[HN Gopher] Did 5G Kill the IMSI Catcher?
___________________________________________________________________
Did 5G Kill the IMSI Catcher?
Author : skramace
Score : 139 points
Date : 2025-04-27 16:27 UTC (6 hours ago)
(HTM) web link (zetier.com)
(TXT) w3m dump (zetier.com)
| huslage wrote:
| iPhones, in general, will not connect to a 5G Standalone network
| that doesn't have SUCI enabled.
| lxgr wrote:
| So they'll just fall back to 4G then, which always sends the
| IMSI in the clear on initial attach?
| IshKebab wrote:
| I don't know if you're implying that the iPhone behaviour is
| bad but I hope not. It's obviously better.
| huslage wrote:
| 5G Standalone networks don't have 4G to fall back to. 5G Non-
| standalone networks are essentially 4G networks with a 5G
| RAN, so SUCI remains optional and most core vendors don't
| support it.
| lxgr wrote:
| That's not what 5G standalone means, as far as I
| understand.
|
| The network I'm using supports 5G SA in some cells, but my
| phone definitely still falls back to both 4G and 5G non-SA
| in some areas where it's not yet available.
|
| And even if 5G SA were available everywhere, there's the
| concern of roaming.
| gruez wrote:
| Source?
| g_p wrote:
| > 5G Standalone security and privacy requirements
|
| > To help ensure compatibility of iPhone and cellular iPad
| devices on private 5G SA networks, infrastructure vendors
| must adhere to the following security and privacy
| requirements:
|
| > Privacy concealment: The Subscription Concealed Identifier
| (SUCI) must use a non-null protection scheme. This can be
| achieved through either an on-SIM SUCI calculation or an ME
| SUCI calculation, as outlined in TCA 2.3.1 and 3.1
| specifications. For detailed information, refer to the 3GPP
| Technical Specification 33.501.
|
| (From https://support.apple.com/en-
| gb/guide/deployment/depac674731...)
|
| This pertains to private networks rather than public operator
| networks, but it certainly seems to imply that use of SUCI is
| an expectation on 5G SA networks (private in this context).
| huslage wrote:
| In the US, the T-Mobile 5G SA eSIM and SIM cards all have
| SUCI at least. I don't have any idea about other networks.
| lxgr wrote:
| I've always been wondering: Is there a SIM card configuration
| flag that allows telling the phone to never even attempt an
| attach using a given technology?
|
| This would allow leaking identifiers (at the cost of greatly
| reducing roaming coverage, at the moment), attaching to spoofed
| networks (for 2G, which does not have mutual authentication) etc.
| jeroenhd wrote:
| SIM cards don't connect to networks, the phone modem can just
| disable support for such protocols. That'd probably be illegal,
| though, in case you're trying to call emergency services and
| don't have 5G reception.
|
| Some Android phones have a setting to at least disable 2G and
| you can easily configure them to a "preference" of only 5G. I
| believe iPhones have a 2G toggle as well if you enable lockdown
| mode.
|
| It'll be years before you can reliably get rid of 4G without
| losing coverage, though.
|
| I don't know about any such settings on mobile platforms such
| as watches, though. I also doubt cars have a setting for this
| (maybe if you use one of those Chinese Android-tablet-with-a-
| car-skin systems?).
| lxgr wrote:
| > SIM cards don't connect to networks
|
| SIM cards have hundreds of various configuration knobs
| influencing what a (compliant) baseband does, so I wouldn't
| be surprised if there was one that does just that.
|
| That said, some knobs are frustratingly missing, though - why
| is manually entering an APN a thing, but the default SMSC can
| be stored on the SIM?
| jeroenhd wrote:
| That's true, of course, but SIMs can be reprogrammed by the
| carrier on a whim. Plus, there are handover features that
| command the modem to downgrade the connection from the
| network side, and who knows if the modem will listen to the
| SIM's config if the network commands it to do something.
|
| I haven't needed to enter APNs in years, there are
| standards to provision those by SMS if they're missing and
| most of them are pre-configured in the phone's OS.
|
| I think limiting this at the modem side will be more
| effective than reprogramming the SIM card, but the
| specifications are open enough that you could take a look
| at a SIM's contents by throwing it in a reader.
|
| You could also look at the code and blobs dealing with
| eSIMs, as they provide the same features but often come
| packaged in the form of software.
|
| Check your local laws before you start messing with SIM
| cards, though, altering certain identifiers can be a crime.
| g_p wrote:
| In terms of existing examples, there's a few equivalent
| (or at least similar) fields defined as SIM files - for
| example, the FPLMN (forbidden PLMN) list of networks your
| phone shouldn't attempt to attach to.
|
| You're right that this needs limited at the modem - but
| the main user accessible method of configuring the modem
| is the phone UI. As this setting is one which needs
| network support, and is likely to disconnect a user who
| misconfigured this, a SIM file for permitted RAT (radio
| access technology) types would make sense, as SIM files
| are under the responsibility of the operator.
|
| Where this would get complex is edge cases, like under
| roaming scenarios, where your home network can't predict
| what might be available, and your handset may need to
| permit downgrading to a technology not permitted on the
| home network.
|
| The toggle in Android to disable 2G seems a start towards
| a user accessible setting for this, which selects what
| the modem is willing to join, but it's certainly far from
| a user friendly way to enable and disable particular
| technologies.
| rival_elf wrote:
| Tangentially related, the latest major Android release supports
| updates from the modem with details about whenever your
| IMSI/IMEI/unencrypted SUCI are disclosed to the network (with
| support for some contextual information, e.g. which protocol
| message was it disclosed in), as well as insight into the in-
| use network cryptography configuration for different protocols.
| 1oooqooq wrote:
| if you pay the google tax for a pixel, you get a convenient 2G
| toggle.
|
| if you don't have an extra $400-900 and buy a cheaper android,
| you get to dial _#_ #4636# _#_ (hn screws asterisks, look it
| up) them go into phone info, select each sim radio and change
| the drop down (and hopefully you know all the standards by all
| names to make the right choice. hint 5G is NR there)
| toast0 wrote:
| There's a convenient toggle on my Moto G Stylus 5G 2023, if
| not a convenient name. In the carrier settings right next to
| allow 5G. Can't easily disable 3G or LTE though. IIRC, LTE
| _is_ also mutually authenticates, but if we 're talking about
| passive catching _and_ the ismi is sent in the clear as the
| article says, then that doesn 't eliminate passive catching.
| I'm not sure about 3G, I thought it wasn't mutual auth
| either.
| lxgr wrote:
| Definitely, mutual authentication and (not) using long-term
| identifiers in the initial attach request are largely
| orthogonal concerns.
|
| I believe even 3G supports mutual authentication (at least
| if the SIM supports it, i.e. it's not a very old GSM only
| one), but anonymized identifiers only appeared with 5G.
| Bender wrote:
| One can backslash escape the asterisks. **
| \*\*
| JadeNB wrote:
| > ##4636## (hn screws asterisks, look it up)
|
| You can include asterisks if you escape them, like \\*:
| *#*#4636#*#*.
| jeroenhd wrote:
| Criminal IMSI catchers are pretty much dead, but with the aid of
| carriers law enforcement can still use similar technology even
| with full standalone 5G networks. I don't know how often
| unauthorized IMSI catchers are used in the wild, but I doubt it's
| a relevant percentage of the total amount of IMSI catchers out
| there.
|
| Thanks to mmWave and beam forming, 5G allows operators to
| practically track you down to the exact centimeter in 3D space.
| Furthermore, depending on how willing the firmware of your modem
| is, the signal used to transfer GPS coordinates to the carrier
| for emergency response situations can also be triggered remotely
| by carrier hardware.
|
| Basically, who needs IMSI catchers when you can just see all of
| the information you'd get from them remotely on a computer screen
| on the other side of the country?
|
| Of course this is great to protect against criminals that are
| looking to find your personal phone number or whatever by showing
| up to your doorstep, but for the vast majority of cases, IMSI
| catchers are defeated because they're no longer necessary.
| lxgr wrote:
| > depending on how willing the firmware of your modem is, the
| signal used to transfer GPS coordinates to the carrier for
| emergency response situations can also be triggered remotely by
| carrier hardware
|
| Do you know if (at least some) basebands actually limit
| network-side location requests to emergency call/text
| situations only?
| jeroenhd wrote:
| All I know is that some don't. I don't know brands or if
| there are even common modems that are filtering for this.
|
| If you don't have a Faraday cage and cell site equipment,
| you're going to have a hard time verifying any of this. The
| modem is closed source, the SIM card is closed source, and
| various firmware blobs to make phones work are all closed
| source. I believe Qualcomm has debug interfaces on some
| chipsets, which might catch these messages, but verifying
| that they catch all use cases is impossible unless you have
| knowledge of the actual mechanism used (or usable) to
| activate the modem.
|
| This is one of the reasons I'm hoping for the open source
| phone community to succeed. So far, the modem stack is
| usually proprietary (with hardware kill switches in the most
| paranoid phones), but it only takes a small group of Linux
| enthusiasts to actually catch the phone network in the act.
|
| Of course, the trouble is that you'll need to be the target
| of government surveillance to be even at risk of any of this.
| If you're not a criminal or a human rights activist, the
| government is probably not pointing its secret spying
| equipment at you, and whatever criminal enterprise hacked its
| way into the carrier network won't either. If you are being
| tracked by either of those, I think developing open source
| modem firmware is probably the least of your concerns.
|
| I honestly wouldn't be surprised if the standard was written
| to make this kind of surveillance possible and that any modem
| refusing to cooperate would be spec incompliant. You can read
| most of the 3GPP spec for free on sites like
| https://portal.3gpp.org/ but I don't have the time or
| interest to dig through the unreadable stream of
| abbreviations and industry terms to find out.
|
| It's all rather pointless anyway when 5G and to an extend 4G
| can geolocate you about as well as GPS can, barring
| reflections and such.
| lxgr wrote:
| Agreed - it's not really a personal concern I have (I have
| no illusions about the chances that none of the apps I
| grant location access to are selling it to the highest
| bidder), but I'm still curious. I can also imagine some
| legitimate use cases, such as pinging the location of
| somebody that had an accident and is possibly unable to
| call 911 themselves.
|
| And same here - I've read a few of the 3GPP specs, but they
| make legalese sound like plain English, and of course never
| tell the full story including actual manufacturer
| decisions.
| fc417fc802 wrote:
| Also worth noting that if the carrier is cooperating then
| you can do better than static snapshots. Tracking signal
| strength of a target moving between towers will give you
| quite a precise historic path (within a few seconds or
| minutes depending on velocity).
| autoexec wrote:
| > If you're not a criminal or a human rights activist, the
| government is probably not pointing its secret spying
| equipment at you
|
| If there's one thing we know for certain about the US and
| domestic spying it's that they're targeting literally
| everyone. They were caught copying all internet traffic
| going over the AT&T backbone in the early 2000s and decades
| later Snowden showed us they never stopped pointing their
| secret spying equipment at us. The best you can hope for is
| that if you don't become an activist or commit enough
| crimes they won't pay much attention to the massive and
| ever-growing troves of data they have on you personally.
| Nokinside wrote:
| It's common to discover IMSI-catchers in national capitals
| around the world. There are many interesting targets.
|
| Washington, D.C. mobile traffic is probably the most spied in
| the world. Especially now when it's run by technological
| cavemen and overly confident techbros. Israeli, Russians,
| Chinese, French and everyone.
| aerostable_slug wrote:
| The Soviet/Russian station in San Francisco was heavily
| involved in SIGINT back in the days of microwave radio trunks
| and analog mobile phones, and I would imagine the Chinese
| have taken the throne from them today.
| rival_elf wrote:
| > Criminal IMSI catchers are pretty much dead,
|
| This isn't true, there are major incidents related to IMSI-
| catchers going on globally right now. E.g. last week from
| Japan: https://newsonjapan.com/article/145466.php,
| https://commsrisk.com/amateur-detectives-find-numerous-
| fake-..., and mass arrests happening in Thailand related to the
| operation of them recently.
|
| To see news related to them, search "Fake Base Stations" or
| "SMS Blaster", as this is how they're commonly referred to in
| the media now.
|
| Other notable highlights from the last few years include: the
| news from Paris a few years ago where police detonated a car
| with an imsi-catcher in it because they thought it was a bomb,
| but actually the driver was being paid to send out sms spam via
| 2g downgrade attacks: https://commsrisk.com/paris-imsi-catcher-
| mistaken-for-bomb-w.... Also the attempt to disrupt the federal
| elections in the Phillippines using a kind of "SMS blaster"
| that takes advantage of unauthenticated emergency alert
| messages, so a step beyond the "classic" imsi catching attack
| that we haven't seen used in the wild before.
| jorvi wrote:
| 5G beamforming is not _that_ accurate a proxy signal, and
| mmWave is phone vaporware, instead only significantly used for
| point-to-point connections. Line-of-sight requirements make it
| dead in the water for anything else.
| buckle8017 wrote:
| Verizon has actually deployed mmWave 5G fairly widely.
| donnachangstein wrote:
| Sprint deployed WiMAX (remember that?) fairly widely, lot
| of good that did them.
|
| mmWave is as dead as dead. The cellular Betamax. iPhone 16e
| (the everyman's iPhone) doesn't support it, and neither did
| the SE before it.
|
| VZW will be converting those base stations into birdhouses
| in 5-7 years.
| NavinF wrote:
| > mmWave is phone vaporware
|
| Is it? I've definitely seen "5G UW" show up on my 15 Pro Max
| in the bay area. Att and Verizon are slowly expanding mmWave
| Scoundreller wrote:
| Get a non-US iPhone which doesn't support those:
| https://www.apple.com/iphone/cellular/
| PantaloonFlames wrote:
| Is this a US-centric view? Presumably crossing national
| borders, as noted in the article, it would be more effective to
| catch IMSIs. When there are lots of countries clustered
| together in a smaller geographical space, ie, not the USA, it
| might be relevant.
|
| But I don't know.
| bigfatkitten wrote:
| > Criminal IMSI catchers are pretty much dead
|
| Quite the opposite. They have seen a _massive_ resurgence over
| the last few years in the form of SMS blasters.
|
| https://commsrisk.com/first-uk-arrests-of-imsi-catching-sms-...
| transpute wrote:
| 2025, _" Rayhunter: Rust tool to detect cell site simulators on
| an orbic mobile hotspot"_,
| https://news.ycombinator.com/item?id=43283917
|
| 2018, EFF Crocodile Hunter,
| https://github.com/EFForg/crocodilehunter
| rival_elf wrote:
| See also this 2019 in-depth primer on cellular attacks I wrote
| for EFF: https://www.eff.org/deeplinks/2019/07/announcing-
| gotta-catch...
| amelius wrote:
| I know very little about the protocol aspects of cellular
| communication, so can anyone explain how such a huge gaping
| security hole could come into existence?
| daneel_w wrote:
| No curious reason for it coming into existence. It's software,
| it will have bugs and oversights. What's curious is that it and
| so many other problems of the cellular grid have been left
| untended to for almost three decades.
| fc417fc802 wrote:
| The issues with cell network security go way beyond "bugs and
| oversight". Whether malicious or incompetent I have no idea.
| toast0 wrote:
| In the beginning of cell phones, security was too expensive.
| Telcos also like to do their own things, so GSM encryption
| wasn't built on best practices. And some countries forbid use
| of even GSM encryption.
|
| Early mobile phone networks suffered from cloning, so work was
| done to improve verification of clients, but verifying the
| network wasn't seen as required. Telcos have been historically
| light on authentication and verification; so it's not
| surprising.
| Bender wrote:
| Adding to this the GSM A3/A8 algo were broken shortly after
| they arrived in the US. The only mitigating control was my
| boss _in a wireless provider_ and the FBI meeting up with
| someone that was going to demo breaking it. They were advised
| what prison they would be relocating to and the demo was
| called off. Rinse and repeat. This was before the internet
| was popular or even widely used. The word eventually got out.
| IshKebab wrote:
| It evolved from a time when this wouldn't have been considered
| a gaping security hole.
| kmeisthax wrote:
| Before 2G, networks used completely unencrypted analog voice.
| You could snoop on anyone's calls with a slightly-modified
| radio; at least until Congress heard about this and made it
| illegal to sell a radio that could be modified to do this[0].
|
| 2G was actually considered a huge bump _up_ in security because
| you could encrypt the contents of calls. Albeit with
| hilariously insecure crypto mandated by the old ITAR regime[1].
| IMSI catchers weren 't part of their threat model, for the same
| reason why people only recently have realized that metadata is
| relevant to security.
|
| [0] This law is still on the books, even though analog cellular
| is entirely dead. It's still a pain in the ass to properly
| comply with this for, e.g. software-defined radio.
|
| [1] This is the same reason why DVD CSS was so easy to crack,
| and why we there used to be 10 different ways to strip SSL
| before we decided to stop serving old browsers entirely.
| kotaKat wrote:
| The article mentions active catchers "requires RF transmission,
| which violates FCC laws (and international equivalents) and is
| detectable"... except...
|
| ... couldn't one build a 'modern' IMSI catcher with a CBRS LTE
| band 48 small cell and their own LTE infrastructure and be above-
| board legal anyways?
| ChuckMcM wrote:
| This is sort of meta to the article...
|
| Wow a web site generated using AI[1]. (or perhaps a human using
| AI)
|
| Anecdotally, when I was attending college there was a 12 year old
| girl also attending and in some of my classes, particularly my
| freshman physics class. She was knocking the curve off with high
| scores on all of the exams. I got a chance to talk to her at
| lunch one day and it turned out she had an eidetic memory. It was
| amazing, she could tell you what was on any page of the text book
| perfectly. That allowed her to recall worked problems in the text
| that were identical in form to the question on the test, and she
| could then use the same steps to solve the test problem. But, and
| this was an important part, she didn't really _understand_
| physics. Whenever our conversation went into areas where she
| could have used physics principles to derive an understanding or
| at least a good guess at some of the depth of a new topic, she
| did not. That didn 't hinder her progress through school but I
| had to believe that at some point it would.
|
| After that experience I started paying more attention to people
| who "knew" facts, and people who "used" facts, which is to say
| that people who had learned something and understood it, would
| use that learning to extrapolate into new areas, open up places
| they didn't understand, and pursue new knowledge about those
| gaps. And there were people who would rebut arguments with
| "facts" but seemed not to grasp the fundamental principles at
| issue.
|
| AI generated "answers" to prompts have exactly the same
| properties as answers from people who know facts but don't
| understand them.
|
| I would guess that the article in question was generated with
| some prompts of the form, "Describe how an IMSI catcher works for
| each type of network." If you're a human and you read the answer
| and noticed that 5G was different you can add the click-bait
| headline and voila, article!
|
| And yet for someone who understands how IMSI catchers work and
| understands the general compatibility environment of the cell
| phone networks, they would point out that most phones are
| designed to work "around the world" which means with all types of
| networks 2G/3G/LTE, and so even if the world around you is LTE/5G
| if you pop up a GSM cell tower signal a modern phone will see it
| and say hi. And then they would go on to describe that WiFi and
| Bluetooth device hardware (MAC) addresses are unique too, and
| those are also sent around if you bleat out your an open wifi
| network or a lonely bluetooth device. Finally it would point out
| that even with the 5G "SUCI", that value is unique to your phone
| and even if you don't give someone enough information to reverse
| map your phone to you, it is absolutely enough information to
| keep track of where this particular phone has been over time.
|
| But all of that context is related to _understanding_ why you
| would even _want_ to capture and IMSI number and how the entire
| system was designed to make that easy even though now that is
| seen as a vulnerability.
|
| So if you've spent some time recognizing the difference between
| people who are talking about something they understand and people
| who are talking about something they read about but don't
| understand, stuff written by AI just sort of pops out at you like
| that.
|
| [1] All the generated images at the bottom was a dead giveaway
| but the structure of the article was also indicative of an LLM
| construction.
___________________________________________________________________
(page generated 2025-04-27 23:00 UTC)