0

Which one in this chain should be blamed for not taking care of security: Phone manufacturers, GSM operators, SIM card manufacturers or OS systems (Android, iOS, etc..) to protect our phones from connecting to rogue GSM antennas? It seems so easy to get hacked, just attacker sets up a rogue tower and that's all.

6
  • 1
    Title question does not match the body question.
    – schroeder
    Feb 22 '19 at 11:37
  • 1
    I'm not sure how/why SIM card makers could become responsible
    – schroeder
    Feb 22 '19 at 11:37
  • @schroeder and who said, that Sim card makers should be responsible - I've just asked who should be. If i knew the answer, i didn't asked.
    – T.Todua
    Feb 22 '19 at 11:51
  • you suggested that they should be blamed ... that implies that you think they conceivably should be responsible for something.
    – schroeder
    Feb 22 '19 at 11:56
  • 1
    The telco industry simply didn't expect small board technology progress so fast , in which, miniature BTS can be build and hide inside traveler luggage or even a backpack. In addition, many new technology disruption also make the telco reluctant to invest money to "fix" the issue. I.e. for those whoe concern, they can always use encrypted VoIP to communicate (now you know why many country intelligent agency try to get the private key of various messenger app / VoIP services) .
    – mootmoot
    Feb 22 '19 at 13:06
4

International interoperability

Users - and thus also phone manufacturers and network operators - want the ability for phones to connect to all kinds of operators throughout the world. It's a clear benefit that if you take your phone, fly across the ocean, and turn it on - and it becomes able to receive and make calls. This means creating and using standards that enable the phone to negotiate a communications channel with any tower following the standard - including operators that were established after the phone was manufactured, including cell towers with technology generations later than when the phone was manufactured.

If I today launch a new cell operator in Wakanda, and put up generic tower hardware, then phones of visiting tourists should transparently connect to them, otherwise they'll be very unhappy that phones don't work in Wakanda. And the phone can't distinguish this scenario from me putting generic tower hardware next to your office. A global "whitelist" of operators would have technical challenges (how would an old non-smart phone w/o internet access know about my Wakanada operator that I launched yesterday?), and also require strong international cooperation, which is unlikely - for example, there are mobile operators running in disputed territories or conflict zones, where the local governments could prefer to "veto" them.

Internal roaming

An operator may be "renting" some towers from another operator - e.g. they want the phone to transparently connect to the other operator's tower. There also are virtual operators, who don't have any towers of their own, but they're paying tower operators for the provided service - and they want their phones to connect to all those towers where they have agreements. So phones connecting to towers not controlled by "your" operator is an important feature of the network that makes it work.

While you generally get notifications for international roaming, for this operators don't want you to get notified. One reason is that for branding reasons, the operator very much does not want users to know that they don't have direct coverage of that spot and you're actually using a competitors tower; the other is that in such cases simply driving down a highway would get you a dozen notifications as your phone repeatedly switches network cells.

Risk doesn't affect operators and manufacturers

Another aspect is that from the perspective of the operators and manufacturers, it's not a particularly relevant risk. It doesn't enable stealing of service or cause loss of revenue for the operators; doing so is illegal (regulated frequencies) so it's not going to be used by other companies to offer competing service; it doesn't easily enable fraud for commercial gain, so it's unlikely to be that frequently used by criminals to cause consumer backlash.

The most common abuse of fake towers is surveillance by law enforcement agencies, and the operators and manufacturers don't have a major reason to prevent that. Yes, there is also some risk to the users, but it's marginal enough to consider it as something that would be nice to fix, but not important enough to harm the (very important) interoperability while doing so.

2
  • thanks for the answers. My final thought is still that we are obviously hackable by anyone who has enough will and resource. We should have an option in Smartphones, to choose which GSM operators to whitelist, and even an option to turn on "notification" to confirm when GSM provider changes. Yes, we should have an option to enable it, even though it might be a bit annyoing. It should be our freedom to choose that option. So, I think OS creators should be blamed for not giving that feature.
    – T.Todua
    Feb 22 '19 at 12:21
  • @T.Todua I'm not certain (somebody with more experience in GSM tech should intervene) how the operator identification works for the case of tower rental or virtual operators. It may well be that this system requires the ability for a single tower to respond "yes, I'm company A" and also "yes, I'm company B" to make that interoperability work - if that's true (again, I'm not certain) then the phone couldn't possibly know if the tower is legitimately providing service on behalf of your operator (because your operator paid them to do so) or is maliciously claiming to do so.
    – Peteris
    Feb 22 '19 at 12:27
1

I would answer the the one that is to blame is the user - at least with decent phones and providers - and the phone manufacturer/phone provider.

Peteris has explained why by default a phone will try to connect on the first tower that will accept it. By on my old Android phone, I have found an option to lock the phone on one single network. It will not work if I travel abroad, or if I use a virtual provider, but it would be enough in my use case to forbid a connection to an unknown network.

Ok is it possible for a rogue tower to pretend being member of a well known network, and I do not not enough on the underlying protocol to know how exactly that kind of attack is possible.

But anyway, when travelling abroad I have alway been warned that the phone was about to connect to a different network.

Of course, at the OS/phone manufacturer level, it should be possible to whitelist a number of networks and forbid any automatic connection outside that range.

4
  • Why user has to be blamed, that is what i cant understand. How average user should take care of that? I wont blame user in this case.
    – T.Todua
    Feb 22 '19 at 14:23
  • @T.Todua: If you leave the door of you house unlocked, you are to be blamed. You know that you must not leave your phone unattended in a public place, you know that you must use an antivirus software on a PC and you are to blame if you do not. Marketing pretends that a smartphone is just a phone with some additional features, but it is not. It is a computer that is connected to open networks, and that additionaly can establish phone calls. It is ok to accept the risks because they are indeed low for the casual user, but only the user can set the security level that they require. Feb 22 '19 at 14:31
  • @oh come on Serge, i radically disagree and surely reckon you are not right. How you invent such scenarios that "in public place leave phone". We live in public areas, in work, and go there or here everytime. Should we stay in castle and never go out ? or all users should be high-tech-skilled to know the IT-threats? oh, i dont want to argue. sorry, but just i reckon that as pointless blame to user.
    – T.Todua
    Feb 22 '19 at 14:48
  • 1
    @T.Todua: I must acknowledge that I have overstated all that ;-). My intent was just to remind users that the security of their smartphone is their concern. It is no use complaining that the phone manufacturer, the OS creator and the provider do not care, even if it is true. The only one that can immediately act is the user. Feb 22 '19 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.