IMSI Catchers and Mobile Security

4 COUNTERMEASURES
4.1 Detection Indicators
As the design and production of IMSI catchers has historically been kept secret, not much
information is publicly available about how specific models of IMSI catchers work. However,
based on investigative research and working prototypes such as Chris Paget’s homebuilt IMSI
catchers, there are some unusual behaviors of IMSI catchers that can be used to differentiate them
from legitimate base stations. Some of these have been identified as proposed heuristics and are
laid out below, following the material in [27].
These detection indicators can be monitored on either the user’s mobile phone (see Sections
4.2 and 4.3) or on separate hardware (see Section 4.4). Such apps or devices may be called “IMSI
catcher catchers” or “IMSI catcher detectors”. Implementation of these indicators has also been
limited by access to baseband chip functions, which has typically been restricted by chipmakers 7 .
4.1.1 Off-band Frequency Usage
In order to increase signal quality and reduce noise, IMSI catchers may choose to operate
on an unused frequency, such as channels reserved for testing or buffer channels between different
operators. The drawback of using these frequencies is that the mobile stations may prefer
neighboring cell frequencies (as advertised by the original base station they are connected to)
instead, reducing the probability of the mobile station connecting to the IMSI catcher.
Alternatively, the IMSI catcher can operate on an advertised frequency that is not actually in use
at that time in the vicinity.
This behavior can be detected by cross-checking the operating frequencies of the cell
towers in the vicinity against the current frequency band plan as designated by local authorities.
According to [27], “radio regulatory bodies and frequency plans are available for almost all
countries.”
4.1.2 Unusual Cell ID
GSM Cell IDs (CIDs) are unique numbers identifying each base station within a Location
Area Code (LAC) in a GSM network. Valid CIDs range from 0 to 65535 (i.e. 2 16 -1) for GSM and
CDMA networks. In order to avoid protocol mismatch with the real base stations and to elicit a
Location Update request from mobile phones, IMSI catchers usually introduce a new CID
previously unused within the operating geographic region.
This behavior can be detected by cross-checking the base station CIDs in the vicinity with
a database of registered base stations, their CIDs, and their registered geographic locations. These
databases are available from government sources, for example, the Federal Communications
7
In his presentation of SnoopSnitch, Nohl explains that the development team would have implemented detection
measures for additional heuristics if they could, but were instead limited by restricted access to information from the
Qualcomm baseband chip [18].
18