5G SUCI-catchers: Still catching them all?

Merlin Chlosta; David Rupprecht; Christina Pöpper; Thorsten Holz

doi:10.1145/3448300.3467826

5G SUCI-catchers: Still catching them all?

Merlin Chlosta, David Rupprecht, Christina Pöpper, Thorsten Holz

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

In mobile networks, IMSI-Catchers identify and track users simply by requesting all users' permanent identities (IMSI) in range. The 5G standard attempts to fix this issue by encrypting the permanent identifier (now SUPI) and transmitting the SUCI. Since the encrypted SUCI is re-generated with an ephemeral key for each use, an attacker can no longer derive the user's identity. However, this scheme does not prevent all tracking and linking: if the identity of a user is already known, an attacker can probe users for that identity. We demonstrate a proof-of-concept 5G SUCI-Catcher attack in a 5G standalone network. Based on prior work on linkability through the Authentication and Key Agreement (AKA) procedure, we introduce an attack variant that enables practical, repeatable attacks. We capture encrypted SUCIs and use the AKA-procedure to link the encrypted identities between sessions. This answers Is user X present now? - - a typical scenario for IMSI-Catchers. We analyze the attack's scalability, discuss real-world applicability, and possible countermeasures by network operators.

Original language	English (US)
Title of host publication	WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks
Publisher	Association for Computing Machinery, Inc
Pages	359-364
Number of pages	6
ISBN (Electronic)	9781450383493
DOIs	https://doi.org/10.1145/3448300.3467826
State	Published - Jun 21 2021
Event	14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2021 - Virtual, Online, United Arab Emirates Duration: Jun 28 2021 → Jul 2 2021

Publication series

Name	WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks

Conference

Conference	14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2021
Country/Territory	United Arab Emirates
City	Virtual, Online
Period	6/28/21 → 7/2/21

Keywords

5G security
AKA
IMSI
IMSI-catcher
SUCI
SUCI-catcher
SUPI
fake base station
subscription concealed identifier

ASJC Scopus subject areas

Computer Networks and Communications
Safety, Risk, Reliability and Quality

Access to Document

10.1145/3448300.3467826

Cite this

Chlosta, M., Rupprecht, D., Pöpper, C., & Holz, T. (2021). 5G SUCI-catchers: Still catching them all? In WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks (pp. 359-364). Article 3467826 (WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks). Association for Computing Machinery, Inc. https://doi.org/10.1145/3448300.3467826

5G SUCI-catchers: Still catching them all? / Chlosta, Merlin; Rupprecht, David; Pöpper, Christina et al.
WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks. Association for Computing Machinery, Inc, 2021. p. 359-364 3467826 (WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Chlosta, M, Rupprecht, D, Pöpper, C & Holz, T 2021, 5G SUCI-catchers: Still catching them all? in WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks., 3467826, WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, Association for Computing Machinery, Inc, pp. 359-364, 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2021, Virtual, Online, United Arab Emirates, 6/28/21. https://doi.org/10.1145/3448300.3467826

Chlosta M, Rupprecht D, Pöpper C, Holz T. 5G SUCI-catchers: Still catching them all? In WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks. Association for Computing Machinery, Inc. 2021. p. 359-364. 3467826. (WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks). doi: 10.1145/3448300.3467826

Chlosta, Merlin ; Rupprecht, David ; Pöpper, Christina et al. / 5G SUCI-catchers : Still catching them all?. WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks. Association for Computing Machinery, Inc, 2021. pp. 359-364 (WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks).

@inproceedings{09a769cc6110451995d507c2da599755,

title = "5G SUCI-catchers: Still catching them all?",

abstract = "In mobile networks, IMSI-Catchers identify and track users simply by requesting all users' permanent identities (IMSI) in range. The 5G standard attempts to fix this issue by encrypting the permanent identifier (now SUPI) and transmitting the SUCI. Since the encrypted SUCI is re-generated with an ephemeral key for each use, an attacker can no longer derive the user's identity. However, this scheme does not prevent all tracking and linking: if the identity of a user is already known, an attacker can probe users for that identity. We demonstrate a proof-of-concept 5G SUCI-Catcher attack in a 5G standalone network. Based on prior work on linkability through the Authentication and Key Agreement (AKA) procedure, we introduce an attack variant that enables practical, repeatable attacks. We capture encrypted SUCIs and use the AKA-procedure to link the encrypted identities between sessions. This answers Is user X present now? - - a typical scenario for IMSI-Catchers. We analyze the attack's scalability, discuss real-world applicability, and possible countermeasures by network operators.",

keywords = "5G security, AKA, IMSI, IMSI-catcher, SUCI, SUCI-catcher, SUPI, fake base station, subscription concealed identifier",

author = "Merlin Chlosta and David Rupprecht and Christina P{\"o}pper and Thorsten Holz",

note = "Publisher Copyright: {\textcopyright} 2021 ACM.; 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2021 ; Conference date: 28-06-2021 Through 02-07-2021",

year = "2021",

month = jun,

day = "21",

doi = "10.1145/3448300.3467826",

language = "English (US)",

series = "WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks",

publisher = "Association for Computing Machinery, Inc",

pages = "359--364",

booktitle = "WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks",

}

TY - GEN

T1 - 5G SUCI-catchers

T2 - 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec 2021

AU - Chlosta, Merlin

AU - Rupprecht, David

AU - Pöpper, Christina

AU - Holz, Thorsten

PY - 2021/6/21

Y1 - 2021/6/21

N2 - In mobile networks, IMSI-Catchers identify and track users simply by requesting all users' permanent identities (IMSI) in range. The 5G standard attempts to fix this issue by encrypting the permanent identifier (now SUPI) and transmitting the SUCI. Since the encrypted SUCI is re-generated with an ephemeral key for each use, an attacker can no longer derive the user's identity. However, this scheme does not prevent all tracking and linking: if the identity of a user is already known, an attacker can probe users for that identity. We demonstrate a proof-of-concept 5G SUCI-Catcher attack in a 5G standalone network. Based on prior work on linkability through the Authentication and Key Agreement (AKA) procedure, we introduce an attack variant that enables practical, repeatable attacks. We capture encrypted SUCIs and use the AKA-procedure to link the encrypted identities between sessions. This answers Is user X present now? - - a typical scenario for IMSI-Catchers. We analyze the attack's scalability, discuss real-world applicability, and possible countermeasures by network operators.

AB - In mobile networks, IMSI-Catchers identify and track users simply by requesting all users' permanent identities (IMSI) in range. The 5G standard attempts to fix this issue by encrypting the permanent identifier (now SUPI) and transmitting the SUCI. Since the encrypted SUCI is re-generated with an ephemeral key for each use, an attacker can no longer derive the user's identity. However, this scheme does not prevent all tracking and linking: if the identity of a user is already known, an attacker can probe users for that identity. We demonstrate a proof-of-concept 5G SUCI-Catcher attack in a 5G standalone network. Based on prior work on linkability through the Authentication and Key Agreement (AKA) procedure, we introduce an attack variant that enables practical, repeatable attacks. We capture encrypted SUCIs and use the AKA-procedure to link the encrypted identities between sessions. This answers Is user X present now? - - a typical scenario for IMSI-Catchers. We analyze the attack's scalability, discuss real-world applicability, and possible countermeasures by network operators.

KW - 5G security

KW - AKA

KW - IMSI

KW - IMSI-catcher

KW - SUCI

KW - SUCI-catcher

KW - SUPI

KW - fake base station

KW - subscription concealed identifier

UR - http://www.scopus.com/inward/record.url?scp=85110238834&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85110238834&partnerID=8YFLogxK

U2 - 10.1145/3448300.3467826

DO - 10.1145/3448300.3467826

M3 - Conference contribution

AN - SCOPUS:85110238834

T3 - WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks

SP - 359

EP - 364

BT - WiSec 2021 - Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks

PB - Association for Computing Machinery, Inc

Y2 - 28 June 2021 through 2 July 2021

ER -

5G SUCI-catchers: Still catching them all?

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this