-5

I have learned about IMSI catchers but also read that one can not get the phone number through that IMSI.

Lets suppose I want to collect the phone numbers of all people in a college/ shopping mall/ part of residential area for targeted advertising. Is it possible? If yes, how does one go about doing it?

alialiali
  • 19
  • 1
  • 1
  • No, this is not possible. – Xander Nov 06 '14 at 18:29
  • I see this all the time! Usually it's some girl asking me to sign some petition but you could easily duplicate with asking for numbers. – Matthew Peters Nov 06 '14 at 18:51
  • @Xander Yes this is possible. Have a look at this [paper] (http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=6103827&url=http%3A%2F%2Fieeexplore.ieee.org%2Fxpls%2Fabs_all.jsp%3Farnumber%3D6103827). Also as LucaBongiorni suggested, attacking via core network, this is very much possible. – kingmakerking Nov 25 '15 at 16:47
  • 1
    @kingmakerking Read the whole question. The method proposed by the paper you cited, even if it works, would be highly illegal, and therefore not suitable for targeted advertising. This is not possible. – Xander Nov 25 '15 at 17:17

1 Answers1

3

It is possible. Let's consider the quicker one with an active attack. Look at: MSISDN Retrieval

The full presentation: http://www.slideshare.net/iazza/dcm-final-23052013fullycensored

Another way could be the use of SS7 queries to the HLR/VLR of the Victim's MNO. (this obviously imply that the attacker has a certain level of permissions/access to the core network (e.g. misconfigured gateways, compromised femtocells, physical access to a BTS->BSC->MSC, etc.).

Community
  • 1
Luca Bongiorni
  • 61
  • 2