Mobile devices rely on two primary identifiers to function within cellular networks: the International Mobile Subscriber Identity (IMSI) and the International Mobile Equipment Identity (IMEI). The IMSI is a unique identifier linked to a user’s SIM card, which the network utilizes for authentication and subscriber lookup. Conversely, the IMEI is a hardware-specific identifier tied to the physical device itself. While the IMSI is frequently used by carriers to route communications and track location, the IMEI serves as a device descriptor that does not typically undergo network authentication.
The security of these identifiers varies significantly depending on the cellular generation in use. In older 2G and 3G networks, both the IMSI and IMEI are transmitted in plaintext. Modern 4G LTE networks attempt to mitigate these risks by using a temporary identifier known as a Globally Unique Temporary Identity (GUTI) to mask the IMSI after the initial connection, and they require mutual authentication before the IMEI is shared. 5G standalone networks further improve security by encrypting the IMSI as a Subscription Concealed Identifier (SUCI).
Despite these protections, vulnerabilities persist because mobile devices are designed to fall back to older network standards when newer signals are unavailable. This behavior allows attackers to deploy fake base stations, commonly referred to as IMSI catchers. By simulating a strong cell tower signal, these devices trick nearby phones into connecting before authentication occurs. In 4G environments, this can force a phone to reveal its IMSI in plaintext. While 5G encryption is intended to prevent this, the lack of universal 5G coverage allows attackers to downgrade a device to a less secure 4G or legacy connection to facilitate the capture.
Beyond the use of fake towers, researchers have identified sophisticated paging attacks that can deanonymize users. Because mobile devices periodically wake up from an idle state to check for incoming traffic—a process known as paging—they utilize specific time slots. In 4G networks, these slots are calculated using a formula tied to the IMSI. By triggering silent calls or notifications, an attacker can monitor which paging slot shows activity, effectively confirming a target's presence in a specific area without needing to intercept the actual data.
This paging technique can serve as a precursor to more invasive signaling attacks. If an attacker successfully determines a device's paging slot, they can use a fake tower to block legitimate network pages. This forces the carrier to fall back to broadcasting the raw IMSI to reach the device, allowing the attacker to capture the identifier. Once an IMSI is obtained, it can be used to track a user’s location or intercept communications via signaling protocols like SS7 or Diameter.
While the IMSI is the primary target for tracking and interception, the IMEI remains a secondary concern. Under normal circumstances, a fake tower cannot easily obtain the IMEI because the device only transmits it after authenticating with the network. However, if a device is downgraded to an older network or if the carrier’s infrastructure itself is compromised, the IMEI can be exposed. Because the IMEI is permanently tied to the hardware, its exposure allows for long-term device tracking that is not easily mitigated by the user.
To combat these threats, some privacy-focused initiatives have proposed the rotation of identifiers. By cycling the IMSI periodically, the historical data associated with a specific user becomes fragmented and unreliable for attackers. This process changes the paging slot calculation, effectively breaking the patterns used in paging attacks and rendering harvested IMSIs stale within a short timeframe.
While these technical mitigations offer a layer of defense, the fundamental challenge remains the reliance on legacy network standards and the inherent design of cellular paging protocols. Security experts note that as long as devices are capable of falling back to insecure network generations, the risk of identifier exposure via fake base stations and signaling manipulation will remain a significant concern for mobile privacy.
