Methods for eavesdropping and tracking mobile phones and other mobile devices are known in the art. For example, eavesdropping devices, which force a mobile phone to transmit the International Mobile Subscriber Identifier (IMSI), are sometimes referred to as “IMSI catchers.” Examples of IMSI catching techniques are described, for example, by Strobel in “IMSI Catcher,” Jul. 13, 2007, by Asokan et al., in “Man-in-the-Middle Attacks in Tunneled Authentication protocols,” the 2003 Security Protocols Workshop, Cambridge, UK, Apr. 2-4, 2003, and by Meyer and Wetzel in “On the Impact of GSM Encryption and Man-in-the-Middle Attacks on the Security of Interoperating GSM/UMTS Networks,” proceedings of the 15th IEEE International Symposium on Personal, Indoor and Mobile Radio Communications, Barcelona, Spain, Sep. 5-8, 2004, pages 2876-2883, which are all incorporated herein by reference.
The communication between GSM mobile terminals and base transceiver stations (BTS) is encrypted using GSM encryption algorithms (A5/1, A5/2), which are described, for example, in “Instant Ciphertext-only Cryptanalysis of GSM Encrypted Communications,” Advances in Cryptology, Proceedings of Crypto 2003, Lecture Notes in Computer Science 2729, Springer-Verlag, 2003, pages 600-616, which is incorporated herein by reference.
Recently, tools for creating IMSI catchers and deciphering these encryption algorithms were made public, for example within the open source projects of Open Source Mobile Communication Base Band (OsmocomBB), or Open Source GSM Baseband project. As a result, criminals and hackers can now overcome this encryption protection using commercially available hardware, in combination with rogue base stations, to create complete eavesdropping solutions and spoof innocent subscriber identities for their own purposes. The Open Source Mobile Communication Base Band (OsmocomBB), or Open Source GSM Baseband project, supports free software that can be uploaded to a mobile phone. The program configures a cellular phone to detect and report to the subscriber when the phone is being tracked by an IMSI catcher.