FlashCatch: Minimizing Disruption in IMSI Catcher Operations

IMSI catchers are surveillance tools that intercept cellular signals to capture user identifiers, such as the IMSI. By imitating a legitimate BS and compelling phones to connect via jamming or stronger signal, they cause temporary disconnection, risking service disruption and raising suspicion, which limits their covert effectiveness. This paper presents FlashCatch, an IMSI-catching approach that significantly accelerates the two primary factors leading to service disruption. First, by exploiting 3GPP standard vulnerabilities, FlashCatch reduces IMSI capture time by over 200 times. Second, it improves the detachment phase through intentional authentication failures, inducing a rapid switch back to a legitimate cell and barring the FBS cell from further reconnection, thus reducing overall noticeable service disruption by at least 50-fold. Laboratory experiments on 7 devices featuring basebands from three different manufacturers demonstrate sub-second IMSI retrieval with seamless service continuity, while dedicated VoLTE and VoIP experiments confirm that ongoing calls resume without termination after a transient small disruption. In-the-wild field tests with 50 volunteers further validate its stealth and operational effectiveness. Moreover, FlashCatch preserves the UE's security context, retaining temporary identifiers that enable linkability attacks for subsequent tracking.