Select Page
A 5G Shortcut Leaves Phones Exposed to Stingray Surveillance

A 5G Shortcut Leaves Phones Exposed to Stingray Surveillance

In North America and many other parts of the world, high-speed 5G mobile data networks dangled just out of reach for years. But as 5G coverage becomes ubiquitous, the rollout comes with an important caveat. Even if your phone says it’s connected to the next-generation wireless standard, you may not actually be getting all of the features 5G promises—including defense against so-called stingray surveillance devices. 

To get 5G out to the masses quickly, most carriers around the world deployed it in something called “non-standalone mode” or “non-standalone architecture.” The approach essentially uses existing 4G network infrastructure as a jumping off point to put out 5G data speeds before the separate, “standalone” 5G core is built. It’s like starting your cake-decorating business out of your cousin’s ice cream shop while you renovate a new storefront three blocks away. 

You may see where this is going. As long as your 5G connection is in non-standalone mode, a lot of what you’re getting is still actually 4G, complete with security and privacy weaknesses that actual 5G aims to address.

“It’s a false sense of security,” says Ravishankar Borgaonkar, a research scientist at the Norwegian tech analysis firm SINTEF Digital. “Currently a lot of the 5G deployed all over the world doesn’t actually have the protection mechanisms designed in 5G. You’re getting the high speed connection, but the security level you have is still 4G.

In practice, that means one of 5G’s top-billed privacy benefits—the ability to stymie stingray surveillance—does not yet apply for most people. Also known as “IMSI catchers” for the “international mobile subscriber identity” number assigned to every cell phone, stingrays act like legitimate cell towers and trick devices into connecting. From there, the tools use IMSI numbers or other identifiers to track the device, and even listen in on phone calls. Stingrays are a popular choice among US law enforcement; they were a reportedly common presence at many of last summer’s anti-police brutality protests. To prevent that sort of monitoring, 5G is built to encrypt IMSI numbers.

Borgaonkar and fellow researcher Altaf Shaik, a senior research scientist at TU Berlin, found that major carriers in Norway and Germany are still putting out 5G in non-standalone mode, which means that those connections are still susceptible to stingrays. The two presented at the Black Hat security conference in Las Vegas last week. 

In the United States, T-Mobile is the farthest along in rolling out its standalone network. The company was the first to begin mass-deployment in August 2020. Verizon and AT&T have taken longer to transition and are still working on switching to high speed 5G in general. Verizon told WIRED that it is on track for “full commercialization” of 5G standalone mode by the end of 2021. AT&T says that it began “limited SA deployments” late last year, and that it will scale up “when the ecosystem is ready.”

A February study by the mobile network analytics firm OpenSignal found that at the beginning of 2021 US mobile users spent about 27 percent of their time on non-standalone mode 5G and less than six percent of their time on standalone mode connections.

While the distinctions between the types of 5G matter a great deal, there’s no easy way to tell whether you’re on a standalone network just by looking at your phone. Android users can download apps that analyze a device’s network connection and can flag non-standalone mode, but that’s an onerous extra step. And those tools are less common on iOS because of Apple’s app restrictions.

The security benefits you miss while on a non-standalone 5G network extend beyond stingrays. You’re potentially susceptible to tracking, eavesdropping, and so-called “downgrade attacks” that push target devices onto older, more vulnerable data networks like 3G. And none of this gets communicated to mobile data users, despite enhanced security features being a key 5G selling point.

Venmo Gets More Private—but It’s Still Not Fully Safe

Venmo Gets More Private—but It’s Still Not Fully Safe

“Venmo’s finally getting the message that maximum publicity on a financial app is a terrible idea,” says Kaili Lambe, senior campaigner at the Mozilla Foundation, a nonprofit focused on internet openness and accessibility. “However, from the beginning we have been calling on Venmo to be private by default, because so many Venmo users don’t actually know that their transactions are public to the world.”

A Venmo spokesperson said the company has no plans at this time to consider making those transactions private by default. That means users will still need to go out of their way to make sure their every peer-to-peer transaction isn’t broadcast to the world. It’s hard to see the benefit of maintaining the status quo. 

“You think of a lot of really sensitive use cases,” says Gebhart. “You think about therapists, you think about sex workers. You think about the president of the United States. It doesn’t take a big imagination to imagine places where these defaults could go horribly wrong and cause real harm to real people.”

The implications of Venmo’s public-by-default stance have played out beyond the discovery of Biden’s account. In 2018, privacy advocate and designer Hang Do Thi Duc used Venmo’s public API to sort through nearly 208 million transactions on the platform, piecing together alarmingly detailed portraits of five users based only on their activity in the app. The following year, programmer Dan Salmon wrote a 20-line Python script that let him scrape millions of Venmo payments in a matter of weeks.

Venmo has since placed restrictions on the rate at which you can access transaction data through the public API, but Salmon says the company hasn’t gone far enough. “Venmo basically had a firehose I could connect to of transaction data,” he says. “Now that that is cut off, the transactions are still out there; it will just take a few more steps to go get them.” He says it would take about an hour of work to build a new scraping tool.

“At Venmo, we routinely assess our technical protocols as part of our commitment to platform security and continually improving the Venmo experience for our customers. Scraping Venmo is a violation of our terms of service, and we actively work to limit and block activity that violate these policies,” Venmo spokesperson Jaymie Sinlao wrote in an emailed statement. “We continue to enable select access to our existing APIs for approved developers to continue innovating and building upon the Venmo platform.”

Venmo is far from the only app that makes you opt out of sharing rather than actively seeking it out. But because its use case is exclusively financial, the stakes are significantly higher, and the assumption of its users potentially misplaced. Venmo hasn’t made it especially easy for users to figure out what they are or are not sharing; in 2018 it reached a settlement with the Federal Trade Commissions related in part to its confusing privacy settings.

“Anecdotally, people are very surprised to find that a financial services app is public by default,” says the Mozilla Foundation’s Lambe. “Even people who’ve been using Venmo for years might not know that their settings are public.”

To make sure that yours aren’t going forward, head to Settings > Privacy and select Private. Then tap Past Transactions, and tap Change All to Private to lock things down retroactively. And while you’re at it, go ahead and tap Friends List, then tap Private and toggle off Appear in other users’ friends list. Otherwise, you’re sharing the digital equivalent of your credit card purchases with everyone you know, and lots of people you don’t. Or consider using something like Square’s Cash App instead, which is private by default.

Losing the global feed is an important step toward privacy for Venmo and its users. Hopefully, more steps are still to come.

More Great WIRED Stories