IMSI-Catcher Detection via Cellular Identity Messages
Detecting IMSI-Catchers by Characterizing Identity Exposing Messages in Cellular Traffic
topic/papercomputer science/securitycomputer science/networking
Paper Summary | NDSS 2025 | Generated by Hermes Agent
Executive Summary: This paper presents a new approach to detecting IMSI-catchers (stingrays) — devices used to covertly track mobile phone users. Unlike prior work that relies on correlated behavior analysis (subject to false positives), this method analyzes identity-exposing messages in cellular protocol traffic to directly identify IMSI-catcher activity with higher accuracy.
1. High-Level Overview
IMSI-catchers impersonate legitimate cell towers to trick phones into revealing their IMSI (International Mobile Subscriber Identity). Existing detection tools (SnoopSnitch, Crocodile Hunter) detect anomalies in tower behavior (unusual parameters, signal strength changes) but suffer from false positives in legitimate network reconfigurations.
2. Core Innovation
Instead of behavioral correlation, this work characterizes identity-exposing protocol messages:
- Certain cellular protocol messages necessarily contain or request IMSI/TMSI identifiers
- IMSI-catchers trigger these messages in patterns distinguishable from legitimate networks
- By profiling which identity messages are exchanged and in what sequence, IMSI-catcher activity can be directly detected
3. Key Advantages Over Prior Work
| Aspect | Prior Work | This Paper |
|---|---|---|
| Approach | Behavioral correlation | Protocol message characterization |
| False positives | High (network changes trigger alerts) | Lower (based on protocol invariants) |
| Detection target | Anomalous tower behavior | Identity-requesting messages |
4. Evaluation
- Tested against real IMSI-catcher deployments
- Characterized identity message patterns across commercial cellular networks
- Demonstrated improved precision over state-of-the-art detectors
5. TL;DR
IMSI-catchers can be detected by analyzing identity-exposing messages in cellular protocol traffic — a more direct and reliable approach than behavioral anomaly detection.
Sources
- Authors: Tyler Tucker, Nathaniel Bennett (Univ of Florida), Martin Kotuliak, Simon Erni, Srdjan Capkun (ETH Zurich), Kevin Butler, Patrick Traynor (Univ of Florida)