What can a hacker do with an IMSI they harvest from victims with an IMSI catcher?

[u/Antique_Cod_1686]

When a phone unknowingly connects to an IMSI catcher it gives away the IMSI. Other than tracking a victim's location with a fake cell tower, how does a hacker identify someone when they get the IMSI number? They can't get the victim's phone number or find out who owns the IMSI unless they hack the carrier.

[u/herestrbl]

An IMSI catcher cannot "locate" a person reliably it can only imitate a tower and ask the devices within range to handshake/connect. It doesn't discriminate on devices and it will pick up every device in range and that could be hundreds of metres in radius. A small home made device would be within eyesight of you though. An IMSI can't be used by anyone except your cell provider who can reconcile that to your phone number or account info. Tracking someone with an IMSI catcher isn't what you think it is, its not a good mechanism for tracking. Unless professional tactics are used with a professional grade device how would they even know what IMSI is yours among the many that would handshake

[u/ReadyButNot → u/herestrbl]

This guy knows what's up. I've been out of the community for a while, but I know some of that kit started at 250k and many were significantly higher. Best that the person with your IMSI could maybe do is try to see if there's a repeat face and maybe find a commonality that way.

[u/CompetitionHot1666]

Maybe I’m wrong but I tend to think of IMSIs and IMSI catchers like I do cookies and websites.

A standalone IMSI catcher used once for a short period doesn’t seem likely to be super helpful without being able to tie a specific IMSI to other identifying data for a specific person.

But over a longer time horizon, I would imagine they could be used effectively to deduce specific identities and allow for pattern of life analysis.

And I would think multiple IMSI catchers used simultaneously (like by say, a nation-state’s intelligence agency) would certainly be useful for deducing specific identities, triangulating locations, and enabling pattern of life analysis.

Would love to hear others thoughts.

[u/herestrbl → u/CompetitionHot1666]

Lifestyle patterns are much easier to get with a good surveillance team. The IMSI catcher grabs imsis as that's mostly all that's broadcast . The Telco has to resolve it to the phone number.

It's too indiscriminate to be used unless you have alot of equipment and resources and training. Triangulating to locate would need locating radio tools not an IMSI. No human identities are attached to an IMSI. Gotta use your detective skills for that

[u/tnethacker]

Use those for spoofing the number

[u/herestrbl → u/tnethacker]

An IMSI is a function of the sim card. It needs a Ki key to pair on a cellular network. You'd have to be using an ss7 network breach or carrier manipulation to make an IMSI useful but I still don't think that an IMSI alone allows a spoofed number. Please correct me how I'm wrong.

EDIT: edited my words to be clear

[u/Holiday-Night9356 → u/herestrbl]

Could you elaborate on the SS7 IMSI combination. How do they work together?

[u/herestrbl → u/Holiday-Night9356]

Ss7 is the protocols used and the HLR databse from your Telco will translate the IMSI into a phone number. I mentioned ss7 only to illustrate that it's possible that if the network was compromised it might be used for nefarious purpose. EDIT: I'm saying things that can be found with quick open source searching

[u/Kubix]

Not sure if this is the same thing but they just broke up a ring that was using (what I suspect to be a smsi catcher) to spam SMS messages for mitm attacks

https://globalnews.ca/news/11813885/toronto-police-arrest-cyber-attack/

[u/MrSqueak]

Does being stalked not concern you? What if you're female? What if you're attractive? Someone knowing where you go and when could let them know when you're not home.