LTE And IMSI Catchers: Then And Now
summary
Documents a concrete LTE attack set: builds low-cost IMSI-catchers with OpenLTE/srsLTE + USRP or LimeSDR, reproduces a TAU reject IMEI leak affecting multiple baseband vendors, and forces phones to emit measurement and RLF GPS exfiltration reports without authentication. Demonstrates persistent DoS (TAU reject → emergency mode requiring reboot), 4G→2G downgrade via RRC release, DNS hijackability because user plane lacks integrity, and SON poisoning by flooding radio link failure reports; reports lead to vendor/GSMA/3GPP disclosures and partial fixes, 5G adds stronger protections but attackers still have avenues.
AI-written summary · about
chapters (18)
- 0:00Introduction and background
- 3:20Mobile network basics
- 4:22Overview of telco attacks
- 9:18LTE privacy vulnerabilities
- 13:11Identity and tracking issues
- 16:04Location tracking via reports
- 19:12GPS data exposure
- 21:19DNS hijacking risks
- 22:23Availability and denial of service
- 27:36Attack setup and tools
- 28:57Why IMSI catchers persist
- 30:22Disclosure and standards impact
- 32:29Status of modern phones
- 33:325G security improvements
- 36:23IMSI catcher detection limits
- 37:045G limitations and future work
- 38:29IoT security considerations
- 39:19Q&A
related talks
01h 06mLTE & IMSI Catcher Myths
08mHacking 4G and how to get arrested in 10 minutes
54mExposing device features on 4G & 5G networks
22mHacking LTE Public Warning Systems
44mNew Vulnerabilities in 5G Networks
19mSecurity Analysis of LTE Connectivity in Connected Cars: A Case Study of Tesla
33mVoLTE Phreaking
48mMobile Network Hacking, IP Edition