LTE security, protocol exploits and location tracking experimentation with low-cost software radio · HackerPapers discussions

LTE security, protocol exploits and location tracking experimentation with low-cost software radio — mentioned by 542354234235

Wed, 10 Sep 2025 14:45:41 GMT

>In order to maintain an uninterrupted connection to a target’s phone, the Harris software also offers the option of intentionally degrading (or “redirecting”) someone’s phone onto an inferior network, for example, knocking a connection from LTE to 2G. [1] >In its most basic functionality, the [LTE] IMSI catcher receives connection/attach request messages from all mobiledevices in its vicinity. These attach messages are forced to disclose the SIM’s IMSI, thus allowing the IMSI catcher to retreive the IMSI for all devices in its vicinity... a fully LTE-based IMSI catcher is possible, very…

Paper and discussion history. A mention is not an endorsement.

LTE security, protocol exploits and location tracking experimentation with low-cost software radio — mentioned by syn0byte

Fri, 16 Nov 2018 19:20:15 GMT

Just slightly complicates it. All you need is for them to be in range of your catcher when they renegotiate a new TIMSI, which is done periodically. If your targeting a specific person that's as simple as deploying a catcher within range of their home and/or office and chances are good you will get most if not all TIMSI negotiations. Like trying to stop MITM attacks on the internet by randomizing MAC addresses between sessions. IMSI are printed on a sticker stuck to the phone. How secret can it really be? Even if TIMSI worked well, there are other techniques…

Paper and discussion history. A mention is not an endorsement.