3 ms·
Can someone explain how is this possible in the first place, i.e. how do those fakes pass authentication checks from the phone/sim card?
by H8crilA 4y ago
Can someone explain how is this possible in the first place, i.e. how do those fakes pass authentication checks from the phone/sim card?
- blamazon 4y agoFTA: > Even though the UE authenticates the tower there are still several messages that it sends, receives, and trusts before authentication happens or w/o authentication. This is the weak spot in which the vast majority of 4G attacks happen I'm a layman but here's my understanding. Imagine you're a police force and you know a criminal has a phone with IMEI of ABC123. You think the criminal might have a headquarters inside a warehouse but you want to be sure they're there before conducting a raid. Set up one of these, on arrival the target phone tells the fake tower what its IMEI is when within range, and you've got them.
- ng55QPSK 4y agoThe point here is: if the owner of the IMSI catcher has some preknowledge about the target phone. There is no way to avoid this.
- ng55QPSK 4y agoas explained in the pdf: There is a part of the connection setup, that will happen before any mutual authentification: The telephone offers the IMEI/IMSI to get an initial connection. The network learns this number and it's the counterpart of a MAC address in Wifi networks.