IMSI Catchers, sometimes called Stingrays, are devices that can intercept information from cellphones. A few years ago, they were prohibitively expensive and mostly used by state actors. Now, anyone with a few hundred dollars and an internet connection can build one at home.
I suspected these devices could be in use around New York City and worked with privacy researchers from the University of Washington to deploy sensors to detect them. We targeted high-value targets around embassies and the United Nations. We discovered no active devices, but we built a baseline map of the cellular landscape of NYC.
In this piece, I explain the mechanics behind IMSI catchers and the potential threat they pose. I also demonstrate how they can be used to capture important information using a person-in-the-middle attack. Finally, I generated a sample of a sensor sweep to show how the data was collected