Remix.run Logo
neuroelectron 3 days ago

This guy claims that it's not that suspicious and not a state-backed operation.

https://x.com/ErrataRob/status/1970586083374112784

mike_d 3 days ago | parent | next [-]

I am very familiar with the hardware being used in that operation and Rob is 100% correct.

Someone used an online SMS service to send threatening messages to a member of the Gleichschaltung squad, and the secret service traced the SIM card back to one of these rented apartments. The reason it was linked to a "Chinese state sponsored blah blah blah" is because most Chinese criminal operations in the US have some indirect benefit to the Chinese government, which is why they are allowed to operate.

You could use this hardware to launch some sort of a flooding attack, but given the density all you are going to knock out is the one cell site all your devices are talking to. If China wanted to knock out cell service around the UN they would use the hundreds of thousands of backdoored Android phones in New York to launch a more distributed attack.

JackFr 3 days ago | parent | next [-]

I not familiar with any of it, so I’m willing to take your word, but doesn’t the scope raise some eyebrows?

Using the prices quoted in TFA they’re talking about $900,000 in servers and another $500,000 in SIM cards, before labor, rent and electricity.

Is that sort of outlay typical for phone scammers.

Also on a technical note is there an advantage to having all your sites in the NYC area? Is it simply that there’s enough cell traffic, the bad actors illicit traffic won’t stand out?

rootsudo 3 days ago | parent | next [-]

No way, whatever the sim hardware cost is and the sim service per month for the carrier.

NYC is just high density, remember cell means cellular so the towers are configured for high traffic and more fall back, also being easy to go around in general, airports etc

Esims go for $5-10 a month. Hardware is less than 20k max. Apartment and general utilities are a sunk cost.

mike_d 3 days ago | parent | prev | next [-]

It was maybe $50k in hardware at each site.

They operate a bunch of cellular modems that send SMS spam, receive SMS verification codes for creating fake accounts, and use the data to act as proxies for web scraping and other nonsense. It isn't criminal, but it isn't exactly ethical either. But it is profitable.

You have to go swap out some of the SIM cards every day to get new numbers, so you need to balance spreading your locations out across multiple cell towers for throughput, but also needing to be within reasonable travel distance.

monerozcash 3 days ago | parent | prev | next [-]

>Is that sort of outlay typical for phone scammers.

Really yes. If they're just selling VOIP routing to the US, they can sell essentially unlimited amounts of it. The more you invest, the more you profit. Grows organically and exponentially.

VectorLock 3 days ago | parent | prev [-]

Each one of those units is probably ~$6k for the device and sim cards. I don't think there were that many of them in the pictures to add up to $900k.

JackFr 3 days ago | parent [-]

The article describes 300 servers and 100,000 SIMs across a handul of locations.

VectorLock 3 days ago | parent [-]

In some countries you can find entire office blocks filled with people who do nothing all day but participate in scam enterprises. I don't think the scale of this phone bank, if its as described, is that surprising really.

3 days ago | parent | next [-]
[deleted]
Yeul 3 days ago | parent | prev [-]

They made cold calling illegal in my country. Also you cannot just sell customer data. It made an entire industry disappear and nobody mourned.

But I'm sure some American lawyer would call that a breach of the constitution.

hsbauauvhabzb 3 days ago | parent [-]

How does your country protect against callers and data sales outside of its jurisdiction?

sschueller 3 days ago | parent | prev | next [-]

The SS is either incompetent and watches too many movies or they are deliberately trying to spin this as some state actor terrorism thing.

Does anyone remember the Boston mooninite panic? This is exactly the kind of incompetence I can think of over at the secret service.

boltzmann-brain 3 days ago | parent | prev [-]

ok, fine, then why place it in NYC? it's a mobile phone, it could be anywhere.

stackskipton 3 days ago | parent [-]

NYC has cellular density for bandwidth to be available and enough traffic so this does not raise red flags with mobile operator. Do this in nowhere Oklahoma and providers would probably notice very quickly.

VectorLock 3 days ago | parent | next [-]

Probably a lot of places to buy MVNO sim cards from with cash as well.

boltzmann-brain 2 days ago | parent | prev [-]

Then why not another tech hub like SV or Seattle?

salmon a day ago | parent | next [-]

There are undoubtedly SIM farms there too. They just didn’t happen to catch the eye of the feds yet

monerozcash 2 days ago | parent | prev [-]

Because you happen to live in NYC.

AnotherGoodName 3 days ago | parent | prev | next [-]

Can’t read it since I don’t have a login there but i’m guessing they buy sims from all over the country and sms on matching prefixes since people will assume a local number is less likely to be spam.

This explains using such a bank. You want to cover as many prefixes as possible and you can’t match area codes with traditional sms services.

jghn 3 days ago | parent | next [-]

You can also see his takes on bsky [1] or h blog he posted there [2]

[1] https://bsky.app/profile/erratarob.bsky.social [2] https://cybersect.substack.com/p/that-secret-service-sim-far...

AnotherGoodName 3 days ago | parent | next [-]

The second link there is much more meaningful.

I actually did see the tweet in full it turns out. It's just that there's not much content so i figured "oh it's one of those twitter thread chains i can't read".

jghn 3 days ago | parent [-]

FWIW I have found him to be a good follow over the years. Unfortunately he mostly only posts on Twitter & not Bsky so I only see his stuff when he crosses over to bsky.

therein 3 days ago | parent | prev [-]

Good post, also they use Quectel because it allows changing IMEI with a single AT command.

perching_aix 3 days ago | parent | prev | next [-]

These days the way to go is social media proxies. A popular one is xcancel. Just replace the x in the domain with xcancel and you'll land on a proxy site (somebody's Nitter instance to be specific): https://xcancel.com/ErrataRob/status/1970586083374112784

Still not gonna help if you have cookies disabled because of the rate limiting, but hey.

dmd 3 days ago | parent | prev | next [-]

I love how spammers do that- it works out great for me. I no longer live in my phones area code. I block the entire area code, which catches a huge amount of spam calls.

IG_Semmelweiss 3 days ago | parent | next [-]

this is a required hack, for any founder

SO much value in being able to root out garbage sales calls

esseph 3 days ago | parent | next [-]

You don't even need to be a founder, just a person in a position that people may believe is responsible for buying products and signing checks at a company.

brookst 3 days ago | parent [-]

With marginal cost of spam being $0, I am pretty sure homeless people and Bill Gates get exactly the same amount of spam. I’d be surprised if there was any target selection.

esseph 3 days ago | parent [-]

LinkedIn scraping is rampant.

dmd 3 days ago | parent [-]

It really is. I don't have my phone number on there, obviously, but when I went from being a random code monkey to having a 'Director' title at a very large institution, my sales spam went from 0 to probably 50 pieces a day.

trod1234 3 days ago | parent | prev [-]

Also need to do something about the inherent insecurity of most phones. GrapheneOS being a pretty decent solution nowadays to control those errant radio signals won't help against profiling for your next oil change/maintenance with those TPMS sensors beaconing everywhere you go.

slumberlust 3 days ago | parent | prev [-]

Same. The only downside is local contractors will also screen you, but most call me back when I leave a message insisting I'm local and give my address.

LargoLasskhyfv 3 days ago | parent | prev | next [-]

If for some reason your browsing environment isn't/can't be configured to circumvent login shenanigans, at least for now, xitter can be read by inserting cancel right behind the X-part of the URL. Like so:

https://xcancel.com/ErrataRob/status/1970586083374112784

With the additional advantage of giving you a view more like threadreader.app, or something. Without having to install anything.

ljf 3 days ago | parent | prev | next [-]

Things I learnt today: that mobile phone numbers in the USA are 'local'

Here in the UK, all landline residential numbers start with an area code that starts 02 for London and 01 for the rest of the coountry (eg 020 for London and 0114 for Sheffield).

Mobile numbers here all start 07 here, and the first 5 digits are carrier specific - but so many people port their numbers that it becomes meaningless pretty quickly. But years ago you could spot a number an know what provider the caller was on.

---

Are residential and mobile numbers similar in the States?

sksksk 3 days ago | parent | next [-]

> all landline residential numbers start with an area code that starts 02 for London and 01 for the rest of the coountry

02 dialling codes are used in more than just London; Northern Ireland and Coventry phone numers start with 02 for example.

hdgvhicv 3 days ago | parent | next [-]

Go back far enough at London was 01 and the rest 02-09. London, Birmingham, Manchester and a few others were 7 digits (041 xxx xxxx for Glasgow)

Then London changed to 081/071, then all changed to 01xxx (eg 0564 to 01564, 081 to 0181), then finally London, Southampton, Belfast and a few others mixed to 02x and 8 digits.

03 became national geographic numbers and things like 0345 and 0500 were phased out, 0800 remained free but not always with mobiles, 0845 was “local” but was basically premium, 0870 was even more, 0898 was super premium etc

But as phones took off in the 00s everyone just had 07 with 9 digits. Not sure when that will fill up, but it feels like a billion numbers is enough for now.

ljf 3 days ago | parent | prev [-]

I stand corrected, I didn't know that - but it is a while since I've paid attention to phone numbers like I used to.

dboreham 3 days ago | parent | prev | next [-]

Yes. There's no obvious way to differentiate between a mobile and a non-mobile number in the USA. Numbers are "somewhat local" in that the first three digits usually correspond to a strict geographical area. However that's not a guarantee since if someone moves to another area/state these days the mobile providers will let them keep their number.

petesergeant 3 days ago | parent | prev | next [-]

Also traditionally American cellphone users pay to receive calls, which will blow the mind of a Britisher.

rkomorn 3 days ago | parent | next [-]

And text messages.

It was very shocking to me how many minutes cell phone plans had in the US when I moved there (it was ... a while ago) compared to France.

But also: in the US, calling someone on their cell cost the same as calling someone on a land line. In France, calling someone on their cell from a land line was something like 4x more per minute.

Really, the structure of phone costs (both land and cell) in the US was quite different.

hdgvhicv 3 days ago | parent [-]

In the 90s local calls and thus Internet was free in America, where in the U.K. it cost upto £5 an hour (in today’s money) to be online.

rkomorn 3 days ago | parent [-]

Yep. France was similar to the UK. I spent years online between 10pm and 6am to use our dialup at the off-hours cost (which wasn't free, but significantly cheaper).

Not the good old days of spending money to browse the internet at 28.8kbps.

palmotea 3 days ago | parent | prev [-]

> Also traditionally American cellphone users pay to receive calls, which will blow the mind of a Britisher.

IIRC, we had to pay for any kind of use on a cell phone use (both to make and receive calls), which is probably stemmed from them being considered premium devices when they were introduced, with a lot of expensive fixed infrastructure you'd use no matter the direction of the call.

silvestrov 3 days ago | parent | prev | next [-]

Denmark went 2 steps further: we no longer have area codes and all phone numbers can be mobile or landline.

In old days the numbers were distinct but these days the overview just says "mostly mobile" or "mostly landline": https://digst.dk/media/x3tmvqsl/nummerplan_2020_farver.pdf

jmyeet 3 days ago | parent | prev [-]

Cell phones evolved differently.

The UK (and Australia) set up a separate prefix for mobile calls. They were more expensive to call. You also knew if you could text someone because it was a mobile number.

The US had analog cell phones for longer and they were introduced to be in the same area code so counted as a "local" call (vs "long distance") for anyone calling that number. The receiver also paid to receive that call, originally.

I honestly don't know how landlines are charged now. It's been probably 20 years since I've had one. Some cheaper cell phone plans might have limited minutes but it's way more common to have unlimited talk and text to any US domestic number (landline or cell).

Oh we had 1800 that were "toll free" meaning they didn't incur long distance charges, originally but this doesn't really apply now. Also, they ran out of 1800 numbers so pretty much anything 18xx is a toll free number.

Note the 1 in front too. That's also a US thing. It technically indicates you're making a "long distance" call. More specifically, you're specifying an area code.e Modern smartphones don't generally require you to type in the 1. Old phones did.

So if you were on a 718 number and call someone else on a 718 number, you could just use the 7 digits of their number. This isn't something people really do anymore. But if you had to call a 646 number you'd put in 1-646-123-4567 back in the day.

By the way, the cell phone numbers being in a given area code explains this joke [1].

Oh the UK/Australia system had its issues too, like it mattered if you were calling from Vodafone to another Vodafone user or if it was an Orange or BT cutstomer because you were charged differently and it could count against different free minutes pools. And you really had no way of knowing.

I don't believe the US had that kind of issue or, they did, it was so long ago that nobody remembers.

[1]: https://xkcd.com/1129/

vinay427 3 days ago | parent | next [-]

> I don't believe the US had that kind of issue or, they did, it was so long ago that nobody remembers.

There is still a similar issue of not knowing whether an area code is for another country in the North American Numbering Plan. It’s fairly common for me to see an unfamiliar number and be unsure whether it’s from the US or Canada, for instance, without additional context.

ljf 3 days ago | parent | prev [-]

Thank you for this - these are the kind of facts that really scratch a mental itch for me.

justahuman74 3 days ago | parent | prev | next [-]

> since people will assume a local number is less likely to be spam.

Local number has become an spam signifier for me

VoidWhisperer 3 days ago | parent [-]

The funny thing for me is that I still have the phone number I had when I was growing up, which is for a state halfway across the US. Most of my spam calls are in the area code of my phone number, making them pretty easy to recognize since I dont really know anyone from that area code anymore

1vuio0pswjnm7 2 days ago | parent | prev | next [-]

"Can't read it since I don't have a login there..."

https://nitter.poast.org/ErrataRob/

motoboi 3 days ago | parent | prev [-]

You don't need a login to read a single tweet.

edoceo 3 days ago | parent | next [-]

Twitter is inconsistent for me. From the mobile (FF, not authenticated) it's blocked but from desktop (FF, not authenticated) is visible.

therein 3 days ago | parent [-]

With Google referrer, it loads even more often, even on mobile I believe. Same for LinkedIn. It will not authwall you if you're coming from Google.

AnotherGoodName 3 days ago | parent | prev [-]

Thanks! I was assuming it was a chain with more details than i saw there.

is_true 3 days ago | parent | prev | next [-]

I thought it was someone running a mobile ip proxy

dilyevsky 3 days ago | parent [-]

"residential" proxies, ad clickbots, instagram/twitter bots - lots of "legit" use-cases these days

codedokode 3 days ago | parent [-]

Ad clickbots are a win-win though? Make ad less profitable.

tosapple 3 days ago | parent | prev | next [-]

I believe that's rob from blog.erratasec.com.

The site may be being hugged to death currently i can see posts on ddg but it can't be reached.

romperstomper 3 days ago | parent | prev | next [-]

An interesting choosing of words - "It's just normal criminal enterprise for sending SMS spam and anonymous messages." It doesn't look anyway "normal" as for me. I feel that this guy just says me "move along, nothing to see here" and resembles some South Park absurdity tbh. As for me it looks quite advanced (though I'm not an expert here) for just sending spam messages.

netsharc 3 days ago | parent [-]

You admit to not knowing what tech these criminals have, and then on the basis of that you conclude "it doesn't look normal to me"..

It's like landing in Saudi Arabia and saying, "All the women here wear head covering, that doesn't look normal to me"...

Meanwhile on the flipside the authorities hype it up to be some state-sponsored threat, as if to say "Look citizen, your very competent government is keeping you safe! Trust us!"

romperstomper 3 days ago | parent | next [-]

Well.. my judgment was based on the facts from the article, which are mostly about the amount and sophistication of equipment. I also read more facts from this link posted there as a reference https://apnews.com/article/unga-threat-telecom-service-sim-9... - they mention 300 SIM servers and 100K SIM cards which is quite impressive as for me. Also, for some reasons all of this is clustered around the UN facilities (in 35 miles radius). Even if all of this is related to spam only activities this is quite a large investment as for me and that's why I'm not really convinced this is just some "normal" thing to see.

neuroelectron 2 days ago | parent | prev [-]

I think $1 million in basically abandoned, anonymized equipment is clearly not normal.

d--b 3 days ago | parent | prev | next [-]

Yeah thanks, that makes more sense. The devices probably are in New York because of the high antenna density which makes it easier to actually not jam the cell towers.

The secret service spun it as a terror threat in the same way your orthopedist tells you your teeth problem comes from bad posture.

I mean, the thing might be used to jam the networks (one would have to check that the devices still work when using all the antennas simultaneously), but that really sounds like an awful lot of effort for a disruption that’s neither guaranteed nor that distuptive. I mean, this would create some chaos for sure, but law enforcement and emergency services use radio to communicate. 99% of businessses use wired phones. So this would mostly affect what? deliveries?

A large scale spam operation is way more plaisible.

That the secret service is directly under Trump may also explain why they spun it as potential terrorism stuff. it’s part of their effort to make people believe that America is under terror threat, so that they can legitimize power grabbing…

3 days ago | parent | prev | next [-]
[deleted]
leric 3 days ago | parent | prev | next [-]

[dead]

billy99k 3 days ago | parent | prev [-]

[flagged]

lovich 3 days ago | parent [-]

> This story is nonsense.

> It's just normal criminal enterprise for sending SMS spam and anonymous messages. Somebody used this service to send SMS threats to some politicians, so the Secret Service traced it back here. They are describing it as some special political threat ("35 mile radius from the UN") when it's just perfectly normal criminal enterprise.

> We know it's a crap story because to the way the New York Times story on this cites anonymous sources in the administration, and then James A. Lewis to confirm it. This guy, formerly of the CSIS think tank, is the the NYTimes regularly trots out to confirm cybersecurity claims by anonymous government officials.

> Ir's just normal crime folks, there's absolutely none of the threats here that they claim.

Why did you put quote marks around the word “legitimate”, like he said the word in his post?

boomboomsubban 3 days ago | parent [-]

>Why did you put quote marks around the word “legitimate”, like he said the word in his post?

They do say that in the associated blog post, though they don't seem to think it's likely to be legitimate. https://cybersect.substack.com/p/that-secret-service-sim-far...

firesteelrain 3 days ago | parent [-]

It does note via screenshot at bottom that these devices are often seen in Russia. Not sure what that means