An IMSI-catcher is a device that intercepts mobile phone communications, acting as a fake cell tower to eavesdrop on calls and track location data. It’s essentially a “man-in-the-middle” attack, placing the device between the target phone and the real cell network. While some security measures exist in newer standards (like 3G), sophisticated attacks can bypass these, especially on older networks. These devices, like the StingRay, are used by law enforcement and intelligence agencies, but their use raises privacy and civil liberty concerns. 

IMSI catchers: a security threat

IMSI catchers, sometimes referred to as cell-site simulators or fake cell towers, can be difficult to detect since they imitate real cell towers to capture mobile phone data. With proper cybersecurity testing measures, you can effectively be alert to these unwanted interceptions. Take a look at these common tools and methods that can efficiently assist in identifying IMSI catchers:

Top Techniques and Resources to Detect IMSI Catchers

1. Use Mobile Apps and Tools

Some apps and technologies are designed to monitor and detect irregularities in cell networks.

SnoopSnitch (Android): This app analyses your phone’s network traffic and alerts you of strange cell tower behaviour. It requires access to low-level network data, which is mostly limited to particular Android phones equipped with Qualcomm chipsets.

Cell Spy Catcher (Android): After starting the learning process of this app, it collects data on local networks to identify which one among them is a trap. Then it alerts you with a red interface screen.
AIMSICD (Android): Detects IMSI catchers and reports on odd network activity, such as quick cell tower changes or downgrades to earlier network technologies (such as 2G). Phones switching to older network technologies usually happen due to IMSI catchers.

Croatian Telecom’s AntiSpy (Android/iOS): An app that uses radio signal analysis to determine when your phone connects to a rogue cell tower.

Apple’s limitations on low-level network data access have led to a decrease in the number of apps accessible for iOS; however, network abnormalities can occasionally be found by keeping an eye on variations in signals.

2. Look for Unusual Network Activity

IMSI catchers can force phones to connect to low-security older networks (2G or 3G) to facilitate communication interceptions. Look out for:

Downgraded connection: Your phone may unexpectedly switch from 4G/5G to 2G/3G or lose high-speed internet connection. Specifically, if it happens in an area that has outstanding coverage, it could be due to an IMSI catcher.

Frequent disconnections: When an IMSI catcher is nearby, your phone might keep on disconnecting and reconnecting with the network.

Suspicious network names: IMSI catchers can also broadcast non-standard or dubious network IDs. For example, a tower with an unusual name or ID might be a fake one.

3. Observe Battery and Signal Behaviour

IMSI catchers compel gadgets to transmit at faster speeds and consume more power.

Rapid battery drain: If the battery on your phone runs out more quickly than usual, it can be because it’s transferring an unusual amount of data to a fake tower.

Unusual signal intensity: An IMSI catcher may be indicated by abrupt, inexplicable changes in signal strength or highly fluctuating signal bars. Strong signals can be sent by these devices to overpower authorised cell towers.

4. Monitoring Tools for Experts

Advanced phone users with proper cybersecurity knowledge can utilise monitoring software or equipment to analyse cellular networks themselves.

Software-defined radios (SDRs): SDR devices enable users to identify and analyse mobile phone signals. By identifying aberrant radio frequencies and patterns, an SDR can aid in the detection of IMSI catchers if used with the appropriate software.

Cellular anomaly detectors: These are sophisticated technologies used by security experts and researchers that monitor local signals. These help detect abnormal cell tower behaviour that is essential in the current rise of data breaches, unexpected cyber attacks, or traffic demand in Australia.

5. Network Data Monitoring

Certified cyber security consultants in Australia suggest users to monitor network data. This includes the phone’s network logs like signal strength, base station ID, and encryption status that certain apps or customised firmware can access. Keeping an eye on this data can help determine when the phone connects to a dubious tower that may have less secure encryption or an unidentified ID.

6. Physical Indicators

IMSI catchers are usually non-stationary and can be implanted on vehicles or drones. So if you observe any strange and unknown vehicles or equipment within your local area and your phone network falters near it, it could be a clue.

7. Use Encrypted Communication

If you are wary of an IMSI catcher but are tech savvy or cannot locate it, resolve to the simple methods of using end-to-end encrypted apps. Switch to apps like WhatsApp, Signal, or Telegram for calls and texts for that while. These platforms prevent intercepted communications from being decoded, even if you do not know how to use tools for detecting IMSI catcher.

Limitations

False positives: Certain apps, software, or devices may identify normal network issues as suspicious.

Limited detection on iPhones: iOS restricts access to low-level radio data, making it more difficult to operate apps that monitor cellular networks. source

With $20 of Gear from Amazon, Nearly Anyone Can Make This IMSI-Catcher in 30 Minutes

With some dirt cheap tech I bought from Amazon and 30-minutes of set-up time, I was streaming sensitive information from phones all around me. IMSIs, the unique identifier given to each SIM card, can be used to confirm whether someone is in a particular area. They can also be used as part of another attack to take over a person’s phone number and redirect their text messages. Obtaining this information was incredibly easy, even for a non-expert.

This attack isn’t revolutionary in any way—IMSI-catchers are certainly not new, and have become famous because they are commonly (and controversially) used by law enforcement to track suspected criminals. A commercial version made by Harris is called a “Stingray,” and they are sometimes called “cell-site simulators” or “fake cell towers.” This is because they spoof a cell phone tower’s connection, meaning that cell phones in the area will try to connect to it; in doing so, the IMSI-catcher is able to passively collect information about phones in the area.

Harris’s Stingray was so secretive that, for years, the FBI dropped criminal court cases that used Stingrays rather than reveal the details of how the evidence was gathered.

But a DIY IMSI catcher is relatively trivial to setup, and the technology is accessible to anyone with a cheap laptop, $20 of gear, and, the ability to essentially copy and paste some commands into a computer terminal. This is about ease of access; a lower barrier of technical entry. In a similar way to so-called spouseware—malware used by abusive partners—surveillance takes on different character when it trickles down to more ordinary, everyday users. The significance and threat from IMSI-catchers is multiplied when a lot more people can deploy one.

Got a tip? You can contact Joseph Cox securely on Signal on +44 20 8133 5190, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

For legal and technical reasons, our IMSI-catcher did not intercept text messages or phone calls, like more powerful versions can. It only captured IMSIs from devices, as well as provides some additional information such as the country and telecom operator of the phone. Motherboard did not store any of the collected data. You should be aware of the laws in your local region before attempting to do this; Motherboard does not condone or suggest you do anything illegal (and, even if legal, you shouldn’t use an IMSI catcher to do anything creepy.)

We’ll explain what each of these are, but in short, the process was:

• Buy a cheap, software defined radio
• Install Ubuntu
• Download IMSI-catcher script with its dependencies
• Find the right frequency to scan for
• Start scanning on that frequency and picking up IMSIs

As the name implies, a software defined radio, or SDR, is simply a radio that instead of having its feature baked in at a hardware level, can be controlled by a computer program. We bought the ‘NooElec NESDR Mini’ from Amazon for around $20 and received it a few days later.

To get the SDR to talk to phones, I needed to give it some instructions. Fortunately, I didn’t need to write my own, but just take some code from GitHub. I used a Python tool simply called ‘IMSI-catcher’, written by the hacker known as Oros42. The program requires an up-to-date version of Ubuntu, a particular Linux distribution, that can be downloaded for free and written either to a USB stick or installed inside a virtual machine.

To install the IMSI-catcher software, I just followed the instructions on the project’s GitHub.

Once installed, I booted up grgsm_livemon, one of the programs included with the project. which presented a slider and a graph, to find a frequency to scan. This required a bit of trial and error—moving the frequency slider until finding a sweet spot where the graph represented a bell curve. The curve meant that the SDR had found what frequency nearby phones were broadcasting on. Depending on where you are, that frequency is going to be different.

Once I found the sweet spot, after a few seconds IMSIs started appearing on my screen.

If I wanted to make the IMSI-catcher a bit more portable, I could theoretically run it on a Raspberry-Pi, a miniature computer you can buy for as little as $30 or cheaper, depending on what model you need. Note that the IMSI-catcher would still need to have Ubuntu on the Pi, which it is not traditionally designed for, but it is likely possible. I would also need to make sure the SDR is receiving enough power from the USB port.

In all, the process of making an IMSI-catcher didn’t take much time at all, as I thankfully didn’t hit any roadblocks. I just made sure I had the latest version of Ubuntu, followed the instructions carefully, and ended up with an IMSI-catcher on my laptop. source

Oros42/IMSI-catcher DOWNLOAD HERE iMSI CATHER SOFTWARE AND BUILD YOUR OWN! TO OF COURSE SOLVE SECURITY FLAWS IN YOUR OWN SYSTEM ONLY 

CellularPrivacy/Android-IMSI-Catcher-Detector DOWNLOAD HERE IMSI CATHER SOFTWARE AND BUILD YOUR OWN! TO OF COURSE SOLVE SECURITY FLAWS IN YOUR OWN SYSTEM ONLY 

Gotta Catch ‘Em All: Understanding How IMSI-Catchers Exploit Cell Networks

Downloads

 Gotta Catch ‘Em All

source

One of the good things about working in the area of core network security, is the opportunity to find new and unexpected types of attacks. These are attacks you didn’t even know could happen, much less have a chance to prevent. Finding these unexpected attacks doesn’t just happen though, it requires experience and investigation, but most importantly it needs the mindset to dig deeper into any strange events that are encountered, and try to understand them, rather than just assuming they are random malicious events.

In this particular case, we are discussing IMSI Catchers. First off, the term IMSI catcher is a misused and sometimes contradictory term however. As explained here, there are actually 2 types of equipment that those in the public (and many in the industry) would conflate into what they would call IMSI catchers.

• ‘Active’ IMSI Catchers, also termed Cell Site Simulators (CSS) or Fake Base Stations – these attempt to force local devices to connect to a Call Site Simulator, in order to decrypt the conversation and texts, and to execute man in the middle interception. These would be considered the more ‘traditional’ type of IMSI catchers most would be aware of. Stingrays are also a common term used for these (named after the brand built by Harris Corporation). A good overview of how the Active IMSI /Cell Site Simulators work is here.
• Passive IMSI Catchers – these passively listen into the paging of mobile devices as they move and register to new real Cell towers in the local area, in order to get the IMSI numbers of these devices. They are far less precise, and are unable to do any of the more sophisticated type of interception, but involve no interaction between the mobile device and the IMSI Catcher. An overview of how these could work, and how they function is here.

The primary difference between these two is that the more traditional Active IMSI Catcher/CSSs always involves some form of interaction with the mobile device, whereas the Passive IMSI Catcher doesn’t – it literally just listens in to the paging that occurs in the local areas as the mobile device changes between legitimate cell towers in the vicinity. This makes a big difference when it comes to detection of these IMSI Catcher types.

A lot of research has gone into various ways of detecting Active IMSI Catchers, by looking at how they differ from real Cell towers. One distinctive example of what an Active IMSI Catcher might do is the forced downgrading of their target mobile device to use a less secure radio interface. This detection of an Active IMSI Catchers can be difficult, involves a lot of local measurements and often can and has in the past led to false positives, but it gives some results. From the attacker’s perspective it’s also a trade-off in that they must make the effort to physically deploy an Active IMSI Catchers in a sensitive area, and then hope its radio activity doesn’t give it away. This is often why more sophisticated attackers may often resort to using attacks over signalling interfaces such as SS7 and Diameter to achieve their aims, which can be sent from any part of the world.

A Passive IMSI Catcher changes things somewhat. It still involves physical deployment of a system to listen in the local targeted area, but it is essentially undetectable on the radio interface, as it emits nothing that would allow it to be detected. This makes it very valuable to perform long-term surveillance in sensitive areas, when the goal is to have the least chance of being detected, while still trying to determine the IMSIs of who is in the local area.

The issue with both types of IMSI Catchers, from the attacker’s perspective, is that what they are left with are a collection of IMSIs from around the world. While this information may be useful, often you need more information to profile who has been ‘caught’. For Active IMSI Catcher deployments; the attackers may also intercept calls/text messages etc, so have a better idea of the target, but for passive IMSI catchers they won’t have that. What the attackers really need is the co-corresponding phone number – the MSISDN of the mobile device associated with the IMSI – in order to truly figure out the identities of the mobile device their IMSI catcher has caught.

This is where our analysis and investigation has come in. Over time, we have been seeing patterns of unusual requests over the SS7 interface, for particular IMSIs. Specifically, what we have been seeing is our Signalling Firewalls, deployed at multiple customer mobile operators, receiving suspicious MAP_RESTORE_DATA packets for IMSIs from unexpected sources. A MAP_RESTORE_DATA packet is a particular command that requests that the home operator sends details for a particular IMSI to the roamed-to network. Details in this case includes MSISDN (the actual phone number), call forwarding setting and other specific information. Further investigation showed that we always received this command when these IMSIs were near or attached to specific Cell Sites while roaming in a 3rd country and nowhere else.

Our working theory, is that what we are observing is what we now call “IMSI Profilers”. These IMSI Profilers work in conjunction with IMSI Catchers – they take the list of IMSIs that have been detected and request profile information, in order to feed these phone numbers back to the IMSI catcher operator. The sequence of events that we believe to happen is shown above. From log analysis it also seems likely (but can’t be confirmed 100%) that the IMSI Catcher in the 3rd country is of the passive variety. In this particular case, the IMSI Profiler is using a source SS7 address (called a SCCP Global Title or GT) in a small European mobile operator that we have detected previously in our SIGIL/Signalling Intelligence system to be used by multiple surveillance companies, further confirming our suspicion that it is malicious.

Regardless of the IMSI catcher type used, this method of analysing incoming suspicious signalling activity gives the opportunity for mobile operators to partially protect their subscribers against IMSI Catchers around the world, something they didn’t have in the past. It won’t stop an Active IMSI Catcher from forcing a subscriber to connect to them, but it would stop additional information being retrieved. And in the case of passive IMSI catcher it is potentially one of the only ways to detect these remotely and block any more useful information being obtained.

In the long term, improvements in the new 5G radio and core network standards means that mobile operators should be able to greatly improve the ability to block IMSI Catchers over 5G. If these are implemented correctly and no loopholes are introduced then effective 5G IMSI Catchers may never arise. In the interim however, IMSI Catchers – both Passive and Active – are being used globally in the world to track and record individuals without their consent. By analysing incoming signalling traffic, and detecting and blocking these IMSI Profilers, mobile operators now have the opportunity to help protect their subscribers globally, regardless of how stealthy the IMSI Catcher is. source

Cell-site simulators/ imsi catchers aka Stingray phone tracker

Cell-site simulators/ imsi catchers

DOWNLOAD IMSI CATHER SOFTWARE AND BUILD YOUR OWN! TO OF COURSE SOLVE SECURITY FLAWS IN YOUR OWN SYSTEM ONLY 

How Cell-Site Simulators Work

Standard Communication

Cellular networks are distributed over geographic areas called “cells.” Each cell is served by one transceiver, also known as a cell-site or base station. Your phone naturally connects with the closest base station to provide you service as you move through various cells.

 

Generally, there are two types of device used by law enforcement that are often referred to interchangeably: passive devices (which we will call IMSI catchers), and active devices (which we will call cell-site simulators.) Passive devices, as a rule, do not transmit any signals. They work by plucking cellular transmissions out of the air, the same way an FM radio works. They then decode (and sometimes decrypt) those signals to find the IMSI of the mobile device and track it.

Active cell-site simulators are much more commonly used by law enforcement, and work very differently from their passive cousins. Cellular devices are designed to connect to the cell site nearby with the strongest signal. To exploit this, cell-site simulators broadcast signals that are either stronger than the legitimate cell sites around them, or are made to appear stronger. This causes devices within range to disconnect from their service providers’ legitimate cell sites and to instead establish a new connection with the cell-site simulator. Cell-site simulators can also take advantage of flaws in the design of cellular protocols (such as 2G/3G/4G/5G) to cause phones to disconnect from a legitimate cell-site and connect to the cell-site simulator instead.  For the purposes of this article we will focus on active cell-site simulators.

It is difficult for most people to know whether or not their phone’s signals have been accessed by an active cell-site simulator, and it is impossible for anyone to know if their phone’s signals have been accessed by a passive IMSI catcher. Apps for identifying the use of cell-site simulators, such as SnoopSnitch, may not be verifiably accurate. Some more advanced tools have been built, which may be more accurate. For instance, security researchers at the University of Washington have designed a system to measure the use of cell-site simulators across Seattle, and EFF researchers have designed a similar system.

What Kinds of Data Cell-Site Simulators Collect

Data collected by cell-site simulators can reveal intensely personal information about anyone who carries a phone, whether or not they have ever been suspected of a crime.

 

Once your cellular device has connected to a cell-site simulator, the cell-site simulator can determine your location and trigger your device to transmit its  IMSI for later identification. If the cell-site simulator is able to downgrade the cellular connection to a 2G/GSM connection then it can potentially perform much more intrusive acts such as intercepting call metadata (what numbers were called or called the phone and the amount of time on each call), the content of unencrypted phone calls and text messages and some types of data usage (such as websites visited).  Additionally, marketing materials produced by the manufacturers of cell-site simulators indicate that they can be configured to divert calls and text messages, edit messages, and even spoof the identity of a caller in text messages and calls on a 2G/GSM network.

How Law Enforcement Uses Cell-Site Simulators

Police can use cell-site simulators to try to locate a person when they already know their phone’s identifying information, or to gather the IMSI (and later the identity) of anyone in a specific area. Some cell-site simulators are small enough to fit in a police cruiser, or even on the vest of an officer, allowing law enforcement officers to drive to multiple locations, capturing from every mobile device in a given area—in some cases up to 10,000 phones at a time. These indiscriminate, dragnet searches include phones located in traditionally protected private spaces, such as homes and doctors’ offices.

Law enforcement officers have used information from cell-site simulators to investigate major and minor crimes and civil offenses. Baltimore Police, for example, have used their devices for a wide variety of purposes, ranging from tracking a kidnapper to trying to locate a man who took his wife’s phone during an argument (and later returned it to her). In one case, Annapolis Police used a cell-site simulator to investigate a robbery involving $56 worth of submarine sandwiches and chicken wings. In Detroit, U.S. Immigration and Customs Enforcement used a cell-site simulator to locate and arrest an undocumented immigrant. In California, the San Bernardino county sheriff’s office used their cell-site simulator over 300 times in a little over a year.

Police may have deployed cell-site simulators at protests. The Miami-Dade Police Department apparently first purchased a cell-site simulator in 2003 to surveil protestors at a Free Trade of the Americas Agreement conference. And it is suspected that they have been used more recently than that during protests against police violence in 2020.

Cell-site simulators are used by the FBI, DEA, NSA, Secret Service, and ICE, as well as the U.S. Army, Navy, Marine Corps, and National Guard. U.S. Marshals and the FBI have attached cell-site simulators to airplanes to track suspects, gathering massive amounts of data about many innocent people in the process. The Texas Observer also uncovered airborne cell-site simulators in use by the Texas National Guard. In 2023 it was revealed that ICE, DHS, and the Secret Service have all used cell-site simulators many times without following their own rules on deployment or getting a warrant.

A recent Congressional Oversight Committee report called on Congress to pass laws requiring a warrant before using cell-site simulators. Some states, such as California, already require a warrant, except in emergency situations.

Who Sells Cell-site Simulators

Harris Corporation is the most well known company providing cell-site simulators to law enforcement. Their Stingray product has become the catchphrase for these devices, but they have subsequently introduced other models, such as Hailstorm, ArrowHead, AmberJack, and KingFish. Harris has stopped selling cell-site simulator technology to local law enforcement agencies but still works with the federal government. Digital Receiver Technology, a division of Boeing, is also a common supplier of the technology, often referred to as “dirtboxes.”

Other sellers of cell-site simulators include Keyw, Octastic, Tactical Support Equipment, Berkeley Varitronics, Cogynte, X-Surveillance, Atos, Rayzone, Martone Radio Technology, Septier Communication, PKI Electronic Intelligence, Datong (Seven Technologies Group), Ability Computers and Software Industries, Gamma Group, Rohde & Schwarz, Meganet Corporation. Manufacturers Septier and Gamma GSM both provide information on what the devices can capture. The Intercept published a secret, internal U.S. government catalogue of various cellphone surveillance devices, as well as an older cell-site simulator manual made available through a Freedom of Information Act request.

Threats Posed by Cell-Site Simulators

Cell-site simulators invade the privacy of everyone who happens to be in a given area, regardless of the fact that the vast majority have not been accused of committing a crime. These are general searches that violate the Fourth Amendment requirement that warrants “particularly” describe who or what is to be searched.

The use of cell-site simulators have been shrouded in government secrecy. Police have used cell-site simulators to track location data without a warrant, by deceptively obtaining “pen register” orders from courts without explaining the true nature of the surveillance. In Baltimore, a judge concluded that law enforcement had intentionally withheld the information from the defense, in violation of their legal disclosure obligations. For a while, police departments tried to keep the use of cell-site simulators secret from not just the public but also the court system, withholding information from defense attorneys and judges—likely due in part to non-disclosure agreements with Harris Corporation. Prosecutors have accepted plea deals to hide their use of cell-site simulators and have even dropped cases rather than revealing information about their use of the technology. U.S. Marshalls have driven files hundreds of miles to thwart public records requests. Police have tried to keep information secret in Sarasota, Florida, Tacoma, Washington, Baltimore, Maryland, and St. Louis, Missouri.

To preserve this secrecy, the FBI told police officers to recreate evidence from the devices, according to a document obtained by the nonprofit investigative journalism outlet Oklahoma Watch.

Cell-site simulators often disrupt cell phone communications within as much as a 500-meter radius of the device, interrupting important communications and even emergency phone calls.  Cell-site simulators have been shown to disproportionately affect low-income communities and communities of color. In Baltimore, the use of cell-site simulators disproportionately impacted African-American communities, according to a map included in an FCC complaint that overlaid where Baltimore Police were using stingrays over census data on the city’s black population.

Cell-site simulators can also disrupt emergency calls, such as 911 in the US, making them not only a menace to privacy but to public safety as well.

Cell-site simulators rely on vulnerabilities in our communications system that the government should help fix rather than exploit.

EFF’s Work on Cell-Site Simulators

For the reasons above, EFF opposes police use of cell site simulators. Insofar as law enforcement agencies are using cell-site simulators in criminal investigations, EFF argues that use should be limited in the following ways:

1. Law enforcement should obtain individualized warrants based on probable cause;
2. Cell-site simulators should only be used for serious, violent crimes;
3. Cell-site simulators should only be used for identifying location of a particular phone;
4. Law enforcement must minimize the collection of data from people who are not the targets of the investigation.
5. Companies making cell-site simulators must confirm that their technology does not disrupt calls to emergency services.

Litigation

We filed a Freedom of Information Act lawsuit to expose and shine light on the U.S. Marshals Service’s use of cell-site simulators on planes.

Along with the ACLU and ACLU of Maryland, we filed an amicus brief in the first case in the country where a judge threw out evidence obtained as a result of using a cell-site simulator without a warrant.

We filed an amicus brief, along with the ACLU, pointing a court to facts indicating that the Milwaukee Police Department secretly used a cell-site simulator to locate a defendant through his cell phone without a warrant in U.S. vs. Damian Patrick. (The government then admitted to having used it.)

Legislation

We were original co-sponsors of the California Electronic Communications Privacy Act (CalECPA), along with the ACLU and the California Newspaper Publisher Association. This law requires California police to get a warrant before using a cell-site simulator. Any evidence obtained from a cell-site simulator without a warrant is inadmissible in court.

EFF supported S.B. 741, which requires transparency measures regarding the use of cell-site simulators. We collected many of these policies.

Further Research

We have written a report on the technical means possibly used by cell-site simulators called “Gotta Catch ‘em All”, and we have developed a proof of concept technical means of detecting cell-site simulators called Crocodile Hunter.

EFF Cases

State of Maryland v. Kerron Andrews

U.S. v. Damian Patrick

EFF v. U.S. Department of Justice

Suggested Additional Reading

Stingray Tracking Devices: Who’s Got Them? (ACLU)

Your Secret Stingray’s No Secret Anymore: The Vanishing Government Monopoly over Cell Phone Surveillance and Its Impact on National Security and Consumer Privacy (Harvard Journal of Law and Technology)

Examining Law Enforcement Use of Cell Phone Tracking Devices (House Oversight Committee)

The Relentless “Eye” Local Surveillance: Its Impact on Human Rights and Its Relationship to National and International Surveillance (Center for Media Justice and others)

Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology (U.S. Department of Justice)

Long-Secret Stingray Manuals Detail How Police Can Spy on Phones  (The Intercept)

A Secret Catalogue of Government Gear for Spying on Your Cellphone (The Intercept)

Cops Turn to Canadian Phone-Tracking Firm After Infamous ‘Stingrays’ Become ‘Obsolete’ (Gizmodo)

source

Detecting IMSI-Catchers by Characterizing Identity Exposing Messages in Cellular Traffic

Tyler Tucker (University of Florida), Nathaniel Bennett (University of Florida), Martin Kotuliak (ETH Zurich), Simon Erni (ETH Zurich), Srdjan Capkun (ETH Zuerich), Kevin Butler (University of Florida), Patrick Traynor (University of Florida)

IMSI-Catchers allow parties other than cellular network providers to covertly track mobile device users. While the research community has developed many tools to combat this problem, current solutions focus on correlated behavior and are therefore subject to substantial false classifications. In this paper, we present a standards-driven methodology that focuses on the messages an IMSI-Catcher textit{must} use to cause mobile devices to provide their permanent identifiers. That is, our approach focuses on causal attributes rather than correlated ones. We systematically analyze message flows that would lead to IMSI exposure (most of which have not been previously considered in the research community), and identify 53 messages an IMSI-Catcher can use for its attack. We then perform a measurement study on two continents to characterize the ratio in which connections use these messages in normal operations. We use these benchmarks to compare against open-source IMSI-Catcher implementations and then observe anomalous behavior at a large-scale event with significant media attention. Our analysis strongly implies the presence of an IMSI-Catcher at said public event ($p << 0.005$), thus representing the first publication to provide evidence of the statistical significance of its findings. source

Detecting IMSI Catchers: Tools, Apps and Methods You Should Know

Yes, you can use Signal without sharing your personal phone number. Here’s how I did it.

THE MESSAGING APP Signal is described by security professionals as utilizing the gold standard of cryptography. Unlike many competitors, its default is end-to-end encryption — and on top of that, the app minimizes the amount of information it stores about users. This makes it a powerful communication tool for those seeking a private and secure means of chatting, whether it’s journalists and their sources, activists and human rights defenders, or just ordinary people who want to evade the rampant data-mining of Big Tech platforms.

Signal continues to introduce privacy-enhancing features such as usernames that can be used in lieu of phone numbers to chat with others — preventing others from finding you by searching for your phone number. But the app still requires users to provide a working phone number to be able to sign up in the first place.

For privacy-conscious individuals, this can be a problem.

In response to subpoena requests, Signal can reveal phone numbers. Relying on phone numbers has also led to security and account takeover incidents. Not to mention that the phone number requirement costs Signal more than $6 million annually to implement.

Signal insists on its site that phone numbers are a requirement for contact discovery and to stymie spam. (Signal did not respond to a request for comment). Other encrypted messaging platforms such as Session and Wire do not require phone numbers.

There are some ways around Signal’s phone number policy that involve obtaining a secondary number, such as using temporary SIM cards, virtual eSIMs, or virtual numbers. But these approaches involve jumping through hoops to set up anonymous payment measures to procure the secondary numbers. And sometimes they don’t work at all (that was my experience when I tried using a Google Voice number to sign up for Signal).

I wanted a way to get a Signal account without leaving any sort of payment trail — a free and anonymous alternative. And thus began my long and tedious journey of registering Signal with a pay phone.

Finding a Pay Phone

The first step was actually finding a pay phone, a task which is dismally daunting in 2024.

The Payphone Project lists around 750,000 pay phones, but after attempting to cross-check a sampling of the hundreds of alleged pay phones in my town with Google Street View and Google Earth satellite images, I came to the quick realization that the list was woefully outdated. Many of these phones no longer exist.

A Google Maps search for pay phones in my area brought up of a half-dozen pins. Using Street View, I found that four locations seemed to have something resembling a pay phone box. Trekking out to them, however, revealed that one no longer had a pay phone, though discoloration of the store façade revealed the precise spot the pay phone used to be; another pay phone looked like it had been the victim of a half-hearted arson attack; the third and fourth lacked dial tones.

Asking on a community subreddit resulted in suggestions that once again led me to places without any working pay phones, or posts berating me for needing a pay phone in 2024 and inquiring about the legality of the endeavors I wished to pursue which would necessitate pay phone usage.

Failing at finding a functional pay phone through a systemic approach, I resorted to brute opportunism — keeping my eyes peeled for pay phones as I went through the dull drudgery of a modern life made ever bleaker by the lack of public phone access.

A Working Pay Phone, That Is

I didn’t just need to find a working pay phone — no small feat in 2024. I also needed to find one able to receive incoming calls, so I could get Signal’s activation message.

On a recent visit to Tampa, where I travel annually to discuss security matters and set things on fire, I spotted a pay phone while leaving Busch Gardens. Picking up the receiver, I was delighted to hear the telephonic equivalent of a pulse: a dial tone.

Now that I had a phone with a dial tone, the next step was to test whether it could receive incoming calls. This is because Signal’s registration process requires a phone number that can either receive a text message or a verification call.

To test whether a pay phone can receive incoming calls, you need to know one thing: the pay phone’s own phone number. Some pay phones reveal their numbers on the phones themselves, but not always.

If the number isn’t listed on the phone — it wasn’t in this case — there’s a workaround that doesn’t involve a paper trail leading back to your cellphone. Use the pay phone to call what’s known as an ANAC (automatic number announcement circuit), which provides an ANI (automatic number identification) service. In other words, it’s a phone number you can call which then reads out the phone number you are calling from. Lists of ANAC numbers have been bantered about for years, though like pay phone lists, almost all are now defunct.

One stalwart ANAC number that has withstood the test of time for over 30 years, however, is 1-800-444-4444. Feel free to try it. Call the number, and it should read yours back to you.

Back at Busch Gardens, I rang up the ANAC and had a number read back to me. The next and final step was to test whether the number actually accepted incoming calls. Unfortunately, when I called the number the ANAC line had read back to me, I reached the Busch Gardens main line, asking me to enter my party’s extension. In other words, this wasn’t actually the pay phone’s number, it was just the general theme park number.

Days later, during a layover on my trip home from Tampa, I noticed a small bay of pay phones at a small regional airport. I repeated the above rigamarole, and lo and behold, when I called the pay phone’s number from the neighboring pay phone, I was able to answer and talk to myself. Finally, success.

I took out a burner phone on which I wanted to set up Signal, which had no SIM or eSIM of any kind, and proceeded to enter the pay phone’s phone number when setting up Signal. Signal first insists on attempting to send a verification code via an SMS text message, so you have to initially go through that fruitless route. But after a few minutes, you can then select the option to receive the verification code via a voice call.

Moments later, the pay phone rang, and I was finally able to set up a Signal account.

The next and final step was to set up a PIN and enable a registration lock so that someone else wouldn’t be able to take over the account by going to the same pay phone and registering their own version of Signal with that same number. The registration lock expires after a week of inactivity, so you also have to keep using the Signal account. It took a while, owing to Signal’s onerous registration requirements coupled with the increasing lack of public phone access, but in the end I proved there is a way to use Signal with an untraceable phone number.

A Step-by-Step Guide

1. Obtain a phone. It doesn’t need to have an active phone number associated with it, and can be either an old phone you have around or a dedicated burner phone.
2. Locate a pay phone. 
3. Find the pay phone’s phone number (call 1-800-444-4444 if it’s not written on the phone).
4. Make sure the pay phone can receive incoming calls.
5. Enter the pay phone number into Signal, and use the ‘Call me’ option to receive a verification call (this option shows up only after the SMS timer runs out).
6. Input the confirmation code, set up a PIN and enable Registration Lock in the Signal app. 

source

SIGNAL’S NEW USERNAMES HELP KEEP THE COPS OUT OF YOUR DATA

Ephemeral usernames instead of phone numbers safeguard privacy — and makes Signal even harder to subpoena.

an assistant U.S. attorney issued a subpoena to Signal demanding that the messaging app hand over information about one of its users. Based on a phone number, the federal prosecutors were asking for the user’s name, address, correspondence, contacts, groups, and call records to assist with an FBI investigation. Two weeks later, the American Civil Liberties Union responded on behalf of Signal with just two pieces of data: the date the target Signal account was created, and the date that it last connected to the service.

That’s it. That’s all Signal turned over because that’s all Signal itself had access to. As Signal’s website puts it, “It’s impossible to turn over data that we never had access to in the first place.” It wasn’t the first time Signal has received data requests from the government, nor was it the last. In all cases, Signal handed over just those two pieces of data about accounts, or nothing at all.

Fake Cell Towers Allow the NSA and Police to Keep Track of You

The Internet is abuzz with reports of mysterious devices sprinkled across America—many of them on military bases—that connect to your phone by mimicking cell phone towers and sucking up your data. There is little public information about these devices, but they are the new favorite toy of government agencies of all stripes; everyone from the National Security Agency to local police forces are using them.

These fake towers, known as “interceptors,” were discovered in July by users of the CryptoPhone500, one of the ultra-secure cell phones released after Edward Snowden’s leaks about NSA snooping. The phone is essentially a Samsung Galaxy S3 customized with high-level encryption that costs around $3,500. While driving around the country, CryptoPhone users plotted on a map every time they connected to a nameless tower (standard towers run by wireless service providers like Verizon usually have names) and received an alert that the device had turned off their phone’s encryption (allowing their messages to be read).

Map showing the location of rogue cell towers identified by the firewall on CryptoPhones in August via ESD America, a defense and law enforcement technology provider based in Las Vegas.

While the abilities of these interceptors vary, the full-featured versions available to government agencies are capable of a panoply of interceptions. For example, the VME Dominator can capture calls and texts, and can even control the intercepted phone. (In an interview with NBC, Snowden revealed that with this kind of technology the NSA is capable of turning on a powered-down phone and essentially using it as a bug.)

This NSA-style surveillance is spreading to local cops. A growing number of police departments are using tower-mimicking devices, “stingrays,” to track a cell phone’s location and extract call logs. Though little is known about the use of these devices, watchdog groups have scored small victories in their attempts to punch through this veil of secrecy. The map below, courtesy of the ACLU, shows how the use of stingrays is spreading. The map also shows that despite the ALCU’s greatest efforts, it is unable to uncover information about stingray use in most of the country.

A recent case provided a glimpse into what stingrays can do and how they are being used.

Awesome Resources explains how anyone with a mobile interception device can intercept cellular data

Mobile networks are dominant in the age of communication and are used to relay mobile communication signals to Public Switched Telephone Networks (PSTN). There is a lot of information that is exchanged on a daily basis. But is your mobile network confidential?

Even though it started out as an ethical technology for security, there are reports about the misuse of the technology doing the rounds.

However, for those concerned about their privacy during calls, using tools like Call Recorder iCall can provide an added layer of security by recording and securely storing conversations.

How does mobile interception work?

There are three types of mobile networks – NGN (Next Generation Networks like 3G, 4G, and 5G), GSM (Global System for Mobile communications) and CDMA (Code Division Multiple Access). All three of them are targets of multiple surveillance technologies.

When the mobile phone data travels over these networks, they are passively intercepted between the mobile phone and the base station it is communicating to. Both uplink signal (outgoing voice or data) and downlink (incoming voice or data) signals can be intercepted.

Who can intercept your mobile signal?

Mobile Interception technology is extensively used by law enforcement agencies, military & defense, or authorities like government and federal & local law enforcement agencies (LEAs). These are also termed as Lawful Interceptions. But there are unauthorized intercepts too!

Our expert Sam Tilston from AwesomeResources.co.uk, a professional in cyber security for more than 20 years believes that anyone with a mobile interception device can intercept cellular information like- voice, data transmission, and metadata.

Lawful Interception (LI) – The modern legal interception protocol

Lawful Interception or LI refers to a specific facility in telecommunications where LEA or government with court orders or legal authorization can intercept mobile signals. In common parlance it’s also called selective wiretapping or authorized wiretapping.

Lawful interception is different from the dragnet-type mass surveillance and is usually carried out by intelligence agencies. The data is merely passed through a fiber-optic splice where its extracted and filtered.

Many countries follow local, national, and global standards for lawful interception laid down by ESTI. Governments and authorities require PSPs (Public Service Providers) to install a (LIG) legal interception gateway and LIN (legal interception nodes) for real-time interception.

Lawful Interception architecture

Currently the global standard for Lawful Interception and its architecture is provided by ESTI. The standard architecture in recent use is 3GPP Evolved Packet System (EPS) that provides IP based services.

The ESP architecture attempts to define an extensible and systematic means by which LEAs and network operators can interact. There are three stages in the architecture:

1. Collection: target-related call content and data are extracted from these PSP networks.
2. Mediation: data is formatted to match the specific standard.
3. Delivery: The content and data are delivered to the law enforcement agencies.

Delivery function in the architecture is what is used to hide your sensitive interceptions from Intercepting Control Element (ICE). Even when there are multiple targets on the same number, the authorities have no idea about it.

What is the need for mobile interception?

Apart from the malicious effects like snooping and eavesdropping, mobile interception can be used for security. Want to know the uses?

1. Administration Security

The Administrative function (ADMF) keeps all the intercept activities of individual LEAs separate and interfaces to the intercepting network.

After configuring authorized user access within the network, password protection can be enabled using one of the following security mechanisms:

• CUG/VPN
• COLP
• CLIP
• Authentication & Encryption

2. IRI (Intercept Related Information) security

In case of communication failures, IRI can be buffered in the 3G network. After successfully transmitting IRI, the content buffer and total buffer can be deleted via a command or a timer. This prevents the IRI data from being exposed to illegal use.

3. CC (Call Content) security

Data inconsistency, log files, and critically important data like billing information can be suppressed to be viewed by only a fraction of the users over the network. This data can also be deleted after successful transmission to the required personnel.

Can your mobile be intercepted?

If you’re in the crosshairs of the authorities, then chances are that you may be under surveillance right now. Don’t worry, if you’re under one, then you’re not alone!

Lawful interceptions are very common, in fact there are 2000-3000 mobile signals being intercepted and analyzed every day. In fact, if you have a few selected smartphone models from Samsung, chances are that your calls are being intercepted.

The presence of Shannon-branded baseband chips, a tracing IC (integrated circuit) and RF (radio frequency) transceiver make it a device that can be easily intercepted. Calls and messages can be intercepted by creating a proxy base station by frankly anyone with a device.

What is the future of mobile interception market?

The market of mobile interception is estimated at $1.8 billion globally, and $ 226.1 million in the U.S. alone. The market is estimated to grow at a tremendous rate of 5.8% annually for the next decade.

With new developments of communication frequencies, networks and channels, integration with newer interception systems will create a little hurdle. New and portable devices are being deployed every day across the world to hamper the mobile interception market.

In summary

Mobile interception is a debatable topic. On one hand, you are always on someone’s radar and that’s something that you can’t live with knowing. On the other hand, it’s a crucial and apt technology for intercepting malicious calls and threats.

As hard as it may sound, it’s hard to negate the importance of mobile interception, as long as it’s legal, and meets the global standards of lawful interception.

Hey, as long as it continues to save millions of lives by combating increasing criminal activities and security threats, it’s always a handy technology and probably will be in the future too. source

Understanding MIMO (Multiple Input, Multiple Output) – Cellular Speed & Booster Implications

The Wonders of MIMO

For RVers and Cruisers, understanding what MIMO technology is, how it works, and how it can be used to enhance cellular speeds has the potential to make finding great mobile internet on the road an easier experience.

For anyone who knows a thing or two about wireless communications, modern 4G/LTE and 5G cellular radios are borderline miraculous.

Consider the first iPhone – which launched in 2007 with a maximum theoretical cellular speed of around 500 Kbps using AT&T’s 2G EDGE cellular network.

A decade and a half later – the latest flagship cellular devices were able to support maximum theoretical speeds of over 2,000 Mbps.

That’s more than a 4,000x increase!

And as the 5G era has matured and become more mainstream, we see peak theoretical speeds are approaching 10 Gbps, another 10x increase!

Of course, theory rarely equals reality – and the cellular networks need to be substantially upgraded and built out to even come close to being able to deliver speeds like this to real people outside of a lab.

And in the real world – you will be sharing this speed with perhaps hundreds or thousands of others connected to the same cell tower.

But real-world 4G/LTE speeds over 50Mbps are actually not at all uncommon, and speeds over 100Mbps are now widely reported, and things just keep getting faster. Mid band 5G is has become lot more common on most of the carriers and we are now seeing the gap between really good LTE and good mid band 5G become way more prevalent in everyday connectivity. If you are in a mmWave 5G area, the speeds can be blazing fast.

One of the key technologies making these sorts of speeds possible is known as MIMO (Multiple Input, Multiple Output) – an incredibly clever technique for putting multiple antennas to work to increase both data transmission speed and reliability.

MIMO technology is fundamental to both 4G/LTE, 5G, and WI-Fi radios – but cellular boosters and MIMO have some… challenges… working together.

Read on to get a grasp of what MIMO is, how it works, and how you can use a little bit of MIMO awareness to potentially increase your cellular speeds.

MIMO In A Nutshell

MIMO is one of the core technologies enabling 4G/LTE and 5G cellular, and almost every modern mobile device (whether a phone or a hotspot) has two or more cellular antennas on board to enable the magic of MIMO.

On the other end of the line – cell towers typically have multiple antennas working together in tight synchronization to communicate with you.

With more antennas transmitting a signal, there are more possible echoes and reflections (read the “how it works” section below to understand the magic here) for the receiving device to catch a signal.

The ability to make multiple connections on the cell tower the better the transmit speeds, even with weak signals.

The cell tower will have a number of transmit/receive antennas and many LTE devices had two antennas.  This allows those devices to utilize 2×2 MIMO.

Devices with four antennas for 4×4 MIMO is now common, with consumer devices such as flagship hotspots such as the AT&T Netgear Nighthawk M6 Pro Hotspot Pro, the Verizon & T-Mobile MiFi X Pro 5G hotspots, plus all the the latest flagship smartphones from Apple, Samsung, and Google.

Although the latest cellular standards (Category 18 & higher) support 8×8 MIMO, consumer devices with 8 antennas are not common.

These antennas connect to a cell tower that will usually have at least four antennas – and as many as 128!  The number of antennas on the tower gives devices more options to get a good, high-performing connection.

This figure illustrates a relatively simple 4×2 MIMO deployment.  In this case, 4×2 means four transmit/receive antennas on the tower, and two on the user device:

This 4×2 configuration isn’t the only one possible, however, upgraded cell towers can have many more transmit/receive antenna elements. The latest devices typically have four antennas to better take advantage of the cell towers antenna array.

MIMO is one of the key technologies that allow these devices to have such great performance – it really is pretty darn amazing stuff! source

MIMO vs Boosters Video

Here Introducing an all-new WiPhone, A Phone for Hackers and Makers. Moreover, WiPhone is a VoIP mobile phone designed to be easily modified, repurposed, and adapted.

Basically, It’s designed to enable hackers by making it easy to extend and modify the electronics and software. Something typical phones are not good for. However, WiPhone is also a VoIP mobile phone. It uses WIFI to make HD voice calls, for free. Though, This means that there is no required service contract.

Additionally, WiPhone solves these problems and gives hackers, makers, and engineers the tool we all wish our phones could be. However, It is direct access to I/O, an easy to program ESP32 processor. However,  All the basics are already set up the user interface, power management, and on/off the circuit, working code.

Furthermore, you also can get straight to work building projects, not setting up the boring parts like power management again and again. Though, No rats nest of wires or ugly stack of dev boards just to get the basic functionality.

WiPhone Tech Specs:

What is the WiPhone?

WiPhone is a unique, minimal phone.

It’s designed to enable hackers by making it easy to extend and modify the electronics and software. Something typical phones are not good for.

WiPhone is also a VoIP mobile phone. It uses WIFI to make HD voice calls, for free. This means that there is no required service contract – and it’s yours for life.

For Hackers:

 Yet So Stylish And Sophisticated!

 WiPhone Pro with Clear Front Face:

source

Smartphones Are A Little Too Smart

What’s the best platform you can imagine for electronics hacking?

It should probably be adaptable, powerful, and programmable. Small and portable would be nice. Maybe with a durable case? What about a built in user interface with things like an LCD screen and button panel? A battery and built-in charging system? Wireless connectivity?

Hey… we just described a mobile phone!

But why aren’t people building more projects based on their smartphones? Well, there are a few issues:

• no electrical connectors to directly connect to the outside world
• no way to easily control the low level hardware, like processor output pins
• opaque development environment and huge IDE
• not designed for easy disassembly, repair, or modification

Enter WiPhone:

WiPhone solves these problems and gives hackers, makers, and engineers the tool we all wish our phones could be. Nice package, direct access to I/O, an easy to program ESP32 processor. All the basics are already set up: user interface, power management and on/off circuit, working code.

You can get straight to work building your project, not setting up the boring parts like power management again and again. And once you’re done it’s durable and looks great. No ratsnest of wires or ugly stack of dev boards just to get the basic functionality.

Modern smartphones are more and more a tool we don’t own, but instead one we’re only allowed to carry around. One that serves the interests of various tracking networks, corporate boards, and government organizations. You don’t own it, it owns you. It tracks you, serves you ads, and sucks away your time with mindless dopamine hits. We want a phone that’s back in our control, optimized for our convenience.

Free Calling! No Hacking Required!

WiPhone is different beast from most smartphones these days. WiPhone uses the existing WiFi around you to make HD Voice calls. For free. Buy it once and it’s yours.

Works on most broadband WiFi networks (including most home WiFi connections). No service contract required, and you can even upgrade the firmware or expand the hardware to do things it wasn’t originally intended for.

What Is This Magical Free Calling You Speak of? Tell me more…

Free calling starts with a SIP account. SIP stands for Session Initiation Protocol, and it’s a standard way to make call over the internet. VoIP is a related term that you may have heard of. There are commercial services that provide SIP/VoIP accounts, and some of them have free accounts. Most consumers use VoIP apps like Skype and Whatsapp, but we can still use the underlying technology directly. After the campaign we’ll spend more time testing services to make our software and instructions work as seamlessly as possible.

Step 1: Get a SIP account (many different ways to do this, but we wrote up a simple how-to that might get you started).

Step 2: Log in on your WiPhone using the credentials from your SIP account (user name, password, and server):

Step 3: Make a Call:

That’s it!

Note: we’re still working through compatibility with various SIP providers since many of them implement the standard in various ways. Once the WiPhones ship we’ll update our getting started instructions to use the servers we find to be most reliable.

What people are saying about WiPhone:

“This is a great cross over between what people know (phones) and what people really want to do (hack).” -Nathan Seidle, Sparkfun Founder

“The WiPhone is a really rather neatly put together project.” -Alasdair Allan, Hackster.io

“If you want a phone that respects your right to repair, this is the project to look at.” -Brian Benchoff, Hackaday.com

“So excited by this project I tried to make one myself” -Random Guy On Our YouTube Channel

First Class Expansion Capabilities

WiPhone is expandable through daughter boards. The whole back of the phone is a replaceable panel that accepts a standard 1.6mm thickness PCB, which you can use to add whatever functionality you like.

Some Examples

We made a WiPhone into an RC car:

And we also made the coolest way to ever to answer a phone:

The daughterboard headers have power, digital I/O, and all the common embedded busses like SPI, I2C, and UART.

 Easy Development

Develop in Arduino/C++ or Python. We’ll also provide basic tutorials covering how to write to the screen, connect to the hardware, save data to memory, etc.  We’ll let you give us feedback on what’s most important to you.

No-Mess Prototyping

————————————————————————————————

Note: Based on the backer survey, we’ll prioritize adding a cellular radio (LTE), and secure communications after the campaign. Back now to get first access to the new hardware as it becomes available.

See the relevant Project Update for details.

————————————————————————————————

We have big plans for the WiPhone, but we also need to start off on solid footing. We’ve set a relatively low funding goal of $40k that will let us cover the costs to finish production of the phones themselves and not much more. That way we can get phones in the hands of people that want them.

But there’s a lot of potential waiting to be unlocked. If we reach $100k of phones, we’ll have enough of a cushion to thoroughly test the design and ultimately deliver a better product. It will also allow us to start taking on extra work. If we reach $100k we’ll start letting backers choose stretch goals.

Some stretch goals would add software features to the WiPhone itself. Others will be to take on design and production of daughterboards and other accessories.

•  Wireless Firmware Updates:Wireless firmware updates will allow you to easily upgrade your firmware.
•  Integrated Python Interpreter: Currently we’ll ship the WiPhone with a separate firmware that allows running MicroPython apps. This stretch goal would allow us to merge the Python interpreter into the main phone firmware to run user apps directly within the phone firmware.
•  Remote Desktop: View and control your WiPhone through a webpage.
•  Encrypted Communications: Add secure communication to calls and messages
•  Threaded Messaging: Add an advanced view to text messages for a more modern chat experience
•  Additional Colors: Add some variety to the clear/gray options we have now for face colors.
•  Advanced Tutorials: Deeper tutorials than the basic ones we’ll ship for the basic campaign. We could go step-by-step through writing a complete app, using the phone to build an entire project, or designing a daughterboard from scratch. We’ll let you give us feedback on what’s most important to you.

First Class Expansion Capabilities – People Like The WiPhone Hack It Like It’s Yours