3

I would like to know what ways there are (if any) to defend against Stingrays and similar interception if you are a mobile carrier and have full control of the base stations and SIM cards?

Can a SIM card be programmed to not downgrade to weak protocols (GSM/2G) or ciphers, or is it purely up to the phone and the SIM has no say in whether the phone switches to a less secure protocol?

Improve this question

1 Answer 1

Reset to default
2

Yes, acceptance of a specific crypto suite is up to the SIM/USIM application on the UICC smart card that is colloquially called "SIM card" these days.

Note, however, that categorically disabling weaker ciphers might inhibit roaming. Also note that carriers do usually stand under the influence of law enforcement - there might be very subtle political reasons for them to leave certain things unfixed, especially when it means that they don't have to get involved in surveiling someone themselves.

Improve this answer
5
  • There are exceptions. For example, the iPhone doesn't always obey all SIM configurations. It will silently disable encryption if commanded by the base station, in order to "just work" in countries that don't allow encryption. This was exploited by Kris Paget: youtube.com/watch?v=fQSu9cBaojc
    – John Deters
    Jan 20, 2017 at 14:22
  • @JohnDeters Don't have time to look into that right now, but it's really the SIM application that does all the baseband handshaking, so the iPhone can basically do anything; if the SIM doesn't want to play together with a network, it won't
    – Marcus Müller
    Jan 20, 2017 at 14:29
  • Marcus, yes, the SIM selects from its list only whatever protocols the local base station tells it is supported. What I was trying to say, poorly, is that the iPhone will silently fall back to an unencrypted protocol, even if the SIM has the flag set ordering the phone to "Warn the user about unsecure calls". I wasn't trying to say the iPhone manages the protocol negotiations.
    – John Deters
    Jan 20, 2017 at 16:17
  • @JohnDeters I wasn't even aware of such a flag! But anyway, that means that the SIM card would still be in charge of allowing that call
    – Marcus Müller
    Jan 20, 2017 at 17:12
  • Let's put it this way: the network asks the SIM which cipher suite are supported, then tells the SIM "hey, pick A5/0" (plaintext). At that point, the SIM can plainly deny. there might be no SIMs that do that – but it could.
    – Marcus Müller
    Jan 20, 2017 at 17:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .