Reconsideration of lowest supported API about android-imsi-catcher-detector

[webcoderz]

I downloaded them all! I think they're great I understand man. No worries
hopefully we can use the knowledge gained to reverse engineer one to
properly understand its use and protocols and also to understand to what
extent of access they have.

On Sep 24, 2016 6:17 PM, "TPS" [email protected] wrote:

Sorry, @akrolla https://github.com/akrolla. I did so, but no 1 seems to
have noticed/commented/reacted, so I'm hoping this will expose it a little
more.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#34 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AS9ogUKp-bQs27G1MmePEkA2P5cQnj12ks5qta-igaJpZM4Bzkdq
.

[webcoderz]

Post this as its own issue. And refer to the documents directly not linking
to a separate issue. Its becoming spam mail.

On Sep 24, 2016 6:02 PM, "TPS" [email protected] wrote:

FWIW, #898
#898
contains docs with some Stingray details.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#34 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AS9ogat7St2iESjzZBv2EmxetKJRrG9Kks5qtawIgaJpZM4Bzkdq
.

[TPS]

Sorry, @akrolla. I did so, but no 1 seems to have noticed/commented/reacted, so I'm hoping this will expose it a little more.

[E3V3A]

Although there are some BS introduced by JB:
http://sseblog.ec-spride.de/2013/05/privacy-threatened-by-logging/

[rjh427]

I think that a fair analogy can be made to automobiles. The advancements between the Android 2.x software and the 4.x software is akin to the differences between a Model T and a modern automobile, yes with all the annoyances such as reminder chimes and more that come along for the ride. While there may be some benefit in a special version of this software for use on older hardware, that should be a secondary effort. The primary effort - at least initially - should be to make this work on modern (but not bleeding edge) hardware. I wish I had seen this to comment on the backwards compatibility issue, earlier.

[SecUpwN]

@rjh427, I fully agree with your reasoning. And hats off to @E3V3A having the balls to admit that the initial decision was not the best. I fully support the point that it is important of having AIMSICD work on newer hardware (not necessarily bleeding edge). At tjis point I really feel sorry for @xLaMbChOpSx, who is currently the leading (and only) developer doing these changes. What is your opinion on all this, @xLaMbChOpSx? I strongly encourage everyone to review and comment on Issue #1 again as I would LOVE to have some type of fully anonymous funding for people like @xLaMbChOpSx in place.

Although over here in Germany people are tought to always have the "laterst and greatest phone" (especially Vodafone is yelling this out to the people through annoying ads on Spotify), I am one of the people who do not have to jump on that train and are fully satisfied with their phone as long as it works. I had my HTC EVO 3D for about 3 years, I expect my HTC ONE to last for about 4 - 5 years. When analyzing the statistics of how many people use which API (see Android Dashboard and for a more detailled page Android Distribution, I can see that API 16 is decreasing and people (of course) tend to get a newer device. To make it short, I'll vote for rising the API again, even if it might be a pain the ass.

Personally speaking, I don't think we don't have a large user base because of the lack of API support, but simply because people are not aware of the fact that IMSI-Catchers are that much of a threat. Also, IMSI-Catchers have been hardly covered by media (in fact, several agencies and the government never wanted the public to know about them, people only got fully aware of them when the magazine "Der Spiegel" wrote a cover-up about it). Simply take a look at any security-related project and you'll notice that people are either too lazy to use it (lack of comfort), or simply think they don't need it because they've "nothing to hide". This "I-have-nothing-to-hide"-Attitude is especially strong in Germany, I wonder if people just say that because they think privacy-aware people are "paranoid" or because they're afraid of accepting the reality of state-sponsored complete and fully automated surveillance. Having said that, we shouldn't worry much about not having a huge fanbase. The time will come that something happens that makes people again fully aware that IMSI-Catchers are used on a DAILY BASIS (in fact, I do think that the numbers of usage submitted by the agencies are FAKED) and then everyone will want to have AIMSICD on their phones. And hey, my pals already use AIMSICD and are proud of it! 😺

[E3V3A]

In addition there is one very good technical reason. API 16 allows for getting the TimingAdvance (TA) parameter. It's only one of several we'll need, but may simplify other things somewhat.

CellInfo.java: mTimingAdvance:

https://android.googlesource.com/platform/frameworks/base.git/+/jb-release/telephony/java/android/telephony/CellInfo.java

[He3556]

There are many professional users out there, who would love to have a AIMSICD APP. I think about about journalists, lawyer and people working in "dangerous" countries and of course the activists living there. Maybe i am a little bit naive to think only friendly people want to use the APP. But it's not on me to judge anybody - and you can't attack somebody with our technology, so i have no problem with it :) Here in Germany not all people care about it but i think - still more people than in other countries. Our history is so awful bad, the skepticism against interception and monitoring continues to the present. But ok - there are still lot's of brain dead people here. But no officals would try to go to the ccc congress to hire h@ckers, like the n$@ does on the blackhead congress. But it would be a funny attempt :) Did you hear about Stingray [http://www.huffingtonpost.com/2014/03/23/cops-phone-tracking_n_5016862.html]
One more company is making big money with selling this to the man in blue and others but under a new name :) i couldn't find a difference to the old catcher. But maybe there is one?

[xLaMbChOpSx]

I am happy to move forward with whatever you think is best I agree with all of the posts here concerning increasing the minimum sdk version, it can provide a number of items which we currently can not access and also will enable the removal of depreciated items.

[SecUpwN]

@xLaMbChOpSx, I am still extremely thankful having you in our project. God bless you! As you can see, raising the minimum SDK version to API 16 is a great step forward. Please do so when you find time to do it. Although progress is slow at times (man, the weather outside as well as friends and work keep me very busy) I think we're doing great in maintaining this. @E3V3A, I know it sound harsh saying this and I know you'd love to be more action here. But hey, we're on it! Hope you see that things are moving. ;-)

@He3556, your comment made me laugh - do you really think that there are no undercover agents visiting the CCC? Hope you're not surprised if I tell you they are. And some of them are well known hackers of the community. Those undercover agents are sometimes working for 25 years in crappy posotions until they are considered to be "insiders" and get the real valuable information. Expect everything to be tapped, man. You run your own website about smartphone security and still have these "naive" thoughts? I'm shocked! ^^

[He3556]

@SecUpwN Well, you miss understood me. I was saying "But no officals would try to go to the ccc congress to hire h@ckers," - I was talking about agents "on stage" or in workshops asking people to join there organization. That doesn't mean there are no agents at all - as long as there are undercover - there are not on stage ;) But in USA they are speaking to the people as officials. But i might me naive when it comes to organized crime. I was talking about the potential users of our APP. We can not decide who will use our APP, thats all. And seriously... this "officials" in our country :) I am not naive enough to say what i think about them here on GitHub... but back to the project... I hope i will find some time to get my HTC ready for testing the APP soon.

[xLaMbChOpSx]

@SecUpwN @E3V3A sounds good to me I will increase the minimum sdk level to 16 and remove any depreciated methods etc that were used for the lower sdk compatibility, the CellInfo class is also quite interesting as it allows access to some details such as signal strength without the need to first create a listener.

[SecUpwN]

THANK YOU, @xLaMbChOpSx. Let me know if I can help in any way.
Please close this Issue once the API has been raised to the discussed level.

[SecUpwN]

@E3V3A, I am making an exception for user Chad here, who posted the following on Aptoide:

Posting a comment via the website/GitHub is a joke based on all the details you have to give while being careful not to duplicate previous bug reports, so I'm posting here on good old Aptoide. I understand this app is being actively developed so it won't be compatible with all models. It currently is not compatible with my make. The minimum sdk required is 16 I believe and I have 15. My phone model is a Samsung GS2 t-989 if that's any help. This app looks awesome, I hope it can get optimized for older phone models. In the meantime good luck developers and thank you for helping combat unconstitutional spy tactics.

Please let me know if it makes sense going lower or what else you would suggest. Thank you.

[E3V3A]

No sense at all.

[TPS]

FWIW, #898 contains docs with some Stingray details.