2

This question already has an answer here:

Stingrays exploit a significant security vulnerability of cell phones: phones attempt to identify themselves to, and even worse, continue to use fake towers. Why not have towers authenticate themselves to phones, ideally before phones identify themselves to the towers? I'm imagining a protocol like this:

  1. the phone pings for towers
  2. a tower sends its public key to the phone signed by a trusted CA
  3. the phone encrypts a symmetric key with the tower's public key and sends it to the tower
  4. profit

Okay, maybe this specific protocol is less than ideal. But the point is, shouldn't there be some form of authentication that occurs before a phone identifies itself?

marked as duplicate by Lie Ryan, Community Aug 3 '17 at 15:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 4
    I think your question was based on incorrect premise. The mobile (or to be precise, the SIM card) do authenticate the cell tower when using modern cell network technology. Stingray works by forcing devices to drop to older cell network which doesn't do authentication properly. – Lie Ryan Aug 3 '17 at 14:41
  • @LieRyan You are right. The original question clarifies the misconception. – Solomonoff's Secret Aug 3 '17 at 15:37
  • I'm not sure how this is a duplicate - OP is asking about the existing authentication protocol and how that protocol relates/impacts stingray tech. They are trying to understand how their scenario lines up with that understanding. If anything, the question needs to be rephrased, but pointing the OP to the authentication protocol doesn't really answer the deeper question 'how is it flawed, and does my understanding of a possible authentication solution make sense?' – Ray Aug 3 '17 at 16:20
  • 1
    @Ray Technically you are right. The answer to this question, in light of the original, is that the attack Stingrays exploit is a downgrade attack and that any security provided within the protocol is moot. However it's close enough to the other question that I'm not sure it's worth anyone's time to keep this one open. – Solomonoff's Secret Aug 3 '17 at 17:40