● Covered by 1 source · 1 reportMedium impact1 neutral
IMSI vs. IMEI: Understanding Phone Identifiers and Surveillance Risks
Key points
- IMSI is tied to the SIM card, IMEI to the physical phone.
- SMS blasters and IMSI catchers exploit cellular network vulnerabilities.
- 4G networks can leak IMSI in plaintext to fake towers.
- 5G's SUCI encryption improves security, but downgrade attacks are possible.
Phone Identifiers and Interception
Canadian authorities recently arrested three individuals for operating an "SMS blaster," a device that mimics a cell tower to send phishing texts to nearby phones. This technology is similar to an IMSI catcher, which is used for surveillance. Both devices function by tricking phones into connecting to them as the strongest signal, allowing them to collect information before authentication occurs.
IMSI vs. IMEI Explained
Phones broadcast several identifiers. The International Mobile Subscriber Identity (IMSI) is a unique number assigned by a mobile carrier and stored on the SIM card, used for network authentication. The International Mobile Equipment Identity (IMEI) is a unique number tied to the physical phone itself, which the network does not authenticate. While Wi-Fi and Bluetooth hardware addresses are often randomized by modern phones, IMSI and IMEI typically remain constant.
The level of protection for these identifiers varies by cellular generation, with standards set by 3GPP. Newer generations offer improved security, but phones can fall back to older, less secure generations, which is a vulnerability exploited by fake towers.
How IMSI Can Be Leaked
IMSI catchers and fake base stations can exploit 4G networks, where a phone transmits its IMSI in plaintext to an unauthenticated tower. Although 5G introduces Subscriber Permanent Identifier Concealment (SUCI) encryption to address this, an IMSI catcher can still force a device to downgrade to 4G or earlier, bypassing the 5G security measures.
Paging attacks also pose a risk. In 4G, an idle phone's paging slot is calculated using its IMSI, which is publicly documented. This allows attackers to determine the IMSI from the paging slot, even though 5G uses a temporary ID for this purpose.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Phones broadcast unique identifiers like IMSI and IMEI, which can be intercepted by devices like SMS blasters and IMSI catchers. These devices exploit vulnerabilities in cellular network protocols, particularly in 4G, to collect subscriber and device information. While 5G introduces better protection, phones can be downgraded to older, less secure generations.