5 ms·

Do IMSI catchers have any way of verifying the intercepted IMSIs are legitimate? If not, would it be possible to build a device to flood them with fake/spoofed

Do IMSI catchers have any way of verifying the intercepted IMSIs are legitimate? If not, would it be possible to build a device to flood them with fake/spoofed IMSIs?

acqq 11y ago
"IMSI catcher" is a device: https://en.wikipedia.org/wiki/IMSI-catcher https://en.wikipedia.org/wiki/IMSI-catcher It doesn't have to "verify" what it collects.
- jritchie 11y ago
  Yes, but the value of the collected data is much reduced if you can't distinguish between legitimate IMSIs and spoofed IMSIs of devices that were never actually there.
  - noselasd 11y ago
    If you attach to a network successfully, it means the its secret key stored in the SIM card matches that of the network. Since your IMSI catcher is basically just a proxy between the mobile phone and the real network, you can therefore easily detect that the IMSI is who it says it is.
  - acqq 11y ago
    No, because he who collects isn't interested in random mobile phones, and whoever tries to spoof "other" phones doesn't know the phones of interest of the collector. And the collector is interested not in knowing the presence but in the whole traffic, so the spoofing is even more obvious.
desdiv 11y ago
>If not, would it be possible to build a device to flood them with fake/spoofed IMSIs? Technical ability wise, yes. Legally, no. The Mobile Telephones (Re-Programming) Act 2002 [0] makes spoofing IMSI, even that of your own, illegal in the UK. [0] https://www.staffordshire.police.uk/info_advice/crime_prevention/immobilise/reprogramming/ https://www.staffordshire.police.uk/info_advice/crime_preven... Disclaimer: I am not a lawyer.
- thomasahle 11y ago
  I fail to see how re-programming is related to spoofing?
  - fweespeech 11y ago
    > (1) A person commits an offence if: > he changes a unique device identifier,
    - dfox 11y ago
      Technically, IMSI is not a device identifier. MT has IMEI and SIM (or more precisely ICC) has ICCID (which is normally never transmitted over the network). And the legislation probably specifically targets spoofing the IMEI, as spoofing IMSI does not gain you anything other than absence of service (on normal GSM/3GPP network).
      - fweespeech 11y ago
        The fact the Government is using it as an identifier likely means they can argue legally you are attempting to change the identifier. Technically correct for technical discussions is not the same as contextually correct in a court room.
        vetinari 11y ago
        IMSI is not a mobile phone identifier, it literally means International Mobile Subscriber Identity and is provisioned in the SIM card. You will change your IMSI by simply changing the SIM card.
        dfox 11y ago
        And to be somewhat more pedantic, it even is not "unique device identifier" of the SIM, as SIM is not an device, but software application (typically one of applications) running on some hardware platform (usually an ICC, which is what is colloquially called "SIM card")
ChuckMcM 11y ago
Like anything, it is technically possible to do this. As a defensive mechanism, I think it would make sense to perhaps hang out at city call and collects a bunch of IMSI's worth spoofing, and then rebroadcast those while you were being subject to surveillance, the goal being to force the adversary to follow down a bunch of leads which are bogus. That said, this is completely illegal (unlike the actual surveillance which has been made legal by a series of unfortunate events). So I would not advise anyone to do this. Not to mention that unless you design your own cellular baseband radio circuit (so that you have access to all the docs) building something like this with "off the shelf" parts is quite expensive.
- archimedespi 11y ago
  SDRs are no longer that expensive - even an Ettus or BladeRF device is within the range of the average middle-class engineer - and can be programmed completely in software to act as a cellular baseband device.

Do IMSI catchers have any way of verifying the intercepted IMSIs are legitimate? If not, would it be possible to build a device to flood them with fake/spoofed IMSIs?

acqq 11y ago

"IMSI catcher" is a device: https://en.wikipedia.org/wiki/IMSI-catcher https://en.wikipedia.org/wiki/IMSI-catcher It doesn't have to "verify" what it collects.

jritchie 11y ago
Yes, but the value of the collected data is much reduced if you can't distinguish between legitimate IMSIs and spoofed IMSIs of devices that were never actually there.
- noselasd 11y ago
  If you attach to a network successfully, it means the its secret key stored in the SIM card matches that of the network. Since your IMSI catcher is basically just a proxy between the mobile phone and the real network, you can therefore easily detect that the IMSI is who it says it is.
- acqq 11y ago
  No, because he who collects isn't interested in random mobile phones, and whoever tries to spoof "other" phones doesn't know the phones of interest of the collector. And the collector is interested not in knowing the presence but in the whole traffic, so the spoofing is even more obvious.

desdiv 11y ago

>If not, would it be possible to build a device to flood them with fake/spoofed IMSIs? Technical ability wise, yes. Legally, no. The Mobile Telephones (Re-Programming) Act 2002 [0] makes spoofing IMSI, even that of your own, illegal in the UK. [0] https://www.staffordshire.police.uk/info_advice/crime_prevention/immobilise/reprogramming/ https://www.staffordshire.police.uk/info_advice/crime_preven... Disclaimer: I am not a lawyer.

thomasahle 11y ago
I fail to see how re-programming is related to spoofing?
- fweespeech 11y ago
  > (1) A person commits an offence if: > he changes a unique device identifier,
  - dfox 11y ago
    Technically, IMSI is not a device identifier. MT has IMEI and SIM (or more precisely ICC) has ICCID (which is normally never transmitted over the network). And the legislation probably specifically targets spoofing the IMEI, as spoofing IMSI does not gain you anything other than absence of service (on normal GSM/3GPP network).
    - fweespeech 11y ago
      The fact the Government is using it as an identifier likely means they can argue legally you are attempting to change the identifier. Technically correct for technical discussions is not the same as contextually correct in a court room.
      - vetinari 11y ago
        IMSI is not a mobile phone identifier, it literally means International Mobile Subscriber Identity and is provisioned in the SIM card. You will change your IMSI by simply changing the SIM card.
        dfox 11y ago
        And to be somewhat more pedantic, it even is not "unique device identifier" of the SIM, as SIM is not an device, but software application (typically one of applications) running on some hardware platform (usually an ICC, which is what is colloquially called "SIM card")

ChuckMcM 11y ago

Like anything, it is technically possible to do this. As a defensive mechanism, I think it would make sense to perhaps hang out at city call and collects a bunch of IMSI's worth spoofing, and then rebroadcast those while you were being subject to surveillance, the goal being to force the adversary to follow down a bunch of leads which are bogus. That said, this is completely illegal (unlike the actual surveillance which has been made legal by a series of unfortunate events). So I would not advise anyone to do this. Not to mention that unless you design your own cellular baseband radio circuit (so that you have access to all the docs) building something like this with "off the shelf" parts is quite expensive.

archimedespi 11y ago
SDRs are no longer that expensive - even an Ettus or BladeRF device is within the range of the average middle-class engineer - and can be programmed completely in software to act as a cellular baseband device.