Can anything shield IMSI from IMSI catchers?

K8y

Hello,
I understand SIMs can easily be tracked because they connect to cell towers and therefore Stingray devices, however what about shielding a phone without a SIM? Would this go unnoticed by an IMSI catcher or geo-fencing operation since it's not "activated" by a SIM?

If not, then is there any way to shield or hide the imsi while using the phone... besides always having to keep it in a copper bag? (I assume these cages at least shield it, right?)

Thank you.

r134a

K8y Airplane mode

K8y

r134a a) So you can just keep it on airplane mode while you use Signal chat via WiFi and IMSI Cacher's wouldn't be able to see?

b) is a special settings set up needed for this or does it come standard in grapheme?

c) If you're on the go, as long as you use a VPN it's pretty safe to use public or hotspot WiFi while doing this on graphene?

Thank you

de0u

K8y So you can just keep it on airplane mode while you use Signal chat via WiFi and IMSI Cacher's wouldn't be able to see?

"Enabling airplane mode disables the cellular radio, but Wi-Fi can be re-enabled and used without activating the cellular radio again. This allows using the device as a Wi-Fi only device." (source)

K8y Is a special settings set up needed for this or does it come standard in grapheme?

See above.

K8y If you're on the go, as long as you use a VPN it's pretty safe to use public or hotspot WiFi while doing this on graphene?

Even without a VPN it's pretty safe, if by "safe" what is meant is that people are unlikely to break into the device. If other threats are being considered, a VPN might help, but also a VPN might hurt.

K8y

de0u Thank you. Do you or anyone know if there are devices that can see what phones are wifi connected to a particular router being targeted?

Regarding attacking those using WiFi calling in airplane mode, I suppose hackers could then monitor the router and those phones connected to it, thus defeating anonymity of the caller in airplane mode...or is that not how it works?

If so could they see any identifiers or information about the phone connected to the router even if its user has Graphene installed?

K8y

de0u Enabling airplane mode disables the cellular radio, but Wi-Fi can be re-enabled and used without activating the cellular radio again

I looked up your source to see how to do this but did not find directions. How does one do this?

other8026

K8y Do you or anyone know if there are devices that can see what phones are wifi connected to a particular router being targeted?

This is a complicated question and depends a lot on the network and what you're trying to accomplish. In general, a VPN on a public network is probably a good idea.

This section of the website may also have some information you might be interested in: https://grapheneos.org/usage#wifi-privacy-associated

K8y WiFi calling in airplane mode

I'd suggest reading the project's responses in these two threads:

Specifically this quote:

Airplane mode avoids cellular so you can avoid the cellular network knowing your location with that but of course then you won't have cellular, only Wi-Fi calling/texting which could also probably be tied to your location since it uses an IPSec tunnel itself rather than going through the VPN. If you want to avoid the carrier knowing your location, airplane mode combined with disabling the SIM works well.

phone-company

Maybe you misunderstand imsi catsher? An imsi catcher is able to play a network cell to the mobile device in which the device logs in. These devices were used to eavesdrop on calls. Without a SIM card, all this is useless and 5g technology has made it virtually superfluous

fluxcondensator

phone-company Even without a sim card the baseband of your loved grapheneos pixel will send data over the air. Also an advanced adversary can target your basebands software to do things with it. Cheers.

phone-company

fluxcondensator Yes, I know that, but the purpose of an Imsi Catcher was to listen in on phone calls

other8026

fluxcondensator Even without a sim card the baseband of your loved grapheneos pixel will send data over the air.

This is why people have been talking about airplane mode in this thread.

fluxcondensator Also an advanced adversary can target your basebands software to do things with it. Cheers.

Perhaps, but this is why it's important to keep up with updates. Also, the baseband is isolated. Google has done some work hardening the cellular baseband on the Pixel 9 as explained in this post. The GrapheneOS project account has said a few times they think Google will backport the improvements to the older devices they support, so successfully exploiting vulnerabilities on cellular basebands should be harder.

fluxcondensator

phone-company No the purpose of an imsi catcher is also location tracking via tracking the imsi/imei trough different cells.

fluxcondensator

other8026 1. An attacker could potentially disable airplane mode.

While the baseband is isolated and hardened point 1. is still a problem.

Thats why removing the baseband / rf tranceiver is the only option for this high of an threat model right now.

phone-company

fluxcondensator yepp okay this seems right

other8026

fluxcondensator 1. An attacker could potentially disable airplane mode.

How? They'd need access to the device and at least one of the PINs or passwords to unlock one of the profiles to do this. In that case, there may be no need for an exploit.

r134a

An 'imsi-catcher' or stingray is also mainly used by government entities, for example at protests.
They will setup a stingray at that location, everybody his phone in close proximity to that protest will connect to that 'cellular tower'/stingray. Consequently they would have a database of anyone who attended that protest. Some embassies use this technique aswell.

r134a

In addition, perhaps someone finds this interesting, but there are even 'passive' imsi-catchers, available on github for anyone with a hackrf or similar sdr. A single person could sniff a cellular tower a see what 'imsi's' are connected to that specifical tower. The single person probably doesn't have the resources to translate those imsis to identities though. Proof of concept can be found on cemaxecuter youtube channel somewhere.

Murcielago

K8y

1) Activate airplane mode

2) Activate WiFi

Or do the same using Quick Settings.

In the status bar at the top you will then see the airplane icon which indicates airplane mode is active and you can still access the Internet via WiFi.

K8y

Murcielago thank you, so if I go to a protest with this setup and find a hotspot, stingrays would not see my SIM or IMSI numbers while I chat on Signal or Session?

DeletedUser237

K8y find a hotspot

If you think it's safe to connect to some random hotspot during a protest I have bad news for you. Unfortunately there's no Wall of Sheep during such events.

Hill_Sphere

K8y

K8y thank you, so if I go to a protest with this setup and find a hotspot, stingrays would not see my SIM or IMSI numbers while I chat on Signal or Session?

This is an interesting conversation, with a lot of history. To add, here are some links that may answer questions about IMSI catchers, etc. in general:

Plain language technical information about IMSI catchers: https://www.eff.org/wp/gotta-catch-em-all-understanding-how-imsi-catchers-exploit-cell-networks

If you're generally interested in protest security - this 'Surveillance Self Defense' guide is pretty good and has a section on attending a protest: https://ssd.eff.org/

It's not just IMSI catchers though... Device/Person correlation can be derived from: AGPS location privilege given to an app that sells this data (e.g. Google fulfilling geo-fence warrants) or connecting to your University's Library Wi-Fi (e.g. Pamona College, etc. recently)...

The story of how IMSI catchers were brought to public knowledge is really interesting. It's been written about, etc. a number of times. One example (or just search Daniel Rigmaiden): https://www.theverge.com/2016/1/13/10758380/stingray-surveillance-device-daniel-rigmaiden-case

K8y

DeletedUser237 good point...the free open hotspot itself might be a trap by the surveillance team! Is that what you mean?

Would a VPN take care of that?