LTE Catcher & Stingrays 2.0

Smartphone Security


IMSI-Catcher of the new generation:

Also known as: Hailstorm’s “Stingray”, Rayzone’s “Piranha”   They all have the GSM IMSI-Catcher features, plus new SS7, UMTS/LTE features

I want to compare the two devices and find out if there is a alternative method for all modes of operation with a 2.0 catcher.


Short conclusion:

1. The catching of IMSIs is much easier with LTE and so is the rest of the methods that are used.

2. The GSM features remain as a fall back, if the SS7 attack doesn’t work for example.

3. The possibilities of manipulating the firmware are more advanced than in 2G.

Sources and Papers about the topic 5G / LTE /
UMTS surveillance and security:






[1] LTE & SS7 Security  [1]

[2] Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information

Practical Attacks against Privacy and Availability in 4G/LTE Mobile Communication Systems

[3]  aLTEr Attack (MITM, DNS Spoofing on LTE): imsi-catcher is also transmitting a signal to the phone. It tries to manipulate the DNS to redirect all data that is send from/to the mobile device. It uses 2 attack vectors   Paper: breaking_lte_on_layer_two.pdf (pre-paper 7-2019)

Details about SS7 requests and messages. TS 29.338 Section 6.3.2 TS 29.305 Section A2.5.2.3

LTE vulnerability allows impersonation of other mobile devices: IMPersonation Attacks in 4G NeTworks



Other papers and projects about next generation surveillance:

5G Is Here—and Still Vulnerable to Stingray Surveillance

Touching the Untouchables: Dynamic SecurityAnalysis of the LTE Control Plane

New Privacy Threat on 3G, 4G, and Upcoming5G AKA Protocols

Easy 4G/LTE IMSI Catchers for Non-Programmers:

LTEInspector: A Systematic Approach for Adversarial Testing of 4G LTE (Protocol Layer)

Stingray Manuals

SS7 Exploid Kit

IMSI Catcher 2.0 and LTE fake base stations:Hackday: lte-imsi-catcher

zdnet Stingray-security-flaw-cell-networks-phone-tracking-surveillance

Blackhat 2021 5G IMSI Catchers Mirage 

LTE Catcher & Stingrays 2.0

White-Stingray: Evaluating IMSI Catchers Detection Applications

Anatomy of Commercial IMSI Catchers and Detectors