I'm open to learning I'm wrong though 🙃

@patrickcmiller
This looks overblown to me. What threat model do they suggest this for?

Disable connecting to random unencrypted Wi-Fi and you're good. 2g is already disabled and every network you connect to is going to record your mobile ID because that's how they decide if you get to use it or not.

@RnDanger Half the damn article is FUD conflating wifi with cellular, as well as "encrypted" meaning "safe", but somehow "encrypted wifi networks aren't always encrypted" or some other bullshit? I'd want to look into how the actual feature is implemented before I can say anything concrete about it.

As for IMEI sniffers, 2g is disabled on real towers. But unless you went out of your way to disable it on your phone, fake ones can still "downgrade" to it with the reduced security, allowing them to listen in on your calls and texts.

IIRC 5g's bootstrap process is similar to TLS, where the tower is authenticated via a certificate before the IMEI is sent, so it's much less vulnerable to this?

@becomethewaifu
IMSI-Catcher, or something similar, to identify and track someone are still possible on 5G Networks.

See: https://casa.rub.de/forschung/publikationen/detail/5g-suci-catchers-still-catching-them-all

@RnDanger

@CyberPunker @becomethewaifu
That's interesting but i wonder who would be using tech like that (without already possessing the ability to just ask the company directly for whatever data they are looking for)
Could an officer use this to inject malware to a known target at a protest, for example?

@RnDanger @CyberPunker extremely unlikely. From my knowledge you'd need to use a malicious tower that the user connects to, then send a zero-click SMS exploit or something, which would require breaking the network's security now that mutual authentication of the tower is a thing.

The study appears to be about asking existing towers whether or not a known identity is connected, which is definitely still a significant tracking risk, but it's a much smaller one than the previous attacks that could just hoover up everyone in an area. (it needs to be done in real time, and you need to already know the ID you want to track beforehand. So "gather the IDs of everyone in this area" can't be done with it)

@patrickcmiller

just got 17, but no such option available

@nyanpasu64 too many news sites are going this route, unfortunately