,
5 tweets,
2 min read
Read on Twitter
What are cell-site simulators (CSSs) and how do they sneakily collect information about our cell phones? EFF’s Threat Lab created “Gotta Catch ‘Em All” to explain, and document the harms CSSs pose. (1/5) eff.org/wp/gotta-catch…
Let’s look at a classic “IMSI-catcher,” which lets operators snoop on the phone usage of people nearby. Classic IMSI-catchers simply record nearby International Mobile Subscriber Identities (IMSIs), and don’t interact with target phones in a significant way beyond that. (2/5) 
They “catch” IMSIs by pretending to be real base stations, then release the target phones. In GSM networks, phones will try to connect to whatever base station is broadcasting at the highest signal strength. (3/5)
Then, the base station asks the phone to send its encryption capabilities. If the base station is a CSS, it can ignore the response or set it to have no encryption.
The CSS releases the phone back to the real network and moves on to try and capture another phone’s IMSI. (4/5)
The CSS releases the phone back to the real network and moves on to try and capture another phone’s IMSI. (4/5)
Learn more in our white paper: Gotta Catch ‘Em All: Understanding How IMSI-Catchers Exploit Cell Networks. (5/5) eff.org/wp/gotta-catch…
