LTE and IMSI catcher myths

Recommendations

Info

Fake base-‐sta+ons..1 • Used for: <strong>IMSI</strong>/IMEI/locaMon tracking, call & data intercepMon • Exploit weaknesses in GSM & 3G networks (parMally) • Knows as <strong>IMSI</strong> Catchers • Difficult to detect on normal phones (Darshak, Cryptophone or Snoopsnitch) 4
Fake base-‐sta+ons..2 5
Page 1 and 2: LTE and IMSI catcher myths Rav
Page 3: Mo+va+on • Baseband story •
Page 7 and 8: LTE/4G networks • Widely deplo
Page 9 and 10: Enhanced security in LTE • Mu
Page 11 and 12: Paging in LTE IMSI = 404220522xx
Page 13 and 14: Enhanced security w.r.t fake ba
Page 15 and 16: LTE RRC protocol* : specifica+o
Page 17 and 18: EMM protocol* : specifica+on vu
Page 19 and 20: IMEI leak : implementa+on vulne
Page 21 and 22: LTE RRC* : implementa+on vulner
Page 23 and 24: Configura+on issues Deployments
Page 25 and 26: Experiment Set-‐up Set-‐u
Page 27 and 28: Semi-‐Passive : determine tr
Page 29 and 30: DoS AZacks Exploi+ng specifica+o
Page 31 and 32: Solu+on! Use any old Nokia pho
Page 33: Thanks Ques+ons?

LTE and IMSI catcher myths

Create successful ePaper yourself

Delete template?

Save as template?