IMSI Catchers and Mobile Security

3 IMSI CATCHERS
3.1 Introduction
Attacks on GSM include cracking GSM encryption, passive GSM interception, and active
GSM interception. IMSI catchers fall into the last category, actively interfering in communications
between mobile phones and base stations by acting as a transceiver (simultaneously transmitting
and receiving). IMSI catchers use a “man-in-the-middle” attack, simultaneously posing as the fake
mobile phone to the real base station and as the fake base station to the real mobile phone.
IMSI catchers are able to determine the IMSI numbers of mobile phones in its vicinity,
which is the trademark capability from which their name is derived. Using the IMSI, they can then
identify mobile traffic on the network and target traffic for interception and analysis.
The most famous IMSI catchers are StingRay devices sold by the Harris Corporation to
various government agencies in the United States. Thus, IMSI catchers have also come to be
generally known as “stingrays”. They have also been called “cell site simulators” or “cell site
emulators”, especially among law enforcement agencies [26].
3.2 Functionality
Although the implementation of different IMSI catchers may vary, the section below
attempts to highlight how most IMSI catchers function, as laid out in [9], [27], [28], and [29].
3.2.1 Obtaining the IMSI
Whenever there is more than one Base Station belonging to the home network in the
vicinity, GSM mobile phones will always connect to the Base Station that is emitting the strongest
signal. Thus, by transmitting a sufficiently strong signal, an IMSI catcher will cause every mobile
phone within a small radius to connect to it.
The IMSI catcher then acts like a Base Station. First, the Mobile Station is induced to send
its encryption capabilities to the Base Station, which can be ignored. Then, the IMSI catcher sends
an Identity Request command to the Mobile Station, which is forced to respond with its IMSI. 4
3.2.2 Initiating network connection
The IMSI catcher can now connect to the network by sending a Location Update Request. 5
When the network responds with an Identity Request, the IMSI catcher can respond with the stolen
IMSI.
4
There is a similar procedure that can be used for forcing transmission of the IMEI.
5
This procedure allows the mobile station to inform the cellular network whenever it moves from one location to the
next, so that the network can continue to keep it connected through the nearest base station.
10