● Cellular Security Lab · Cheat Sheet
DEF CON 34
← Intro Section 1 Overview
Telecom Village · Def Con 34 · Quick Reference

Cellular Security Cheat Sheet

Keep this handy as you work through the lab. IMSI catchers · SS7/Diameter attacks · Protocol comparisons · CLI commands

Key Identifiers

IMSIInt'l Mobile Subscriber Identity
Permanent SIM identity (up to 15 digits). Stored in SIM and HLR. Capture → query subscriber profile. MCC (country) · MNC (carrier) · MSIN (subscriber)
MSISDNMobile Station Int'l Number
Your phone number (E.164). Stored in HLR, linked to IMSI. SS7 SRI maps MSISDN → IMSI. +1-310-555-0100 → IMSI via HLR lookup
IMEIInt'l Mobile Equipment Identity
Identifies the device hardware (15 digits), not the subscriber. Survives SIM swaps; blacklisted when stolen.
TMSITemporary Mobile Sub. Identity
Temporary IMSI alias issued by the VLR after first attach to hide IMSI on-air. Reallocation is operator-discretion. First attach still sends IMSI in cleartext.
SUPI / SUCI5G Subscription Identifiers
SUPI = 5G permanent ID (typically an IMSI). SUCI = SUPI encrypted via ECIES with home network public key. Rotates every attach — IMSI catchers get nothing.

Network Generations — Security Snapshot

Gen Auth Air Identity Core Proto Key Risk
2G GSM One-way IMSI cleartext MAP/SS7 IMSI catchers trivial
3G UMTS Mutual IMSI 1st attach MAP/SS7 Downgrade → 2G; SS7
4G LTE Mutual IMSI 1st attach Diameter Downgrade; Diameter attacks
5G NR Mutual SUCI (encrypted) HTTP/2+TLS Legacy interop, still evolving
Downgrade: 5G devices can be forced to 2G by suppressing higher-gen signals — all 2G vulnerabilities then apply.

Core Protocols

SS7 — Signaling System No. 7
Backbone signaling of PSTN and 2G/3G. Carries call routing, SMS, and subscriber management (MAP). Designed in the 1970s with zero inter-carrier authentication — trust implied by network position.
MAP — Mobile Application Part
SS7 layer carrying cellular-specific messages: location, auth vectors, SMS routing. Key messages you'll use in Sections 1 & 2 are listed at right.
Diameter
4G's AAA replacement for SS7/MAP. Still exposed via carrier interconnects. Interfaces: S6a (HSS↔MME), Gx (policy), Rx (IMS). Attacks mirror SS7 in intent.
5G SBA — Service-Based Architecture
HTTP/2 + TLS + JSON replaces MAP/Diameter in pure-5G. REST microservices with explicit trust. Caveat: N26/SGs interwork gateways re-expose legacy attack surface.

Network Architecture — Who Does What

  • UE / MS Handset + SIM. SIM holds IMSI & Ki; Ki never leaves. 5G USIM also stores home network public key (SUCI).
  • BTS / gNB Radio tower. 2G: no UE-side crypto verification — what IMSI catchers impersonate.
  • BSC / RNC Base Station Controller. Aggregates towers, manages handoff, backhaul to core.
  • MSC / VLR Switching center + Visitor Location Register. Routes calls; queries HLR for auth vectors and subscriber info.
  • HLR / AuC Master subscriber DB + Auth Center. IMSI↔MSISDN map, Ki storage, auth vector gen (RAND/SRES/Kc). Primary SS7 attack target.
  • 4G: HSS/MME HSS = LTE HLR (Diameter). MME = attach/detach handler. Replaces MSC/VLR in EPC.
  • 5G: UDM/AMF UDM = 5G HLR. AMF = 5G MME. Communicate via HTTP/2 SBA.

Key SS7 MAP Messages

Abbreviation Full Name What it does / attack use
SRI Send Routing Info Queries HLR for IMSI from a phone number (MSISDN). Legitimate use: call routing. Attack use: enumerate real IMSIs from a phone book.
SRI-SM Send Routing Info for SM Same as SRI but for SMS routing. Also returns IMSI. Frequently abused because SMSC access is widespread.
ATI Any Time Interrogation Queries HLR for subscriber cell ID, IMEI, subscriber state. Requires no prior signaling interaction with the device.
PSI Provide Subscriber Info Sent to MSC/SGSN to return the serving cell / Cell-ID. Finer-grained than ATI; used in emergency location services.
UL / ISD Update Location / Insert Subscriber Data Normally used for roaming. Attackers forge UL to divert calls to an attacker-controlled VLR, enabling interception.
SAI Send Authentication Info Retrieves authentication vectors from HLR/AuC. If an attacker can send SAI, they get RAND/SRES/Kc and can impersonate the network or decrypt calls.

Attack Quick Reference

IMSI Catcher
aka Stingray, fake BTS
Rogue 2G BTS broadcasting real MCC/MNC. Devices attach and send IMSI in cleartext before auth. Passive — no interaction needed.
Downgrade Attack
force 5G → 4G → 2G
Jam or suppress 4G/5G, or broadcast a high-power rogue cell to force a device onto 2G. All 2G weaknesses then apply.
SS7 Cell-ID Lookup
ATI / PSI query
Send ATI or PSI from an SS7 interconnect with a subscriber MSISDN/IMSI. Response returns the serving cell + Cell-ID.
Call / SMS Interception
UL + SAI chain
Update Location diverts calls to attacker VLR; Send Auth Info retrieves session keys (Kc) to decrypt 2G traffic. SMS: fake SRI-SM reroutes to attacker SMSC.

Lab CLI — Command Reference

kal -s GSM900 -g 40
§2 Stage 1: Scan GSM-900 band for active channels. Strongest ARFCN is your target. Adjust -g (20–49 dB) — too low misses signals, too high saturates.
grgsm_scanner -b GSM900
§2 Stage 1: Decode the BCCH on channels kal found. Returns MCC, MNC, LAC, Cell-ID — values your rogue BTS must advertise.
grgsm_livemon -f 940.2e6
§2 Stage 1: Tune to target frequency; decodes air frames and forwards them as GSMTAP packets → UDP 127.0.0.1:4729. Run before tshark.
tshark -i lo -f 'udp port 4729' -Y 'gsm_a.rr' -c 5
§2 Stage 1: Capture paging frames from grgsm_livemon. Look for a repeating TMSI — your target is actively camped nearby.
bts --up --mcc 310 --mnc 260 --arfcn 51 --power 43
§2 Stage 2: Launch rogue BTS impersonating target network. TX must exceed real tower signal — calculated as TX power − ~84 dB path loss.
rfblock --bands lte,nr
§2 Stage 2: Suppress LTE/5G bands — forces victim phone to fall back to 2G rogue cell. All 2G weaknesses then apply.
bts --monitor
§2 Stage 2: Watch for inbound attach requests. 2G sends no auth challenge to the network — rogue BTS harvests IMSI in cleartext.
sms_intercept --imsi <imsi>
§2 Stage 3: Arm SMS interceptor for the attached subscriber. A5/0 null cipher means no decryption needed — traffic is plaintext.
smsdecode <hex-pdu>
§2 Stage 3: Decode raw GSM SMS PDU (3GPP TS 23.040) field-by-field. Reveals OTP in cleartext. Copy hex payload from intercept output.
sri --msisdn +13105550100
§1: SS7 SendRoutingInfo — resolve MSISDN → IMSI via HLR.
submit <value>
Submit a captured flag value (TMSI, IMSI, or OTP). Hint system guides if wrong.
stage 1 · stage 2 · stage 3 · clear · reset
Navigation: jump to stage, clear console, reset state. Type help for full command list.