Wireless Hacking Device Causes Bomb Scare in Paris, Leaves More Questions Than Answers

On December 30, 2022, French authorities were conducting a security check outside Strasbourg Saint-Denis metro station in Paris when a vehicle was stopped for a routine check. Upon checking the car, officers found a suitcase in the trunk that contained cables and antennas, according to French media outlet el Parisien.

The police then noticed the presence of several telephones and an installation including white antennae. A box containing a device that may resemble a bomb was found in the trunk. Have demining services been dispatched to the site? 2/2 pic.twitter.com/e8isfMMhMy

— Amaury Bucco (@AmauryBucco) December 30, 2022

The bomb squad teams, not knowing what the device was at the time, decided to carry out a controlled detonation to destroy it, believing it to be an explosive device. The driver, an unidentified woman, was arrested under the influence of drugs. The car, which was not registered in her name, was confiscated by the authorities.

The next day, French journalist Amory Boucot reported on Twitter that police had opened an investigation into the incident because “the box contained professional spy equipment.”

What was the device?

According to the Twitter page Hacker Fantastic, the device was a professional but outdated build for “finding equipment and subscriber details (IMSI/IMEI) over a large area, at least several city blocks”. The IMEI is International Mobile Subscriber Identity, which is a unique number used to identify a specific user on a cellular network, and IMSI is International Mobile Station Equipment Identity, which is a unique identifier for cellular and satellite phones. This means the device intercepted and collected mobile phone traffic and tracked mobile phone users’ location data.

IMSI catcher, depending on output power, this device can locate equipment and subscriber details (IMSI/IMEI) over a large area, at least several city blocks. Price $50-100k and up. pic.twitter.com/99qgNpgSUk

— hackerfantastic.crypto (@hackerfantastic) January 2, 2023

Hacker Fantastic broke down the components of the device in a post saying that “It’s so beautiful, power modules on top, cooling fans, what looks like modular radio blocks, an amplifier, a filter, an SDR radio and the icing on the cake is a ‘bait’ antenna system , made to look like a hotspot. Whatever they’re hacking with this, someone spent money to build it.

“The antenna system is either this decoy hot spot or the hot spot is being used for control by another device because it has power and another cable going to it. I’m jelly anyway, someone was arrested spying in the field and now he’s left out in the cold,” they added.

Hacker Fantastic concluded by saying, “I’m surprised people still use these antics in the field, they are effective but very noisy and not discreet. It’s 2022, it was the peak of surveillance technology a decade ago.”

This case is very interesting because IMSI catchers are commonly used by law enforcement (look for Stingrays in the US) and intelligence agencies to intercept phone calls and collect location data, but in recent years we have seen increased use by criminal organizations. According to of the Congressional Science, Space, and Technology Oversight Committee, criminal groups have largely used the technology to disrupt GPS and cellular networks, but it can also be used to collect financial information or information that can be used for extortion .

It remains unknown whether this device was used for criminal or intelligence purposes. Although it was not close to any embassies, the area where the car was located was surrounded by shopping areas, hotels and restaurants. The whole situation is weird and could lead down a bunch of different rabbit holes depending on the motive, but the investigators are going to have an increasingly difficult time now that their main piece of evidence has been blown.

I find this case very interesting and unique and will try to provide updates if new information is released.