Did 5G kill the IMSI catcher?

5G beamforming is not that accurate a proxy signal, and mmWave is phone vaporware, instead only significantly used for point-to-point connections. Line-of-sight requirements make it dead in the water for anything else.

> Criminal IMSI catchers are pretty much dead

Quite the opposite. They are more popular than ever, in the form of SMS blasters.

https://commsrisk.com/first-uk-arrests-of-imsi-catching-sms-...

> depending on how willing the firmware of your modem is, the signal used to transfer GPS coordinates to the carrier for emergency response situations can also be triggered remotely by carrier hardware

Do you know if (at least some) basebands actually limit network-side location requests to emergency call/text situations only?

Is this a US-centric view? Presumably crossing national borders, as noted in the article, it would be more effective to catch IMSIs. When there are lots of countries clustered together in a smaller geographical space, ie, not the USA, it might be relevant.

But I don't know.

It's common to discover IMSI-catchers in national capitals around the world. There are many interesting targets.

Washington, D.C. mobile traffic is probably the most spied in the world. Especially now when it's run by technological cavemen and overly confident techbros. Israeli, Russians, Chinese, French and everyone.

> Criminal IMSI catchers are pretty much dead,

This isn't true, there are major incidents related to IMSI-catchers going on globally right now. E.g. last week from Japan: https://newsonjapan.com/article/145466.php, https://commsrisk.com/amateur-detectives-find-numerous-fake-..., and mass arrests happening in Thailand related to the operation of them recently.

To see news related to them, search "Fake Base Stations" or "SMS Blaster", as this is how they're commonly referred to in the media now.

Other notable highlights from the last few years include: the news from Paris a few years ago where police detonated a car with an imsi-catcher in it because they thought it was a bomb, but actually the driver was being paid to send out sms spam via 2g downgrade attacks: https://commsrisk.com/paris-imsi-catcher-mistaken-for-bomb-w.... Also the attempt to disrupt the federal elections in the Phillippines using a kind of "SMS blaster" that takes advantage of unauthenticated emergency alert messages, so a step beyond the "classic" imsi catching attack that we haven't seen used in the wild before.

SIM cards don't connect to networks, the phone modem can just disable support for such protocols. That'd probably be illegal, though, in case you're trying to call emergency services and don't have 5G reception.

Some Android phones have a setting to at least disable 2G and you can easily configure them to a "preference" of only 5G. I believe iPhones have a 2G toggle as well if you enable lockdown mode.

It'll be years before you can reliably get rid of 4G without losing coverage, though.

I don't know about any such settings on mobile platforms such as watches, though. I also doubt cars have a setting for this (maybe if you use one of those Chinese Android-tablet-with-a-car-skin systems?).

Tangentially related, the latest major Android release supports updates from the modem with details about whenever your IMSI/IMEI/unencrypted SUCI are disclosed to the network (with support for some contextual information, e.g. which protocol message was it disclosed in), as well as insight into the in-use network cryptography configuration for different protocols.

if you pay the google tax for a pixel, you get a convenient 2G toggle.

if you don't have an extra $400-900 and buy a cheaper android, you get to dial ##4636## (hn screws asterisks, look it up) them go into phone info, select each sim radio and change the drop down (and hopefully you know all the standards by all names to make the right choice. hint 5G is NR there)

See also this 2019 in-depth primer on cellular attacks I wrote for EFF: https://www.eff.org/deeplinks/2019/07/announcing-gotta-catch...

So they'll just fall back to 4G then, which always sends the IMSI in the clear on initial attach?

Source?

In the beginning of cell phones, security was too expensive. Telcos also like to do their own things, so GSM encryption wasn't built on best practices. And some countries forbid use of even GSM encryption.

Early mobile phone networks suffered from cloning, so work was done to improve verification of clients, but verifying the network wasn't seen as required. Telcos have been historically light on authentication and verification; so it's not surprising.

Before 2G, networks used completely unencrypted analog voice. You could snoop on anyone's calls with a slightly-modified radio; at least until Congress heard about this and made it illegal to sell a radio that could be modified to do this[0].

2G was actually considered a huge bump up in security because you could encrypt the contents of calls. Albeit with hilariously insecure crypto mandated by the old ITAR regime[1]. IMSI catchers weren't part of their threat model, for the same reason why people only recently have realized that metadata is relevant to security.

[0] This law is still on the books, even though analog cellular is entirely dead. It's still a pain in the ass to properly comply with this for, e.g. software-defined radio.

[1] This is the same reason why DVD CSS was so easy to crack, and why we there used to be 10 different ways to strip SSL before we decided to stop serving old browsers entirely.

The networks are insecure by standard. They are designed such that they can have "lawful intercept" by government entities. The key material on the SIM card is readily transferred between the carrier and SIM/eSIM card manufacturers, which enables multiple levels of supply chain attacks if the material is mishandled.

IMSI-catchers are not considered a security hole by the carriers or the standards bodies. SUCI/SUPI was put in at the request of phone vendors, if I remember correctly, and is still the only piece of public key cryptography in the networks. Everything else is symmetric keys.

It evolved from a time when this wouldn't have been considered a gaping security hole.

No curious reason for it coming into existence. It's software, it will have bugs and oversights. What's curious is that it and so many other problems of the cellular grid have been left untended to for almost three decades.

This is a very interesting comment. When I read your physics story, I thought you would be getting to the similarity to current llms. However hallucinations seem like a different issue that the young student might not have. If she incorrectly matches some scenario to a text match, maybe some hallucinations. Some humans are confident in making comments about things I don't understand, like you know who. But many humans somehow have a concept of their limited knowledge. When they add that to LLMs, that will be powerful.

1) Yes, it's still possible to convince a phone to connect to older RAT generations. However, the idea is that as those are phased out, it's unlikely that they'll be enabled on UEs, so phones likely won't connect and "say hi" as you say. For example, 2G is already being disabled on many devices. It'll be a while before 2G-4G is fully phased out and IMSI Catchers become completely infeasible, but I think that it's safe to say that "5G got it right" in finally solving this issue.

2) I don't think you have a good understanding of how SUCIs work if you think that it's unique to a device. The UE generates a fresh ECC ephemeral public key every time it sends its SUCI (which isn't often to begin with due to GUTIs, which are one-time use and only assigned post-ciphering). You can read more about it here: https://medium.com/@aditya.koranga/ecies-in-5g-core-supi-to-...