As far as I know, cell phones intermittently transmit a Mobile ID number to inform surrounding cell towers that the phone is available. Is this transmission encrypted, or would one be able to passively monitor phone IDs in an area. Also, is this transmission static over time? Does it contain phone number data? I couldn't find conclusive answers through google. Any extra info or explanation regarding communication between cell phones and towers or encoding schemes, etc would be appreciated.
After looking around this is how I think GSM networks works: 1) Phone broadcasts IMSI (not encrypted) 2) Tower responds with crypto challenge 3) Phone replies. 4) If reply passes, tower gives phone a temporary IMSI to use and communicates with that phone as long as it is the strongest tower in proximity.
As far as I know the tower tells the phone what encryption to use, so the initial broadcast of the IMSI should be readable. The issue is 99% of the time the phone will be using a temporary IMSI the tower gave it so. Is this correct? Is there any way one could tell the difference between a unique IMSI or a temp one that has been provided by the network.
My question is quite general in nature. All I really want to know if there is any way to passively gather unique phone signatures of any kind on a standard 3G network, preferably static signatures that wont change over days or months. Everything I've seen related to this is based on illegal man in the middle attacks.