Fake Cellular Towers Capture IMSI and IMEI Identifiers, Exposing Mobile Users to Tracking
What Happened — In April 2026 Canadian authorities arrested three individuals operating an “SMS blaster,” a device that masquerades as a legitimate cellular base station. The hardware forces nearby phones to connect to the strongest signal, then extracts the International Mobile Subscriber Identity (IMSI) from the SIM card and the International Mobile Equipment Identity (IMEI) from the device itself. Because 4G networks still transmit the IMSI in cleartext before mutual authentication, the fake tower can harvest these permanent identifiers even when the phone later upgrades to encrypted 5G sessions. The attackers use the collected data for large‑scale phishing campaigns and location tracking. The technique is a modern incarnation of the IMSI‑catcher, and it works by downgrading phones to older generations (2G/3G/4G) where the identifiers are not protected.
Why It Matters for Trust & Control Assurance — The incident highlights the need for strong network‑level authentication and continuous monitoring of device‑to‑network connections to satisfy access‑control objectives.
Who Is Affected — Telecommunications operators, mobile‑device manufacturers, and any organization that relies on cellular connectivity for employees or customers.
Recommended Actions –
- Enforce 5G‑only connectivity where coverage permits and disable fallback to legacy generations.
- Deploy network‑level encryption for subscriber identifiers (e.g., enforce SUCI usage).
- Log and audit all base‑station association events to detect anomalous “downgrade” attempts.
Technical Notes – The attack exploits the clear‑text transmission of IMSI on 4G/LTE before authentication; IMEI is always sent unencrypted. No CVE is involved; the weakness is protocol‑level. Source: BleepingComputer