3 ms·
Here are the limitations: 1.) It seems to listen to messages from the cell towers rather than listening directly to phones. This means you are likely to catch
by jstanley 8y ago
Here are the limitations:
1.) It seems to listen to messages from the cell towers rather than listening directly to phones. This means you are likely to catch IMSIs from a very wide area (i.e., every phone that connects to the cell tower you're listening to), which means you don't get much information about "who was in the local vicinity". This probably also means you can't tell the phone's signal strength, as the received signal strength is that of the tower not the phone (unless the tower modulates its transmit power based on how poor the phone's signal is?).
2.) It can only listen to one frequency at a time. This means you need N RTL-SDRs if you want to listen to phones connecting to N cell towers. (But the RTL-SDR does have about 3MHz bandwidth, so in theory it should be possible to listen to multiple cell towers simultaneously).
3.) It can only see IMSIs when a phone first connects. I don't think the IMSI is sent when making a call or transferring data.
4.) It only works on GSM, i.e 2G. Hardly anyone uses that these days. (I don't know if a similar passive approach would work on 3G and 4G, it may be that only software is required in order to support more than 2G).
The benefits of this approach compared to other things I've seen are that it is totally passive, so even a savvy target is unlikely to be able to detect that his IMSI has been caught, and it is extremely cheap to carry out.
- deleted 8y ago[deleted]
- droopybuns 8y ago>> 4.) It only works on GSM, i.e 2G. Hardly anyone uses that these days. (I don't know if a similar passive approach would work on 3G and 4G, it may be that only software is required in order to support more than 2G). Do you have some data that supports this claim? I haven't gone sniffing recently- but I believe T-mobile is still wed to 2G for the foreseeable future, and internationally, 2G is still in a lot of countries. I believe one northern european telco is going to decommission their UMTS network and support both LTE & GPRS.
- willstrafach 8y agoThis is Rx-only though, so the target device(s) cannot forced down to 2G.
- conradev 8y agoAT&T discontinued GSM nationwide: https://about.att.com/innovationblog/2g_sunset https://about.att.com/innovationblog/2g_sunset T-Mobile is keeping it running until at least 2020: https://www.t-mobile.com/news/att-2g-iot-lifeline https://www.t-mobile.com/news/att-2g-iot-lifeline edit: Wikipedia has a pretty solid list: https://en.wikipedia.org/wiki/2G#Past_2G_networks https://en.wikipedia.org/wiki/2G#Past_2G_networks
- jstanley 8y ago> Do you have some data that supports this claim? Only that I don't know anyone who is happy if their phone ever connects over 2G. By "hardly anyone uses that", I meant end users, not phone companies. I am happy to agree that 2G infrastructure still exists, it's just that most phones aren't using it.
- willstrafach 8y ago> 3.) It can only see IMSIs when a phone first connects. I don't think the IMSI is sent when making a call or transferring data. I believe this is correct, in fact (someone please correct me if I've got this wrong?) it looks as if this open source tool being cited is incorrectly labelling TMSIs as IMSIs.