Hacker News Reader

Can someone explain how is this possible in the first place, i.e. how do those fakes pass authentication checks from the phone/sim card?

View on HN

FTA:

> Even though the UE authenticates the tower there are still several messages that it sends, receives, and trusts before authentication happens or w/o authentication. This is the weak spot in which the vast majority of 4G attacks happen

I'm a layman but here's my understanding. Imagine you're a police force and you know a criminal has a phone with IMEI of ABC123. You think the criminal might have a headquarters inside a warehouse but you want to be sure they're there before conducting a raid. Set up one of these, on arrival the target phone tells the fake tower what its IMEI is when within range, and you've got them.

The point here is: if the owner of the IMSI catcher has some preknowledge about the target phone.

There is no way to avoid this.

as explained in the pdf: There is a part of the connection setup, that will happen before any mutual authentification: The telephone offers the IMEI/IMSI to get an initial connection. The network learns this number and it's the counterpart of a MAC address in Wifi networks.

Reply on news.ycombinator.com