IMSI Catching: Phone surveillance measures and countermeasures go mainstream
by Rick Falkvinge
August 29, 2017
The German newspaper Die Zeit has a long feature this week about IMSI catchers and their countermeasures, words that were long heard only in countersurveillance cultures at Black Hat and Defcon.
Observing this phenomenon make the jump from the obscure to the mainstream tells us a lot about the years to come: surveillance and countersurveillance will be a cat-and-mouse game for quite some time.
Most people have heard of their IMEI, their phone’s unique identifier. It’s short for International Mobile Equipment Identity, and a lot of people learn how to read this number.
Most people have heard of their IMEI, their phone’s unique identifier. It’s short for International Mobile Equipment Identity, and a lot of people learn how to read this number.
Originally, it was produced by typing ×#06# on your phone, a sequence that amazingly still works, but it’s also on the phone receipt, in the menus, and in a number of friendlier places. This is the number you can insure, and this is the number you can report stolen to brick the phone.
A more secretive number is the IMSI, the Subscriber Identity, which identifies not the phone but the SIM card inside the phone. In most parts of the world, you’re expected to buy these separately from the phone, and you can replace the SIM card to change carriers but keep the same phone. In some other parts of the world, where telco carries have exercised regulatory capture and have a dysfunctional market, the SIM is typically card prebaked into the phone, and in these countries, you might never have seen it – but it’s still there, identified by the IMSI.
There are many good technical reasons to keep this number a secret. For example, any reconfiguration instructions sent to the phone from the carrier – so-called Over-the-Air provisioning — must be signed cryptographically with the IMSI of the current SIM card, in order to prevent fraudulent configuration. It’s also the number used when the phone contacts the carrier network, and therefore, anybody intercepting that handshake will see the IMSI.
This is the technology used in so-called IMSI catchers. When there is a large number of people in an area that the regime — police or other forces — want to keep tabs on, they deploy high-powered fake celltowers that the phones connect to, believing that these fake celltowers are their carrier’s. The fake towers then contact the real ones in turn, performing what we call a man-in-the-middle attack, which is just what it sounds like, sitting between the phones and the real cellphone towers.
This is a fairly sophisticated attack, one made by law enforcement in a highly dubious legal area. That’s why it’s really interesting to see mainstream media cover the topic now.
It’s particularly interesting as law enforcement won’t immediately get identities out of this attack — it will merely read which IMSI numbers were in the area at the time of the man-in-the-middle attack. Some of the time, this could conceivably be translated into people’s actual names, by means of subpoenas or similar to the carriers. A lot of the time, it won’t (think anonymous prepaid SIM cards).
While this attack can be used to track an individual’s movements once you have their IMSI — and has been used for this, notably with the American-made Stingray devices — it’s more alarming that law enforcement is increasingly using the attack to keep a catalog over which people, or at least their phones, are present at a certain type of protest.
Die Zeit’s article also covers countermeasures to the IMSI catcher attack, and mentions that while there are numerous apps that detect IMSI catchers, the better ones can only detect about 90% of those attacks.
A more secretive number is the IMSI, the Subscriber Identity, which identifies not the phone but the SIM card inside the phone. In most parts of the world, you’re expected to buy these separately from the phone, and you can replace the SIM card to change carriers but keep the same phone. In some other parts of the world, where telco carries have exercised regulatory capture and have a dysfunctional market, the SIM is typically card prebaked into the phone, and in these countries, you might never have seen it – but it’s still there, identified by the IMSI.
There are many good technical reasons to keep this number a secret. For example, any reconfiguration instructions sent to the phone from the carrier – so-called Over-the-Air provisioning — must be signed cryptographically with the IMSI of the current SIM card, in order to prevent fraudulent configuration. It’s also the number used when the phone contacts the carrier network, and therefore, anybody intercepting that handshake will see the IMSI.
This is the technology used in so-called IMSI catchers. When there is a large number of people in an area that the regime — police or other forces — want to keep tabs on, they deploy high-powered fake celltowers that the phones connect to, believing that these fake celltowers are their carrier’s. The fake towers then contact the real ones in turn, performing what we call a man-in-the-middle attack, which is just what it sounds like, sitting between the phones and the real cellphone towers.
This is a fairly sophisticated attack, one made by law enforcement in a highly dubious legal area. That’s why it’s really interesting to see mainstream media cover the topic now.
It’s particularly interesting as law enforcement won’t immediately get identities out of this attack — it will merely read which IMSI numbers were in the area at the time of the man-in-the-middle attack. Some of the time, this could conceivably be translated into people’s actual names, by means of subpoenas or similar to the carriers. A lot of the time, it won’t (think anonymous prepaid SIM cards).
While this attack can be used to track an individual’s movements once you have their IMSI — and has been used for this, notably with the American-made Stingray devices — it’s more alarming that law enforcement is increasingly using the attack to keep a catalog over which people, or at least their phones, are present at a certain type of protest.
Die Zeit’s article also covers countermeasures to the IMSI catcher attack, and mentions that while there are numerous apps that detect IMSI catchers, the better ones can only detect about 90% of those attacks.
We can expect this to escalate in the coming years.
Syndicated Article - This article was previously published at Private Internet Access.
No comments:
Post a Comment