As far as I know, cell phones intermittently transmit a Mobile ID number to inform surrounding cell towers that the phone is available. Is this transmission encrypted, or would one be able to passively monitor phone IDs in an area. Also, is this transmission static over time? Does it contain phone number data? I couldn't find conclusive answers through google. Any extra info or explanation regarding communication between cell phones and towers or encoding schemes, etc would be appreciated.



After looking around this is how I think GSM networks works: 1) Phone broadcasts IMSI (not encrypted) 2) Tower responds with crypto challenge 3) Phone replies. 4) If reply passes, tower gives phone a temporary IMSI to use and communicates with that phone as long as it is the strongest tower in proximity.

As far as I know the tower tells the phone what encryption to use, so the initial broadcast of the IMSI should be readable. The issue is 99% of the time the phone will be using a temporary IMSI the tower gave it so. Is this correct? Is there any way one could tell the difference between a unique IMSI or a temp one that has been provided by the network.

My question is quite general in nature. All I really want to know if there is any way to passively gather unique phone signatures of any kind on a standard 3G network, preferably static signatures that wont change over days or months. Everything I've seen related to this is based on illegal man in the middle attacks.

migrated from electronics.stackexchange.com Sep 28 '15 at 16:58

This question came from our site for electronics and electrical engineering professionals, students, and enthusiasts.

  • This is way too vague/broad. You should at least narrow it down to a specific cell tech, e.g. GSM. In which case you can probably get good answers through google (books in particular), e.g. google.com/… – Fizz Sep 27 '15 at 5:37
  • Also, cell networks are generally encrypted, but whether you can (passively) break their encryption or not, depends on the cell tech and sophistication of the attacker, e.g. arstechnica.com/gadgets/2010/12/… – Fizz Sep 27 '15 at 6:00
  • @RespawnedFluff Excellent links, you should roll them into an answer. – tcrosley Sep 27 '15 at 7:43
  • 1
    Such equipment would be likely illegal in the us except for law enforcement. The infamous stingray creates a passive GSM network, sniffs for IMEI and the captures any cells listed on their target list. But I doubt you will find amy detailed implementation details online – crasic Sep 28 '15 at 17:18
  • 1
    The illegality is due to the fact that you will need some transmitter and yoy dont have a license. Sniffing existing GSM networks requires breaking encryption or passively interfering with licensed radio communications which is also no Bueno – crasic Sep 28 '15 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy