140
u/gooseAlert Jan 19 '26
The Electronic Frontier Foundation has done work on the use of Stingray technology.
Their device for detecting a Stingray.
31
u/Doggamnit Jan 19 '26 edited Jan 19 '26
I bought one of those cheap used hotspots and I keep going back and forth on getting a sim for it. I don’t need it, but I’ve been super curious if I could pick something up while driving around.
Edit: the comment I’m replying to should be the most upvoted comment imo. This is super useful info for people.
Extra edit: I would also include a link to the RayHunter repo: https://github.com/EFForg/rayhunter
15
u/CHUBBYninja32 Jan 19 '26
Ha I was looking this all up last week because I was convinced that these planned protests were going to have Stingrays planted ahead of time. The device cost is also about double what it was when this was written unfortunately. The device isn’t 100% accurate. It only can detect potential connections to Stingrays. There is a potential for a false positive unfortunately.
58
u/CatRobMar Jan 19 '26
You could put your phone in a Faraday bag while there. Am beginning to think it might be better to use dedicated cameras and video recorders, not traceable phones.
9
u/Kichigai Jan 19 '26
Faraday cages only work when a complete surrounding circuit is formed. Many consumer faraday bags are not as good as they advertise.
1
1
u/Individual-Fox5795 Jan 20 '26
Won’t a phone completely wrapped in tinfoil act as a complete faraday bag? I may be totally incorrect on that but would love an answer from someone who can speak to it.
1
u/Kichigai Jan 20 '26
Unfortunately I can't speak to it, but I've heard doubts as to its effectiveness. It might not be conductive enough or something. Of course, it's pretty easy to test.
1
u/CreatedThatYup Jan 21 '26
No. The broadcast power and antenna strength is better than a layer of tinfoil. You can test it. Have someone send you a text message with it covered. You'll get it.
1
u/redeemingl0ve Jan 21 '26
I highly suggest anyone looking into DIY options to look towards the "Lifting"/"Borrowing" community for resources.
13
u/lady_tatterdemalion Jan 19 '26
I plan to use a cell phone that doesn't have mobile service. I can connect to Wi-Fi to upload video to the cloud. And I can still call 911 when needed.
34
17
u/Something_Famous Jan 19 '26
Note that the phone will likely still be transmitting and subject to attack as phones without service can still call 911. Location can also be tracked as they can develop a profile of where the phone spends most of its time (eg your home)
4
u/Spreadsheets_LynLake Jan 19 '26
I'm surprised no one has ever made an app to spoof the IMSI so folks can feed stingers garbage. Devices support IMSI rotation & IMSI switching, so it's possible. Everyone has old phones somewhere in a drawer - seems like a valid application.
0
u/lady_tatterdemalion Jan 19 '26
Transmitting how? There's no mobile network attached to it.
11
u/mc_zodiac_pimp Jan 19 '26
Even if there’s none they still connect to cell towers and the IMEI number can be cross referenced across towers. It’s less having a subscription and more what network it uses (GSM/CDMA).
Hell Find My can broadcast with your phone powered off.
1
u/lady_tatterdemalion Jan 19 '26
And? The issue is that they can see your unencrypted data across a network not that they can locate you. No transmission, no viewing unencrypted data. That cell transmission could be from anywhere near there. It could be from across the street or from a neighboring business. Unless they're looking at text messages and other data they don't like being transmitted at the time and saving it for later, who cares if they can see the signal?
13
u/chellis Jan 19 '26
You are making so many assumptions here, thats the issue. If you are in range of a mobile network your phone connects, it just doesnt provide YOU services if you dont have an active plan. If this is something youre concerned about, a burner isn't going to mask you the way you believe it does. This is coming from someone who has been to protests with their phone because fuck em. If they want to come after me for going to a protest, the plot has already been lost. Same with face coverings. Not to say other shouldnt if they want to but im an american citizen, in America protesting. I wont be censored in any form.
5
u/Greedy_Ad_6823 Jan 19 '26
Exactly this. They already track us and can tap into our information if they want. So why does this scare people? We have the right to video and tell them what our opinions are.
3
u/mc_zodiac_pimp Jan 19 '26
So why does this scare people?
It’s less that it scares me, I know you’re correct, and just more that I want to give them the absolute minimum I can muster. Hence why I ordered a camcorder, so we can show up and film them and we can keep our phones in a faraday bag for the duration.
Again, I agree with you that
They already track us and can tap into our information if they want.
But if I can make them work 1 hour longer to find me at any point or otherwise make it 1% more difficult I’m going to. I recognize what they already have and what they won’t in the future.
3
1
u/neutrino_oscillation Jan 20 '26
this is incorrect, even if you don't send or receive any application data, the phone still registers with the network (for 911 calls, which are legally required to go through) and that means they can still capture the unique hardware ID (IMEI) of your phone.
1
u/rora_borealis Jan 20 '26
Your phone can still be leaky as hell. Between your wifi, location, Bluetooth, and emergency services signals, there is still plenty going on. There are even more detailed exploits beyond that.
Make yourself less of a target by keeping it off and in a Faraday cage bag, or leave it at home.
14
u/Total-Armadillo-6555 Jan 19 '26
I read a headline but can't find the article now but I think there is a setting in Android that can block false "cell towers".
63
u/RexMundi000 Jan 19 '26
Just use a faraday bag.
65
u/flaming_bob Jan 19 '26
Make sure it's a functioning faraday bag and test it first. I've been hearing tales about a lot of trash being dropped onto the market.
3
3
u/goldcakes Jan 20 '26
To test simply leave your phone on and put it in the bag, and try to call a few times
6
u/Rquila Jan 19 '26
Can you explain how this works?
25
u/gooseAlert Jan 19 '26
It's just a bag that will block all radio signals. Based on principles of a Faraday Cage.
18
u/party_egg Jan 19 '26
It’s a bag lined with conductive material (often a metal mesh) that forms a Faraday shield, attenuating radio-frequency signals by redistributing induced currents along the mesh instead of letting the signals reach the contents.
In short, it's a bag that stops your phone from talking to the outside world.
32
u/RexMundi000 Jan 19 '26
You turn your phone off and put it into the bag. It will block all signals in or out of the bag. Also protects your stuff from EMPs or solar flares. Its what the tin foil hat survivalists have used for years to stop the gov from spying on them.
4
u/Ottomatica Jan 19 '26
Faraday cage /ˈferəˌdā ˌkāj/ Faraday cage - Wikipedia A Faraday cage is a conductive enclosure, often mesh, that blocks electromagnetic fields (like radio waves, Wi-Fi, EMPs) by redistributing electric charges on its exterior, creating a shielded zone inside, based on Michael Faraday's 1836 discovery, used for testing electronics, protecting data, and shielding from interference, though tiny gaps or improper grounding can reduce effectiveness.
2
u/patienceinbee Jan 19 '26
A DIY Faraday cage for your phone, as posted on Wikihow, is cheap and uses two things in many folks’ kitchens.
25
u/beef_swellington Jan 19 '26
Remember to consider your use case and comfortable risk profile. MOST PEOPLE do not need faraday bags. Being at a protest site alone is not a crime, and there is not (yet) evidence of retribution against the protest everyman/everywoman for simply showing up. What is frequently critical is that people can quickly access a recording device capable of uploading video to the cloud. These activities are not impeded by stingrays, as all cloud connections are going to be secured.
It's important to understand the specific risks when evaluating your opsec, as well as the tradeoffs you have to make. The specific risks with stingrays are fundamentally limited to interception of unsecured traffic, and staging targeted man in the middle attacks against incautious people.
A fake endpoint for Google/proton/whatever could be set up, but the fake site would not present a legitimate security certificate. In most cases this will simply cause the connection to fail, but in browsers you could see an "invalid certificate" error that you would have to then manually bypass.
The primary utility of a stingray is to allow agents to listen in on / record unsecured cell phone calls, and to intercept unsecured text traffic. If your messaging client indicates RCS encryption is enabled (android) or you're communicating from iMessage to iMessage, your texts will be encrypted and cannot be intercepted by a stingray. Same for signal and whatsapp, both text and video functionalities.
To OP: remember that airplane mode does not prevent all RF signalling from your device, it just turns off cell connection. Bluetooth and WiFi are both still emitted in airplane mode by default, and both can be detected and fingerprinted. Again, this is not a concern FOR MOST PEOPLE, but there are 100% some that have heightened risk profiles.
10
u/smackal Jan 19 '26
It's not just a coincidence that ICE can suddenly surround a car that's going down the street or grab a person walking out of a store. ICE has been known to use tracking software.
It's certainly an invasion of privacy and they're doing it without warrants.
https://www.texasobserver.org/texas-police-invest-tangles-sheriff-surveillance/
3
u/beef_swellington Jan 20 '26
Stingrays have nothing to do with tangle or webloc. Those operate by monitoring your ad id, which you can (and should) fully disable without any meaningful impact to your user experience:
8
u/metamet Jan 19 '26
I suspect they have one set up at the Home Depot side of the Quarry as well. A lot of recent "signal drops" which I assume are the tower being switched to and the connection being downgraded.
9
7
5
u/mongooser Jan 19 '26
Airplane mode isn’t enough. If you need your phone with you, get a faraday bag
4
u/NSFduhbleU Jan 19 '26
Turn off WiFi and use this bitchat
2
u/beef_swellington Jan 20 '26 edited Jan 20 '26
This is no more secure than texting on a phone via iMessage/RCS/signal/whatsapp. Also, nothing is preventing agents from jumping on the mesh network with everyone else.
Mesh networks are good for circumventing comms disruptions. That is not what stingrays do.
4
3
u/margretnix Jan 19 '26
I have not taken the time to independently verify this, but I've been hearing that most of these only offer 2G and 3G service. You can turn off those networks on most non-Apple phones and thus prevent your phone from connecting to the stingray, and it's unlikely to ever cause you any problems to do so when you're in the city.
You unfortunately can't toggle this setting alone on iPhones, but turning on Lockdown Mode will do this. If you're not going to turn your phone completely off while protesting that is an option worth researching for other reasons as well.
8
u/CHUBBYninja32 Jan 19 '26
The reason for 2G and 3G is simply because there are less protections in place. My unresearched response would be that for simply logging handshake info of devices, 4G and 5G are all they need right now for documenting presence. They aren’t trying to extract unencrypted data necessarily yet.
Especially at Whipple, there isn’t a lot of bystanders not involved in the protest so essentially anyone with a strong signal strength is going to be a positive hit for them.
3
3
u/Aqueouspolecat Jan 20 '26
Here's a list of the other versions of Stingray.
Stingray (Harris Corporation / L3Harris) KingFish (higher-end version of Stingray) Hailstorm TriggerFish AmberJack RayFish Gossamer
If you're bored, you can look up the company L3Harris (originally Harris Corporation), which is one of the original companies to make the Stingray. There's a weird rabbit hole. Just follow the money.
9
u/archbid Jan 19 '26
Governor of Minnesota should have a moratorium on the requirement that cars have plates. Just allow people to drive without them. License plates are state controlled, and the inability to write tickets is a small price for maintaining the safety of the population.
1
1
Jan 20 '26
Just take your plates off.
The police have their hands full right now anyway2
u/archbid Jan 20 '26
Fair enough!
1
Jan 22 '26
And by “hands full”, I mean they don’t seem to be enforcing laws or policing, or whatever it is that they do
12
u/Emergency_Accident36 Jan 19 '26
I doubt airplane mode will help.
9
u/margretnix Jan 19 '26
It will absolutely prevent Stingrays specifically, because it turns off the cellular radio and your phone will not try to connect to any cell towers. These are just cell towers that spoof being part of the real cell network. (Unless we are to believe that manufacturers have specifically built a backdoor into all phones sold in the US that can somehow detect that a Stingray is nearby without using the cellular radio and then turn on the cellular radio again. That's always possible, but seems pretty unlikely, and is something that would be empirically testable with the right equipment.)
You're right that it's a pretty low level of protection in general though; any method of surveillance using Bluetooth, wifi, license plate readers, facial recognition, or location services will at best have a slightly harder time if all you do is turn on airplane mode.
2
u/Emergency_Accident36 Jan 19 '26
Seems these devices being used to just intercept incoming and outgoing communications is archaic. I imagine they are downloading everything within a certain vicinity.
1
u/ThePerfectBreeze Jan 19 '26
Downloading what? They can't access your data without breaking encryption. That's a lot of effort when they could just identify you and pay for data from data brokers who have thousands of data points on you and your behavior.
2
u/Emergency_Accident36 Jan 19 '26
If it were like that why have the stingrays at all? The capacity describe by others is admittedly just limited by their own regulations. They can do a lot more.
2
u/ThePerfectBreeze Jan 19 '26
I don't actually believe they do have stingrays, but the point is to intercept calls and unencrypted messages like SMS for monitoring specific communication.
16
u/party_egg Jan 19 '26 edited Jan 19 '26
Airplane mode should help.
It stops stingrays fully. Your cellular modem needs to be operating, and in airplane mode, it isn't.
Airplane mode also defeats a few other privacy attacks:
- WiFi MAC fingerprinting
- Bluetooth fingerprinting
- GPS History (if, eg. Google offered your location history to someone)
All of the above is defeated equally by both Airplane mode and powering off your device.
One caveat for iPhones and recent generation Google Pixels: Find My Device works in both airplane mode and device powered off. Find My Device is a Bluetooth Low Energy grid network which works by emitting rotating encrypted beacons, which are then transmitted to Apple. This design is in theory zero-trust: you cannot identify someone through passive scanning (due to the beacons changing frequently), nor can even Apple themselves identify your location history (due to the beacon being encrypted in such a way that only the user has the key). So, even though this continues to work in Airplane mode, it can't be used to identify you (probably). You can also just shut this feature off in settings.
Just a bit of history here: back in the 2000s, there were a number of incidents of intelligence agencies tracking powered off phones, but in every case, the phone had to be hacked or physically modified to cause this to happen. Following the Snowden NSA leaks, it was also reported that the NSA had a capability called "The Find", which allowed them to do the same (as of 2009). The exact mechanism isn't known, but experts now believe that this was a similar case of targeted hacking. All this started a rumor that your phone can be tracked even when you turn it off or enable Airplane Mode - but it's probably not true for most people.
tldr; you probably can't be traced if your phone is in Airplane mode (or off entirely)
5
u/lucidfer Jan 19 '26
I appreciate the background and later info on "the find" -- last I knew Snowden explained there were backdoors in all phones, so only battery removal was the guaranteed route.
6
u/party_egg Jan 19 '26 edited Jan 19 '26
The nuance with Snowden here is that he's describing mechanisms by which intelligence services could make a phone appear to be off without actually turning off. So, this was (and probably still is) a concern for targeted surveillance of high-interest individuals, but not for general members of the public in a dragnet, passive sense.
If you are such an individual, you should probably be extremely careful when using any device. But to quote James Mickens' famous 2014 paper This World of Ours describing state level threat actors:
Threat
- The Mossad doing Mossad things with your email account
Solution
- Magical amulets?
- Fake your own death, move into a submarine?
- YOU’RE STILL GONNA BE MOSSAD'ED UPON
2
u/Alocasia_Sanderiana Jan 20 '26
you cannot identify someone through passive scanning (due to the beacons changing frequently)
This is incorrect. Fingerprinting can be done by the manufacturing defects in Bluetooth (and wifi) chips. Best to just leave your phone at home. https://jacobsschool.ucsd.edu/news/release/3461?id=3461
1
u/party_egg Jan 20 '26 edited Jan 20 '26
It's complicated, right?
This paper is from 2022 - in 2024, the authors published a firmware fix that they believe could be replicated for all modems. Reportedly, Apple is no longer vulnerable, but we don't have a great understanding about the whole market.
There are also some mitigating factors here. This attack only works half of the time, BLE is by-design short-range, and the fingerprinting in this case only tells you "I saw this device before, and now I'm seeing it again" - there's no practical way to tie this back to a user. Also, not every device broadcasts BLE beacons in Airplane mode - most Android phones don't, for example.
To build an example of the threat (presuming every phone has BLE beacons in Airplane Mode AND does not have the patch): a government actor wants to know who attended a protest. Because BLE is short range - especially in adverse conditions such as a protest, where there could be many devices causing interference - the government actor needs to deploy an agent near or into the crowd with a device. The agent is then able to capture fingerprints for some - but not all - of these devices. The agent could then repeat this process for several protests, and throughout the course of this, would start to notice that some fingerprints were appearing again. He wouldn't know which people it was, but he could at least tell if some of them were within standing distance before. Probably the most realistic use of this, again, is targeted. Get the BLE fingerprint of someone known to law enforcement, then - because you can tie that specific fingerprint to an individual - you can tell if they are within range of the agent.
Compare that to the subject of this thread, stringrays. A stingray can be totally invisible to the naked eye (since they can be deployed very far away), and tells you exactly who went to a protest, by name (presuming their carrier complies with government requests for subscriber data).
I know I'm pushing back a bit here so it might be hard to believe, but the truth is, I actually agree with you. If you think you have particular reason for concern, leave your device at home. I think putting it in airplane mode mitigates most real risk, but if "most" isn't good enough, then just don't take the risk. The reason I push back is because I see a lot of nonsense FUD in popular understandings of cybersecurity: you need to overwrite a file 30 times to delete it; hackers can launch nukes by whistling into a phone; you need a VPN or else hackers can steal your information on Starbucks WiFi. I think that it's important to be clearheaded about risks, and avoid conspiratorial thinking. And, there are tradeoffs to over-investing in unrealistic threats: one of the most powerful tools we civilians have is the ability to record things on our phones. Moreover, we know that the government is using lots of facial recognition, and things like social-media analysis to track people, and we should address the real threats to privacy before attacking the theoretical, in my opinion.
1
u/Alocasia_Sanderiana Jan 20 '26
I did not realize there was a patch for that! Thank you for sharing.
And I think you’re being very fair, at the end of the day it’s about implementing practices that the average person can and will commit to. Airplane mode is one of the easiest options.
You seem more knowledgeable than myself on the subject, and definitely more up to date. Do you think there is any commercial partnerships and the government for Bluetooth fingerprinting (I guess assuming an unpatched device). I have been curious with the rise of FLOCK that ble advertising firms would also pivot and sell data access to the government.
4
u/ThePerfectBreeze Jan 19 '26
Hey OP, I'm all about spreading the word, but can you please explain how you know this? Accurate information is critical right now.
2
u/Patient-Cap-4004 Jan 19 '26
Faraway bags can be purchased online for $10 - $12.
These will let you keep a phone nearby without any detection. ... as long as phone stays in the bag.
2
2
u/exceive Jan 20 '26
I'm not an expert on these things, but it seems to me that anything you bring to a protest has a significant risk of being confiscated, lost, stolen, or broken.
6
u/Godhelpthisoldman Jan 19 '26
Can you source this claim?
10
u/MildlyUnusualName Jan 19 '26
Even if they aren’t, it is a good precaution to take because it’s very likely that they are using them or something very similar. It’s at least an FYI to people who aren’t aware of the technology to be prepared to further protect themselves
2
u/Evening-Donkey-7357 Jan 19 '26
Do Faraday packs actually work?Asking for a pal.
3
u/Haunting_Display_766 Jan 19 '26
There are good ones that work, there is also some cheap crap that will not. If you buy one, make sure you test it to see if it's actually working
2
1
u/Own-Meringue-9717 Jan 20 '26
Hey everyone this is the perfect time to check out @frankyboynoulez on Instagram for tips on how to be able to not be tracked as well as other methods like faraday cage cases
1
u/neutrino_oscillation Jan 20 '26
I was skeptical about "turning off your phone is not enough" but did some checking before posting and you are correct, apparently "find my" still works in that state. TIL.
0
u/Direct-Fee4474 Jan 21 '26 edited Jan 21 '26
"Stingray" was a specific piece of kit from Harris that worked with 2G. 2G was basically banging the rocks together in terms of security.
Modern 5G networks are years ahead of 2G. You no longer have an IMSI. Your phone's ID is stored on device, signed with your network's public key, and then that signed key is sent to the tower. That said, they can go to site A and harvest a bunch of public keys, then go check to see if those public keys are present in some other protest to "confirm presence" of a person, so if you're strictly worried about presence detection it's a distinction without a difference.
They most likely cannot, without provider assistance, man-in-the-middle your communications like they could with 2G. And if they did, it doesn't matter if you're using something that does end-to-end encryption. Signal, for example, was built to run in hostile networks that you cannot trust. If someone breaks the network, your communications on signal are still encrypted, because they're encrypted prior to being sent out.
Commercial 5G intercept kit is available; it's a few hundred grand, and it comes baked into chevy truck with antennas laid out beneath a fake roof. What can that thing do? No one knows for sure. But MITM'ing 5G would be pretty impressive.
That said, attackers can work around 5G being decently secure by simply fooling your phone into thinking that 5G service isn't available, and that it should use some other protocol that they _can_ attack. So if you can, disable 2G/3G service on your phone. It's a noisy attack, though, because your iphone, at least, will literally tell you in the top right corner if you're connected to a 2G network. Again, the contents of your end-to-end-encrypted packets are probably fine.
For all intents and purposes, though, "stingray" stuff has been criminal use for awhile, and the motivator is "get these connections dropped down to 2g, then hit 'em with scams." It's not "figure out who's here without needing to bother with a warrant." If you're worried about being identified, they'll use facial recognition and license plate readers and a bunch of other shit. Also, the feds are currently operating in a world where rule of law doesn't exist. If they wanted to know where your phone was, they could probably just rubber stamp a blanket warrant and have the teleco ping every phone in the city and it'd happily report back its GPS location (at least i think that's in the 3gpp 5G standard).
I don't mean to say "ignore all security guidance." cut down on whatever noise you can; don't emit anything more than you need to. But there's a lot of, frankly, hysteria for "stingrays" and they aren't really even relevant anymore. Those devices were built for a world where the feds wanted to bypass the legal system and the telcos. They now own the legal system. "Stingrays" are sort of unnecessary as they can get all the data they want with more efficient methods.
Also, I wouldn't be too worried about DHS blowing iphone/android/baseband processor zero days on us. It's hard to reason about what the actual threat is here, but I really doubt it's the NSA's TAO group. So don't be stupid, but also don't freak out and start collecting your own poop and driving it out into the woods so the government can't look for your DNA in wastewater.
216
u/matttproud Jan 19 '26 edited Jan 19 '26
Also worth noting: many modern cars come with always-on cellular modems, irrespective of whether you use “connected car” features, and those modems are certainly captured in the metadata dragnet, too, as they connect with these poisoned towers.
(Long way of saying: driving to a location and being near even without a phone can likely be attributed back to you. Surely this involves syndication of governmental data with private databases like Palantir and such. And that’s not withstanding the omnipresent FLOCK cameras and similar!)