An international mobile subscriber identity-catcher, or IMSI-catcher, is a
telephone eavesdropping device used for intercepting
mobile phone
A mobile phone, cellular phone, cell phone, cellphone, handphone, hand phone or pocket phone, sometimes shortened to simply mobile, cell, or just phone, is a portable telephone that can make and receive calls over a radio frequency link whil ...
traffic and tracking location data of mobile phone users.
Essentially a "fake"
mobile tower acting between the target mobile phone and the service provider's real towers, it is considered a
man-in-the-middle
In cryptography and computer security, a man-in-the-middle, monster-in-the-middle, machine-in-the-middle, monkey-in-the-middle, meddler-in-the-middle, manipulator-in-the-middle (MITM), person-in-the-middle (PITM) or adversary-in-the-middle (AiTM) ...
(MITM) attack. The
3G wireless standard offers some risk mitigation due to mutual authentication required from both the handset and the network.
However, sophisticated attacks may be able to downgrade 3G and
LTE to non-LTE network services which do not require mutual authentication.
IMSI-catchers are used in a number of countries by
law enforcement
Law enforcement is the activity of some members of government who act in an organized manner to enforce the law by discovering, deterring, rehabilitating, or punishing people who violate the rules and norms governing that society. The term en ...
and
intelligence agencies
An intelligence agency is a government agency responsible for the collection, analysis, and exploitation of information in support of law enforcement, national security, military, public safety, and foreign policy objectives.
Means of informatio ...
, but their use has raised significant civil liberty and privacy concerns and is strictly regulated in some countries such as under the German ''Strafprozessordnung'' (StPO / Code of Criminal Procedure).
Some countries do not have encrypted phone data traffic (or very weak encryption), thus rendering an IMSI-catcher unnecessary.
Overview
A virtual
base transceiver station
A base transceiver station (BTS) is a piece of equipment that facilitates wireless communication between user equipment (UE) and a network. UEs are devices like mobile phones (handsets), WLL phones, computers with wireless Internet connectivity, o ...
(VBTS)
is a device for identifying the
temporary mobile subscriber identity (TMSI),
international mobile subscriber identity
The international mobile subscriber identity (IMSI) is a number that uniquely identifies every user of a cellular network. It is stored as a field and is sent by the mobile device to the network. It is also used for acquiring other details of th ...
(IMSI) of a nearby
GSM
The Global System for Mobile Communications (GSM) is a standard developed by the European Telecommunications Standards Institute (ETSI) to describe the protocols for second-generation ( 2G) digital cellular networks used by mobile devices such as ...
mobile phone
A mobile phone, cellular phone, cell phone, cellphone, handphone, hand phone or pocket phone, sometimes shortened to simply mobile, cell, or just phone, is a portable telephone that can make and receive calls over a radio frequency link whil ...
and
intercepting
In ball-playing competitive team sports, an interception or pick is a move by a player involving a pass of the ball—whether by foot or hand, depending on the rules of the sport—in which the ball is intended for a player of the same team b ...
its calls, some are even advanced enough to detect the
international mobile equipment identity
The International Mobile Equipment Identity (IMEI) is a numeric identifier, usually unique, for 3GPP and iDEN mobile phones, as well as some satellite phones. It is usually found printed inside the battery compartment of the phone but can al ...
(IMEI). It was patented
and first commercialized by
Rohde & Schwarz
Rohde & Schwarz GmbH & Co KG (, ) is an international electronics group specializing in the fields of electronic test equipment, broadcast & media, cybersecurity, radiomonitoring and radiolocation, and radiocommunication. The company provides ...
in 2003. The device can be viewed as simply a modified cell tower with a malicious operator, and on 4 January 2012, the
Court of Appeal of England and Wales
The Court of Appeal (formally "His Majesty's Court of Appeal in England", commonly cited as "CA", "EWCA" or "CoA") is the highest court within the Courts of England and Wales#Senior Courts of England and Wales, Senior Courts of England and Wal ...
held that the patent is
invalid for obviousness.
IMSI-catchers are often deployed by court order without a
search warrant
A search warrant is a court order that a magistrate or judge issues to authorize law enforcement officers to conduct a search of a person, location, or vehicle for evidence of a crime and to confiscate any evidence they find. In most countries, ...
, the lower judicial standard of a
pen register
A pen register, or dialed number recorder (DNR), is an electronic device that records all numbers called from a particular telephone line. The term has come to include any device or program that performs similar functions to an original pen regist ...
and trap-and-trace order being preferred by law enforcement. They can also be used in search and rescue operation for missing persons. Police departments have been reluctant to reveal use of these programs and contracts with vendors such as
Harris Corporation
Harris Corporation was an American technology company, defense contractor, and information technology services provider that produced wireless equipment, tactical radios, electronic systems, night vision equipment and both terrestrial and spaceb ...
, the maker of
Stingray
Stingrays are a group of sea rays, which are cartilaginous fish related to sharks. They are classified in the suborder Myliobatoidei of the order Myliobatiformes and consist of eight families: Hexatrygonidae (sixgill stingray), Plesiobatidae ( ...
and Kingfish phone tracker devices.
In the UK, the first public body to admit using IMSI catchers was the
Scottish Prison Service
The Scottish Prison Service (SPS) is an executive agency of the Scottish Government tasked with managing prisons and Young Offender Institutions.
The Chief Executive of the Scottish Prison Service, currently Teresa Medhurst, is responsible fo ...
, though it is likely that the
Metropolitan Police Service
The Metropolitan Police Service (MPS), formerly and still commonly known as the Metropolitan Police (and informally as the Met Police, the Met, Scotland Yard, or the Yard), is the territorial police force responsible for law enforcement and ...
has been using IMSI catchers since 2011 or before.
Body-worn IMSI-catchers that target nearby mobile phones are being advertised to law enforcement agencies in the US.
The
GSM
The Global System for Mobile Communications (GSM) is a standard developed by the European Telecommunications Standards Institute (ETSI) to describe the protocols for second-generation ( 2G) digital cellular networks used by mobile devices such as ...
specification requires the handset to authenticate to the network, but does ''not'' require the network to authenticate to the handset. This well-known security hole is exploited by an IMSI catcher.
The IMSI catcher masquerades as a
base station
Base station (or base radio station) is – according to the International Telecommunication Union's (ITU) Radio Regulations (RR) – a "land station in the land mobile service."
The term is used in the context of mobile telephony, wireless com ...
and logs the IMSI numbers of all the
mobile station
A mobile station (MS) comprises all user equipment and computer software, software needed for communication with a Cellular network, mobile network.
The term refers to the global system connected to the mobile network, i.e. a mobile phone or mob ...
s in the area, as they attempt to attach to the IMSI-catcher. It allows forcing the mobile phone connected to it to use no call encryption (A5/0 mode) or to use easily breakable encryption (A5/1 or A5/2 mode), making the call data easy to intercept and convert to audio.
The
3G wireless standard mitigates risk and enhanced security of the protocol due to mutual authentication required from both the handset and the network and removes the false base station attack in GSM.
Some sophisticated attacks against 3G and
LTE may be able to downgrade to non-LTE network services which then does not require mutual authentication.
Functionalities
Identifying an IMSI
Every mobile phone has the requirement to optimize its reception. If there is more than one base station of the subscribed network operator accessible, it will always choose the one with the strongest signal. An IMSI-catcher masquerades as a base station and causes every mobile phone of the simulated network operator within a defined radius to log in. With the help of a special identity request, it is able to force the transmission of the IMSI.
Tapping a mobile phone
The IMSI-catcher subjects the phones in its vicinity to a
man-in-the-middle attack
In cryptography and computer security, a man-in-the-middle, monster-in-the-middle, machine-in-the-middle, monkey-in-the-middle, meddler-in-the-middle, manipulator-in-the-middle (MITM), person-in-the-middle (PITM) or adversary-in-the-middle (AiTM) ...
, appearing to them as a preferred base station in terms of signal strength. With the help of a
SIM, it simultaneously logs into the GSM network as a mobile station. Since the encryption mode is chosen by the base station, the IMSI-catcher can induce the mobile station to use no encryption at all. Hence it can encrypt the plain text traffic from the mobile station and pass it to the base station.
A targeted mobile phone is sent signals where the user will not be able to tell apart the device from authentic cell service provider infrastructure.
This means that the device will be able to retrieve data that a normal cell tower receives from mobile phones if registered.
There is only an indirect connection from mobile station via IMSI-catcher to the GSM network. For this reason, incoming phone calls cannot generally be patched through to the mobile station by the
GSM network
The Global System for Mobile Communications (GSM) is a standard developed by the European Telecommunications Standards Institute (ETSI) to describe the protocols for second-generation ( 2G) digital cellular networks used by mobile devices such as ...
, although more modern versions of these devices have their own mobile patch-through solutions in order to provide this functionality.
Passive IMSI Detection
The difference between a passive IMSI-catcher and an active IMSI-catcher is that an active IMSI-catcher intercepts the data in transfer such as spoke, text, mail, and web traffic between the endpoint and cell tower.
Active IMSI-catchers generally also intercept all conversations and data traffic within a large range and are therefore also called rogue cell towers. It sends a signal with a plethora of commands to the endpoints, which respond by establishing a connection and routes all conversations and data traffic between the endpoints and the actual cell tower for as long as the attacker wishes.
A passive IMSI-catcher on the other hand only detects the
IMSI,
TMSI or
IMEI
The International Mobile Equipment Identity (IMEI) is a numeric identifier, usually unique, for 3GPP and iDEN mobile phones, as well as some satellite phones. It is usually found printed inside the battery compartment of the phone but can al ...
of an endpoint. Once the IMSI, TMSI or IMEI address is detected, the endpoint is immediately released. The passive IMSI-catcher sends out a signal with only one specific command to the endpoints, which respond to it and share the identifiers of the endpoint with the passive IMSI-catcher. The vendors of passive IMSI-catchers take privacy more into account.
Universal Mobile Telecommunications System (UMTS)
False base station attacks are prevented by a combination of key freshness and integrity protection of signaling data, not by authenticating the serving network.
To provide a high network coverage, the
UMTS
The Universal Mobile Telecommunications System (UMTS) is a third generation mobile cellular system for networks based on the GSM standard. Developed and maintained by the 3GPP (3rd Generation Partnership Project), UMTS is a component of the Inte ...
standard allows for inter-operation with GSM. Therefore, not only UMTS but also GSM base stations are connected to the UMTS service network. This fallback is a security disadvantage and allows a new possibility of a man-in-the-middle attack.
Tell-tales and difficulties
The assignment of an IMSI catcher has a number of difficulties:
# It must be ensured that the mobile phone of the observed person is in standby mode and the correct network operator is found out. Otherwise, for the mobile station, there is no need to log into the simulated base station.
# Depending on the signal strength of the IMSI-catcher, numerous IMSIs can be located. The problem is to find out the right one.
# All mobile phones in the area covered by the catcher have no access to the network. Incoming and outgoing calls cannot be patched through for these subscribers. Only the observed person has an indirect connection.
# There are some disclosing factors. In most cases, the operation cannot be recognized immediately by the subscriber. But there are a few mobile phones that show a small symbol on the display, e.g. an exclamation point, if encryption is not used. This "Ciphering Indication Feature" can be suppressed by the network provider, however, by setting the OFM bit in EF
AD on the SIM card. Since the network access is handled with the SIM/USIM of the IMSI-catcher, the receiver cannot see the number of the calling party. Of course, this also implies that the tapped calls are not listed in the itemized bill.
# The assignment near the base station can be difficult, due to the high signal level of the original base station.
# As most mobile phones prefer the faster modes of communication such as 4G or 3G, downgrading to 2G can require blocking frequency ranges for 4G and 3G.
Detection and counter-measures
Some preliminary research has been done in trying to detect and frustrate IMSI-catchers. One such project is through the
Osmocom
Osmocom (open source mobile communications) is an open-source software project that implements multiple mobile communication standards, including GSM, DECT, TETRA and others.
History and usage
In 2008 Harald Welte and Dieter Spaar experiment ...
open source mobile station software. This is a special type of mobile phone firmware that can be used to detect and fingerprint certain network characteristics of IMSI-catchers, and warn the user that there is such a device operating in their area. But this firmware/software-based detection is strongly limited to a select few, outdated GSM mobile phones (i.e. Motorola) that are no longer available on the open market. The main problem is the closed-source nature of the major mobile phone producers.
The application Android IMSI-Catcher Detector (AIMSICD) is being developed to detect and circumvent IMSI-catchers by StingRay and silent SMS. Technology for a stationary network of IMSI-catcher detectors has also been developed.
[ Several apps listed on the ]Google Play Store
Google Play, also known as the Google Play Store and formerly the Android Market, is a digital distribution service operated and developed by Google. It serves as the official app store for certified devices running on the Android operating sys ...
as IMSI catcher detector apps include SnoopSnitch, Cell Spy Catcher, and GSM Spy Finder and have between 100,000 and 500,000 app downloads each. However, these apps have limitations in that they do not have access to phone's underlying hardware and may offer only minimal protection.
See also
* Telephone tapping
Telephone tapping (also wire tapping or wiretapping in American English) is the monitoring of telephone and Internet-based conversations by a third party, often by covert means. The wire tap received its name because, historically, the monitorin ...
* Stingray phone tracker
The StingRay is an IMSI-catcher, a cell phone surveillance, cellular phone surveillance device, manufactured by Harris Corporation. Initially developed for the military and intelligence community, the StingRay and similar Harris devices are in ...
* Mobile phone jammer
A mobile phone jammer or blocker is a device which deliberately transmits signals on the same radio frequencies as mobile phones, disrupting the communication between the phone and the cell-phone base station, effectively disabling mobile phones wi ...
External links
* Chris Paget's presentation
Practical Cellphone Spying
' at DEF CON 18
Verrimus - Mobile Phone Intercept Detection
Footnotes
Further reading
*
*
*
*
External links
Mobile Phone Networks: a tale of tracking, spoofing and owning mobile phones
IMSI-catcher Seminar paper and presentation
The OsmocomBB project
iParanoid: IMSI Catcher Intrusion Detection System presentation
{{DEFAULTSORT:Imsi-Catcher
Surveillance
Mobile security
Telephone tapping
Telephony equipment
Law enforcement equipment