Cellular Network Security

IMSI Catchers: Fake Cell Towers

IMSI catchers (also called StingRays, Grasshoppers, or DevilRye) are surveillance devices that masquerade as legitimate cellular base stations. They exploit the normal cell selection procedure to force phones to connect:

How IMSI Catchers Work

Downlink signal strength attack: IMSI catchers transmit a stronger downlink signal than legitimate base stations. Phones continuously measure signal strength and normally select the strongest candidate. By emitting a powerful signal, the IMSI catcher tricks the phone into believing it is the best serving cell.

Once attached, IMSI catchers can:

• Intercept communications: All traffic passes through the IMSI catcher as a man-in-the-middle
• Track location: The phone's reported timing advance and signal measurements reveal approximate location
• Force 2G fallback: Many IMSI catchers force phones to 2G, where A5/1 encryption is breakable or A5/0 (no encryption) is used
• Extract IMSI: The IMSI is transmitted during the identity response procedure (attach, location update)

IMSI vs TMSI

Known IMSI Catcher Devices

• Harris StingRay: Most documented; used by FBI, DEA, state/local law enforcement
• Boeing DRT: Used by US military and intelligence agencies
• CellularIntercept: Various commercial surveillance equipment

Legal note: StingRay use in the US requires court orders in most jurisdictions. The FBI historically required NDAs preventing disclosure by carriers. EFF and Calyx Institute have advocated for stronger oversight and warrant requirements.

SS7 (Signaling System #7) Vulnerabilities

SS7 was designed in the 1970s when the global telephone network was a closed, trusted system. Today, SS7 networks interconnect with hundreds of operators worldwide — any connected network can send SS7 messages to any other. This creates a fundamental attack surface.

MAP Protocol Attacks

The Mobile Application Part (MAP, 3GPP TS 29.002) is the application-layer SS7 protocol for mobile networking:

• SRIforLC: Query subscriber routing information — obtain MSC address for call interception
• ATI (Any Time Interrogation): Real-time location tracking — query subscriber's current cell from HLR
• MAP MT-FSM/MO-FSM: Send or intercept SMS messages
• MAP FORWARD CALL: Redirect incoming calls to a premium number or interceptor
• USSD commands: Query prepaid balances, trigger service provisioning, deplete airtime

Diameter and GTP Vulnerabilities in 4G

4G networks replaced SS7 with Diameter for authentication and policy, and GTP for tunnel management. These protocols have their own vulnerabilities:

Diameter Attacks

• Diameter overload: Flood endpoints with requests causing DoS
• Fictional device attack: Register fake devices to extract subscriber credentials
• Gx/Rx interface attacks: Manipulate policy rules for traffic manipulation

GTP Tunnel Attacks

• Tunnel hijacking: Take over existing GTP-U tunnels by sending Update Session with matching TEID
• Create Session flooding: Exhaust network resources with tunnel creation requests
• Identity extraction: Use GTP-GPRS messages to extract subscriber IDs and cell information

5G Security Improvements

5G introduced significant security enhancements over 4G:

Subscriber Privacy: SUPI vs SUCI

5G AKA Enhancement

5G's Authentication and Key Agreement (AKA) provides mutual authentication between the UE and the network, with stronger key derivation and home network authentication visible to the UE.

Network Slicing Security

5G network slicing creates logically isolated networks. Each slice has dedicated resources and independent security contexts, preventing slice-hopping attacks.

SEPP (Security Edge Protection Proxy)

SEPP protects inter-carrier signaling between operators, preventing the SS7 leakage that occurs in 4G/3G networks.

Null Cipher Vulnerability

5G allows null cipher for backward compatibility with legacy devices. When negotiated, no encryption is applied. This vulnerability should be phased out but remains in networks.

Countermeasures

Network-Level

• SS7/Diameter firewall: Filters malicious MAP/Diameter messages at network borders
• GTP packet filtering: Monitors GTP tunnels at GGSN/PGW
• Circuit-switched fallback prevention: Prevents forced 2G fallback
• Cellular base station verification: Verify legitimate network identity via certificates

Device-Level

• VPN usage: Encrypt all IP traffic end-to-end
• End-to-end encrypted messaging: Signal, WhatsApp for communications
• SnoopSnitch (Android): Detects IMSI catchers and SS7 attacks
• Airplane mode: Disconnect from network when not needed

Known Incidents

• 2014 CCC: Chaos Computer Club demonstrated tracking German Chancellor Merkel's phone via SS7 ATI request to Deutsche Telekom
• 2016 Karsten Nohl: Research showed SS7 attacks work on 3G/4G networks worldwide
• 2018: US carrier SS7 firewalls shown to be incomplete; SS7 attacks against US subscribers documented
• 2021: Iranian SS7 attacks used to track dissidents and journalists abroad