Phishing with Intelligence Devices

SGGP 05/04/2023 09:14

Liberation newspaper (France) recently published an investigative article about fraud using new technology - with technology devices that can be easily purchased from China - causing concern for the French government.

Imsi-catcher device for intelligence or special units

According to the article, on the last day of 2022, a car driving very slowly, the rear window covered by a large gray box, attracted the attention of the police in the 10th district of Paris. When checking, they discovered a safe with many Chinese characters, connected to the trunk with red wires. Meanwhile, in the front seat, an electric cable was connected to the hood. The driver confessed that he was paid to roam the streets of the French capital. Nearly 2 months later, the police seized a similar device in an ambulance. The driver said that an anonymous person on Snapchat paid 1,000 EUR/week to drive around Paris, in crowded places such as the Champs-Elysées, the Eiffel Tower, Haussmann Avenue... and even in wealthy suburbs.

Technical analysis shows that the device is an Imsi-catcher for intelligence and special units of the police and gendarmerie, which helps collect all mobile phone numbers within a radius of 200 meters. This machine simulates a fake relay antenna, inserted between the phone and the network antenna. The victims' phone numbers disappear from the network for a few seconds to a few minutes and the Imsi-catcher switches from 4G to the less secure 2G, to send fraudulent messages. From September 2022 to February 2023, over 240,000 Orange customers had their numbers collected. The machine sends a series of fake SMS messages pretending to be health insurance, asking to update cards and bank accounts.

Collecting phone numbers is also used as the basis for more sophisticated scams. Minutes after receiving an SMS, a person claiming to be a bank consultant calls back, tells the victim the message is fake, asks to file a complaint immediately, and then transfers the phone to a person claiming to be a police officer. The victim is asked to hand over all valuables and bank cards, because they suspect a break-in. Most of the victims are elderly. Investigators have tracked down Abdoulaye K. and Mohamed M., the owners of Scion Data Agency, a company that specializes in “digital marketing.” Its website boasts that it has 20 million phone numbers and can “send bulk messages.” Both have been detained.

Where did this spy device come from when its sale and use are strictly regulated in France? The two suspects admitted to buying it from China, but did not reveal the seller. Checking the transactions, the police discovered a transfer of 18,430 EUR to an account named Kevin Y. in China. This is the seller of the eavesdropping devices, with offices in China, the UK, Peru and Dubai (United Arab Emirates). Scion Data Agency is Kevin Y.'s agent in France. Kevin Y.'s company also has many similarities with another company specializing in the defense sector, which not only sells eavesdropping devices but also supplies weapons. This person is also the "contact point" for a number of Chinese technology companies abroad.

According to Liberation, the indiscriminate use of Imsi-catchers is worrying. In France, only a special commission called R226, established in 2015, has the right to issue licenses, and the number is limited: 70 for the Ministry of the Interior , 20 for the defense. However, Liberation's investigation shows that buying this device is now very easy. It is not even necessary to go to the Dark Web (a part of the internet that is not publicly available, not accessible through regular search engines like Google and can only be accessed through special software or through a virtual private network - VPN), just a few clicks are enough to buy from China and receive it by post.

Source