https://zetier.com/5g-imsi-catcher/ [svg][zetier_FullColor] * Home * Capabilities * Careers * Blog Contact Us Did 5G kill the IMSI catcher? A primer on one of the oldest cellular vulnerabilities * April 10, 2025 * by Mark Santorello, Senior Cyber Engineer /nl_img1/nl_img1 You dial into your Zoom meeting while sitting on a moving train. Your mobile device (i.e., User Equipment, UE) must seamlessly switch towers as you go in and out of range. This concept, called mobility, remains a central requirement for mobile networks, but it's also a central security vulnerability. You see, you may have just been hacked while leisurely zooming on said train - and you'd never know it. The GSM (better known as 2G) protocol has a security vulnerability that exposes a user's personal identifier (IMSI) in the clear, allowing for attribution and geolocation. This vulnerability is also in the UMTS (a.k.a. 3G) spec, and in the LTE (4G) spec. While the vulnerability was finally addressed in NR (5G), it's imperfect and remains an exploitable 5G network vulnerability... and my favorite cybersecurity topic. In this article, I'll introduce this long-standing security exploit, known as an IMSI catcher, discuss some high-level technical aspects regarding 2G-4G IMSI catchers, then finish with 5G security improvements and the possibility of 5G IMSI catchers. What is an IMSI? Every account on a cellular network has a unique identifier to connect a SIM card to a credit card, and that identifier is called the International Mobile Subscriber Identity (IMSI, pronounced "IM-zee"). This number contains 3 pieces of information: the Mobile Country Code (MCC) of the issuing network operator, the Mobile Network Code (MNC) of the issuing network operator, and a unique number that only exists for that SIM card. The IMSI is ultimately used to make sure you paid your bill and that you're allowed to register onto a network. What is an IMSI catcher? An IMSI catcher is a tool that collects cellular signals and decodes packets to access and save off the IMSI. There are two types of IMSI catchers: active and passive. Diagram showing a person with a cell phone that's interacting with an IMSI catcher because it has a stronger signal than a nearby 5G cell tower. So, the IMSI catcher is directly catching the phone's IMSI. This illustrates Active IMSI Catching.Diagram showing a person with a cell phone that's interacting with an IMSI catcher because it has a stronger signal than a nearby 5G cell tower. So, the IMSI catcher is directly catching the phone's IMSI. This illustrates Active IMSI Catching. Active IMSI Catcher Also known as a cell station simulator or rogue base station, an active IMSI catcher is the more effective of the two. The downside is that it requires RF transmission, which violates FCC laws (and international equivalents) and is detectable. Diagram showing a person with a cell phone that's interacting with a 5G tower, and the IMSI catcher is listening in, and thus catching the phone's IMSI. This illustrates Passive IMSI Catching.Diagram showing a person with a cell phone that's interacting with a 5G tower, and the IMSI catcher is listening in, and thus catching the phone's IMSI. This illustrates Passive IMSI Catching. Passive IMSI Catcher This type requires a lot more planning and may not yield as many IMSIs. However, it's undetectable (from an RF perspective) and reflects a true account of the network without interference. To use an analogy, active IMSI catchers are like standing outside of the grocery store with an official-looking outfit and asking for people's licenses to write down the number; it may work until someone with a badge shows up. On the other hand, passive IMSI catchers are like sitting behind the one-way glass by the checkout counter and taking a photo of everyone's licenses when they open their wallets - difficult to detect and not illegal because it's in plain sight (probably... I'm not a lawyer and this isn't legal advice). How does an IMSI catcher work? (NB: The remainder of this article refers exclusively to passive IMSI catchers.) A UE (User Equipment, like your smartphone) is constantly performing selection, reselection, and registration procedures to maintain mobility and access to the cellular network. These processes are extremely complicated at the technical level, yet conceptually they're very simple. 1. After selecting a cell tower, based on measurements and control information, the UE sends a request to attach to a cell tower. 2. If the UE is allowed to attach, the cell tower and UE go back and forth a few times to negotiate some parameters, finalizing with the UE sending its IMSI. 3. The cell tower starts a new back-and-forth with the network to establish whether or not the IMSI is valid, active, and paid. 4. If the UE is allowed on the network, the cell tower initiates the authentication process, and everything from here on out is encrypted. This would be the end of the story, were it not for mobility. Again, mobility is a feature, as well as a network vulnerability. Every time the UE switches to another tower, it must repeat the registration process. (Ok, not EVERY time, but every time that the UE is in IDLE mode, which is most of the time. Handover is a whole other discussion.) To minimize the number of times a UE registers using an unencrypted IMSI, the network issues a Temporary Mobile Subscriber Identity (TMSI, pronounced "TIM-zee"). The TMSI is issued over an encrypted connection and associated with the IMSI on the network side. For the sake of this article, we'll consider the TMSI to be an unexploitable solution (...it's not). There are 3 ways to catch an IMSI: LOCATION, LOCATION, LOCATION! As mentioned earlier, the technical aspects of developing a passive IMSI catcher are complicated. (If you're interested in this topic, send an email to hello@zetier.com.) The simplified explanation is this: sometimes phones send IMSIs in cleartext, and if you're collecting at the right place and right time, you'll catch them. Conversely, even if you have the perfect IMSI catcher, but you're in the wrong location, you'll never catch an IMSI. So, where do you catch an IMSI? In the 2G and 3G protocols, IMSIs are sent in the clear under 3 conditions: 1. Initial attach 2. Crossing a Location Area Code (LAC) boundary (NB: Depending on the system configuration, TMSIs can be shared between LACs) 3. Location Update Request (LUR) In addition, these protocols utilize spectrum around the downlink center frequency for Radio Resource Control (RRC), meaning a radio only needs to tune to a single frequency to get the downlink and uplink for these particular messages - which is very convenient. However, my favorite thing about the ever-dwindling 2G/3G towers is that the initial attach procedure includes inter-RAT (Radio Access Technology) reselection. This means you can grab an IMSI in any LTE dead zone where a UE falls back to 2G or 3G. 4G is much less convenient: the uplink and downlink channels are necessary, and they must be partially synchronized. This is ultimately a technical issue that can be overcome with computing power. Furthermore, the initial attach is really the only viable option for reliably grabbing IMSIs, yet it's extremely unreliable. 4G IMSIs can be found on PLMN borders (e.g., country borders, airports, roaming boundaries) and older RAT borders (e.g., reselection boundaries from 2G or 3G towers). If 4G/LTE piques your curiosity, you may want to explore the IMSI extractor. 5G has finally addressed the cleartext IMSI network vulnerability. The IMSI is now called the Subscription Permanent Identifier (SUPI, pronounced "SOUP-ee"), and the unique identifier portion is encrypted using public key cryptography to create the Subscription Concealed Identifier (SUCI, pronounced "SU-shi"). Together, the 5G SUPI and SUCI sufficiently solve the 5G network vulnerability: the SUCI is transmitted in the clear (instead of the 5G SUPI), yet the SUCI isn't useful for identification or geolocation. So that's it? IMSI catchers are dead? From a purely academic stance, perhaps IMSI catchers have become impractical on fully patched, full-featured, network-wide 5G deployments. But such perfection remains extremely unlikely, and I expect to see several opportunities: 1. 5G is a multi-stage rollout, and any 5G Non-Standalone (NSA) deployments have all of the same vulnerabilities as 4G! 2. Downgrading from 5G to 4G supports handover (i.e., the TMSI is passed between RATs), but I've seen so many misconfigured towers over the years that I'd assume a downgrade to be vulnerable. 3. Mobile carriers may also not use the SUCI at all. I'm not sure how prevalent this vulnerability is in the wild, but I believe it's non-zero. How to block an IMSI catcher There's no way to block an IMSI catcher. The only simple thing you can do, that can have an effect, is to set your network priority to 5G-SA - but most phones don't support this feature. If you're really paranoid, stay in airplane mode until you're in a very dense coverage area. While this is far from a guarantee, IMSI catchers are more likely to be sitting in areas with compromised signal quality. Finally, you can keep your phone in a Faraday bag, which can provide up to 100 dB of signal attenuation. There's always something Cellular mobility will always have intrinsic vulnerabilities. The 3GPP 5G-NR spec has been a huge improvement against attribution attacks, which is definitely good for users. As for CNE developers, it has shifted the problem from technical to geographical. Active IMSI catchers and active jamming remain viable options, but they come with the same risks as always. On the bright side, there's still work to be done - and it's very fun work! If you're interested in this space, feel free to reach out - or explore our OSS in the cellular space: Bungeegum, our free Android testing tool for simulating real-world conditions, and Lariat, another open-source testing tool for wrangling the wide range of Android devices - both developed in-house at Zetier. Illustrations by Rebecca DeField. Have thoughts to share? Join the discussion on HackerNews - Your Next Read [svg][speedrunne] Speedrunners = vulnerability researchers Thousands of video game enthusiasts are developing experience in the cybersecurity industry by accident. They have a fun hobby, pouring over the deta... * February 26, 2025 * By a Senior Cyber Engineer [svg][asic-id-ha] The mystery of $0 HP printers Recently, I picked up a few printers from Craigslist... for the unbeatable price of $0. My goal was to use them for a trade-show simulation network, ... * February 19, 2025 * By a Zetier Cyber Engineer [svg][def-con-20] Making the podium at DEFCON 2024 Editor's Note: This post is written from the first-person perspective of a Zetier team member, reflecting on his experience at the DEFCON 2024 confer... * January 14, 2025 * By a Zetier Cyber Engineer [svg][open-sourc] Our 2024 open-source contributions Open-source contributions play a critical role in advancing technology, and this year, our team caught - and fixed - bugs in a variety of project... * December 19, 2024 * By the Zetier team [svg][porting-fr] Is it hard to port Frida on OpenWrt? Frida "just works" on many common platforms: Windows Linux, glibc-based Android macOS and iOS But what about porting it to your ... * November 26, 2024 * By a Zetier Cyber Engineer [svg][Bungeegum-] Android testing with Bungeegum Comprehensive testing capabilities are vital for building robust and secure Android applications in the world of Android cyber tool development. O... * August 24, 2024 * By a Zetier Cyber Engineer [svg][image4] A small box contains a big surprise While scrolling mischievously at midnight on eBay, I came across an item of interest. It was obviously sealed deliberately, military-related, and fro... * July 12, 2024 * By a Zetier Cyber Engineer [svg][cybersecur] Being a reservist at Zetier Getting a job while in the reserves is pretty easy. Keeping one while being activated and while life is happening is another story. Zetier is a compa... * August 16, 2024 * By a Zetier Cyber Engineer [svg][tshark-lua] Something fishy happens when compiling Tshark with Lua Wireshark has long been a standard tool for engineers across many disciplines. With its rich feature set, protocol support, and outstanding GUI,... * June 12, 2024 * By Mark Santorello, Senior Engineer [svg][flaShMASH] flaShMASH your dumps While inspecting an electrocardiograph (ECG) device from Spacelabs (specifically the 90496 shown in Figure 1) I ran into a little issue. Upon dum... * May 24, 2024 * By a Zetier Cyber Engineer [svg][DALL] Oops, there goes the OPSEC Breadcrumbs are left throughout computer systems that hackers can use to track attribution or recover sensitive information that was unintentionally ... * May 22, 2024 * By the Zetier team [svg][DALL] February 2024 watercooler topics Recent conversations around the Zetier watercooler covered a range of topics in IT, cybersecurity, and technology innovations. Our discussions sp... * March 4, 2024 * By the Zetier team [svg][image1-e17] Meet Snipey: Snipe-IT asset management Introduction Introducing Snipey: The Ultimate Command-Line Companion for Snipe-IT Asset Management Managing IT assets effectively is crucial fo... * March 4, 2024 * By a Zetier Cyber Engineer [svg][watercoole] December 2023 watercooler topics At Zetier, throughout the month we share news and articles of interest over Slack. This serves as a virtual watercooler for us as our team is spread a... * February 5, 2024 * By the Zetier team [svg][JTAG-Blog_] Using JTAG to dump parallel NOR flash Reading Parallel NOR Flash with JTAG Still have that old development kit kicking around from college or high school? Yeah, me too. Don't have a pr... * March 18, 2024 * By a Zetier Cyber Engineer [svg][DALL] Android testing with Lariat Introducing Lariat Howdy partners! At Zetier, we realize Android testing can be difficult, tedious, and less fun than walking 20 miles with a pebb... * February 19, 2024 * By a Zetier Security Researcher [svg][Sharing-Ou] Sharing our knowledge Sharing knowledge is in Zetier's corporate DNA, and this expresses itself in multiple ways. For example, we participate in conferences, we ho... * January 10, 2024 * By Mark Goldenberg, Senior Zetier Technical Writer [svg][image4] Power up your power supplies In cyber vulnerability research and reverse engineering, professionals frequently encounter hardware with specific power requirements not met by ... * February 5, 2024 * By a Zetier Cyber Engineer [svg][image-3-e1] 2023 corporate offsite Zetier's team are scattered across the country in nine states, from New York to California to Florida. We communicate daily on the phone, by ... * January 10, 2024 * By Mark Goldenberg, Senior Zetier Technical Writer [svg][thumbnail] Poor man's 3D tomography Overview Reverse engineering printed circuit boards is generally regarded as a time-intensive and sometimes difficult process as the interconnect ... * January 10, 2024 * By a Zetier Cyber Engineer [svg][DALL] CodeQL for security research What is CodeQL CodeQL is a declarative query language for code, currently maintained by GitHub. GitHub maintains a decently sized set of queries t... * January 10, 2024 * By a Senior Zetier Cyber Engineer x Contact Form [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [Submit] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] x Request Our Products Catalog [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [Submit] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] [svg][zetier_FullColor-1] Type your email... [ ] Subscribe Quick Links * Home * Capabilities * Careers * Blog Get In Touch * hello@zetier.com * +1 (877) 603-1337 * 4200 Wilson Boulevard (Suite 460) Arlington, Virginia 22203 (c) 2025 Zetier, Inc. | All Rights Reserved * [svg][icon-x] * [svg][icon-linke] * [svg][icon-githu] x Read Zetier's blog posts Enter your email address to subscribe to this blog and receive notifications of new posts by email. Email Address [ ] Subscribe Join 14 other subscribers Discover more from Zetier Subscribe now to keep reading and get access to the full archive. Type your email... [ ] Subscribe Continue reading Loading Comments... Write a Comment... [ ] Email (Required) [ ] Name (Required) [ ] Website [ ] [Post Comment]