IMSI Catcher.

A fake cell-site that tricks nearby phones into revealing their IMSI/IMEI and, on weak networks, intercepting calls and SMS. It belongs to the Attacks & Threats category of cybersecurity.

A fake cell-site that tricks nearby phones into revealing their IMSI/IMEI and, on weak networks, intercepting calls and SMS.

An IMSI catcher is a portable cell-site simulator that exploits the asymmetric trust model of 2G/3G mobile networks: handsets authenticate to the network but the network does not authenticate to the handset. By broadcasting a stronger signal with a familiar PLMN/MCC-MNC, the catcher forces nearby phones to camp on it and to send their IMSI in plain text during attach. Many catchers force a downgrade from 4G/5G to GSM (no mutual authentication), enabling silent SMS, geolocation and call interception. Open-source variants were demonstrated by Chris Paget (DEF CON 2010) and the YateBTS / OpenBTS projects. Defences include 5G subscription concealed identifier (SUCI), stingray-detection apps, mandatory mutual authentication and disabling 2G.

Defences for IMSI Catcher typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Cell-site simulator, Fake BTS, Stingray-class device.