IMSI vs. IMEI: What Phones Broadcast and Who Can Read It
Summary
A sponsored explainer describes how cellular networks and fake towers can expose IMSI and IMEI identifiers, outlines 4G paging attacks and 5G protections, and presents Cape’s IMSI rotation as a mitigation.
Key points
- The article distinguishes the SIM-linked IMSI from the device-linked IMEI and says older 2G/3G networks can transmit both in plaintext.
- It says 4G may send an IMSI in plaintext before authentication, while 5G uses encrypted SUCI; coverage gaps and downgrades can leave phones exposed.
- A 2019 paper described identifying a phone’s 4G paging slot using silent calls, texts, or app notifications; the article says the method worked against all tested US carriers.
- The article describes a related fake-tower attack that can trigger a carrier fallback to broadcasting a raw IMSI, which researchers validated against one major US carrier.
- It says IMSI rotation can make harvested identifiers stale and change paging slots; Cape describes its service as rotating IMSIs daily or on demand.
- The article says Cape combined with GrapheneOS offers an LTE-only mode to block downgrades; this is presented as a vendor-associated capability.
Article Details
- Topic
- How cellular networks expose IMSI and IMEI identifiers, and how fake base stations and paging attacks can exploit that exposure
Vendors
Products
GrapheneOSCape plus GrapheneOS adds LTE-only mode, which blocks downgrades.Identifier RotationCape’s Identifier Rotation changes your IMSI every 24 hours, or on demand, cycling through seven IMSIs a week drawn from a shared pool that’s constantly reassigned among customers, so each IMSI carries a tangled history