International mobile subscriber identity

It's not that trivial to know your location and to intercept your calls, etc., if you are with a roaming SIM card.

First, the local carrier doesn't even know your phone number, so it's very difficult for a local adversary They need to make some calls to you or send texts to you if you even have a number and try to intercept these calls and try to make some timing analysis before they even know what IMSI belongs to you.

So if they go the normal route of going to... for example, private detective and trying to leverage their license to get this information from Verizon.

And here, it's just not possible.

And that is just visual tracking.

They also detail the use of stingrays, which are technically known as IMSI catchers.

These are devices often mounted in standard police SUVs that intercept your private cellular communications.

See, I'm struggling to understand the mechanics here.

And so those were primarily SS7.

Those were where it was vulnerable and that things like IMSI catchers and stingrays could break down the signaling and potentially be able to manipulate or collect that kind of data.

But those have been turned down.

It doesn't mean that it doesn't exist, but now the SS7 is in the US is primarily carried over what's called SIGTRAN.

Which is just a... a staggering level of cognitive dissonance.

Oh no! The government is using emergency alert systems to track them through the phone tower that's triangulating the GPS satellite, accessing the Wi-Fi positioning, Bluetooth beacon searching and receiving IMSI, that's fake phone towers in case you're not familiar with that lingo like I wasn't, catching operating system using permission allowing, add pixel ID and cookie receiving, metadata creating, biometric storing and sharing smartphone.

How will we ever overcome this dramatic overreach from the government? I won't even be able to hide in the woods jacking it to porn in the bunker if the government can use these alerts to track me.

At least the corporations who provided me with the tracking device that I willingly use gave me something in exchange for it.

This attack requires knowing the name or credentials of the Wi-Fi networks the camera is looking for.

But what concerns me more is that this information wasn't in an encrypted upstream to begin with, which means that by using a professional grade SDR or IMSI catcher, which is more or less a DIY stingray device, a malicious hacker could just hijack the LTE connection and then do the exact same thing without needing to know these network names or even being physically near the camera.

This could also allow a more modern version of a tempest attack, which I'll demonstrate in a few minutes, and that's where a hacker could decode the motion JPEG video stream.

I actually tried to accomplish this as I love puzzles, but unfortunately, time forced me to choose between decoding the pixel sequence or finishing this video.

So what does a one million dollar spy truck actually come equipped with? The core of the order was a platform called Falcon Net.

To understand why Falcon Net is so dangerous, you need to understand two pieces of tech.

IMSI catchers and software-defined radio.

Every mobile phone has a unique digital ID burned into its SIM card called the IMSI, which stands for International Mobile Subscriber Identity.

Yeah, I mean, the main part here really is that, you know, as Loic was saying about the SGP32, on its own, it has to be downloaded.

It has to be contracted between the network and the customer, whereas really the combination with Keegan is the FlowLive multi-IMSI running as a profile on the SIM with multiple operators, so multiple IMSIs.

And Flowlive has more than 20 various Emsis on its library.

So we could get the multi-Emsi application that's running straight out of the box.

So what does a $1 million spy truck actually come equipped with? The core of the order was a platform called Falconet.

To understand why Falconet is so dangerous, you need to understand two pieces of tech, IMSI catchers and software-defined radio.

Every mobile phone has a unique digital ID burned into its SIM card called the IMSI, which stands for International Mobile Subscriber Identity.

It acts like a digital fingerprint of a license plate for your phone.

Under normal circumstances, your phone is constantly scanning the area for the strongest signal from a cell phone tower operated by your carrier.

An IMSI catcher or cell site simulator is essentially a fake cell tower.

When mounted inside a moving vehicle, it broadcasts a signal that tricks every nearby smartphone into believing it's the strongest, closest available tower.

And because your phone is programmed to always seek the best connection, it automatically drops its connection to your carrier and connects to the fake tower in the SUV.

Calls originating or terminating numbers involving both phone numbers.

Um, information shall include telephone numbers dialed, incoming telephone numbers, date, time, duration of the call, registration, connection records, IMSI and IMEI of the number associated.

So that's like device identification.

Cell tower information.

You want to know who is connected, who.

So in the old 2G and 3G networks, we could see the IMEI or IMSI And on the network, there's the IMSI catchers.

And with those, you can tell exactly who's on that network right then.

So in 4G, what they've done is they've switched over to a temporary identifier.