6 ms·
Wasn't this thought impossible with LTE, I thought older bands were only susceptible to this attack.
by CommanderData 1y ago
Wasn't this thought impossible with LTE, I thought older bands were only susceptible to this attack.
- betaby 1y ago5G standalone is not transmitting IMEI in plain text ever to my knowledge.
- boston_clone 1y agoisn't this then ripe for a downgrade attack?
- NoiseBert69 1y agoTo LTE? Doesn't work there either. There are IMSI catchers - but they all require GSM. At least on Google Pixels you can turn off 2G with a switch. The phone even shows a message about its insecurity. In Germany I'm running 100% on LTE/5GNR-only for many months now without having a single coverage gap.
- boston_clone 1y agothank you for the explainer; I do need to research for a more complete understanding of this space. looks like iPhones will need to enable Lockdown Mode to disable 2G, at least for iOS 17+ per https://ssd.eff.org/module/attending-protest https://ssd.eff.org/module/attending-protest
- jeroenhd 1y agoClassic 2G stingrays are a lot less complicated, but attempts to secure the IMSI haven't properly been implemented until 5G came around. Even then, the IMSI has been replaced with encryption and temporary identifiers your carrier knows belongs to you, and if law enforcement comes in with a warrant they can get those replacement identifiers from your carrier regardless. You can't get the IMSIs passively anymore, but LTE doesn't make these attacks impossible, just less practical, especially for criminals that don't have warrants on their side.
- NoiseBert69 1y agoThey can use standardized lawful interception interfaces to get all this data. No big need to dig down deep into the radio and protocol layer.
- yinznaughty 1y agoYou can collect IMSI passively over LTE: https://github.com/SysSec-KAIST/LTESniffer https://github.com/SysSec-KAIST/LTESniffer You can just jam everyone in the area and see who reconnects.
- kotaKat 1y agoCouldn’t I just grab a Baicells eNB off eBay and point it at my own Open5GS installation and passively sniff IMSIs of users scanning around anyways that try to attach and reject? It feels like I could build some kind of “sniffer” fairly easily these days as well.
- 542354234235 1y ago>In order to maintain an uninterrupted connection to a target’s phone, the Harris software also offers the option of intentionally degrading (or “redirecting”) someone’s phone onto an inferior network, for example, knocking a connection from LTE to 2G. [1] >In its most basic functionality, the [LTE] IMSI catcher receives connection/attach request messages from all mobiledevices in its vicinity. These attach messages are forced to disclose the SIM’s IMSI, thus allowing the IMSI catcher to retreive the IMSI for all devices in its vicinity... a fully LTE-based IMSI catcher is possible, very simple and very cheap to implement without requiring to jam the LTE and 3G bands to downgrade the service to GSM. [2] Exploits on 5G to retrieve the IMSI. [3] [1] https://theintercept.com/2016/09/12/long-secret-stingray-manuals-detail-how-police-can-spy-on-phones/ https://theintercept.com/2016/09/12/long-secret-stingray-man... [2] https://arxiv.org/abs/1607.05171 https://arxiv.org/abs/1607.05171 [3] https://arxiv.org/abs/1809.06925 https://arxiv.org/abs/1809.06925