Detecting IMSI Catchers - Cellular Surveillance

19/12/2025

The 30-Second Primer

Your phone has two identifiers it whispers to every nearby cell tower: an IMSI (the SIM's identity) and an IMEI (the handset's identity). When a tower asks for them, the handshake assumes the tower is real. There is no certificate, no chain of trust, no "is this actually my carrier?" check — the protocol was designed in the 1980s and that lineage shows. An IMSI catcher exploits this by impersonating a tower, advertising a stronger signal than the real one, and accepting your phone's handshake. From that point on, it can log your IMSI, force you down to weaker encryption (or none at all), and forward your traffic to the real network while reading or mutating it in transit.

Why 2026 Is Different

Three things changed quietly over the last decade. First, the hardware collapsed in price — a usable IMSI catcher in 2013 cost six figures and required a black-budget purchase; today a HackRF One ($300) or even an RTL-SDR ($35) with the right software does most of the job. Second, the tooling went open source — GR-GSM, YateBTS, srsRAN, OpenBTS — these now do in hours what used to take months of NDA-bound engineering. Third, 4G/5G stacks were supposed to fix this with mutual authentication, but every modern phone still falls back to 2G when no LTE tower answers — and an IMSI catcher's whole job is to be the only "tower" that answers.

The Fingerprints of a Fake Tower

Real towers leave a stable, public-record trail. Fake ones don't. The tells:

A cell ID that doesn't appear in the public databases (OpenCellID, CellMapper, Mozilla Location Service).
A sudden 2G downgrade in an area with strong LTE coverage.
Missing or empty neighbour-cell list (real towers gossip about their neighbours; fake ones usually don't bother).
Encryption negotiation that lands on A5/0 (no encryption) or A5/2 (broken since 2003) instead of A5/3.
Strong signal from a "tower" that geolocates to a parked van.
Periodic re-registration prompts that legitimate networks don't trigger.

Detection on Your Phone (the easy path)

Before you build anything, see what your phone already knows.

SnoopSnitch (Android, rooted) — flags downgrade attacks, silent SMS, and unusual cell behaviour. The gold standard for phone-level detection.
NetMonster (Android, no root needed) — visualizes nearby towers, cell IDs, signal strength. Good for spotting "new" towers in familiar places.
Cell Spy Catcher (Android) — lightweight, alerts on suspicious changes.
iOS field-test mode — dial *3001#12345#* on an iPhone with a SIM. Limited information, but you can see cell IDs and signal metrics. Apple keeps tightening what's visible.
EFF's Crocodile Hunter — runs on a Pixel + custom kernel, more research-grade than daily-use.

All of these have the same limitation: they only see what the baseband chip is willing to expose, and the baseband is a closed firmware that often lies. They are useful but not sufficient.

Detection with a $40 SDR

The real game is passively listening to the air, decoding the broadcast control channels, and comparing what you hear to what you expect. An RTL-SDR dongle ($35) plus a quarter-wave antenna ($5) is enough for the GSM 900/1800 bands. A HackRF gives you LTE-band sniffing too. Software stack:

GR-GSM — GNU Radio block set that decodes GSM broadcast channels.
gr-gsm airprobe_rtlsdr.py — captures System Information messages from every tower in earshot.
IMSI-Catcher (Oros42) — open-source Python detector that takes the GR-GSM stream and flags anomalies in real time.
Wireshark + GSMTAP — decoded packets are pipeable straight into Wireshark for analysis.
CrocodileHunter (EFF, again — but the server-side version) for crowd-sourced verification.

A Sample Capture Walkthrough

Let's Plug the dongle in. Pick a GSM 900 MHz ARFCN that's strong in your area. Run:

# Capture System Information broadcasts on ARFCN 65
grgsm_livemon_headless -f 947.4M &

# Pipe to the IMSI-Catcher detector
python3 IMSI-catcher.py

# Or watch raw packets in Wireshark
sudo wireshark -k -i lo -f "port 4729"

A clean baseline looks like 3–7 stable cell IDs, all geolocating to mapped towers within a few hundred metres, all negotiating A5/3 encryption. A bad day looks like a brand-new cell ID at extraordinary signal strength, an empty neighbour list, and an A5/0 hand-off. Cross-reference the cell ID against opencellid.org — if it's not in the database and it's emitting at high power in a city, you have an interesting question to ask.

Defensive Habits

Force LTE/5G only in your phone's network mode. Disables the 2G downgrade path entirely (some Android builds expose this in dial-pad code menus; iOS started exposing it under Settings → Cellular in iOS 17).
Encrypt above the cellular layer. Signal, WhatsApp, Wire, anything end-to-end encrypted — the IMSI catcher sees ciphertext.
Run a VPN at all times. Same logic: even if the catcher proxies your data plane, all it sees is TLS-in-TLS.
Faraday at sensitive locations. If you're a journalist meeting a source, a lawyer with confidential clients, an executive in a hostile country — pouch the phone, not just the laptop.
Burner phones for protests with no personal accounts, never used near your home cell. Treat the IMSI as the identifier it is.

Thoughts?

Drop a comment below - it'll show up here once I read it.

loading…