If you read about cell phone tracking it looks an IMSI Catcher always uses a fake base station the get the phones IMSI. I don't understand why this is necessary.

Couldn't they just passively read the signal and copy the phones ID from it's communication?

From what I read the signal might be encrypted but can be broken in real time. So why the trouble of faking a complete base station.

  • It is probably something to do with the timsi. – munchkin Jan 26 '15 at 10:46
  • I think it also has to do with what your intended use is. If you want to execute a man-in-the-middle attack, you'd need one of these, I think. – spoorlezer Jan 26 '15 at 12:45

IMSI Catchers are fake mobile network cells (BTS) and additional equipment for call routing that operates in a "evil twin attack" and MiTM manner. They are usually positioned in places nearby the victim, where their signal is stronger than the signal of the legitimate network service provider cell, so the victim phone choose the fake BTS than the legitimate one. When the phone try to negotiate the encryption scheme with the specific for the GSM protocol handshake procedure, the IMSI Catcher identifies the victim by it's IMSI and downgrade the required cryptography from A5/1 or A5/2 to A5/0 or "not encrypted". It basically tells the victim phone "i can't support anything but A5/0". When the phone starts to communicate with the IMSI Catcher and traffic channel is allocated for that client, all communications can be sniffed on the traffic channel, because there is no encryption. Next, with the permission of the network service provider to access their HLR, the communication is encrypted with the subscriber master key, and routed through the network. This way, we can have two-way communication without the victim knowledge about the surveillance actions.

This can't be done without physical BTS, since it needs to receive and transmit on the RF media.

  • 1
    Yes, but the questions is: Do the attacker need the fake a network cell if he only likes to get the phones IMSI? Couldn't he sniff the phones ID from normal traffic? Meaning: Is the IMSI encrypted? – PiTheNumber Jan 27 '15 at 16:16
  • Excuse me. The IMSI is sended in cleartext first time when the phone do a procedure called a "location update". After that, the network authenticate the subscriber, and temporary identificator called TMSI is assigned and bounded to the IMSI in the network BSC. From this moment, the TMSI is the way to identify and address the subscriber. It is encrypted and is valid only to the location area (a bunch of cells covering some area). When you phone come outside of that range, the network discard this TMSI and the procedure is done again in the new location area. – programings Jan 27 '15 at 16:59
  • So no, you don't need BTS if you just want to sniff IMSIes and other information distributed on the broadcast channel of the cell. Regular RTL-SDR dongle for example, with software like airprobe and Linux box is enough. – programings Jan 27 '15 at 17:12
  • Doesn't IMSI catcher just record the IMSI/IMEI and disconnect ? I mean, even if they are faked BTS, they don't have to be a proxy : many times they are just catch IMSI number and quit, Right ? – ransh Apr 24 '17 at 18:06
  • The carrier can already track the subscriber's movements using it's terrestrial network. It would be meaningful to use an IMSI Catcher for tracking through IMSI registration only if you want to prove that the subscriber was in a close proximity to the IMSI Catcher equipment. You can't do the same using the terrestrial network because you can get only as close as the location area that the subscriber is currently roaming in and a location area can sometimes be pretty large. – programings May 4 '17 at 23:11

I agree on the fact that to catch ( to know) IMSIs you don't necessarily need a physical base station, provided you can hack into the core network and exploit signalling protocols such as Signalling System no. 7. With SIP/VoIP protocols and hence the amalgamation of IP world with Telecom world, the core network is no more a walled garden. Getting access to core network have been relatively easy than before.

For example, you can use the following signalling protocol message to fetch the IMSI given that you have victim's phone number.

  2. MAP_SENDROUTING_INFO (of call setup procedure)
  3. anyTimeInterrogation request

For more details, read the section 4.2.3 of this thesis.

However, SS7 attacks to know IMSI could be much more expensive than having a fake base station yourself. You can build (I would not recommend it) your own handheld base station using Yate openBTS. One such recent update on IMSI catcher can be seen from this from Blackhat Europe.

  • The "would not recommend" comment is because it is illegal? Can't it be done with lower powrr for a lab test phone? – ransh Apr 11 '17 at 11:44
  • @ransh Your arew right. Ideally, one has to own a radio license to legally operate in the same bandwidth as that of the phones making it legal use for lab testing. Also, Lower power != bandwidth other than the phone operates. – kingmakerking Apr 11 '17 at 13:34
  • Doesn't IMSI catcher just record the IMSI/IMEI and disconnect ? I mean, even when they are faked BTS, they don't have to be a proxy: many times they are just catch IMSI number and quit, Right ? – ransh Apr 24 '17 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.