Fake cell phone towers known as interceptors are spying on our conversations & texts

Like many of the ultra-secure phones that have come to market in the wake of Edward Snowden's leaks, the CryptoPhone 500, which is marketed in the U.S. by ESD America and built on top of an unassuming Samsung Galaxy SIII body, features high-powered encryption. Les Goldsmith, the CEO of ESD America, says the phone also runs a customized or "hardened" version of Android that removes 468 vulnerabilities that his engineering team team found in the stock installation of the OS.

His mobile security team also found that the version of the Android OS that comes standard on the Samsung Galaxy SIII leaks data to parts unknown 80-90 times every hour.  That doesn't necessarily mean that the phone has been hacked, Goldmsith says, but the user can't know whether the data is beaming out from a particular app, the OS, or an illicit piece of spyware.  His clients want real security and control over their device, and have the money to pay for it.

“At the same time, the firewall is monitoring every instruction coming into and out of the base station—and it’s showing you what baseband activity occurred but was not controlled by the operating system,” says Les Goldsmith, CEO of ESD America. For example, Goldsmith continues,”someone can send a message straight to your base station to operate the camera in your phone, and the firewall will show you that the camera has been actuated even though the user hasn’t pressed a button to do it.” To show what the CryptoPhone can do that less expensive competitors cannot, he points me to a map that he and his customers have created, indicating 17 different phony cell towers known as “interceptors,” detected by the CryptoPhone 500 around the United States during the month of July alone. (The map below is from August.)  Interceptors look to a typical phone like an ordinary tower.

 Once the phone connects with the interceptor, a variety of “over-the-air” attacks become possible, from eavesdropping on calls and texts to pushing spyware to the device. “Interceptor use in the U.S. is much higher than people had anticipated,” Goldsmith says.  “One of our customers took a road trip from Florida to North Carolina and he found 8 different interceptors on that trip.  We even found one in the vicinity of South Point Casino in Las Vegas.” Who is running these interceptors and what are they doing with the calls?  Goldsmith says we can’t be sure, but he has his suspicions. “What we find suspicious is that a lot of these interceptors are right on top of U.S. military bases.  So we begin to wonder – are some of them U.S. government interceptors?  Or are some of them Chinese interceptors?” says Goldsmith.  “Whose interceptor is it?  Who are they, that's listening to calls around military bases?  Is it just the U.S. military, or are they foreign governments doing it?  The point is: we don't really know whose they are.” Interceptors vary widely in expense and sophistication – but in a nutshell, they are radio-equipped computers with software that can use arcane cellular network protocols and defeat the onboard encryption.  Whether your phone uses Android or iOS, it also has a second operating system that runs on a part of the phone called a baseband processor.  The baseband processor functions as a communications middleman between the phone’s main O.S. and the cell towers.  And because chip manufacturers jealously guard details about the baseband O.S., it has been too challenging a target for garden-variety hackers. “The baseband processor is one of the more difficult things to get into or even communicate with,” says Mathew Rowley, a senior security consultant at Matasano Security.  “That’s because my computer doesn't speak 4G or GSM, and also all those protocols are encrypted.  You have to buy special hardware to get in the air and pull down the waves and try to figure out what they mean.  It's just pretty unrealistic for the general community.” But for governments or other entities able to afford a price tag of “less than $100,000,” says Goldsmith, high-quality interceptors are quite realistic.  Some interceptors are limited, only able to passively listen to either outgoing or incoming calls.  But full-featured devices like the VME Dominator, available only to government agencies, can not only capture calls and texts, but even actively control the phone, sending out spoof texts, for example.  Edward Snowden revealed that the NSA is capable of an over-the-air attack that tells the phone to fake a shut-down while leaving the microphone running, turning the seemingly deactivated phone into a bug. Whenever he wants to test out his company’s ultra-secure smart phone against an interceptor, Goldsmith drives past a certain government facility in the Nevada desert.  (To avoid the attention of the gun-toting counter-intelligence agents in black SUVs who patrol the surrounding roads, he won't identify the facility to Popular Science).  He knows that someone at the facility is running an interceptor, which gives him a good way to test out the exotic “baseband firewall” on his phone.  Though the baseband OS is a “black box” on other phones, inaccessible to manufacturers and app developers, patent-pending software allows the GSMK CryptoPhone 500 to monitor the baseband processor for suspicious activity.   So when Goldsmith and his team drove by the government facility in July, he also took a standard Samsung Galaxy S4 and an iPhone to serve as a control group for his own device. ”As we drove by, the iPhone showed no difference whatsoever.  The Samsung Galaxy S4, the call went from 4G to 3G and back to 4G.  The CryptoPhone lit up like a Christmas tree.” Though the standard Apple and Android phones showed nothing wrong, the baseband firewall on the Cryptophone set off alerts showing that the phone’s encryption had been turned off, and that the cell tower had no name – a telltale sign of a rogue base station.   Standard towers, run by say, Verizon or T-Mobile, will have a name, whereas interceptors often do not. And the interceptor also forced the CryptoPhone from 4G down to 2G, a much older protocol that is easier to de-crypt in real-time.  But the standard smart phones didn’t even show they’d experienced the same attack.   “If you've been intercepted, in some cases it might show at the top that you've been forced from 4G down to 2G.  But a decent interceptor won't show that,” says Goldsmith.  “It'll be set up to show you falsely that you're still on 4G.  You'll think that you're on 4G, but you're actually being forced back to 2G.” Some devices can not only capture calls and texts, but even actively control the phone and send spoof texts.http://www.popsci.com/article/technology/mysterious-phony-cell-towers-could-be-intercepting-your-calls
http://www.wired.com/2014/09/cryptophone-firewall-identifies-rogue-cell-towers/