What is IMSI Catcher ?

Below is an exchange between myself and tech expert about IMSI Catcher

💬 **me**: I’m curious about how mobile networks protect subscriber identities. Could you explain the mechanisms involved, especially regarding the IMSI?

💬 **Tech Expert**: Sure! Mobile networks use a Temporary Mobile Subscriber Identity (TMSI) assigned to devices at regular intervals. The long-term IMSI is only used for fault recovery or when a TMSI hasn’t been assigned. This helps prevent device lock-out when errors occur. However, this system doesn’t protect against active attackers who can exploit IMSI requests to gather IMSIs.

💬 **Me**: That’s interesting. So, what exactly is an IMSI Catcher, and how does it pose a threat?

💬 **Tech Expert**: An IMSI Catcher is a device that mimics a legitimate base station to collect IMSIs from nearby mobile devices. It appears as a real base station but is not part of the commercial network. By collecting IMSIs, it can track users’ movements and, in GSM networks, perform Man-In-The-Middle (MITM) attacks by intercepting all communications between the device and the network.

💬 **Me**: How serious is the threat from IMSI Catchers?

💬 **Tech Expert**: Very serious. IMSI Catchers can identify and track individuals, intercept calls and messages, and force all nearby phones to transmit their IMSI and IMEI data. Initially, these devices were expensive and limited to law enforcement, but now they’re relatively cheap and accessible due to advances in software-defined radio technology.

💬 **Me**: How do these devices work in practice, and what are the types of IMSI Catching attacks?

💬 **Tech Expert**: IMSI Catching attacks can be passive or active. Passive IMSI Catchers eavesdrop on wireless traffic, waiting for devices to transmit their IMSIs, which is slow but hard to detect. Active IMSI Catchers set up a fake base station with a strong signal, prompting nearby devices to respond with their IMSIs, believing it’s a real network that lost the TMSI. This method captures IMSIs quickly and efficiently.

💬 **Me**: That’s quite comprehensive. Are there any notable examples or developments in IMSI Catching technology ?

💬 **Tech Expert**: Yes, the first IMSI Catcher was launched by Rohde & Schwarz in 1996. Today, a homemade IMSI Catcher can be built for about $1,500 using open-source platforms like OpenBTS. This accessibility has increased the potential for misuse, making IMSI protection a critical issue for mobile network security.

Don’t miss our 5G Training courses to learn more about theses technologies :