3 ms·
Just slightly complicates it. All you need is for them to be in range of your catcher when they renegotiate a new TIMSI, which is done periodically. If your tar
by syn0byte 8y ago
Just slightly complicates it. All you need is for them to be in range of your catcher when they renegotiate a new TIMSI, which is done periodically. If your targeting a specific person that's as simple as deploying a catcher within range of their home and/or office and chances are good you will get most if not all TIMSI negotiations.
Like trying to stop MITM attacks on the internet by randomizing MAC addresses between sessions. IMSI are printed on a sticker stuck to the phone. How secret can it really be?
Even if TIMSI worked well, there are other techniques:
https://arxiv.org/pdf/1607.05171.pdf https://arxiv.org/pdf/1607.05171.pdf
- rusk 8y agoYes but ... you have to track the target by other means then. There’s not much beyond tracking this particular attack is useful for so if you have to track them anyway what’s the point!
- self 8y ago> IMSI are printed on a sticker stuck to the phone. My phones have the IMEI number written on them, not the IMSI numbers. I'll have to take the SIM out to see if it has the IMSI written on it somewhere.
- omribahumi 8y agoWhat’s written on the SIM card is called ICCID. For some carriers, you can convert from IMSI to ICCID and vice versa, because they chose this convention.
- tinus_hn 8y agoIMSI is the Subscriber Identifier and is linked to the SIM card in the phone. The IMEI, Equipment Identifier, is printed on the device.
- rusk 8y agoStrictly speaking, IMSI identifies the SIM. A subscriber may have multiple SIMs and many SIMs throughout their lifetime. The IMSI is never ever transferable. The IMSI/SIM represents a unique network identity and links to items such as individualised cryptographic keys; session state, etc. the counterparts to which are baked into the SIM itself.