Hacker News Reader

Comment by rusk | Hacker News Reader

I’m pretty sure modern networks allocate temporary anonymised IMSIs (TIMSI) to eschew just this kind of attack ...

EDIT yes http://www.gsm-security.net/faq/timsi-temporary-imsi-gsm.sht...

Just slightly complicates it. All you need is for them to be in range of your catcher when they renegotiate a new TIMSI, which is done periodically. If your targeting a specific person that's as simple as deploying a catcher within range of their home and/or office and chances are good you will get most if not all TIMSI negotiations.

Like trying to stop MITM attacks on the internet by randomizing MAC addresses between sessions. IMSI are printed on a sticker stuck to the phone. How secret can it really be?

Even if TIMSI worked well, there are other techniques: https://arxiv.org/pdf/1607.05171.pdf

> IMSI are printed on a sticker stuck to the phone.

My phones have the IMEI number written on them, not the IMSI numbers. I'll have to take the SIM out to see if it has the IMSI written on it somewhere.

What’s written on the SIM card is called ICCID. For some carriers, you can convert from IMSI to ICCID and vice versa, because they chose this convention.

IMSI is the Subscriber Identifier and is linked to the SIM card in the phone. The IMEI, Equipment Identifier, is printed on the device.

Strictly speaking, IMSI identifies the SIM. A subscriber may have multiple SIMs and many SIMs throughout their lifetime. The IMSI is never ever transferable. The IMSI/SIM represents a unique network identity and links to items such as individualised cryptographic keys; session state, etc. the counterparts to which are baked into the SIM itself.

Yes but ... you have to track the target by other means then. There’s not much beyond tracking this particular attack is useful for so if you have to track them anyway what’s the point!

https://en.m.wikipedia.org/wiki/Radio_fingerprinting It is irrevalent.

Not in the context of OP it isn't.

Which networks are doing that though? I remember so many talks about security issues because of outdated protocols.

All UMTS networks or newer use TMSI the actual IMSI is only sent once per baseband reset as long as there wasn’t a period where a hand off between VLRs didn’t occur and you didn’t roam to another network without direct peering.

That said there is a trick to bypass TMSI for tracking as you can trigger an IMSI re-registration by interrupting mobile data or by forcing the mobile phone to downgrade through jamming.

Also TMSI only prevents tracking not eavesdropping, it makes targeted eavesdropping harder but not impossible if you can track the target through other means.

I'm not positive on this, but I'm pretty sure it's mandatory in LTE. When you first register you send your IMSI (in the clear...) and they return a TMSI for you.

My quick skim through the code looks like it'll track that too though:

    # Register IMSI as seen if a TMSI believed to
    # belong to the IMSI is seen.

Every network built on 3GPP protocol stack (including 90's 2G GSM) does that, because it is inherent feature of how GSM signalling protocols work.

Reply on news.ycombinator.com