System and method for IMSI catching in 5G networks
System and method that uses a first transceiver and a second transceiver, and a processor. The processor is configured to cause a cellular device associated with the 5G cellular network to communicate, to the first transceiver, a 5G identifier used by the device to identify itself, using the first transceiver. The processor is further configured to ascertain a correspondence between the 5G identifier and a Subscription Permanent Identifier (SUPI), by communicating with a core network of the 5G cellular network via a lawful-interception (LI) communication interface of the core network. The processor is further configured to cause the cellular device to register with the second transceiver, in response to ascertaining the correspondence and to the 5G identifier having been communicated from the cellular device.
1. A system, comprising:
a first transceiver, configured to imitate a 5th generation (5G) base transceiver station (BTS) belonging to a 5G cellular network;
a second transceiver, configured to imitate a lower-generation BTS belonging to a lower-generation cellular network; and
a processor, configured to:
cause a cellular device associated with the 5G cellular network to communicate a first other 5G identifier used by the device to identify itself, to any transceiver while a person-of-interest (POI) and the cellular device are at a first location;
cause the cellular device to communicate a second other 5G identifier to any transceiver while the POI and the cellular device are at a second location;
transmit the first other 5G identifier and the second other 5G identifier used by the device to identify itself, to a core network of the 5G cellular network via a lawful-interception (LI) communication interface of the core network;
receive, from the LI, a corresponding Subscription Permanent Identifier (SUPI) to both the first other 5G identifier and the second other 5G identifier used by the device to identify itself;
ascertain that the SUPI corresponds both to the first other 5G identifier and to the second other 5G identifier; and
cause the cellular device to register with the second transceiver in response to ascertaining that the SUPI corresponds both to the first other 5G identifier and to the second other 5G identifier.
2. The system according to claim 1 , wherein the processor is further configured to, subsequently to causing the cellular device to register with the second transceiver, perform man-in-the-middle (MITM) intermediation of communication exchanged with the cellular device.
3. The system according to claim 1 , wherein the processor is further configured to, subsequently to causing the cellular device to register with the second transceiver, cause the cellular device to behave as a beacon.
4. The system according to claim 1 , wherein the processor is further configured to:
receive one or more other 5G identifiers from different respective other cellular devices,
by communicating the other 5G identifiers to the core network, ascertain one or more other SUPIs corresponding to the other 5G identifiers, respectively, and
store an association between the other 5G identifiers and the other SUPIs, respectively.
5. The system according to claim 1 , wherein the 5G identifier includes a Global Unique Temporary Identifier (GUTI).
6. The system according to claim 1 , wherein the 5G identifier includes a Subscription Concealed Identifier (SUCI).
7. The system according to claim 1 , wherein the processor is configured to cause the cellular device to register with the second transceiver by communicating, to the cellular device, a message selected from the group of messages consisting of: a REGISTRATION REJECT message and a SERVICE REJECT message.
8. A method, comprising:
using a first transceiver imitating a 5th generation (5G) base transceiver station (BTS) belonging to a 5G cellular network;
causing a cellular device associated with the 5G cellular network to communicate, to the first transceiver, a first 5G identifier used by the device to identify itself, in a first correspondence between the first transceiver and the cellular device, while a person-of-interest (POI) and the cellular device are at a first location;
transmitting to a core network of the 5G cellular network via a lawful-interception (LI) communication interface of the core network, the first 5G identifier used by the device to identify itself;
receiving, from the LI, a corresponding Subscription Permanent Identifier (SUPI) to the first 5G identifier used by the device to identify itself;
causing the cellular device to communicate a second 5G identifier to any transceiver while the POI and the cellular device are at a second location;
communicating the second 5G identifier to the core network, ascertaining a second correspondence between the second 5G identifier and the SUPI;
causing the cellular device to register with a second transceiver imitating a lower-generation BTS belonging to a lower-generation cellular network in response to the SUPI being included in a predefined list of SUPIs, wherein causing the cellular device to register with the second transceiver comprises causing the cellular device to register with the second transceiver in response to the SUPI corresponding both to the first 5G identifier and to the second 5G identifier.
9. The method according to claim 8 , further comprising, subsequently to causing the cellular device to register with the second transceiver, performing man-in-the-middle (MITM) intermediation of communication exchanged with the cellular device.
10. The method according to claim 8 , further comprising, subsequently to causing the cellular device to register with the second transceiver, causing the cellular device to behave as a beacon.
11. The method according to claim 8 , further comprising:
receiving one or more other 5G identifiers from different respective other cellular devices;
by communicating the other 5G identifiers to the core network, ascertaining one or more other SUPIs corresponding to the other 5G identifiers, respectively; and
storing an association between the other 5G identifiers and the other SUPIs, respectively.
12. A system, comprising:
a first transceiver, configured to imitate a 5th generation (5G) base transceiver station (BTS) belonging to a 5G cellular network;
a second transceiver, configured to imitate a lower-generation BTS belonging to a lower-generation cellular network; and
a processor, configured to:
communicate a Subscription Permanent Identifier (SUPI) of interest to a core network with a subscription for push notifications of 5G identifiers corresponding to the SUPI of interest via a lawful-interception (LI) communication interface;
receive from the core network the 5G identifier associated with the SUPI of interest via the LI communication interface;
cause a cellular device associated with the 5G cellular network to communicate to the first transceiver, a 5G identifier associated with the device to identify itself;
determine if there is a match between the 5G identifier associated with the SUPI of interest with the 5G identifier associated with the device to identify itself;
cause the cellular device to register with the second transceiver in response to a match of the 5G identifiers.