Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think you meant the German-made Cryptophone 500, not Blackphone.

http://www.wired.com/2014/09/cryptophone-firewall-identifies...

I recently discovered an IMSI-catcher app on the F-droid market for Android. It's called Android IMSI-Catcher Detector and you can easily find it in the Security category if you filter by it in the app. For some reason, I can't browse for it on the site.

The project is in alpha stage and seems to be this one here:

https://github.com/SecUpwN/Android-IMSI-Catcher-Detector

There's also this paper on making IMSI-catcher detectors:

https://www.sba-research.org/wp-content/uploads/publications...

I hope to see more people working on this, though. In fact, I wish Google, Apple and Microsoft would add protections against IMSI-catchers by default in their mobile operating systems. After all it's already a known privacy issue affecting millions [1], and it seems not just in US either. They can't continue to pretend it doesn't exist anymore.

[1] - http://www.wired.com/2014/11/feds-motherfng-stingrays-mother...



There's another article (also in Norwegian): http://www.aftenposten.no/nyheter/iriks/Slik-oppdaget-Aftenp...

They spotted the (presence of) IMSI-catchers with a GSMK Cryptophone, apparently. I actually come to HN just now, to see if their product had been shredded, I mean carefully analysed, here earlier ;-)


Also, there are some phones that you can see diagnostics from the baseband:

https://github.com/2b-as/xgoldmon

"xgoldmon is a small tool to convert the messages output by the USB logging mode of phones with Intel/Infineon XGold baseband processor back to the GSM/UMTS radio messages sent over the air so you can watch them in e.g. Wireshark in realtime."

The idea here being that if you can see diag from these phones you can watch for suspicious things like zero length SMS and so on ...


Thanks for the collection of further literature.

I whish the network associations weren't undermined by the big five and wouldn't weaken their encryption standards to allow this.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: