Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did 5G kill the IMSI catcher?

zetier.com

Post reply on HN
Print view View original

41–50 of 122 posts

Re: Did 5G kill the IMSI catcher?

#41

Post by kmeisthax »

amelius wrote: post #21

I know very little about the protocol aspects of cellular communication, so can anyone explain how such a huge gaping security hole could come into existence?

Before 2G, networks used completely unencrypted analog voice. You could snoop on anyone's calls with a slightly-modified radio; at least until Congress heard about this and made it illegal to sell a radio that could be modified to do this[0].

2G was actually considered a huge bump up in security because you could encrypt the contents of calls. Albeit with hilariously insecure crypto mandated by the old ITAR regime[1]. IMSI catchers weren't part of their threat model, for the same reason why people only recently have realized that metadata is relevant to security.

[0] This law is still on the books, even though analog cellular is entirely dead. It's still a pain in the ass to properly comply with this for, e.g. software-defined radio.

[1] This is the same reason why DVD CSS was so easy to crack, and why we there used to be 10 different ways to strip SSL before we decided to stop serving old browsers entirely.

Re: Did 5G kill the IMSI catcher?

#42

Post by lxgr »

toast0 wrote: post #24
1oooqooq wrote: post #19

Earlier quoted context omitted.

if you pay the google tax for a pixel, you get a convenient 2G toggle. if you don't have an extra $400-900 and buy a cheaper android, you get to dial # #4636# # (hn screws asterisks, look it up) them go into phone info, select each sim radio and change the drop down (and hopefully you know all the standards by all names to make the right choice. hint 5G is NR there)

There's a convenient toggle on my Moto G Stylus 5G 2023, if not a convenient name. In the carrier settings right next to allow 5G. Can't easily disable 3G or LTE though. IIRC, LTE is also mutually authenticates, but if we're talking about passive catching and the ismi is sent in the clear as the article says, then that doesn't eliminate passive catching. I'm not sure about 3G, I thought it wasn't mutual auth either.

Definitely, mutual authentication and (not) using long-term identifiers in the initial attach request are largely orthogonal concerns.

I believe even 3G supports mutual authentication (at least if the SIM supports it, i.e. it’s not a very old GSM only one), but anonymized identifiers only appeared with 5G.

Re: Did 5G kill the IMSI catcher?

#43

Post by NavinF »

jorvi wrote: post #26
jeroenhd wrote: post #6

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks. I don't know how often unauthorized IMSI catchers are used in the wild, but I doubt it's a relevant percentage of the total amount of IMSI catchers out there. Thanks to mmWave and beam forming, 5G allows operators to practically track you down to the exact c…

5G beamforming is not that accurate a proxy signal, and mmWave is phone vaporware, instead only significantly used for point-to-point connections. Line-of-sight requirements make it dead in the water for anything else.

> mmWave is phone vaporware

Is it? I've definitely seen "5G UW" show up on my 15 Pro Max in the bay area. Att and Verizon are slowly expanding mmWave

Re: Did 5G kill the IMSI catcher?

#44

Post by Scoundreller »

NavinF wrote: post #43
jorvi wrote: post #26

Earlier quoted context omitted.

5G beamforming is not that accurate a proxy signal, and mmWave is phone vaporware, instead only significantly used for point-to-point connections. Line-of-sight requirements make it dead in the water for anything else.

> mmWave is phone vaporware Is it? I've definitely seen "5G UW" show up on my 15 Pro Max in the bay area. Att and Verizon are slowly expanding mmWave

Get a non-US iPhone which doesn't support those: https://www.apple.com/iphone/cellular/

Re: Did 5G kill the IMSI catcher?

#45

Post by donnachangstein »

buckle8017 wrote: post #40
jorvi wrote: post #26

Earlier quoted context omitted.

5G beamforming is not that accurate a proxy signal, and mmWave is phone vaporware, instead only significantly used for point-to-point connections. Line-of-sight requirements make it dead in the water for anything else.

Verizon has actually deployed mmWave 5G fairly widely.

Sprint deployed WiMAX (remember that?) fairly widely, lot of good that did them.

mmWave is as dead as dead. The cellular Betamax. iPhone 16e (the everyman's iPhone) doesn't support it, and neither did the SE before it.

VZW will be converting those base stations into birdhouses in 5-7 years.

Re: Did 5G kill the IMSI catcher?

#46

Post by bigfatkitten »

jeroenhd wrote: post #6

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks. I don't know how often unauthorized IMSI catchers are used in the wild, but I doubt it's a relevant percentage of the total amount of IMSI catchers out there. Thanks to mmWave and beam forming, 5G allows operators to practically track you down to the exact c…

> Criminal IMSI catchers are pretty much dead

Quite the opposite. They are more popular than ever, in the form of SMS blasters.

https://commsrisk.com/first-uk-arrests-of-imsi-catching-sms-...

Re: Did 5G kill the IMSI catcher?

#47

Post by aerostable_slug »

Nokinside wrote: post #11
jeroenhd wrote: post #6

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks. I don't know how often unauthorized IMSI catchers are used in the wild, but I doubt it's a relevant percentage of the total amount of IMSI catchers out there. Thanks to mmWave and beam forming, 5G allows operators to practically track you down to the exact c…

It's common to discover IMSI-catchers in national capitals around the world. There are many interesting targets. Washington, D.C. mobile traffic is probably the most spied in the world. Especially now when it's run by technological cavemen and overly confident techbros. Israeli, Russians, Chinese, French and everyone.

The Soviet/Russian station in San Francisco was heavily involved in SIGINT back in the days of microwave radio trunks and analog mobile phones, and I would imagine the Chinese have taken the throne from them today.

Re: Did 5G kill the IMSI catcher?

#48

Post by JadeNB »

1oooqooq wrote: post #19
lxgr wrote: post #3

I've always been wondering: Is there a SIM card configuration flag that allows telling the phone to never even attempt an attach using a given technology? This would allow leaking identifiers (at the cost of greatly reducing roaming coverage, at the moment), attaching to spoofed networks (for 2G, which does not have mutual authentication) etc.

if you pay the google tax for a pixel, you get a convenient 2G toggle. if you don't have an extra $400-900 and buy a cheaper android, you get to dial # #4636# # (hn screws asterisks, look it up) them go into phone info, select each sim radio and change the drop down (and hopefully you know all the standards by all names to make the right choice. hint 5G is NR there)

> ##4636## (hn screws asterisks, look it up)

You can include asterisks if you escape them, like \*: *#*#4636#*#*.

Re: Did 5G kill the IMSI catcher?

#49

Post by Alive-in-2025 »

ChuckMcM wrote: post #38

This is sort of meta to the article... Wow a web site generated using AI[1]. (or perhaps a human using AI) Anecdotally, when I was attending college there was a 12 year old girl also attending and in some of my classes, particularly my freshman physics class. She was knocking the curve off with high scores on all of the exams. I got a chance to talk to her at lunch one day and it turned out she had an eidetic memory.…

This is a very interesting comment. When I read your physics story, I thought you would be getting to the similarity to current llms. However hallucinations seem like a different issue that the young student might not have. If she incorrectly matches some scenario to a text match, maybe some hallucinations. Some humans are confident in making comments about things I don't understand, like you know who. But many humans somehow have a concept of their limited knowledge. When they add that to LLMs, that will be powerful.

Re: Did 5G kill the IMSI catcher?

#50

Post by AStonesThrow »

Nokinside wrote: post #11
jeroenhd wrote: post #6

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks. I don't know how often unauthorized IMSI catchers are used in the wild, but I doubt it's a relevant percentage of the total amount of IMSI catchers out there. Thanks to mmWave and beam forming, 5G allows operators to practically track you down to the exact c…

It's common to discover IMSI-catchers in national capitals around the world. There are many interesting targets. Washington, D.C. mobile traffic is probably the most spied in the world. Especially now when it's run by technological cavemen and overly confident techbros. Israeli, Russians, Chinese, French and everyone.

Back in the mid-80s, it was an open secret that some AMPS transmissions could be received on ordinary TV tuners which were capable up to Channel 83 or so.

My father being a DXer and installer of a home-built Yagi and rotator system, I discovered this fairly easily. All he told me was to just guard the privacy of these people I was snooping on, because they were supposed to be private conversations after all. I never heard anything of substance anyway. It was one of the more boring surveillance activities of my misspent youth.

Post reply on HN