Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did 5G kill the IMSI catcher?

zetier.com

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Did 5G kill the IMSI catcher?

#101

Post by 1oooqooq »

toast0 wrote: post #24
1oooqooq wrote: post #19

Earlier quoted context omitted.

if you pay the google tax for a pixel, you get a convenient 2G toggle. if you don't have an extra $400-900 and buy a cheaper android, you get to dial # #4636# # (hn screws asterisks, look it up) them go into phone info, select each sim radio and change the drop down (and hopefully you know all the standards by all names to make the right choice. hint 5G is NR there)

There's a convenient toggle on my Moto G Stylus 5G 2023, if not a convenient name. In the carrier settings right next to allow 5G. Can't easily disable 3G or LTE though. IIRC, LTE is also mutually authenticates, but if we're talking about passive catching and the ismi is sent in the clear as the article says, then that doesn't eliminate passive catching. I'm not sure about 3G, I thought it wasn't mutual auth either.

wait. which market? never seen a Motorola with the "disable 2G" toggle!

and yes, that only prevents the lower denominator which uses downgrade, which is the vast majority everywhere.

Re: Did 5G kill the IMSI catcher?

#102

Post by 1oooqooq »

jeroenhd wrote: post #72
1oooqooq wrote: post #19

Earlier quoted context omitted.

if you pay the google tax for a pixel, you get a convenient 2G toggle. if you don't have an extra $400-900 and buy a cheaper android, you get to dial # #4636# # (hn screws asterisks, look it up) them go into phone info, select each sim radio and change the drop down (and hopefully you know all the standards by all names to make the right choice. hint 5G is NR there)

The 2G toggle can also be found in some other phones, but not every phone manufacturer has support for configuring their modems like that or has bothered to keep the setting in their settings app overhaul. I know that setting, but I'm not entirely sure if that controls a preference or a mandatory cell config, and if it will prevent downgrades from the network side or not. Some manufacturers and most custom ROMs also…

every modem have to have that control. and you can access it on every model I've ever seen with the code i shared. i think it might be a requirement for some of the regulations they plaster stickers for.

having the ui it not is a balance between playing nice with over reaching law enforcement and enterprise clients.

Re: Did 5G kill the IMSI catcher?

#103

Post by 1oooqooq »

Bender wrote: post #37
1oooqooq wrote: post #19

Earlier quoted context omitted.

if you pay the google tax for a pixel, you get a convenient 2G toggle. if you don't have an extra $400-900 and buy a cheaper android, you get to dial # #4636# # (hn screws asterisks, look it up) them go into phone info, select each sim radio and change the drop down (and hopefully you know all the standards by all names to make the right choice. hint 5G is NR there)

One can backslash escape the asterisks. ** \*\*

kinda of information that would be very useful displayed when you're entering a comment. it's not like i work here...

Re: Did 5G kill the IMSI catcher?

#104

Post by Bender »

1oooqooq wrote: post #103
Bender wrote: post #37

Earlier quoted context omitted.

One can backslash escape the asterisks. ** \*\*

kinda of information that would be very useful displayed when you're entering a comment. it's not like i work here...

That and all the things listed in this repo [1] not my repo.

[1] - https://github.com/minimaxir/hacker-news-undocumented

Re: Did 5G kill the IMSI catcher?

#105

Post by joecool1029 »

maxsilver wrote: post #96
wtallis wrote: post #69

Earlier quoted context omitted.

Stadiums are pretty much the only place where mmWave in phones makes sense. For the other 99.99% of usage, it's an expensive power-hungry extra radio that doesn't work. mmWave 5G is mostly a sunk cost for Verizon, and largely irrelevant to everyone else.

> Stadiums are pretty much the only place where mmWave in phones makes sense. And Airports, and Parks, and Ampitheateaters, and Malls, and Theme Parks... mmWave isn't a general solution, sure. But mmWave is great for anywhere crowded enough to benefit from a DAS setup, and there are a lot of DAS setups around.

In any case it was a much better solution than band 46 license assisted access LTE-A/NR-U which used unlicensed 5Ghz spectrum shared with wifi. If we want to talk about vaporware/abandoned stuff, this was among the most controversial and least deployed solutions to those areas before mmwave became a thing.

Re: Did 5G kill the IMSI catcher?

#106

Post by joecool1029 »

huslage wrote: post #28
g_p wrote: post #12

Earlier quoted context omitted.

> 5G Standalone security and privacy requirements > To help ensure compatibility of iPhone and cellular iPad devices on private 5G SA networks, infrastructure vendors must adhere to the following security and privacy requirements: > Privacy concealment: The Subscription Concealed Identifier (SUCI) must use a non-null protection scheme. This can be achieved through either an on-SIM SUCI calculation or an ME SUCI calcu…

In the US, the T-Mobile 5G SA eSIM and SIM cards all have SUCI at least. I don’t have any idea about other networks.

One thing I've always wondered is if you need a R15 sim card for it to use SUCI or if the old cards can receive provisioning to do it. I know for a fact you can use any USIM on t-mobile (so it had to support at least 3G) and it will work in the latest 5G devices without issue on SA.

Re: Did 5G kill the IMSI catcher?

#107

Post by derefr »

jorvi wrote: post #26
jeroenhd wrote: post #6

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks. I don't know how often unauthorized IMSI catchers are used in the wild, but I doubt it's a relevant percentage of the total amount of IMSI catchers out there. Thanks to mmWave and beam forming, 5G allows operators to practically track you down to the exact c…

5G beamforming is not that accurate a proxy signal, and mmWave is phone vaporware, instead only significantly used for point-to-point connections. Line-of-sight requirements make it dead in the water for anything else.

What about convention centers, subway platforms, and other places where you have a lot of people packed together outside the reach of exterior towers? They stick microcells on the ceilings of these — wouldn't it make sense for those to be mmWave?

Re: Did 5G kill the IMSI catcher?

#108

Post by joecool1029 »

kotaKat wrote: post #22

The article mentions active catchers "requires RF transmission, which violates FCC laws (and international equivalents) and is detectable"... except... ... couldn't one build a 'modern' IMSI catcher with a CBRS LTE band 48 small cell and their own LTE infrastructure and be above-board legal anyways?

No, because the devices now do authentication of the base station. You would need to issue sim cards with your own service (and then obviously you could track your own carrier's users). Cannot just force other devices to connect to it that are on different carriers. 2G they didn't do this so the malicious base station could just lie about what it was and encourage devices to connect.

Re: Did 5G kill the IMSI catcher?

#109

Post by os2warpman »

wtallis wrote: post #69
cyberax wrote: post #52

Earlier quoted context omitted.

mmWave is going to be useful in places like stadiums or large arenas, though. It works wonders in these kinds of applications. WiMAX never really worked well at all.

Stadiums are pretty much the only place where mmWave in phones makes sense. For the other 99.99% of usage, it's an expensive power-hungry extra radio that doesn't work. mmWave 5G is mostly a sunk cost for Verizon, and largely irrelevant to everyone else.

>it's an expensive power-hungry extra radio that doesn't work

Yes, it requires more power.

You have to consider power and the time the radio needs to be on to accomplish the task.

If using mmWave you can transfer data at 2,000Mbps and using midband you achieve 500Mbps the baseband will be on for 4x the time with midband, and it will need to use less than 1/4th the power of mmWave to break even.

Midband does not require 1/4th the power of mmWave. Closer to 1/2th.

On 11/27/22 at 5:13pm I was in the St. Louis airport and ran a speed test on my iPhone 12 Pro Max. I was probably one of the first non-diagnostic users of their mmWave infrastructure and I must have been the only user at the time because I achieved a damn-near-practical-maximum of 3938Mbps down. The only reason I ran the speed test at all was that a notoriously sluggish web application I was using was performing spectacularly.

Since then I have been running speed tests at concerts, sporting events, traffic jams, airports, shopping centers, and the Rennaissance Faire. All locations where, prior to 5G, cellular coverage was useless.

On 10/13/24 at 1:14pm I was in a crowded terminal at Chicago O'Hare and ran a speed test on an iPhone 15 Pro Max. Connected via mmWave I achieved 1869Mbps down.

Re: Did 5G kill the IMSI catcher?

#110

Post by fweimer »

amelius wrote: post #21

I know very little about the protocol aspects of cellular communication, so can anyone explain how such a huge gaping security hole could come into existence?

The telco trusts its own network. Telcos doesn't trust users, so users need to authenticate themselves, and devices need to be regulated. But under the traditional telco security model, the network doesn't need to authenticate itself to the devices.

Even today, building the necessary infrastructure for network trust management is also really, really hard across the many jurisdictions involved.

Post reply on HN