Is originating number tied to an SMS from a mobile phone?

Question

I've been working with an SDR (software-defined radio) as part of a computer security class project. We've been wondering if, let's say a mobile phone associates with the SDR (which is operating as a fake BTS), and then tries to send an SMS, then would the SDR be able to pick up the originator address (as the mobile phone number) from this number?

In the first place, does a mobile phone know its number at all? Or does it only know its TMSI number? How does it identify itself when it sends an SMS to its GSM provider's BTS then?

Answer 1

Phones don't even know their phone number. Sure, there is a number field in the SIM card that can be updated remotely by the carrier, but most importantly there is no guarantee that field is even set or is set to the correct number. Phones identify themselves to the network using the IMSI of the SIM card (and proves that it indeed is the card associated to that IMSI by crypto based on the card's symmetric KI key) and from there use the random TMSIs assigned to them by the network.

The numbers are added by the mobile network infrastructure down the line. You can very well have multiple numbers tied to a single SIM card and phone, and you can theoretically change your number in a matter of seconds (though in reality most mobile network infrastructure is legacy crap that won't allow it, but technically there is nothing preventing this from happening if carriers were using decent software).