Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did 5G kill the IMSI catcher?

zetier.com

Post reply on HN
Print view View original

81–90 of 122 posts

Re: Did 5G kill the IMSI catcher?

#81

Post by vv_ »

lxgr wrote: post #10
jeroenhd wrote: post #9

Earlier quoted context omitted.

SIM cards don't connect to networks, the phone modem can just disable support for such protocols. That'd probably be illegal, though, in case you're trying to call emergency services and don't have 5G reception. Some Android phones have a setting to at least disable 2G and you can easily configure them to a "preference" of only 5G. I believe iPhones have a 2G toggle as well if you enable lockdown mode. It'll be years…

> SIM cards don't connect to networks SIM cards have hundreds of various configuration knobs influencing what a (compliant) baseband does, so I wouldn’t be surprised if there was one that does just that. That said, some knobs are frustratingly missing, though – why is manually entering an APN a thing, but the default SMSC can be stored on the SIM?

> SIM cards have hundreds of various configuration knobs influencing what a (compliant) baseband does, so I wouldn’t be surprised if there was one that does just that.

There is EF-UST (USIM Service Table) but it doesn't explicitly allow/deny radio access technologies.

Re: Did 5G kill the IMSI catcher?

#82

Post by vv_ »

jeroenhd wrote: post #14
lxgr wrote: post #10

Earlier quoted context omitted.

> SIM cards don't connect to networks SIM cards have hundreds of various configuration knobs influencing what a (compliant) baseband does, so I wouldn’t be surprised if there was one that does just that. That said, some knobs are frustratingly missing, though – why is manually entering an APN a thing, but the default SMSC can be stored on the SIM?

That's true, of course, but SIMs can be reprogrammed by the carrier on a whim. Plus, there are handover features that command the modem to downgrade the connection from the network side, and who knows if the modem will listen to the SIM's config if the network commands it to do something. I haven't needed to enter APNs in years, there are standards to provision those by SMS if they're missing and most of them are pre…

> Check your local laws before you start messing with SIM cards, though, altering certain identifiers can be a crime.

Generally the contents of specific important Elementary Files (EF) are protected by requiring you to have an ADM code to read/write.

> I haven't needed to enter APNs in years, there are standards to provision those by SMS if they're missing and most of them are pre-configured in the phone's OS.

You might need to enter an APN if you have a B2B contract with the operator, where they'll route all traffic from your device(s) through a VPN directly to you. Besides that and static addresses, I am not aware of any other prevalent use-case for changing an APN.

Re: Did 5G kill the IMSI catcher?

#83

Post by vv_ »

flotzam wrote: post #71

> The only simple thing you can do, that can have an effect, is to set your network priority to 5G-SA – but most phones don’t support this feature. 'add support for "5G only" and "4G or 5G only" modes in addition to our existing "4G only" mode' - https://grapheneos.org/releases#2025022700

If you force 4G and 5G only, you are likely to lose access to mobile calls. VoLTE interoperability is still lacking, and this issue is unlikely to be resolved without intervention from a standards organization mandating interoperability and default settings. Unfortunately it will only get attention when somebody can't do an Emergency Call.

Re: Did 5G kill the IMSI catcher?

#84

Post by wkat4242 »

jeroenhd wrote: post #6

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks. I don't know how often unauthorized IMSI catchers are used in the wild, but I doubt it's a relevant percentage of the total amount of IMSI catchers out there. Thanks to mmWave and beam forming, 5G allows operators to practically track you down to the exact c…

mmWave is used almost nowhere though.

Here in Europe phone manufacturers don't even bother including the antennas anymore.

Re: Did 5G kill the IMSI catcher?

#85

Post by vv_ »

huslage wrote: post #55
amelius wrote: post #21

I know very little about the protocol aspects of cellular communication, so can anyone explain how such a huge gaping security hole could come into existence?

The networks are insecure by standard. They are designed such that they can have "lawful intercept" by government entities. The key material on the SIM card is readily transferred between the carrier and SIM/eSIM card manufacturers, which enables multiple levels of supply chain attacks if the material is mishandled. IMSI-catchers are not considered a security hole by the carriers or the standards bodies. SUCI/SUPI wa…

Fyi the above isn't some conspiracy theory as it is standardized by 3GPP:

https://www.etsi.org/deliver/etsi_ts/133100_133199/133106/14...

Here's an interesting quote from the above:

"Depending on national requirements, the CSP may be required to report the location of the Target at the beginning and end of CS calls and PS and IMS sessions on a per warrant or per intercept basis. It may also be a national requirement for the CSP to report the location of the Target [...]"

Re: Did 5G kill the IMSI catcher?

#86

Post by vv_ »

vv_ wrote: post #77
jeroenhd wrote: post #6

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks. I don't know how often unauthorized IMSI catchers are used in the wild, but I doubt it's a relevant percentage of the total amount of IMSI catchers out there. Thanks to mmWave and beam forming, 5G allows operators to practically track you down to the exact c…

> Furthermore, depending on how willing the firmware of your modem is, the signal used to transfer GPS coordinates to the carrier for emergency response situations can also be triggered remotely by carrier hardware. It should be feasible for an operator to issue a command to the (e)UICC (SIM) in the phone to fetch the current location from the modem and send it back via SMS. At least this was the case for a relativel…

For "Lawful Interception" you might want to read:

https://www.etsi.org/deliver/etsi_ts/133100_133199/133106/14...

https://www.etsi.org/deliver/etsi_ts/101600_101699/101671/02...

Re: Did 5G kill the IMSI catcher?

#87

Post by wkat4242 »

esseph wrote: post #51
donnachangstein wrote: post #45

Earlier quoted context omitted.

Sprint deployed WiMAX (remember that?) fairly widely, lot of good that did them. mmWave is as dead as dead. The cellular Betamax. iPhone 16e (the everyman's iPhone) doesn't support it, and neither did the SE before it. VZW will be converting those base stations into birdhouses in 5-7 years.

That's sad for Apple, then. A poor decision on their part. Examples of Android phones that often support mmWave 5G: Samsung: Many Galaxy S and Z series models, including recent releases. Google: Pixel phones, especially the Pro models. OnePlus: Various 5G phones, including the 10 Pro, 10T, and Nord series. (etc) Apple should get their shit together.

Those Samsungs lack mmWave antennas in Europe. Not sure about Apple.

Re: Did 5G kill the IMSI catcher?

#88

Post by flotzam »

vv_ wrote: post #83
flotzam wrote: post #71

> The only simple thing you can do, that can have an effect, is to set your network priority to 5G-SA – but most phones don’t support this feature. 'add support for "5G only" and "4G or 5G only" modes in addition to our existing "4G only" mode' - https://grapheneos.org/releases#2025022700

If you force 4G and 5G only, you are likely to lose access to mobile calls. VoLTE interoperability is still lacking, and this issue is unlikely to be resolved without intervention from a standards organization mandating interoperability and default settings. Unfortunately it will only get attention when somebody can't do an Emergency Call.

Emergency calls bypass the network restriction. I don't see it documented for GrapheneOS, but https://source.android.com/docs/security/features/cellular-s... states

'Android allows users to disable 2G at the radio hardware level on any device that implements the capability constant, "CAPABILITY_USES_ALLOWED_NETWORK_TYPES_BITMASK". This stops a device from scanning or connecting to 2G networks.

Note: Emergency calling is never impacted. A device still scans and connects to 2G networks for emergency services.'

Re: Did 5G kill the IMSI catcher?

#89

Post by delfinom »

NavinF wrote: post #43
jorvi wrote: post #26

Earlier quoted context omitted.

5G beamforming is not that accurate a proxy signal, and mmWave is phone vaporware, instead only significantly used for point-to-point connections. Line-of-sight requirements make it dead in the water for anything else.

> mmWave is phone vaporware Is it? I've definitely seen "5G UW" show up on my 15 Pro Max in the bay area. Att and Verizon are slowly expanding mmWave

"5G UW" is marketing bullshit by Verizon that they force cellphone makers to display. Basically it originally meant "mmWave" but was later revised to "mmWave or mid-band". You are probably seeing the mid-band due to the limitations of mmWave.

Re: Did 5G kill the IMSI catcher?

#90

Post by razakel »

Boldened15 wrote: post #68
somenameforme wrote: post #63

Earlier quoted context omitted.

The phreaking [1] community was huge and becoming increasingly sophisticated long before mobile was even a thing. I think it's mostly that telecoms were traditionally discouraged from pursuing security. There's, at most, a minimal commercial incentive to it, and the government loves comms that can be easily spied on meaning you're going to get pushback from that side if you start aiming for security. The idea to star…

Don’t 2FA apps have the major downside that if you lose the specific mobile device you installed it on you’re SOL, unless you have backup codes that are too technical for most. SMS gets you more human support since you pay your carrier, I can walk into my nearest teleco branch with my ID if I lose my phone and change the SIM to another phone. So most of the time unless your SIM is hijacked it’s a good proxy for being…

>I can walk into my nearest teleco branch with my ID if I lose my phone and change the SIM to another phone.

And I can do the same pretending to be you, or simply bribe the minimum-wage cashier who doesn't really care.

Do they even have a flag for highly sensitive accounts, e.g. set off an alarm if someone tries to issue a new SIM for the President?

Post reply on HN