How I hold my cellphone protected towards stingrays (not that sort)

Abstract

Stingrays trick iPhones and Android units alike into sharing delicate data, notably your IMSI quantity, which can be utilized for identification and monitoring.
Android has optionally available protections like disabling 2G and blocking unencrypted communications, however assist is dependent upon the precise cellphone you may have, and which model of Android it is operating.
iPhones have fewer defenses towards stingrays except you allow Lockdown Mode.

It has been over a decade for the reason that begin of the Snowden leaks, which uncovered mass surveillance packages within the US. I point out this as a result of one of many smaller issues Snowden (and others) drew consideration to is the usage of “stingrays,” often known as IMSI catchers. Police, army, and intelligence companies have sometimes used these to intercept knowledge on cellphone customers with out their data — and criminals could now be making use of the expertise as properly.

All this makes it clever to be taught a little bit bit about how stingrays work, and how one can defend your iPhone or Android machine towards them, since nobody has an inherent proper to intercept your cellphone visitors with out a warrant. What’s attention-grabbing is that in the meanwhile, Android 16 appears to supply a bonus on this space — although Apple will presumably catch up ultimately.

Associated

Do you really need to worry about spyware on your phone?

It is a matter of the place you reside, what you do, and what your safety habits are like.

What’s a stingray, and the way does it work?

Preying on hidden vulnerabilities

Unsplash

The very first thing to level out is that legally talking, the time period “stingray” derives from a selected product — the StingRay, made by the Harris Company. It is so much simpler to speak about stingrays than IMSI catchers, nonetheless, so the product grew to become a catch-all time period, a lot as some folks confer with all facial tissues as Kleenex.

Functionally, stingrays trick your cellphone into connecting to them by pretending to be a close-by mobile tower. As soon as that occurs, it is doable to extract delicate knowledge, together with your cellphone’s IMSI (Worldwide Cellular Subscriber Identification) quantity, which can be utilized to determine and observe you. Stingrays can also be used to gather metadata, and in some circumstances, the precise content material of communications. Extra not often, stingrays are used as offensive weapons, say to conduct denial of service (DoS) assaults.

Any mobile machine inside vary of a stingray is vulnerable to connecting to it, so your knowledge could also be snatched up even once you aren’t an meant goal.

This will all sound like one thing your cellphone ought to have the ability to defend towards, however stingrays can dupe your cellphone into utilizing a protocol with weaker safety, as an example by briefly switching you from 5G to 2G, which most carriers have deserted. Usually, automated hopping is an efficient factor — it retains you linked as you progress between areas with totally different protection. But when it isn’t dealt with correctly, it will probably turn into an assault vector.

One of many terrifying issues about stingrays is that they are non-discriminatory. That’s, any mobile machine inside vary of a stingray is vulnerable to connecting to it, so your knowledge could also be snatched up even once you aren’t an meant goal. This and different points have drawn the eye of scrutiny of teams just like the American Civil Liberties Union and the Digital Frontier Basis. There’s extra to elucidate than I can presumably go into right here, so I encourage you to be taught extra, notably in the event you’re planning to affix a politically delicate protest.

Associated

Packing light? Do these 4 things on your iPhone first

How I travel-proofed my iPhone.

The way to defend an Android machine towards stingrays

The perfect safety is reserved for the most recent units

A very powerful factor is protecting Android up-to-date, and being conscious of its anti-stingray choices. For those who’ve obtained Android 12 or later, you possibly can disable 2G connectivity utterly by going to Settings -> Community & Web -> SIMs, selecting your SIM, then toggling off Enable 2G. Don’t be concerned — most cellphone carriers have switched solely to 4G and 5G, so you will not discover any calls, texts, or knowledge interrupted. Certainly even 3G networks are being deprecated, since they’re too gradual to maintain up with the calls for of recent apps.

Android 14 expands this safety with an possibility to dam “null ciphers,” i.e. unencrypted communications. There isn’t any authentic motive to be utilizing unencrypted knowledge anymore, given how harmful the web may be, so disabling null ciphers is an apparent method of mitigating the specter of stingray assaults. Android 15 takes yet one more step ahead, enabling a notification each time a community asks for distinctive machine identifiers, or forces weaker safety.

The one zero-risk possibility, although, is to dam mobile exercise solely.

Android 16 features a Cellular community safety web page to centralize issues, which it is best to have the ability to attain through Settings -> Safety & privateness -> Security Middle. There is a massive catch, nonetheless — it solely seems on units with explicit modems, and model 3.0 or later of Android’s IRadio {hardware} abstraction layer (HAL). You are unlikely to see the web page in any respect, even in the event you personal one thing as latest as a Pixel 9. You will have to attend to your subsequent cellphone improve to check this out.

The excellent news right here is that many Android telephones ought to assist disabling 2G, at the least. It is simply much less handy and safe than what the most recent and best Android 16 units are able to.

For those who’re in a high-risk scenario, there are apps that may doubtlessly warn you about stingrays, reminiscent of SnoopSnitch. The one zero-risk possibility, although, is to dam mobile exercise solely, and that applies to each iPhones and Android units.

Associated

Is it safe to use Apple AirTags?

The dangers are often very low, however you want to pay attention to them.

The way to defend an iPhone towards stingrays

Time to play catch-up

Enabling Lockdown Mode on an iPhone. — Apple

Apple

iPhones are lagging behind in the case of stingray safety, however they are not defenseless. You’ll be able to, for instance, go to Settings -> Mobile -> Mobile Knowledge Choices -> Voice & Knowledge and select both 5G On or LTE. The 5G Auto possibility does enhance battery life, however will increase your possibilities of being kicked right down to a much less safe community.

For those who use that step, you may additionally need to go to Settings -> Mobile -> Community Choice and disable Automated, however be warned — this selection can create havoc. You could end up unable to roam home networks, and you will have to manually choose a service once you journey overseas. It is in all probability not well worth the trouble.

That is partly as a result of in iOS 16 or later, Apple provides a function referred to as Lockdown Mode. This allows a large set of safety measures, principally meant for journalists, dissidents, and others vulnerable to being focused by authoritarian regimes or international governments. For those who’re really frightened about stingrays, although, Lockdown Mode forcibly disables 2G, and limits how your iPhone can work together with the surface world. It is so draconian that it is best to keep away from it except completely mandatory — even many web sites and Messages attachments will not work.

It isn’t clear but whether or not iOS 26, coming fall 2025, will provide any enhancements to stingray safety. I am anticipating Apple to meet up with Android in some unspecified time in the future, nonetheless, for the reason that firm prides itself on safety and privateness.