Abstract IMSI Catchers are tracking devices that break the privacyof the subscribers of mobile access networks, with disruptive effects toboth the communication services and the trust and credibility of mobilenetwork operators. Recently, we verified that IMSI Catcher attacks arereally practical for the state-of-the-art 4G/LTE mobile systems too. OurIMSI Catcher device acquires subscription identities (IMSIs) within anarea or location within a few seconds of operation and then denies ac-cess of subscribers to the commercial network. Moreover, we demonstratethat these attack devices can be easily built and operated using readilyavailable tools and equipment, and without any programming. We de-scribe our experiments and procedures that are based on commerciallyavailable hardware and unmodified open source software.

IMSI Catchers are active attack devices against the radio link protocols in mo-bile networks with the main goal of collecting IMSIs (International Mobile Sub-scriber Identities), the subscribers’ identifiers used in the authentication and ac-cess control procedures. In particular, these attacks break one of the importantsecurity requirements set in the international specifications, namely the privacyand non-traceability of the subscriber. The malicious devices usually act as aman-in-the-middle to fulfil more advanced attacks. IMSI Catchers can be usedfor mass-surveillance of individuals in a geographical area, or link a real personto his/her identity in the network, trace a person with a known IMSI (checkhis/her presence in a building or area), eavesdrop on private conversations, allthese being privacy issues concerns. IMSI disclosure is a direct consequence ofthe poor cryptographic mechanism used or its improper usage. On the otherhand, DoS (Denial-of-Service) attacks introduce serious financial losses on a tar-geted operator, as the subscribers cannot access the mobile services; moreover,other services that use the mobile infrastructure are impacted by the networkunavailability; these include emergency calls or SMSs containing one-time codesfor two-way authentication mechanisms used in the bank sector.

IMSI Catchers are tracking devices that break the privacy of the subscribers of mobile access networks, with disruptive effects to both the communication services and the trust and credibility of mobile network operators. Recently, we verified that IMSI Catcher attacks are really practical for the state-of-the-art 4G/LTE mobile systems too. Our IMSI Catcher device acquires subscription identities (IMSIs) within an area or location within a few seconds of operation and then denies access of subscribers to the commercial network. Moreover, we demonstrate that these attack devices can be easily built and operated using readily available tools and equipment, and without any programming. We describe our experiments and procedures that are based on commercially available hardware and unmodified open source software.