Easy 4G/LTE IMSI Catchers for Non-Programmers

TL;DR

This paper demonstrates that IMSI Catchers can be easily built and operated by non-programmers using readily available hardware and open source software, posing significant privacy risks in 4G/LTE networks.

Contribution

It shows practical, accessible methods for constructing IMSI Catchers, highlighting vulnerabilities in current 4G/LTE systems that can be exploited without programming skills.

Findings

IMSI Catchers can acquire IMSIs within seconds.

Attack devices can deny network access to subscribers.

Construction requires only commercial hardware and open source software.

Abstract

IMSI Catchers are tracking devices that break the privacy of the subscribers of mobile access networks, with disruptive effects to both the communication services and the trust and credibility of mobile network operators. Recently, we verified that IMSI Catcher attacks are really practical for the state-of-the-art 4G/LTE mobile systems too. Our IMSI Catcher device acquires subscription identities (IMSIs) within an area or location within a few seconds of operation and then denies access of subscribers to the commercial network. Moreover, we demonstrate that these attack devices can be easily built and operated using readily available tools and equipment, and without any programming. We describe our experiments and procedures that are based on commercially available hardware and unmodified open source software.