Develop FlashCatch heuristic

[wgreenberg]

What problem does this feature solve or what does it enhance?

i found this new paper claiming to describe a novel IMSI catcher technique which they call FlashCatch: https://dl.acm.org/doi/pdf/10.1145/3734477.3734705

the paper claims that rayhunter (and a number of other detectors) are ineffective against techniques like theirs, but based on their description, i don't think that's the case. in particular, i wonder if @cooperq's updated IMSI Requested heuristic works on this.

the paper also references a number of others which describe various IMSI catcher techniques, which we may want to investigate

Proposed Solution

investigate if our new v2 IMSI Requested heuristic is effective against this, and if not, develop one which is

Alternatives Considered

No response

[MatejKovacic]

So basically what they are saying is they have the following workflow:

(1) Victim Detachment and Rogue Connection: FlashCatch detaches the victim UE from its legitimate BS by presenting a
stronger FBS signal—either by boosting power or jamming the legitimate cell, and using the legitimate PLMN and frequency
parameters, the FBS induces cell reselection.

(2) Accelerated IMSI Extraction: Once connected, FlashCatch immediately sends an IR (Fig. 3, key innovation #1), using standard 3GPP procedures (e.g., TAU/Service Request) to promptly obtain the IMSI and TMSI preserving the security context.

(3) Seamless Detachment and Network Recovery: Immediately after obtaining IMSI—and as detailed in Section 4.4—FlashCatch
deliberately triggers three consecutive authentication failures by transmitting incorrect MAC values (see Fig. 3).

This causes the victim UE to mark the FBS as barred and reconnect to a legitimate cell, all while preserving the GUTI and session keys.

This results in:

• rapid IMSI retrieval
• maintaining seamless connectivity (even phone call does not break)
• works on 4G (no 2G downgrade required)

However, they say: "we significantly accelerate detachment by quickly causing multiple authentication failures". Could this be a possible indicator of compromise? Detach message, resulting in cell reselection and then authentication failure.