15

The police in Canada are saying that there is a new technique ("line-trapping") where the scammers told a lady to call the police to confirm some fraudulent details, but when she hung up and called the police, the scammers were still on the line and acted as the police. The article does not get into any technical detail.

I was unable to find anything technical about this scam online. Is this something specific to the York Police switchboard, or is it something potentially larger than this particular event? Is it even a real "new technology"?

https://www.cbc.ca/news/canada/ottawa/line-in-trapping-technology-1.5387822

6
  • 4
    "New" in general? No. On old landlines it was possible to do the same thing. On mobiles, this would be new. No technical details released yet. Please note that in the reports, this isn't "sniffing" or "listening to the call when another connection is made" or MITM. The callers keep the line open to them when the victim hangs up. The attackers simply acted like they were the police when the victim made another call.
    – schroeder
    Commented Jan 1, 2020 at 13:41
  • 2
    @schroeder: does anywhere said that this line trapping scam are happening on mobile? Reading through the various reports issued by the police, I can't find anywhere that suggest whether this is happening via landline or mobile, so unless there's other evidence, I'd suspect that this scam probably happens over the landline using the same old vulnerability?
    – Lie Ryan
    Commented Jan 2, 2020 at 0:37
  • @LieRyan I went through all the articles, and you are correct, nowhere do they mention what type of phone. All the articles use stock images of a cell phone.
    – schroeder
    Commented Jan 2, 2020 at 9:33
  • 1
    I got a response from the York Police directly. It's in my answer below.
    – schroeder
    Commented May 7 at 15:02
  • 1
    @BenoitEsnard lol no, I contacted them again yesterday.
    – schroeder
    Commented May 7 at 15:26

3 Answers 3

4
+25

Because there is no technical information, the below is pure speculation


I can think about 3 methods in which the attackers could have continued tapping the device and intercepting calls.

Method #1 - Ghost Cell Tower

Assuming that the attackers had physical proximity to the victim, there are tools that enable the interception of phone calls and other communications. some call them Ghost Cell towers, and the most known "solution" in the market is a stingray. The mobile device is always looking for the closest cell-tower, and by leveraging that inherent "vulnerability" it is possible to replicate the cell tower interaction with the mobile device to intercept the calls. It's quite widely used by law enforcement agencies including the US and Canada, and the attackers might have gotten their hands on such a device, intercept the call and continue the fraudulent activity even when the victim called the police.

Method #2 - Roaming Enforcement

A harder approach, but one that is also widely used by attackers. again an inherent "vulnerability" in the cell networks is the ability to send a request to a carrier to move a user to a different carrier for roaming (in example, if you are flying abroad and the phone immediately connects to a foreign carrier, but you are still billed by your local carrier for those calls / data usage). In recent years there were evidences of attackers gaining access to less secure carriers (e.g. in africa) and transmitting a roaming request for a victim, to intercept SMS OTP requests mostly for financial hacking (e.g. bank accounts). if the attackers had a grip over a third party carrier, they could roam the device to that carrier and for a small period of time be able to route phone calls or intercept SMS requests. To date I haven't heard of that method being used for phone calls, but mostly for SMS phishing / fraud. You can read more about those attacks in the great blackhat presentation by Hendrick Shmidt, Daniel Mende and Enno Ray

Method #3 - Attackers infected the victim's device

If the attackers had access to the device through a malware of any sort, they were probably able to alter the phone numbers for the "police line" or route calls. I didn't see the article suggest whether the victim had an android or an iphone device but for android it should be quite easy. there are companies that sell such technologies to enforcement agencies (e.g. NSO) and a similar tool might have found it's way to the attackers.

You can also read a bit more on GSM risks in this article by the GSMA: https://www.gsma.com/security/wp-content/uploads/2019/03/GSMA-Security-Threat-Landscape-31.1.19.pdf

1
  • I got a response from the York Police. It's in my answer.
    – schroeder
    Commented May 7 at 15:01
6

I contacted York Regional Police, who were the ones making the claim in 2019. This is what they said in an email to me today:

Through investigation it was determined that it was simply a case of number spoofing. The initial information provided to investigators was not accurate and no “line-trapping” took place. In reality the scam was similar to the warning we issued below.

https://www.yrp.ca/en/Modules/News/index.aspx?feedId=eec058e4-5b49-437f-89cd-d222d7465de7&page=3&newsId=1b91282f-11d6-44cd-b85a-be6d7669c095

The link is to simple caller-ID spoofing.

So, no "line trapping". No new tech. No new technique. A misunderstanding.

0
2

All I've seen is the same scant information, repeated on multiple sites. Those that cite a source cite one of the others, which say exactly the same thing.

The key element here is that, allegedly, ending a call doesn't kill the connection until a few minutes later. Somehow.
And that phone companies were working to cut that time.
Which all sounded like something from the era of landline phones, not mobiles.
No mention is made of the phones being compromised.

It's possible that:

  1. There's a misquotation: it's not true that it still works when YOU end the call, only when the scammer pretends to end it - "okbye, beeeeeeeeeep..."
  2. It's a deliberate hoax and way too many people believed it (unlikely, but the circular citations are a typical symptom)
  3. That explanation is a distraction from some OTHER vulnerability we're not supposed to know about
  4. It IS true, but the technical details won't go public until the problem is patched, to raise the entry barrier for OTHER criminals doing the same, and due to WEP-level shame.

[edit] According to @schroeder's answer, it turned out to be nonsense, after all :)

4
  • 2
    When the news first broke, I love the initial reports: "this is the first incident of its kind the department has heard of," -- so, how did they know about this? Were they speculating? "oh, it must have been some new tech..." So, I would add a more mundane explanation: someone with half of an idea speculated to someone else and it spun out of control
    – schroeder
    Commented May 6 at 14:46
  • 1
    And there is only the one instance ever reported
    – schroeder
    Commented May 6 at 14:51
  • 2
    I got a response from the York Police. It's in my answer.
    – schroeder
    Commented May 7 at 15:01
  • I had been thinking along the lines of the "scammer plays hangup sound and dial tone" scenario, too. But I have a hard time imagining my grandparents not reflexively pushing the hangup sensor. Glad to see it was indeed a hoax. Commented May 8 at 19:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .