Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did 5G kill the IMSI catcher?

zetier.com

Post reply on HN
Print view View original

111–120 of 122 posts

Re: Did 5G kill the IMSI catcher?

#111

Post by huslage »

joecool1029 wrote: post #106
huslage wrote: post #28

Earlier quoted context omitted.

In the US, the T-Mobile 5G SA eSIM and SIM cards all have SUCI at least. I don’t have any idea about other networks.

One thing I've always wondered is if you need a R15 sim card for it to use SUCI or if the old cards can receive provisioning to do it. I know for a fact you can use any USIM on t-mobile (so it had to support at least 3G) and it will work in the latest 5G devices without issue on SA.

No. The SIM is specifically programmed with SUCI from the factory. The GSMA has a whole process around it.

Re: Did 5G kill the IMSI catcher?

#112

Post by maxsilver »

joecool1029 wrote: post #105
maxsilver wrote: post #96

Earlier quoted context omitted.

> Stadiums are pretty much the only place where mmWave in phones makes sense. And Airports, and Parks, and Ampitheateaters, and Malls, and Theme Parks... mmWave isn't a general solution, sure. But mmWave is great for anywhere crowded enough to benefit from a DAS setup, and there are a lot of DAS setups around.

In any case it was a much better solution than band 46 license assisted access LTE-A/NR-U which used unlicensed 5Ghz spectrum shared with wifi. If we want to talk about vaporware/abandoned stuff, this was among the most controversial and least deployed solutions to those areas before mmwave became a thing.

Agreed. Stealing public WiFi spectrum for private LTE was always a terrible idea.

Re: Did 5G kill the IMSI catcher?

#113

Post by trod1234 »

vv_ wrote: post #77
jeroenhd wrote: post #6

Criminal IMSI catchers are pretty much dead, but with the aid of carriers law enforcement can still use similar technology even with full standalone 5G networks. I don't know how often unauthorized IMSI catchers are used in the wild, but I doubt it's a relevant percentage of the total amount of IMSI catchers out there. Thanks to mmWave and beam forming, 5G allows operators to practically track you down to the exact c…

> Furthermore, depending on how willing the firmware of your modem is, the signal used to transfer GPS coordinates to the carrier for emergency response situations can also be triggered remotely by carrier hardware. It should be feasible for an operator to issue a command to the (e)UICC (SIM) in the phone to fetch the current location from the modem and send it back via SMS. At least this was the case for a relativel…

The reason Google has the best Wi-Fi AP location database is because they knowingly violated wiretapping laws, when they rolled out Streetview, and they were only fined a cool 13 million for it.

https://epic.org/documents/investigations-of-google-street-v...

They were ordered to destroy any data related to the collection from Streetview, and they did it seems, but they may not have deleted any of the data that had already been copied/integrated to other separate services like GiS, where they may have simply just moved that wiretapping to the edge devices to facilitate geo-location similar to how Apple uses Wi-Fi points as landmarks as a plausible (we aren't wiretapping), while still physically mapping based on radio signal, and also indirectly on calls through AI.

https://www.courthousenews.com/google-must-face-claims-of-ai...

The only learned lesson they had seemed to be that you don't make a public-facing API that allows searches of locations based on BSSID, or MAC address to the general public (which is what they had for Streetview).

Re: Did 5G kill the IMSI catcher?

#114

Post by red0point »

joecool1029 wrote: post #108
kotaKat wrote: post #22

The article mentions active catchers "requires RF transmission, which violates FCC laws (and international equivalents) and is detectable"... except... ... couldn't one build a 'modern' IMSI catcher with a CBRS LTE band 48 small cell and their own LTE infrastructure and be above-board legal anyways?

No, because the devices now do authentication of the base station. You would need to issue sim cards with your own service (and then obviously you could track your own carrier's users). Cannot just force other devices to connect to it that are on different carriers. 2G they didn't do this so the malicious base station could just lie about what it was and encourage devices to connect.

Of course you can. The IMSI is sent before any authentication.

Re: Did 5G kill the IMSI catcher?

#115

Post by toast0 »

1oooqooq wrote: post #101
toast0 wrote: post #24

Earlier quoted context omitted.

There's a convenient toggle on my Moto G Stylus 5G 2023, if not a convenient name. In the carrier settings right next to allow 5G. Can't easily disable 3G or LTE though. IIRC, LTE is also mutually authenticates, but if we're talking about passive catching and the ismi is sent in the clear as the article says, then that doesn't eliminate passive catching. I'm not sure about 3G, I thought it wasn't mutual auth either.

wait. which market? never seen a Motorola with the "disable 2G" toggle! and yes, that only prevents the lower denominator which uses downgrade, which is the vast majority everywhere.

US market, purchased direct from Motorola.

Re: Did 5G kill the IMSI catcher?

#116

Post by cyberax »

vv_ wrote: post #76
cyberax wrote: post #52

Earlier quoted context omitted.

mmWave is going to be useful in places like stadiums or large arenas, though. It works wonders in these kinds of applications. WiMAX never really worked well at all.

> WiMAX never really worked well at all Neither did LTE (or VoLTE) work well at the start. WiMAX didn't get the funding and backing primarily because it didn't integrate well with existing systems. Hilariously it fit the criteria as 4G before LTE did. I guess there was a strong vendor push to include LTE into 4G.

I had one of the few laptop models with WiMAX built-in, and I tried it several times. The only time it worked was on the Brighton Beach boardwalk, surprising me completely. But even then, the connection speed was lower than of my 3G USB modem.

Re: Did 5G kill the IMSI catcher?

#117

Post by g_p »

joecool1029 wrote: post #106
huslage wrote: post #28

Earlier quoted context omitted.

In the US, the T-Mobile 5G SA eSIM and SIM cards all have SUCI at least. I don’t have any idea about other networks.

One thing I've always wondered is if you need a R15 sim card for it to use SUCI or if the old cards can receive provisioning to do it. I know for a fact you can use any USIM on t-mobile (so it had to support at least 3G) and it will work in the latest 5G devices without issue on SA.

You need a SIM card (ideally) with support for elliptic curve crypto, and some additional fields added in the profile (SIM services 124 and 125). You can then, once those services are enabled, place network public keys on the SIM itself.

There are 2 ways to do SUCI calculation - both require SIM support to hold public keys. SUCI-on-SIM requires a SIM that can do the encryption to the public key on the SIM itself, and issue that in response to the IDENTITY command; SUCI-on-phone requires a SIM that "just" has the public key fields present, and the handset can do the SUCI calculation and encrypt the SUPI for the public key stored on the SIM.

Either way, your scenario isn't using SUCI concealment by my understanding, unless you got a new SIM card, or it was reprogrammed somehow to support the SIM service fields needed (but I'm not aware of operators doing that).

Re: Did 5G kill the IMSI catcher?

#118

Post by vv_ »

trod1234 wrote: post #113
vv_ wrote: post #77

Earlier quoted context omitted.

> Furthermore, depending on how willing the firmware of your modem is, the signal used to transfer GPS coordinates to the carrier for emergency response situations can also be triggered remotely by carrier hardware. It should be feasible for an operator to issue a command to the (e)UICC (SIM) in the phone to fetch the current location from the modem and send it back via SMS. At least this was the case for a relativel…

The reason Google has the best Wi-Fi AP location database is because they knowingly violated wiretapping laws, when they rolled out Streetview, and they were only fined a cool 13 million for it. https://epic.org/documents/investigations-of-google-street-v... They were ordered to destroy any data related to the collection from Streetview, and they did it seems, but they may not have deleted any of the data that had al…

They have a geolocation API that allows searches of locations based on BSSID's and RSSI's and cell towers. It is "public" but you need to pay $ per requests.

Re: Did 5G kill the IMSI catcher?

#119

Post by trod1234 »

vv_ wrote: post #118
trod1234 wrote: post #113

Earlier quoted context omitted.

The reason Google has the best Wi-Fi AP location database is because they knowingly violated wiretapping laws, when they rolled out Streetview, and they were only fined a cool 13 million for it. https://epic.org/documents/investigations-of-google-street-v... They were ordered to destroy any data related to the collection from Streetview, and they did it seems, but they may not have deleted any of the data that had al…

They have a geolocation API that allows searches of locations based on BSSID's and RSSI's and cell towers. It is "public" but you need to pay $ per requests.

Good to know, wasn't aware they had this.

Re: Did 5G kill the IMSI catcher?

#120

Post by jorvi »

derefr wrote: post #107
jorvi wrote: post #26

Earlier quoted context omitted.

5G beamforming is not that accurate a proxy signal, and mmWave is phone vaporware, instead only significantly used for point-to-point connections. Line-of-sight requirements make it dead in the water for anything else.

What about convention centers, subway platforms, and other places where you have a lot of people packed together outside the reach of exterior towers? They stick microcells on the ceilings of these — wouldn't it make sense for those to be mmWave?

Not really, because many cheaper phones don't have mmWave antennas. Nor do some international iPhones.

Aside from that, mmWave's biggest application is high-speed connections, not necessarily large client capacity per cell (although there is correlation). For subways I'd probably want the lowest band 4G or 5G cells for maximum penetration.

Convention centers are not really a good application for micro cells, as you have ample time to do a professional WiFi setup. Something like 5000 people should be serviceable by a 10Gb/s backhaul.

I could see stadiums being a good application for mmWave. Scant few foreigners visit American sports games, media wants/needs lot of backhaul, peaks of 30 000 visitors is definitely very hard to manage with WiFi.

mmWave in American cities is a horrible application though. Americans love building vertically, which greatly hampers mmWave viability.

Post reply on HN