4 ms·

I’m pretty sure modern networks allocate temporary anonymised IMSIs (TIMSI) to eschew just this kind of attack ... EDIT yes http://www.gsm-security.net/faq/tim

• aw3c2 8y ago
  Which networks are doing that though? I remember so many talks about security issues because of outdated protocols.
  • tonyarkles 8y ago
    I'm not positive on this, but I'm pretty sure it's mandatory in LTE. When you first register you send your IMSI (in the clear...) and they return a TMSI for you. My quick skim through the code looks like it'll track that too though: # Register IMSI as seen if a TMSI believed to # belong to the IMSI is seen.
  • dogma1138 8y ago
    All UMTS networks or newer use TMSI the actual IMSI is only sent once per baseband reset as long as there wasn’t a period where a hand off between VLRs didn’t occur and you didn’t roam to another network without direct peering. That said there is a trick to bypass TMSI for tracking as you can trigger an IMSI re-registration by interrupting mobile data or by forcing the mobile phone to downgrade through jamming. Also TMSI only prevents tracking not eavesdropping, it makes targeted eavesdropping harder but not impossible if you can track the target through other means.
  • dfox 8y ago
    Every network built on 3GPP protocol stack (including 90's 2G GSM) does that, because it is inherent feature of how GSM signalling protocols work.
• syn0byte 8y ago
  Just slightly complicates it. All you need is for them to be in range of your catcher when they renegotiate a new TIMSI, which is done periodically. If your targeting a specific person that's as simple as deploying a catcher within range of their home and/or office and chances are good you will get most if not all TIMSI negotiations. Like trying to stop MITM attacks on the internet by randomizing MAC addresses between sessions. IMSI are printed on a sticker stuck to the phone. How secret can it really be? Even if TIMSI worked well, there are other techniques: https://arxiv.org/pdf/1607.05171.pdf https://arxiv.org/pdf/1607.05171.pdf
  • rusk 8y ago
    Yes but ... you have to track the target by other means then. There’s not much beyond tracking this particular attack is useful for so if you have to track them anyway what’s the point!
  • self 8y ago
    > IMSI are printed on a sticker stuck to the phone. My phones have the IMEI number written on them, not the IMSI numbers. I'll have to take the SIM out to see if it has the IMSI written on it somewhere.
    • omribahumi 8y ago
      What’s written on the SIM card is called ICCID. For some carriers, you can convert from IMSI to ICCID and vice versa, because they chose this convention.
  • tinus_hn 8y ago
    IMSI is the Subscriber Identifier and is linked to the SIM card in the phone. The IMEI, Equipment Identifier, is printed on the device.
    • rusk 8y ago
      Strictly speaking, IMSI identifies the SIM. A subscriber may have multiple SIMs and many SIMs throughout their lifetime. The IMSI is never ever transferable. The IMSI/SIM represents a unique network identity and links to items such as individualised cryptographic keys; session state, etc. the counterparts to which are baked into the SIM itself.
• ryacko 8y ago
  https://en.m.wikipedia.org/wiki/Radio_fingerprinting https://en.m.wikipedia.org/wiki/Radio_fingerprinting It is irrevalent.
  • rusk 8y ago
    Not in the context of OP it isn't.