If you read about cell phone tracking it looks an IMSI Catcher always uses a fake base station the get the phones IMSI. I don't understand why this is necessary.

Couldn't they just passively read the signal and copy the phones ID from it's communication?

From what I read the signal might be encrypted but can be broken in real time. So why the trouble of faking a complete base station.

  • It is probably something to do with the timsi.
    – munchkin
    Jan 26, 2015 at 10:46
  • I think it also has to do with what your intended use is. If you want to execute a man-in-the-middle attack, you'd need one of these, I think.
    – spoorlezer
    Jan 26, 2015 at 12:45

2 Answers 2


IMSI Catchers are fake mobile network cells (BTS) and additional equipment for call routing that operates in a "evil twin attack" and MiTM manner. They are usually positioned in places nearby the victim, where their signal is stronger than the signal of the legitimate network service provider cell, so the victim phone choose the fake BTS than the legitimate one. When the phone try to negotiate the encryption scheme with the specific for the GSM protocol handshake procedure, the IMSI Catcher identifies the victim by it's IMSI and downgrade the required cryptography from A5/1 or A5/2 to A5/0 or "not encrypted". It basically tells the victim phone "i can't support anything but A5/0". When the phone starts to communicate with the IMSI Catcher and traffic channel is allocated for that client, all communications can be sniffed on the traffic channel, because there is no encryption. Next, with the permission of the network service provider to access their HLR, the communication is encrypted with the subscriber master key, and routed through the network. This way, we can have two-way communication without the victim knowledge about the surveillance actions.

This can't be done without physical BTS, since it needs to receive and transmit on the RF media.

  • 1
    Yes, but the questions is: Do the attacker need the fake a network cell if he only likes to get the phones IMSI? Couldn't he sniff the phones ID from normal traffic? Meaning: Is the IMSI encrypted? Jan 27, 2015 at 16:16
  • Excuse me. The IMSI is sended in cleartext first time when the phone do a procedure called a "location update". After that, the network authenticate the subscriber, and temporary identificator called TMSI is assigned and bounded to the IMSI in the network BSC. From this moment, the TMSI is the way to identify and address the subscriber. It is encrypted and is valid only to the location area (a bunch of cells covering some area). When you phone come outside of that range, the network discard this TMSI and the procedure is done again in the new location area. Jan 27, 2015 at 16:59
  • So no, you don't need BTS if you just want to sniff IMSIes and other information distributed on the broadcast channel of the cell. Regular RTL-SDR dongle for example, with software like airprobe and Linux box is enough. Jan 27, 2015 at 17:12
  • Doesn't IMSI catcher just record the IMSI/IMEI and disconnect ? I mean, even if they are faked BTS, they don't have to be a proxy : many times they are just catch IMSI number and quit, Right ?
    – ransh
    Apr 24, 2017 at 18:06
  • The carrier can already track the subscriber's movements using it's terrestrial network. It would be meaningful to use an IMSI Catcher for tracking through IMSI registration only if you want to prove that the subscriber was in a close proximity to the IMSI Catcher equipment. You can't do the same using the terrestrial network because you can get only as close as the location area that the subscriber is currently roaming in and a location area can sometimes be pretty large. May 4, 2017 at 23:11

I agree on the fact that to catch ( to know) IMSIs you don't necessarily need a physical base station, provided you can hack into the core network and exploit signalling protocols such as Signalling System no. 7. With SIP/VoIP protocols and hence the amalgamation of IP world with Telecom world, the core network is no more a walled garden. Getting access to core network have been relatively easy than before.

For example, you can use the following signalling protocol message to fetch the IMSI given that you have victim's phone number.

  2. MAP_SENDROUTING_INFO (of call setup procedure)
  3. anyTimeInterrogation request

For more details, read the section 4.2.3 of this thesis.

However, SS7 attacks to know IMSI could be much more expensive than having a fake base station yourself. You can build (I would not recommend it) your own handheld base station using Yate openBTS. One such recent update on IMSI catcher can be seen from this from Blackhat Europe.

  • The "would not recommend" comment is because it is illegal? Can't it be done with lower powrr for a lab test phone?
    – ransh
    Apr 11, 2017 at 11:44
  • @ransh Your arew right. Ideally, one has to own a radio license to legally operate in the same bandwidth as that of the phones making it legal use for lab testing. Also, Lower power != bandwidth other than the phone operates. Apr 11, 2017 at 13:34
  • Doesn't IMSI catcher just record the IMSI/IMEI and disconnect ? I mean, even when they are faked BTS, they don't have to be a proxy: many times they are just catch IMSI number and quit, Right ?
    – ransh
    Apr 24, 2017 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .