3 ms·

An explanation wasn't prominently displayed on that web site, so from https://en.wikipedia.org/wiki/IMSI-catcher https://en.wikipedia.org/wiki/IMSI-catcher :

by ta8645 3y ago

An explanation wasn't prominently displayed on that web site, so from https://en.wikipedia.org/wiki/IMSI-catcher https://en.wikipedia.org/wiki/IMSI-catcher : An international mobile subscriber identity-catcher, or IMSI-catcher, is a telephone eavesdropping device used for intercepting mobile phone traffic and tracking location data of mobile phone users. Essentially a "fake" mobile tower acting between the target mobile phone and the service provider's real towers, it is considered a man-in-the-middle (MITM) attack.

deleted 3y ago
[deleted]
H8crilA 3y ago
How come the tower doesn't have to cryptographically authenticate with the phone? Like websites do, using TLS certificates.
- Ms-J 3y ago
  This may be of use to you: https://blog.cryptographyengineering.com/2013/05/14/a-few-thoughts-on-cellular-encryption/ https://blog.cryptographyengineering.com/2013/05/14/a-few-th... "GSM phones authenticate to the tower, but the tower doesn’t authenticate back. This means that anyone can create a ‘fake’ tower that your phone will connect to. The major problem here is that in GSM, the tower gets to pick the encryption algorithm! That means your attacker can simply turn encryption off (by setting encryption ‘algorithm’ A5/0) and simply route the cleartext data itself.In theory your phone is supposed to alert you to this kind of attack, but the SIM chip contains a bit that can de-active the warning. And (as researcher Chris Paget discovered) carriers often set this bit."
- livueta 3y ago
  Along with the sibling comment, there are also protocol downgrade attacks analogous to what HSTS prevents in HTTP/S. IIRC these require active jamming, but if you're .gov who cares. This is a reason why security-conscious OSes like Graphene allow explicitly disabling older protocols.
  - Ms-J 3y ago
    You can also disable these in regular Android, depending on the phone manufacture. Look for your phone's engineering screens.

by ta8645 3y ago

deleted 3y ago

[deleted]

H8crilA 3y ago

How come the tower doesn't have to cryptographically authenticate with the phone? Like websites do, using TLS certificates.

Ms-J 3y ago
This may be of use to you: https://blog.cryptographyengineering.com/2013/05/14/a-few-thoughts-on-cellular-encryption/ https://blog.cryptographyengineering.com/2013/05/14/a-few-th... "GSM phones authenticate to the tower, but the tower doesn’t authenticate back. This means that anyone can create a ‘fake’ tower that your phone will connect to. The major problem here is that in GSM, the tower gets to pick the encryption algorithm! That means your attacker can simply turn encryption off (by setting encryption ‘algorithm’ A5/0) and simply route the cleartext data itself.In theory your phone is supposed to alert you to this kind of attack, but the SIM chip contains a bit that can de-active the warning. And (as researcher Chris Paget discovered) carriers often set this bit."
livueta 3y ago
Along with the sibling comment, there are also protocol downgrade attacks analogous to what HSTS prevents in HTTP/S. IIRC these require active jamming, but if you're .gov who cares. This is a reason why security-conscious OSes like Graphene allow explicitly disabling older protocols.
- Ms-J 3y ago
  You can also disable these in regular Android, depending on the phone manufacture. Look for your phone's engineering screens.