12

The police in Canada are saying that there is a new technique ("line-trapping") where the scammers told a lady to call the police to confirm some fraudulent details, but when she hung up and called the police, the scammers were still on the line and acted as the police. The article does not get into any technical detail.

I was unable to find anything technical about this scam online. Is this something specific to the York Police switchboard, or is it something potentially larger than this particular event? Is it even a real "new technology"?

https://www.cbc.ca/news/canada/ottawa/line-in-trapping-technology-1.5387822

Improve this question
6
  • @jhon details are in the various reports on the incident
    – schroeder ♦
    Jan 1, 2020 at 13:39
  • 4
    "New" in general? No. On old landlines it was possible to do the same thing. On mobiles, this would be new. No technical details released yet. Please note that in the reports, this isn't "sniffing" or "listening to the call when another connection is made" or MITM. The callers keep the line open to them when the victim hangs up. The attackers simply acted like they were the police when the victim made another call.
    – schroeder ♦
    Jan 1, 2020 at 13:41
  • 1
    @schroeder: does anywhere said that this line trapping scam are happening on mobile? Reading through the various reports issued by the police, I can't find anywhere that suggest whether this is happening via landline or mobile, so unless there's other evidence, I'd suspect that this scam probably happens over the landline using the same old vulnerability?
    – Lie Ryan
    Jan 2, 2020 at 0:37
  • @LieRyan I went through all the articles, and you are correct, nowhere do they mention what type of phone. All the articles use stock images of a cell phone.
    – schroeder ♦
    Jan 2, 2020 at 9:33
  • 1
    I'm contacting York Regional Police to get an update.
    – schroeder ♦
    Jan 2, 2020 at 9:43

1 Answer 1

Reset to default
2
+25

Because there is no technical information, the below is pure speculation

I can think about 3 methods in which the attackers could have continued tapping the device and intercepting calls.

Method #1 - Ghost Cell Tower

Assuming that the attackers had physical proximity to the victim, there are tools that enable the interception of phone calls and other communications. some call them Ghost Cell towers, and the most known "solution" in the market is a stingray. The mobile device is always looking for the closest cell-tower, and by leveraging that inherent "vulnerability" it is possible to replicate the cell tower interaction with the mobile device to intercept the calls. It's quite widely used by law enforcement agencies including the US and Canada, and the attackers might have gotten their hands on such a device, intercept the call and continue the fraudulent activity even when the victim called the police.

Method #2 - Roaming Enforcement

A harder approach, but one that is also widely used by attackers. again an inherent "vulnerability" in the cell networks is the ability to send a request to a carrier to move a user to a different carrier for roaming (in example, if you are flying abroad and the phone immediately connects to a foreign carrier, but you are still billed by your local carrier for those calls / data usage). In recent years there were evidences of attackers gaining access to less secure carriers (e.g. in africa) and transmitting a roaming request for a victim, to intercept SMS OTP requests mostly for financial hacking (e.g. bank accounts). if the attackers had a grip over a third party carrier, they could roam the device to that carrier and for a small period of time be able to route phone calls or intercept SMS requests. To date I haven't heard of that method being used for phone calls, but mostly for SMS phishing / fraud. You can read more about those attacks in the great blackhat presentation by Hendrick Shmidt, Daniel Mende and Enno Ray

Method #3 - Attackers infected the victim's device

If the attackers had access to the device through a malware of any sort, they were probably able to alter the phone numbers for the "police line" or route calls. I didn't see the article suggest whether the victim had an android or an iphone device but for android it should be quite easy. there are companies that sell such technologies to enforcement agencies (e.g. NSO) and a similar tool might have found it's way to the attackers.

You can also read a bit more on GSM risks in this article by the GSMA: https://www.gsma.com/security/wp-content/uploads/2019/03/GSMA-Security-Threat-Landscape-31.1.19.pdf

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .