[dreamlayers]

How is this possible? Are phones willing to connect to any cell and blindly trust that text messages from there are genuine and really coming from the numbers they claim to be coming from? Isn't there some cryptographic verification?

[mcpherrinm]

2g networks didn't have the phone verify the network, so yes they can do this.

At least as of today, most phones have an option to turn off 2g but that isn't a default.

[OptionOfT]

The only way to truly disable 2g on an iPhone is to enable lock-down mode, which is a step too far for me.

[xamuel]

Agree. I do a lot of travel and in 3rd-world countries it is quite common to get 2g spam, it's really unacceptable that Apple doesn't offer a way to turn off 2g short of lockdown mode.

[lxgr]

Are you sure it's not sourced from the visited network? In that case, 3G or beyond wouldn't help you, as mutual authentication does not imply end-to-end authentication of all traffic between you and your home provider.

[xamuel]

It happens specifically when I wander out of network coverage. If I stay in my airbnb where I have coverage, then 0 spam

[akimbostrawman]

It's always amusing to me how apple tries to hide basic security features behind there super duper totally secure mode which nobody will enable because it destroys usability.

Meanwhile GrapheneOS in the default mode is as much or much more secure (and private duh) than there marketing mode with little to no usability decrease.

[mayhemducks]

I was curious about this so I looked around a bit. My interpretation is that GrapheneOS still has not cracked this nut. Neither has iPhone, unless you enable "Lockdown Mode"

https://github.com/GrapheneOS/os-issue-tracker/issues/3952 https://github.com/GrapheneOS/os-issue-tracker/issues/6076

[akimbostrawman]

4G only, 4G+5G only and 5G only mode has been a thing on GOS for over a year.

https://github.com/GrapheneOS/platform_packages_apps_Setting...

5G-SA only is a separate issue which currently neither devices support.

[OGWhales]

Yeah, they really go all or nothing with the lock down mode. There are a lot of things from it I’d like to enable but not everything.

[lostmsu]

At least Pixels have the setting to disable 2G, which is on by default.

[opengrass]

Plausible. Only Rogers still has working 2G.

[mcpherrinm]

It doesn't matter what the network is doing; the phone needs to disable 2g. There's various ways to get the phone to downgrade to 2g otherwise, eg https://montsecure.com/files/2021_downgrade.pdf

Android has it as a toggle: https://source.android.com/docs/security/features/cellular-s...

iPhone disables it for phones in lockdown mode.

[Scoundreller]

And if you have a modern enough SIM+phone combo, it won’t even display the 2g network as an available network, nor 3G on my device.

I wonder if this mostly hit international SIMs, since they wouldn’t be running the same level of SIM code to prefer various network locks like a local SIM.

Helps you stay under the radar and gov services over SMS is a lot more advanced outside of Canada if you want to do some fraud.

[gruez]

>And if you have a modern enough SIM+phone combo, it won’t even display the 2g network as an available network, nor 3G on my device.

Source? It might just be that your carrier retired its 2g/3g network, not that the phone/sim refuses 2g/3g connections. If some cell tower popped up claiming to 2g/3g, your phone still might happily connect.

[Scoundreller]

source = Rogers SIM in me phone

my Telus/Bell SIM shows the 3G network tho

[lxgr]

Unfortunately, I think there's no way for a SIM card to indicate to the phone that it would like it to please never connect to any 2G (or any non-mutually-authenticated) network.

Absent that, maybe this happens via a carrier profile (or equivalent mechanism)?

[stephen_g]

That's incredible, here in Australia they not only shut down all 2G networks almost a decade ago, but they've already shut down 3G as well!

Although now looking at Wikipedia there are a lot more 2G networks sticking around than I realised, still hard for me to believe given what's happened here!

[wil421]

You do realize it’s a fake 2g/3g network and most phones don’t care. They will happily connect to whatever they support.

[lxgr]

Only if they’re not already connected to a better network, no?

[voxic11]

Funny enough its the tower that tells the cellphone modem which network is "better" and it does this in an unencrypted cell reselection message. So it is easy to force a phone to select 2G.

https://efforg.github.io/rayhunter/heuristics.html#lte-sib67...

[stephen_g]

Of course I realise that, but that’s irrelevant to my point.

The point was that I’m surprised how many real 2G networks there still are, and that one still exists in Canada at all.

[llm_nerd]

Which is interesting in that they very publicly shut down the 3G network last year.

[Scoundreller]

Probably some IoT/M2M contracts. Telus/Bell has really cut down on the spectrum allotted to their 3G that’s still up, and I doubt much is still assigned on Rogers’ 2G side.

[kotaKat]

Well, based on what I'm gleaning from https://www.smsbroadcaster.com/ (yes, they sell these brazenly in the open), I suspect they're doing some SDR shenanigans to bring up fake cell networks and leverage Cell Broadcast instead of just SMS.

https://en.wikipedia.org/wiki/Cell_Broadcast

They are also interfering with connections and attempting downgrade attacks to do 2G SMS messages as well (and is likely where Canadian carriers were picking up the 'millions' of attacks against its network and failed authentication attempts).

Amusingly this was all also caught because of Telus reviewing those SMS messages that were reported as spam from people on iOS/Android and realizing that the messages weren't being terminated inside the cell network at all when they tried tracing them out and suspected that this was the case.

[capitalhilbilly]

The original standards weren't expecting anyone but carriers to send messages and ramping up security has been a slow process, so downgrade attacks probably work nicely.

[opengrass]

Guessing the spammer doesn't want to overload towers or be foxed within the same 3 so they're driving. Maybe the hats(?) shut off on rotation... or eSIM?

[SwtCyber]

SMS is old infrastructure and the sender identity in an SMS is not like a signed email domain or an end-to-end verified chat identity. A lot of trust sits in the carrier network and interconnects