Easy 4G/LTE IMSI Catchers for Non-Programmers

Abstract

IMSI Catchers are tracking devices that break the privacy of the subscribers of mobile access networks, with disruptive effects to both the communication services and the trust and credibility of mobile network operators. Recently, we verified that IMSI Catcher attacks are really practical for the state-of-the-art 4G/LTE mobile systems too. Our IMSI Catcher device acquires subscription identities (IMSIs) within an area or location within a few seconds of operation and then denies access of subscribers to the commercial network. Moreover, we demonstrate that these attack devices can be easily built and operated using readily available tools and equipment, and without any programming. We describe our experiments and procedures that are based on commercially available hardware and unmodified open source software.

Experimental Analysis of Subscribers’ Privacy Exposure by LTE Paging

“…The LTE network architecture is roughly divided into the access part called the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) and the core part called the Evolved Packet Core (EPC). The E-UTRAN [24] and EPC are themselves divided into several network components, each playing an important role in the complete LTE network architecture. Figure 1 illustrates the LTE architecture.…”

“…Examples include IMSI catchers, active devices that masquerade genuine base stations with the purpose of stealing the permanent identity of subscribers. This makes LTE vulnerable to location attacks such as testing the presence or absence of a subscriber in an area [33,17,24,25]. Another example is the one we address in this paper: privacy exposure of subscribers by paging messages.…”

On Security Research Towards Future Mobile Network Generations

“…• Active Radio: An attacker with this capability has full control over radio transmissions and is therefore able to put arbitrary messages on the radio channel. This enables an attacker to setup a own base station or a fully controllable phone stack using an SDR [9], [29], [30], [31], [32], [33].…”

“…V-D1 Session Key Retrieval via SS7 [56], [66] U ? V-D1 Privacy AKA Protocol Linkability Attack [7], [82] U V-A1 IMSI Paging Attack [7] U V-A1 Location Leak by SIP Message [83] U VII-A1 Location/Tracking Area not Allowed (Downgrade) [4], [6], [84] U V-A1 Measurement Reports Localization [4], [10] U V-A1 OTA SIM Card Update Key Reconstruction [85] U V-C1c Unauthenticated IMEI Request [8], [64], [66], [67], [68], [69] U V-A1 Unauthenticated IMSI Request (IMSI Catcher) [8], [9], [64], [65], [66],…”

“…However, over the last years, a large body of literature has revealed numerous security and privacy issues in mobile networks. There is a broad set of attacks [4], [5], [6], [7], [8], [9] that affect the users' privacy and data secrecy, the mobile network operators' revenue, and the availability of the infrastructure. Various countermeasures against these attacks have been proposed, some of which have become security features of new mobile generations.…”