The IMSI catcher explained: how it works, and WiFi based detection

Every subscription has a permanent identifier stored on the card in the phone. The network needs it at least once, because it is what links a device in front of a particular mast to an account held somewhere else entirely. Everything after that first exchange can use a temporary identifier, and mobile networks have done exactly that for decades.

The weakness is in the first exchange. A device arriving with no valid temporary identity has to present the permanent one, and in the generations before 5G it presented that value in the clear. An IMSI catcher is anything that arranges to be on the receiving end. The classic implementation is a false base station: it advertises itself as an ordinary cell with a strong signal, handsets in range prefer it, and it asks each of them to identify itself. Some go further and push the connection down to an older generation with weaker protection, because an older protocol asks fewer awkward questions.

Understanding how it works matters for a practical reason. The attack is not a break of the cryptography: nothing is decrypted, and no key is recovered. It exploits the fact that a network must be able to ask an unknown device who it is, and that a device has no way to tell a legitimate question from a hostile one before answering it.

The cellular version has real costs. It needs radio hardware, it transmits on licensed spectrum, and it is disruptive enough to be noticed. Research presented at Black Hat Europe in 2016 by a team from the University of Oxford, working with ENS Paris-Saclay, showed a route around all three. The Oxford side of that work was led by Piers O'Hanlon, who presented it in London in November 2016 and set out the same findings in an interview for this project.

Mobile operators run their own WiFi networks and configure handsets to join them without asking. So that this needs no action from the user, the phone authenticates using the credentials already on the SIM instead of a password, and the identity it presents in that exchange is derived from the same permanent subscriber identity. A WiFi based IMSI catcher is therefore an ordinary access point advertising an operator network name, waiting for nearby phones to connect on their own initiative and identify themselves in the process.

What makes it serious is the economics. There is no licensed spectrum, no specialised radio, and nothing that looks unusual to anyone scanning the air. The accompanying paper analysed the authentication protocols formally, examined the connection profiles shipped on devices, and set out countermeasures; it also records what happened when the issues were reported to the parties responsible for fixing them.

• PDF Mobile subscriber WiFi privacy: the paper behind the coverage
• PDFPress coverage of the WiFi-based IMSI catcher, November 2016

Detection is harder than it sounds because the device is the worst-placed observer in the system. Knowing how it works does not tell a handset that it is happening. A handset sees the cell it is attached to and very little else, and the operating system does not expose most of what would be needed to judge whether that cell is behaving honestly. Detection therefore works on inference: a connection that is downgraded for no apparent reason, a cell whose identity does not fit its neighbours, a network that appears in one location and never again.

Each of those signals has an innocent explanation, which is why detection built on them produces both false alarms and quiet misses. On the WiFi side the equivalent signal is a familiar network name in an unfamiliar place, and here at least a user has a blunt but effective control: automatic joining can be switched off, at the cost of the convenience it was added to provide. That single setting is the most reliable defence against the WiFi based variant that a person can apply themselves.

The more durable answer is not detection at all but removing the thing worth catching. If no permanent identity crosses the air in a readable form, an IMSI catcher has nothing to collect, and detection becomes a secondary concern instead of the main defence.

5G changes the first exchange. The permanent identity is encrypted to the home network’s public key on the device, and only the concealed form is transmitted; the serving network can route the request without being able to read the identity inside it. A passive listener gets a value that differs each time, which ends the specific attack described above.

It does not end the subject. Mobile privacy depends on every path by which a device can be recognised, and the concealed identifier only closes one of them, the most important one but not the only one. Other identifiers persist at other layers, and any system that falls back to an older generation inherits that generation’s behaviour along with its coverage.

This is the reasoning behind treating mobile privacy as a set of specified components rather than a single protocol fix, which is what the privacy cluster in the enabler catalogue sets out to do.

The privacy enablers