On reading about IMSI catchers, I keep seeing that they "impersonate" a real cell tower or "base station" so that the phone drops its signal-carried data on that machine while on its way to the intended destination.

What I don't understand is, how exactly does the IMSI catcher do that, or by what mechanism? What is it doing to trick the phone/SIM/connection into saying "This is a valid stop to drop off data"?

Clarification (thanks to Steve Sether): Are there specific flags/attributes used in GSM and/or LTE broadcasts that the ISMI catcher must copy to spoof its identity as a cell tower? What are they?

  • By acting like a valid tower. It's just a matter of reproducing the proper protocols. This is kinda like asking "how does a raspberry pi running a web server trick a computer into thinking it is a web server?" – Conor Mancone Dec 11 '19 at 2:37
  • To clarify, I'm asking what are those protocols? – Long Way Dec 11 '19 at 2:40
  • GSM, LTE, CDMA, etc. I think the point is that cell phone towers don't have any form of authentication. – Steve Sether Dec 11 '19 at 2:57
  • 1
    en.wikipedia.org/wiki/IMSI-catcher Looks like LTE does have some form of authentication with the network, but the IMSI catcher forces a downgrade. – Steve Sether Dec 11 '19 at 3:01
  • Sorry I guess I meant what flags or specific attributes of GSM or LTE comms is that IMSI catcher broadcasting to do that? I've heard of stuff like Network ID and Location Area and I'm not sure if that's what gets copied to trick the phone. Or am I wrong in assuming such flags need to be used? – Long Way Dec 11 '19 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.