senate Judiciary Committee Chairman Patrick Leahy (D-Vt.) and Sen. Chuck Grassley (R-Iowa). In response, the two lawmakers wrote Attorney General Eric Holder and Homeland Security chief Jeh Johnson, maintaining they were "concerned about whether the FBI and other law enforcement agencies have adequately considered the privacy interests" of Americans.

According to the letter, which was released last week:

For example, we understand that the FBI’s new policy requires FBI agents to obtain a search warrant whenever a cell-site simulator is used as part of a FBI investigation or operation, unless one of several exceptions apply, including (among others): (1) cases that pose an imminent danger to public safety, (2) cases that involve a fugitive, or (3) cases in which the technology is used in public places or other locations at which the FBI deems there is no reasonable expectation of privacy.
The letter was prompted in part by a Wall Street Journal report in November that said the Justice Department was deploying small airplanes equipped with cell-site simulators that enabled "investigators to scoop data from tens of thousands of cellphones in a single flight, collecting their identifying information and general location."

The bureau's position on Americans' privacy isn't surprising. The Obama Administration has repeatedly maintained that the public has no privacy in public places. It began making that argument as early as 2010, when it told a federal appeals court that the authorities should be allowed to affix GPS devices on vehicles and track a suspect's every move without court authorization. The Supreme Court, however, eventually ruled that warrants are required. What's more, the administration has argued that placing a webcam with pan-and-zoom capabilities on a utility pole to spy on a suspect at his or her residence was no different from a police officer's observation from the public right-of-way. A federal judge last month disagreed with the government's position, tossing evidence gathered by the webcam that was operated from afar.

In their letter, Leahy and Grassley complained that little is known about how stingrays, also known as ISMI catchers, are used by law enforcement agencies. The Harris Corp., a maker of the devices from Florida, includes non-disclosure clauses with buyers. Baltimore authorities cited a non-disclosure agreement to a judge in November as their grounds for refusing to say how they tracked a suspect's mobile phone. They eventually dropped charges rather than disclose their techniques. Further, sometimes the authorities simply lie to judges about their use or undertake other underhanded methods to prevent the public from knowing that the cell-site simulators are being used.

"The Judiciary Committee needs a broader understanding of the full range of law enforcement agencies that use this technology, the policies in place to protect the privacy interests of those whose information might be collected using these devices, and the legal process that DOJ and DHS entities seek prior to using them," Leahy and Grassley wrote in their letter to Holder and Johnson.

Hanni Fakhoury, an attorney for the Electronic Frontier Foundation, said some states and judges are pushing back against stingrays.

"In Tacoma, judges now require police (to) specifically note they plan to use an IMSI catcher and promise not to store data collected from people who are not investigation targets," he said. "TheFlorida and Massachusetts state supreme courts ruled warrants were necessary for real-time cell phone tracking. Nine states—Colorado, Illinois, Indiana, Maryland, Minnesota, Tennessee,Utah, Virginia, and Wisconsin—passed laws specifically requiring police to use a warrant to track a cell phone in real time."

Telecom 2014: The Top 12 Stories Are All “To Be Continued”

Telecompetitor12/23/14 at 11:37 AM by Joan Engebretson

Telecompetitor covered a lot of big telecom stories in 2014, but there were 12 that stood out in my mind – and I thought readers might find it helpful to see them all recapped in one place.

If there is any single common thread among the top 12 telecom 2014 stories, it’s this: From open regulatory issues such as Net Neutrality and the Connect America Fund to ongoing trends like gigabit networks, nearly all of these stories are “to be continued.”

Gigabit networks see strong growth. I counted at least 30 new gigabit market entrants in 2014, some of whom made announcements for multiple markets, as well as numerous new markets announced by companies that entered the gigabit market in 2013 or before. And according to one of the suppliers to this market, there’s plenty more companies in the pipeline.

Major pay TV mergers pending. AT&T wants to acquire DirecTV and Comcast wants to acquire Time Warner Cable. Both deals are driven in part by a desire to minimize skyrocketing programming costs. Regulators must determine the consumer impact before granting their approval.

Net Neutrality is a highly volatile topic. When an appeals court struck down the FCC’s Open Internet (also known as Net Neutrality) guidelines, consumer groups and President Obama called for the commission to reclassify broadband as a Title II or communications service – a move the telecom industry opposes. The commission should address this in 2015 – and undoubtedly will make enemies no matter what it does. Equally volatile and unresolved is the issue of Internet traffic exchange, which may or may not be related to Net Neutrality, depending which side you’re on.

Windstream plans ground breaking REIT spinoff. The company hopes to free up capital for investment by moving its fiber and copper assets into a real estate investment trust, which also is expected to acquire similar assets from other telcos pursuing the same goal. The deal is scheduled for completion in the first half of 2015. Will Windstream achieve its goals? Will other companies adopt the same approach? The industry will be looking for answers to these and other questions.

TDM-to-IP transition is top of mind. Telcos are getting serious about transitioning today’s TDM based networks to IP-based infrastructure. AT&T, CenturyLink and other have proposed TDM-to-IP trials – and the FCC owes the industry an answer on these proposals.

Connect America Fund implementation creeps along. Transitioning today’s voice focused high-cost Universal Service program into a broadband-focused Connect America Fund is a complex task. In 2015 the commission is scheduled to offer funding to price cap carriers to cover some of the costs of deploying broadband to rural areas that lack broadband today. At least one carrier expects to accept funding. But if a carrier opts out, funding will be awarded through an as-yet-undefined competitive bidding process. The commission is looking to rural broadband trials, whose participants were just announced, to provide guidance on the bidding process. The commission also owes smaller rate of return carriers an answer on what their CAF program should look like, but how soon it might tackle that is unknown.

E-rate reforms. The schools and libraries – or E-rate—portion of the Universal Service programalso is being revamped to focus on broadband. The FCC made considerable progress on this in 2014. Now it’s a matter of execution.

Wireless price wars. After a substantial network upgrade, T-Mobile set out to move new traffic onto that network by grabbing customers from other network operators through aggressive prices and promotions. All three of the other major national operators have now responded with their own programs, the aggressiveness of which varies depending on the operators’ circumstances. Sprint, which has the most to lose, has offered the strongest response; followed by AT&T, which has been the specific target of some T-Mobile promos and Verizon, which also is feeling the impact. The question for 2015 will be the ongoing impact of this vastly more competitive marketplace on stock prices and valuations.

Spectrum value skyrockets. The ongoing auction of mid-band spectrum already has far exceeded expectations in terms of what wireless operators would spend – and it’s not over yet. With traffic levels climbing fast, network operators feel compelled to bid high to accommodatefuture growth. We should know final prices in the current auction soon – and those prices should give network operators a sense of the moves they need to make in 2015 to prepare themselves for the auction of potentially even more valuable low-band broadcast spectrum in 2016.

OTT providers as cablecos. The FCC is contemplating classifying certain OTT video providers as multichannel video distribution providers – a move that would force content providers to negotiate with those companies to deliver the same programming that traditional cablecos offer. This could be a game-changing decision – and one that will be hotly debated moving forward.

Municipal broadband networks. When cities are unable to persuade local carriers to upgrade their broadband networks, they sometimes take matters into their own hands, making plans to build their own networks. The incumbents say this is unfair and in some states have pushed for and obtained legislation effectively preventing municipal networks. FCC Chairman Tom Wheeler says that’s anti-competitive and has threatened to step in. Will he or won’t he and what form would that intervention take? We could have the answers in 2015.

Sprint seeks rural partners. Sprint wants small rural network operators to help it build out LTEnationwide. To achieve that, the company is offering long-term spectrum leases and letting rural carriers leverage its vendor relationships for better equipment deals. The program, known as SMART and delivered through the NetAmerica alliance, already has attracted some rural network operators. How successful will the program be and how will its results compare with those of Verizon, which launched a substantially different rural LTE program several years back? Those are important questions moving forward.

Clearly 2015 already is shaping up to be an exciting year in telecom. Telecompetitor looks forward to experiencing it with you.

NPR: Who's Catching Your Cellphone Conversations?

by L. CAROL RITCHIE  NPR
October 21, 2014 2:39 PM ET

The police could be monitoring your cellphone.iStockphoto
With the right equipment, people can hijack your cellphone, listen to your calls and read your texts, alarming privacy rights advocates and tech experts alike.

We know the eavesdropping is happening, but we don't know much about who's doing the listening. The police and other law enforcement agencies do it, but they have been restricted by the FBI from telling us about it. Beyond the police, the listeners could be the U.S. government, corporate spies or even foreign intelligence agencies.

The devices, known as IMSI catchers or by a brand name, Stingray, used to be expensive, bulky and hard to purchase. Now they can be bought online for as little as $1,800 and can be as small as a briefcase.

"Today, a tech-savvy criminal or hobbyist can even build one using off-the-shelf equipment,"writes Stephanie Pell, a cyberethics fellow at the Army Cyber Institute at West Point.

IMSI catchers trick cellphones into thinking they're connected, as normal, to a network like Verizon or AT&T. But the devices hijack the phone's signal, and in some cases, intercept the contents of calls and texts. The IMSI catchers take advantage of a vulnerability built into the system. Phones using 3G or 4G technology can authenticate cell towers, but phones on older 2G systems cannot tell between real and fake towers.

An IMSI catcher blocks the smarter 3G and 4G signals, forcing phones in the area to switch to the unsecured 2G service — something that phones also do routinely in more rural areas, where 2G service is widespread. The IMSI catcher then poses as a tower and "catches" signals.

IMSI catchers — the letters stand for International Mobile Subscriber Identity, a code unique to each phone — have gotten little media attention. But in August, Popular Science published a map showing the locations of a large number of IMSI catchers, or interceptors, spread throughout the U.S.

Now, there's an arm's race on between the technology used to intercept cellphone calls and the technology used to detect that technology.

The map was made by a company that sells a device, called a GSMK CryptoPhone, that can detect the interceptors — known as an IMSI catcher-catcher. ESD America says that it and its customers have used the CryptoPhone to find some 500 of the fake cell towers.

"Interceptor use in the U.S. is much higher than people had anticipated," ESD CEO Les Goldsmith told Popular Science. "One of our customers took a road trip from Florida to North Carolina and he found 8 different interceptors on that trip."

The CryptoPhone, which sells for $3,500, is built onto a Samsung Galaxy SIII phone.

In September, another CryptoPhone marketing executive drove around Washington, D.C., looking for signs of IMSI catchers. He said he found 18 in less than two days.

The map of those locations is unnerving. "It looks," writes Ashkan Soltani of The Washington Post, "like a primer on the geography of Washington power, with the surveillance devices reportedly near the White House, the Capitol, foreign embassies and the cluster of federal contractors near Dulles International Airport."

Granted, these executives will profit from sales of the CryptoPhone. Some security experts are skeptical that the CryptoPhone can pinpoint with accuracy the location of the IMSI catchers.

But there's enough evidence to alarm others, including the Federal Communications Commission, which set up a task force in August "to combat the illicit and unauthorized use of IMSI catchers." Set up in response to congressional questioning, the task force will study the extent of IMSI catcher use by criminal gangs and foreign intelligence services.

Pell, of the Army Cyber Institute, says the real issue is the cell system's underlying vulnerability. She sees it as a threat to national cybersecurity.

"Whatever effective monopoly the U.S. government once had over the use of IMSI catchers is now gone," Pell writes in Wired. Fixing that flaw would hinder some law enforcement efforts, but that cost is outweighed by the benefit of knowing no foreign elements are listening in on government officials' conversations, she says.

We know more about police using Stingrays — often from the trail of objections by privacy rights advocates — but we still don't know much.

The FBI, Secret Service, National Security Agency and at least nine other national agencies use IMSI catchers, according to the American Civil Liberties Union.

Some 46 local agencies in 18 states use the technology — but because most acquire Stingrays secretly, that number "dramatically underrepresents the actual use of stingrays by law enforcement agencies," the ACLU says.

Local police acquire Stingrays secretly, an FBI requirement. Before using the technology, police departments must sign nondisclosure agreements promising not to release Stingray details to the public, according to documents obtained in September by the websiteMuckRock under a Freedom of Information Act request.

The Florida-based Harris Corp., maker of the Stingray, notifies the FBI and FCC when police request the technology, and the FBI then requires the nondisclosure agreement. The arrangement is a condition of Harris' FCC equipment authorization, explains Nathan Wessler, an attorney with the ACLU.

That secrecy — along with grants from the Department of Homeland Security — has allowed police to get and use Stingrays without local approval or oversight, he says. When the ACLU sued the Tucson, Ariz., police for Stingray records, an FBI agent invoked the FBI nondisclosure agreement as a reason to keep the information secret, Wessler says.

When police use them against potential suspects, they can sweep up information from the cellphones of dozens or even hundreds of bystanders. They do these sweeps without warrants and without telling the public how much information they keep or for how long, Wessler says.

"I do think the average person should be concerned about this," he says.

"Information about where we are and where we go over the course of time can reveal sensitive information about our lives," he says. "Whether we visit a psychologist, go to an AA meeting, stop off at a liquor store after work, who we spend time with: That information should be private."

What Makes Cellphone Coverage Vary?

October 22, 2014

Pots and Pans

It seems I have been writing about cellphones for a few days, so I thought I would cover a question that I have been asked many times. I travel a lot and it’s not unusual to sit next to somebody and note that the two of you are having a very different cellular experience. One of you may be getting one bar for data and voice while the other might be getting four, sitting only a few feet apart. What explains this difference in cellular performance? I will start with the obvious explanations, but sometimes the differences are due to more subtle issues.

Who is your carrier? Both people might have an iPhone, but if one has Verizon and the other has AT&T the experience is different because both are connected to completely different technologies and totally separate networks. AT&T and T-Mobile use GSM (Global System for Mobile) technology, the technology that is used in most of the rest of the world. But Verizon and Sprint use CDMA (Code Division Multiple Access) technology. These technologies are so different that a handset that is made only for one technology won’t work on the other. This is why you can’t take your Verizon handset to most of the rest of the world when you travel.

Who’s on the nearest tower? I’ve often been driving with somebody and hear them be glad to see an upcoming cell tower because they assume this means they’ll get better coverage. But you can’t assume this because not every carrier is on every cell tower. There are a large number of cell towers in the country. Some of these are owned by the wireless carriers but many are leased. The cellular companies look at available towers and then cobble together the combination of towers that make the most effective and cost-efficient network for them.

This task has gotten hard for the carriers because of the fact that cellphones now carry data. The original cell tower network with all of the giant towers was created back when cellphones only carried voice. But now that the networks are deploying data and using higher frequencies it turns out that a more ideal network would place the towers closer together than the traditional locations. This is causing massive reconfigurations of the networks as the carriers try to improve data reception.

Cell sites get busy. Or said another way, any one carrier on a tower might get busy while another carrier might not be busy. As cell sites get busy they do a couple of things to handle the excess traffic. Most carriers still give preference to voice over data, so as more voice calls are added to a network the amount of bandwidth allocated to data is often choked down (but not always). And eventually the tower site refuses to add new customers. But when sites get busy the performance normally degrades.

You might be roaming. Roaming is when a customer is riding a different network than the one to which they subscribe. If you are an AT&T customer and are roaming on a T-Mobile site, you will not get the same priority as a T-Mobile customer. This might mean getting slower data speeds if the site becomes busy, and it could also mean being booted from the site as it becomes full.

Spectrum is not created equal. There is not just one spectrum being used for cellular data. There are already nearly a dozen different slices of spectrum being used and the FCC is going to be auctioning more over the next two years. Every time you move to a different cell site you might be changing the frequency you are using. Carriers not only cobble together a network of the ideal cell sites, but they also play a chess game of deciding which spectrum to deploy at each tower. None of the carriers owns all of the different spectrum available, and the spectrums they own in different cities can be drastically different. This means getting four bars at your home might not give you the same experience as getting four bars when you are traveling.

What your phone allows. Perhaps one of the biggest differences in reception is that each cellphone maker decides what spectrum a given handset is going to receive. It costs a lot of energy, meaning battery time, for a phone to always search on all of the different frequencies. So different handsets allow different frequency bands. This is why LTE coverage differs so widely because there are many sets that don’t even see some of the LTE frequencies. All handsets look for the basic cellular bands, but only the most expensive sets are designed to look for almost everything out there. And as more cellular bands are allowed into the mix this will get more pronounced. Of course, you have to read very deep into the specifications of your phone to understand what it does and does not receive. Good luck asking that question at the cellphone store.

Plain old interference. Every cellular frequency has a different propagation characteristic. If you and the guy next to you are talking on different frequencies then you each will be dealing with a different set of interference. This is one of the reasons that cellular coverage is so wonky in complicated buildings like airports and hospitals. Each cellular frequency is likely to find a different set of problems in a complex environment and one frequency might get killed in a given part of the airport while another is fine. This is why you might find yourself walking around trying to find a signal while people around you are still talking.

Majority of mobile apps will fail basic security tests in the future: Gartner

Summary: The research firm claims that 75 percent of all mobile applications will fail basic security tests next year -- leaving the enterprise vulnerable.

By Charlie Osborne for Between the Lines | ZDNet September 15, 2014 -- 09:59 GMT (02:59 PDT)




Gartner claims that through next year, 75 percent of mobile apps will fail the most basic of security tests.
The research firm says that in 2015, the majority of mobile applications -- whether in the Android, iOS or Windows Phone ecosystems -- will not have basic business-acceptable security protocols in place. This poses a serious problem for the enterprise, where bring-your-own-device (BYOD) schemes are commonplace. Should employees download apps which can access enterprise assets or perform business functions, but have no basic standards of security in place, not only are enterprise security policies at risk of violation but sensitive corporate data and networks may also become vulnerable.

Dionisio Zumerle, principal research analyst at Gartner commented:

"Enterprises that embrace mobile computing and bring your own device (BYOD) strategies are vulnerable to security breaches unless they adopt methods and technologies for mobile application security testing and risk assurance. Most enterprises are inexperienced in mobile application security. Even when application security testing is undertaken, it is often done casually by developers who are mostly concerned with the functionality of applications, not their security."

Zumerle said that existing static application security testing (SAST) and dynamic application security testing (DAST) vendors will need to modify and adjust their tests to address mobile technologies. Both SAST and DAST have been used for the past decade, but mobile applications -- due to their variety and reliance on continually evolving mobile operating systems -- are a fresh challenge.

Gartner believes that in addition to SAST and DAST, new kinds of test based on behavioral analysis are emerging for mobile devices. These tests monitor the GUI and running background applications in order to detect malicious or risky behaviour. For example, a music player which also accesses contact lists or geolocation could be suspicious.

However, this is not necessarily enough -- and enterprise users should also make sure servers, which communicate with mobile devices, are continually tested and protected.

"Today, more than 90 percent of enterprises use third-party commercial applications for their mobile BYOD strategies, and this is where current major application security testing efforts should be applied," noted Zumerle.

"App stores are filled with applications that mostly prove their advertised usefulness. Nevertheless, enterprises and individuals should not use them without paying attention to their security. They should download and use only those applications that have successfully passed security tests conducted by specialized application security testing vendors."

Gartner predicts that by 2017, endpoint breaches will be focused on smartphones and tablets, and "security features that mobile devices offer today will not suffice to keep breaches to a minimum." In addition, the research firm recommends that the enterprise uses application containment -- such as wrapping and software development kits (SDKs) -- to better protect data.

Through 2017, Gartner predicts that 75 percent of mobile security breaches will be the result of mobile application misconfigurations, such as the misuse of personal cloud storage in tandem with enterprise data.

Mysterious Phony Cell Towers Could Be Intercepting Your Calls

Every smart phone has a secondary OS, which can be hijacked by high-tech hackersBy
Andrew Rosenblum Posted 08.27.2014 at 1:00 pm Popular Science


Unencrypted Connection

Les GoldsmithLike many of the ultra-secure phones that have come to market in the wake of Edward Snowden's leaks, the CryptoPhone 500, which is marketed in the U.S. by ESD America and built on top of an unassuming Samsung Galaxy SIII body, features high-powered encryption. Les Goldsmith, the CEO of ESD America, says the phone also runs a customized or "hardened" version of Android that removes 468 vulnerabilities that his engineering team team found in the stock installation of the OS.

His mobile security team also found that the version of the Android OS that comes standard on the Samsung Galaxy SIII leaks data to parts unknown 80-90 times every hour. That doesn't necessarily mean that the phone has been hacked, Goldmsith says, but the user can't know whether the data is beaming out from a particular app, the OS, or an illicit piece of spyware. His clients want real security and control over their device, and have the money to pay for it.

To show what the CryptoPhone can do that less expensive competitors cannot, he points me to a map that he and his customers have created, indicating 17 different phony cell towers known as “interceptors,” detected by the CryptoPhone 500 around the United States during the month of July alone. (The map below is from August.) Interceptors look to a typical phone like an ordinary tower. Once the phone connects with the interceptor, a variety of “over-the-air” attacks become possible, from eavesdropping on calls and texts to pushing spyware to the device.



August GSM Interceptor Map
ESD

“Interceptor use in the U.S. is much higher than people had anticipated,” Goldsmith says. “One of our customers took a road trip from Florida to North Carolina and he found 8 different interceptors on that trip. We even found one at South Point Casino in Las Vegas.”

Who is running these interceptors and what are they doing with the calls?
Who is running these interceptors and what are they doing with the calls? Goldsmith says we can’t be sure, but he has his suspicions.

“What we find suspicious is that a lot of these interceptors are right on top of U.S. military bases. So we begin to wonder – are some of them U.S. government interceptors? Or are some of them Chinese interceptors?” says Goldsmith. “Whose interceptor is it? Who are they, that's listening to calls around military bases? Is it just the U.S. military, or are they foreign governments doing it? The point is: we don't really know whose they are.”


Ciphering Disabled
Les Goldsmith

Interceptors vary widely in expense and sophistication – but in a nutshell, they are radio-equipped computers with software that can use arcane cellular network protocols and defeat the onboard encryption. Whether your phone uses Android or iOS, it also has a second operating system that runs on a part of the phone called a baseband processor. The baseband processor functions as a communications middleman between the phone’s main O.S. and the cell towers. And because chip manufacturers jealously guard details about the baseband O.S., it has been too challenging a target for garden-variety hackers.

“The baseband processor is one of the more difficult things to get into or even communicate with,” says Mathew Rowley, a senior security consultant at Matasano Security. “[That’s] because my computer doesn't speak 4G or GSM, and also all those protocols are encrypted. You have to buy special hardware to get in the air and pull down the waves and try to figure out what they mean. It's just pretty unrealistic for the general community.”

But for governments or other entities able to afford a price tag of “less than $100,000,” says Goldsmith, high-quality interceptors are quite realistic. Some interceptors are limited, only able to passively listen to either outgoing or incoming calls. But full-featured devices like the VME Dominator, available only to government agencies, can not only capture calls and texts, but even actively control the phone, sending out spoof texts, for example. Edward Snowden revealed that the N.S.A. is capable of an over-the-air attack that tells the phone to fake a shut-down while leaving the microphone running, turning the seemingly deactivated phone into a bug. Andvarious ethical hackers have demonstrated DIY interceptor projects, using a software programmable radio and the open-source base station software package OpenBTS – this creates a basic interceptor for less than $3,000. On August 11, the F.C.C. announced an investigation into the use of interceptors against Americans by foreign intelligence services and criminal gangs.

An “Over-the-Air” Attack Feels Like Nothing
Whenever he wants to test out his company’s ultra-secure smart phone against an interceptor, Goldsmith drives past a certain government facility in the Nevada desert. (To avoid the attention of the gun-toting counter-intelligence agents in black SUVs who patrol the surrounding roads, he won't identify the facility to Popular Science). He knows that someone at the facility is running an interceptor, which gives him a good way to test out the exotic “baseband firewall” on his phone. Though the baseband OS is a “black box” on other phones, inaccessible to manufacturers and app developers, patent-pending software allows the GSMK CryptoPhone 500 to monitor the baseband processor for suspicious activity.

So when Goldsmith and his team drove by the government facility in July, he also took a standard Samsung Galaxy S4 and an iPhone to serve as a control group for his own device.

”As we drove by, the iPhone showed no difference whatsoever. The Samsung Galaxy S4, the call went from 4G to 3G and back to 4G. The CryptoPhone lit up like a Christmas tree.”

Though the standard Apple and Android phones showed nothing wrong, the baseband firewall on the Cryptophone set off alerts showing that the phone’s encryption had been turned off, and that the cell tower had no name – a telltale sign of a rogue base station. Standard towers, run by say, Verizon or T-Mobile, will have a name, whereas interceptors often do not.

Some devices can not only capture calls and texts, but even actively control the phone and send spoof texts.

And the interceptor also forced the CryptoPhone from 4G down to 2G, a much older protocol that is easier to de-crypt in real-time. But the standard smart phones didn’t even show they’d experienced the same attack.

“If you've been intercepted, in some cases it might show at the top that you've been forced from 4G down to 2G. But a decent interceptor won't show that,” says Goldsmith. “It'll be set up to show you [falsely] that you're still on 4G. You'll think that you're on 4G, but you're actually being forced back to 2G.”

So Do I Need One?
Though Goldsmith won’t disclose sales figures or even a retail price for the GSMK CryptoPhone 500, he doesn’t dispute an MIT Technology Review article from this past spring reporting that he produces about 400 phones per week for $3,500 each. So should ordinary Americans skip some car payments to be able to afford to follow suit?

It depends on what level of security you expect, and who you might reasonably expect to be trying to listen in, says Oliver Day, who runs Securing Change, an organization that provides security services to non-profits.

“There's this thing in our industry called “threat modeling,” says Day. “One of the things you learn is that you have to have a realistic sense of your adversary. Who is my enemy? What skills does he have? What are my goals in terms of security?”

If you’re not realistically of interest to the U.S. government and you never leave the country, then the CryptoPhone is probably more protection than you need. Goldsmith says he sells a lot of phones to executives who do business in Asia. The aggressive, sophisticated hacking teams working for the People’s Liberation Army have targeted American trade secrets, as well as political dissidents.

Day, who has written a paper about undermining censorship software used by the Chinese government, recommends people in hostile communications environments watch what they say over the phone and buy disposable “burner” phones that can be used briefly and then discarded.

“I'm not bringing anything into China that I'm not willing to throw away on my return trip,” says Day.

Goldsmith warns that a “burner phone” strategy can be dangerous. If Day were to call another person on the Chinese government’s watch list, his burner phone’s number would be added to the watch list, and then the government would watch to see who else he called. The CryptoPhone 500, in addition to alerting the user whenever it’s under attack, can “hide in plain sight” when making phone calls. Though it does not use standard voice-over-IP or virtual private network security tools, the CryptoPhone can make calls using just a WI-FI connection -- it does not need an identifiable SIM card. When calling over the Internet, the phone appears to eavesdroppers as if it is just browsing the Internet.

San Francisco Becomes First U.S. City to Offer Encrypted Wi-Fi

What is it about this hot spot stretch that has Marc Touitou, San Francisco’s CIO, so excited?

 by John Sepulvado / June 11, 2014 0 

San Francisco CIO Marc Touitou

Marc Touitou is hopeful that what’s starting as a small Wi-Fi hot spot on Market Street in San Francisco will soon become the standard for cities around the world.

So what is it about this hotspot stretch that has Touitou, San Francisco’s CIO, so excited?

“It’s about you being safe in the street!” Touitou said with a huge smile in his voice. “With all the data breaches you have seen, it becomes increasingly important to protect our residents."
Touitou calls it Hotspot 2.0.

“Hotspot 2.0 is free Wi-Fi, but it’s encrypted,” Touitou said. “And San Francisco is the first city in the U.S., possibly in the world, to enable Hotspot 2.0.”

Since the introduction, Touitou says other cities have asked to partner with San Francisco to provide their residents with Hotspot 2.0 as well. Those cities include San Jose, Calif., and Melbourne, Australia.

Touitou describes these partnerships as agreeing to do the “handshake.”

“We have an existing relationship with the Australian government; [they] engaged us, they want to do the handshake,” Touitou said.
Joining SF Would be ‘Quick and Easy’
So what costs come with these handshakes? San Francisco Chief Technology Officer Flavio Aggio says the costs are minimal, if anything at all.

“We took a few developers and technicians to develop this with our partners, but it doesn’t cost anything for the partner cities,” Aggio said. “We need to get together technically, and we will need to get together on the security token, and that’s it.”

Hotspot 2.0 uses the same technology that banking companies do to let customers use online financial services. Aggio said users are sent a security token that registers their device, and continues to authenticate the device from that first point on.

“It works in a similar way to your client — when you have your computer connected to your bank, that gives you a lock to your computer connection,” Aggio said. “It’s called AES256 encryption. And if you are authenticated in San Francisco, you will get automatically authenticated in San Jose. This solves the problem so you don’t have multiple passwords – that is the secret of Hotspot 2.0.”

That technology is called Passpoint, and the city of San Francisco is optimistic it’s the future of free Wi-Fi, in part because it offers cities that join economic benefits.
Wired Cities Make More Money

Aggio says currently, only Market Street in San Francisco is offering Hotspot 2.0 in the city, but that the service will expand into San Francisco’s parks this summer.

Meanwhile, San Francisco is becoming the chosen home for many of Silicon Valley’s workers and executives. Yet, Touitou said the encrypted Wi-Fi isn’t being expanded through the city to help lure even more tech workers.

“We’re not doing this for economic reasons,” Touitou said. “We do it for the same reason we do high-capacity Wi-Fi. We’re doing it because we [want] to be first -- and because it’s fun!”

But Touitou does acknowledge that there are economic benefits that come by offering Wi-Fi and broadband services, especially services that are secure.

“We know [when] there is 20 percent of broadband penetration, you get a 1 percent growth in local GDP,” Touitou says. “It encourages people to have their tech companies here. And because of the train on security, everyone wants Wi-Fi, and everyone wants secure Wi-Fi.”

A 2013 research paper by the National League of Cities confirms the importance of being wired for economic growth. The paper urges American cities to develop innovative ways to keep wired access available, and even directs cities to look for federal grants to develop the Internet infrastructure.

“In 2011 the United States ranked 15th among 30 developed and developing nations in deploying broadband services,” the researchers state in the paper. ”This is a huge departure from where this country stood in the 1990s, when it was one of the leaders in providing broadband access.”

While Hotspot 2.0 isn’t universal broadband services, the city did mirror the steps outlined by the researchers to implement its Wi-Fi plan. That includes partnering with other cities, Touitou said.

“When the CIO of San Jose [contacted us], we decided to do a pilot – on Market Street -- and give the desire to other players to do the same,” he explained.

That partnership extends to companies as well: Corporate partners Global Reach and Ruckus Wireless worked with the city to provide Hotspot 2.0.
Touitou is hopeful that eventually New York City and maybe Boston will join the network as well. But for now, Touitou says San Francisco is looking forward to expanding Hotspot 2.0 into San Jose and Melbourne.

“It’s exciting, because we had that in the back of our minds, to always be pushing the envelope on the technology itself,” Touitou said. “Security is not new. But what we’re doing is.”