The diverse and variegated reactions of different cellular devices to IMSI catching attacks

Abstract

The goal of this paper is to assess how different User Terminals react to IMSI-catching attacks, namely location privacy attacks aiming at gathering the user's International Mobile Subscriber Identity (IMSI). After having implemented two different attack techniques over two different Software-Defined-Radio (SDR) platforms (OpenAirInterface and srsLTE), we have tested these attacks over different versions of the mobile phone brands, for a total of 19 different radio modems tested. We show that while the majority of devices surrender almost immediately, iPhones seem to implement some cleverness that resembles proper countermeasures. We also bring about evidence that the two chosen SDR platforms implement different signaling procedures that differentiate their ability as IMSI-catchers. We finally analyse IMSI-catchers' behaviors against subscribers of different operators, showing that successfulness of the attack depends only on the chipset and the SDR tool. We believe that our analysis may be useful either to practitioners that need to experiment with mobile security, as well as engineers for improving the design of mobile modems. CCS CONCEPTS• Security and privacy → Network security; Mobile and wireless security;

The Impact of IMSI Catcher Deployments on Cellular Network Security: Challenges and Countermeasures in 4G and 5G Networks

“…Mobile device security settings can be effective in preventing IMSI catcher attacks by disabling features such as automatic network selection or forcing the device to use specific encryption protocols [45]. However, the effectiveness of these settings relies on user awareness and diligence in managing their device settings.…”

Wifi Pentesting Roadmap for Classic-Future Attacks and Defenses

“…In this, the legitimate user doesn't deauthenticate to the legitimate access point if only, if the hacker has a password of the legitimate access point. Even, the hacker send denied of the service, the legitimate user doesn't accept it because hacker doesn't have the password [10][11][12][13][14].…”

A Systematic Literature Mapping on the Security of 5G and Vertical Applications

“…The attackers can use an application on the user's device to change the contents of a token, steal confidential information, and send malicious packets to the 5G core. Other examples of attacks include Man-In-The-Middle (MITM), stolen verifier, replay, pilot contamination (e.g., non-orthogonal multiple access in 5G mm-Wave massive MIMO networks [Wang et al, 2020a]) [Osorio et al, 2020], pollution attack (e.g., in cooperative MEC caching [Yang et al, 2018]), stolen smart card (enabling offline password guessing [Shin and Kwon, 2018]), jamming (e.g., pulsed based jamming attack [Schinianakis et al, 2019]), signaling storm [Ahmad et al, 2017], byzantine, sinkhole, IMSI catchers [Chlosta et al, 2021;Mjolsnes and Olimid, 2019;Palamà et al, 2020] It is also possible to transmit multiple false PSS to the target 5G NR frame (at higher power), impersonate a BS during the RRC handshake, and conduct masquerading attacks (e.g., focusing on the mobility management entity [Moreira et al, 2018]). Besides, identifiers (e.g., MAC addresses) can be cloned or spoofed, data from the IoT deployment to the 5G BS (or 5G BS to the IoT deployment) can be captured, and node memory extracted to fraudulently use the private key [Bordel et al, 2021].…”