Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 30

Capturing Subscriber Identifiers in LTE Pre-authentication

Recommended resources

Introduction

Welcome back. In our last lesson, we explored how attackers exploit the "original sins" of 2G security—one-way authentication and broken encryption—to execute downgrade attacks against modern phones. We saw that by forcing a device onto an insecure 2G network, an attacker can bypass all of the security improvements made in 4G and 5G.

Today, we'll move our focus squarely onto the 4G LTE network itself. You might assume that LTE's mutual authentication and strong encryption would prevent the kind of identity theft we saw with 2G IMSI catchers. However, a critical window of opportunity exists for an attacker. This lesson will address the learning outcome: Describe how subscriber identifiers (IMSI, IMEI) can be captured in LTE by exploiting pre-authentication signaling.

We will dissect the initial moments of an LTE connection to understand how, even in a theoretically secure network, permanent identities can be stolen in plain text before any security is activated. This is a foundational active attack against 4G and is a crucial concept to master as we move toward building and attacking our own test network.

1. The LTE Insecurity Rationale: A Window of Vulnerability

Unlike 2G, LTE was designed with mutual authentication in mind: the device authenticates to the network, and the network authenticates to the device. So, how can a rogue base station successfully impersonate a real one? The answer lies in the order of operations. A significant amount of signaling is exchanged between the device and the base station before any authentication or encryption keys are established.

During this initial "pre-authentication" phase, the communication is unencrypted and lacks integrity protection. The device has no cryptographic way to verify it's talking to a legitimate tower and essentially has to trust the information being broadcast.

To understand this fundamental vulnerability, let's turn to a key research paper on LTE security.

LTE security, protocol exploits and location tracking ...

The following sections from the paper 'LTE security, protocol exploits and location tracking...' provide the foundational concepts for today's lesson. It explains why LTE is vulnerable despite its security features and defines the key identifiers at risk.

Please read two parts of this paper: Section II-A, 'Mobile network identifiers': Quickly review the definitions of IMSI, TMSI, and IMEI. This will refresh your memory of these crucial terms. Section V-B, 'LTE insecurity rationale': This is the core of this section. Focus on the argument that many unprotected messages are exchanged before authentication, creating a window for a rogue base station to operate. Pay attention to Figure 6, which visually represents this message exchange.

As the paper highlights, a mobile device will engage in a substantial conversation with any base station that advertises the correct network identifiers. This pre-authentication exchange is precisely what an attacker exploits to capture a device's permanent identity.

2. The Attach Procedure: How the IMSI is Leaked

Now, let's zoom in on the specific process where this leak occurs: the LTE Attach procedure. This is the sequence of steps a device (UE) follows to connect to the network.

When your phone powers on or enters a new area, it sends an Attach Request message to the network. This message must include a unique identifier so the network knows who is connecting.

  • Best Case: The device uses a temporary, periodically changing identifier called a GUTI (Globally Unique Temporary Identifier), which is derived from the TMSI (Temporary Mobile Subscriber Identifier) you read about. Using a temporary ID protects the user's privacy.
  • Worst Case: If the device doesn't have a valid GUTI (e.g., it's the first time connecting, or the network has lost its record), it has no choice but to fall back to using its permanent, globally unique identifier: the IMSI (International Mobile Subscriber Identity).

An attacker's goal is to create a situation that forces this "worst-case" scenario. This diagram shows the high-level flow of the attach and authentication process. Notice that the Attach Request (containing the GUTI or IMSI) occurs before the security procedures (NAS Security Mode Command, etc.).

LTE Attach and Authentication Procedure
This sequence diagram illustrates the LTE attach procedure. The UE sends its `Attach Request` with an identifier (ideally GUTI, but possibly IMSI) to the MME. Only after this initial step does the MME initiate authentication and security procedures, creating a window where the initial identifier is sent with limited protection.

Your experience with Wireshark will be helpful here. Let's see what this looks like in a real packet capture.

LTE Call Flow - Wireshark (Pcap) analysis of LTE UE Attach

This video from Telco Bytes analyzes a Wireshark capture of an LTE attach procedure. It will show you exactly where the subscriber's identity is located in the initial messages.

Watch the segment from 02:49 to 06:01. The presenter breaks down the Initial UE Message, which contains the NAS Attach Request. Pay close attention to where he points out that the UE will use its IMSI if it doesn't have a valid temporary ID (M-TMSI).

As the video demonstrates, the IMSI is sent in the clear within the Attach Request message. An attacker doesn't need to break any encryption; they just need to be in a position to receive that message.

Furthermore, it's not just the IMSI. The IMEI (International Mobile Equipment Identifier), which is the unique serial number of the physical phone hardware, is also transmitted during the connection setup. An attacker capturing both the IMSI (the subscriber) and the IMEI (the device) gets a complete profile of their target.

3. The IMSI Catcher Attack in LTE

An IMSI Catcher (also known as a "Stingray") is a device that acts as a rogue base station to perform this exact attack. Here’s the step-by-step flow:

  1. Impersonation: The attacker sets up a rogue eNodeB (the 4G term for a base station) using an SDR and software like srsRAN or OpenLTE. They configure it to broadcast the same network ID (MCC and MNC) as a legitimate local provider (e.g., AT&T, Verizon). They may boost their signal power to be more attractive than nearby real towers.
  2. Forced Re-authentication: A victim's phone sees the strong, familiar network signal and sends an Attach Request using its temporary ID (GUTI). The attacker's rogue base station, having no knowledge of this GUTI, can simply send an Identity Request message back to the phone.
  3. Identity Capture: The phone, following protocol, complies with the Identity Request and responds with its permanent IMSI. The attacker has now captured the target's identity.
  4. Disconnect: The attacker can then send an Attach Reject message, dropping the connection. The victim's phone will then search for and connect to a legitimate tower, often with the user noticing only a brief flicker of service interruption.

This illustration, while also showing a downgrade, captures the essence of the initial steps of the attack. The rogue base station positions itself as the strongest signal and requests the phone's identity.

Spoofing Authentication: CSS Tricking the Network (IMSI Catcher Attack)
This diagram illustrates the core logic of an IMSI catcher. The malicious actor (1) broadcasts a strong signal, (2) prompts the phone to identify itself, and (3) captures the IMSI when the phone responds to the network's identity request.

The following paper provides a detailed, practical guide on how this is achieved with off-the-shelf tools, reinforcing that this is not just a theoretical attack.

Easy 4G/LTE IMSI Catchers for Non-Programmers

This paper, 'Easy 4G/LTE IMSI Catchers for Non-Programmers,' is highly relevant to your practical goals. It demonstrates that these attacks are accessible without deep programming knowledge.

Please read two key sections: Section 4, 'The LTE IMSI Catcher': This describes the precise methodology. Focus on how the attacker uses a different Tracking Area Code (TAC) to force the UE to initiate a Tracking Area Update (TAU), which results in the UE revealing its IMSI in response to an IDENTITY REQUEST. Section 5.2, 'IMSI Catching': This shows the successful result of the experiment—a captured IMSI printed in a log file.

Finally, to see this in a live (though simulated) environment, the next video demonstrates a passive LTE sniffer capturing an IMSI. While the tool is passive, the underlying principle is the same: it's capturing the IMSI sent by the UE during the initial, unencrypted connection phase. This is what a successful active attack would look like from the attacker's console.

DragonOS Noble Sniff + Passively Capture LTE IMSI (x310, b205mini, SignalSDR Pro)

This video from cemaxecuter on the DragonOS channel provides a practical demonstration of capturing an IMSI in an LTE test environment.

Watch from 10:29 to 12:47. You will see the operator start the UE (the cell phone client), which then attaches to the network. In the background, the LTE sniffer console successfully captures and displays the IMSI.

Conclusion

In this lesson, we have moved beyond downgrade attacks and demonstrated that even the 4G LTE standard has a fundamental vulnerability in its connection procedure. By exploiting the unencrypted and unauthenticated signaling that occurs before security is activated, an attacker can build a rogue base station to capture a user's most sensitive identifiers.

Key Takeaways:

  • LTE is vulnerable to IMSI/IMEI capture because a significant number of signaling messages are exchanged before mutual authentication and encryption are established.
  • An attacker runs a rogue base station (IMSI Catcher) that impersonates a legitimate network.
  • The attacker forces the victim's device to reveal its permanent IMSI by rejecting its temporary identifier (GUTI) and explicitly sending an Identity Request.
  • The entire exchange happens in the pre-authentication phase, requiring no cryptographic breaks.
  • This attack is practical and can be accomplished with accessible open-source software and software-defined radios.

Preview of the Next Lesson:

Capturing an IMSI is a powerful way to track a subscriber. But what if you could track a specific device without ever learning its IMSI? In our next lesson, we will investigate another, more subtle method of tracking. We will learn how to describe the concept of radio capability-based tracking attacks, where the unique features of a phone's radio hardware can be used as a fingerprint.