LTE Phone Number Catcher: A Practical Attack against Mobile Privacy

Abstract

Phone number is a unique identity code of a mobile subscriber, which plays a more important role in the mobile social network life than another identification number IMSI. Unlike the IMSI, a mobile device never transmits its own phone number to the network side in the radio. However, the mobile network may send a user’s phone number to another mobile terminal when this user initiating a call or SMS service. Based on the above facts, with the help of an IMSI catcher and 2G man-in-the-middle attack, this paper implemented a practicable and effective phone number catcher prototype targeting at LTE mobile phones. We caught the LTE user’s phone number within a few seconds after the device camped on our rogue station. This paper intends to verify that mobile privacy is also quite vulnerable even in LTE networks as long as the legacy GSM still exists. Moreover, we demonstrated that anyone with basic programming skills and the knowledge of GSM/LTE specifications can easily build a phone number catcher using SDR tools and commercial off-the-shelf devices. Hence, we hope the operators worldwide can completely disable the GSM mobile networks in the areas covered by 3G and 4G networks as soon as possible to reduce the possibility of attacks on higher-generation cellular networks. Several potential countermeasures are also discussed to temporarily or permanently defend the attack.

Security Threats to Voice Services in 5G Standalone Networks

“…Although the mobile network continues to evolve, the original insecure network will still take some time to be abandoned. Based on this, an attacker can force devices in the 3G/4G environment to downgrade to insecure 2G and exploit the authentication vulnerabilities to steal privacy [12,13]. However, there are not many studies on downgrade attacks on 5G networks.…”

Threat modeling framework for mobile communication systems

“…Unlike the rest of the identi ers, MSISDN is public by nature. However, the collection of arbitrary MSISDNs from a speci c location [184] makes it potentially sensitive like the rest of the identi ers. Besides the obvious privacy concern of sensitive information to unintended entities, the user-speci c identi ers also form a crucial part of adversarial tactics, for example, for the successful use of standard protocols ( 6.2) in the core network communication.…”

“…Most of the signaling a acks that use SS7 are also fall into this category. In other cases, identitybased a acks involve identity mapping, where the adversaries map temporary identi ers (e.g., TMSI and GUTI) to permanent identi ers (e.g., IMSI or MSISDN) [23,81,150,184]. In rare cases, the IMSI can further be mapped to social media identities [162].…”

Anomaly Detection Algorithms for Location Security in 5G Scenarios

“…Localization services, which in the past were mainly provided by non-cellular technologies (e.g., Global Navigation Satelline Systems and/or Global Positioning Systems) integrated within the cellular devices, are now conceived as first class citizens of the 5G architecture starting from Release 16 [2]-[4], and will play a crucial role in several scenarios envisioned for 5G, including self-driving cars, unmanned aerial vehicles, smart logistics, emergency services, and many more [5]- [7]. At the same time, the ability to exploit location signals emitted by 5G base stations comes with a bleak side: many literature works [8]- [20] show how Fig. 1: Operating scenario for a cellular network under the attack of a jammer or spoofer which leads to inaccurate or counterfeit location estimates.…”