What is an IMSI number (2022 Technical guide)

What is an IMSI number (2022 Technical guide)

When travelling overseas, we are always conscious about our security. However, are we taking the appropriate measures to protect our digital identity? We spend a lot of time on the internet doing important things like banking and paying bills.

Since the invention of smart devises, these transactions have been moved from desktops and laptops to smartphones and tablets. We need to be aware of the fact that our digital identity can be tracked on mobile networks through our international mobile subscriber identity number.

It is important to know about this as you may encounter an emergency when travelling where you may need access to cash. You don’t want to make yourself a potential target.

Further Reading: SIM card sizes, dimensions & types (2022 Use guide)

What does IMSI mean

The international mobile subscriber identity (IMSI) is a number that uniquely identifies every user of a cellular network.

It is stored as a 64-bit field and is sent by the mobile device to the network. It is also used for acquiring other details of the mobile in the home location register (HLR) or as locally copied in the visitor location register.

Benefits of IMSI numbers

In a world where we connect our lives through smart devises and the internet of things, we often open ourselves up to become potential targets to hackers who will try to use any tactic that they can to access our information. this is either achieved through a coordinated hack or through a deceptively placed safe public wifi network.

If you are travelling and you do not have a VPN app on your phone, it is advisable that you do important transactions such as banking or checking work email over an LTE (mobile operator) network. If there is a security breach over these networks, an IMSI number can be used to pinpoint the phones location and the time when the breach occurred.

When a mobile is affiliated, a temporary IMSI is allocated and used to identify the subscriber in future exchanges. This is embedded in the SIM of the mobile equipment and is provided anytime the network is accessed. It is transmitted during initialization.

To prevent the subscriber from being identified and tracked by eavesdroppers on a radio interface, the IMSI is rarely transmitted. A randomly generated temporary mobile subscriber identity (TMSI) is sent instead of the IMSI, to ensure that the identity of the mobile subscriber remains confidential and eliminate the need to transfer it in an undeciphered fashion over radio links.

Decoding the IMSI format

The International Telecommunication Union (ITU) has standardized IMSI numbers, so it’s easy to identify what country and MNO a given subscriber should be associated with. IMSIs usually have 15 digits, but it varies depending on the country and provider. Those digits are divided into three sets, each of which communicates a different piece of information:

  • The first set of digits is the Mobile Country Code (MCC), which defines the country a subscriber primarily operates within. This is always either two or three digits;
  • The second set of digits is the Mobile Network Code (MNC), which represents the MNO the subscriber identify is associated with. This is between one and three digits; and
  • The final set of digits is the Mobile Subscription Identification Number (MSIN), which is unique to the subscriber. (This is typically nine or ten digits.).

310170845466094 is an IMSI number. The first three numbers (310) indicate that the location of the phone is the US. The second three numbers (170) indicates that Sprint is the phones mobile operator. The remaining numbers (100047265624299) is the phones MSIN number.

What is multi-IMSI

A multi-IMSI number is a number that allows a user to use their devise across a range of networks.

Multi-IMSI technology is essential for cellular IoT manufacturers that plan on deploying globally or creating mobile applications. You want your device to have service wherever your customers use it—not just wherever a particular carrier has coverage or roaming agreements with other MNOs.

This is one of the benefits of having a travel sim card. Further reading: Benefits of a travel SIM card (2022 International tourist guide)

What is an IMSI catcher?

An international mobile subscriber identity-catcher, or IMSI-catcher, is a telephone eavesdropping device used for intercepting mobile phone traffic and tracking location data of mobile phone users.

Essentially a “fake” mobile tower acting between the target mobile phone and the service provider’s real towers, it is considered a man-in-the-middle (MITM) attack. The 3G wireless standard offers some risk mitigation due to mutual authentication required from both the handset and the network.

However, sophisticated attacks may be able to downgrade 3G and LTE to non-LTE network services which do not require mutual authentication.

IMSI catcher detection solutions

There are a few ways you can protect yourself against a IMSI catcher.

The first is through FirstPoint Mobile Guard. FirstPoint Mobile Guard provides a unique military-grade capability to detect IMSI Catchers and prevent Man in the Middle Attacks at the network level. Designed for cutting-edge protection on the SIM-card level and mass-deployment in large organizations, the main strength of this solution is its ease of use.

Just insert the FirstPoint SIM card into the smartphone or IoT device you wish to protect and FirstPoint does the rest. This solution is extremely suitable for organizations and governments who want maximal security at minimal configuration. This cyber security-as-a-service provides continuous network-based protection with little to no maintenance required once it is installed in the employee devices.

There are also a number of apps that one can use to detect a IMSI catcher:

Android IMSI Catcher Detector (AIMSICD);

  • SecurCube;
  • SnoopSnitch;
  • Darshak;
  • ComSec; and
  • Cell Spy Catcher.

Alternatively, use a VPN app. Further reading: Top 110 Best travel apps (2022 International tourist guide)

Examples of IMSI numbers

IMSI:310170845466094

MCC      310         United States

MNC      170         Sprint

MSIN     100047265624299

IMSI:470040123456789

MCC      470         Bangladesh

MNC      04           TeleTalk

MSIN     0123456789

IMSI:460001357924680

MCC      460         CHINA

MNC      00           CMCC

MSIN     1357924680

IMSI:520031234567890

MCC      520         THAILAND

MNC      03           AIS

MSIN     1234567890

How 5G make IMSI more secure

There has been a lot of literature written about 5G which is the fifth generational development of mobile operator networks. Did you know that 5G technology makes IMSI’s more secure? This is achieved by ensuring the full anonymisation of the subscriber identity from mobile equipment to core network.

To do this, it created a new kind of identifier, the SUPI (Subscription Permanent Identifier). Devices don’t send the SUPI over the air. Instead, they send an encrypted key called a SUCI (Subscription Concealed Identifier).  Even if an attacker intercepts the SUCI the information is useless and cannot be used to harvest data.

IMSI FAQ’s

•             Where is the IMSI stored?

The IMSI is stored in the Subscriber Identity Module (SIM) inside the phone and is sent by the phone to the appropriate network.

•             What is the difference between an IMSI & MSISDN?

An international mobile subscriber identity (IMSI) number uniquely identifies a mobile phone subscriber and is usually stored within a SIM card. A mobile subscriber integrated services digital network (MSISDN) number is a mobile’s phone number.

•             Is IMSI secure or encrypted?

IMSIs on the 2G, 3G and 4G network are not encrypted. Instead, they are transmitted in plain text over the air. So although calls and texts are encrypted in 4G, the user’s meta data – identity and location – is not. This leaves the owner of the IMSI open to a number of threats.

•             What’s the difference between IMSI & ICCID?

An IMSI identifies the user in the GSM and is a portion of the SIM profile, but it doesn’t identify the SIM card itself. The Integrated Circuit Card ID (ICCID number) identifies the actual SIM card itself and not necessarily the user.

•             Is IMSI and IMEI the same?

The IMSI (International Mobile Subscriber Identity) is a code used by the phone company to identify the SIM on the mobile network. The IMEI (International Mobile Station Equipment Identity) is an international “Serial number” for your phone (device itself) to properly identify it on the carriers network.

•             What is the IMSI used for?

The IMSI is a number that uniquely identifies every user of a cellular network.

•             How do I find my SIM number IMSI?

Open your Apps list and tap on Settings. Scroll to the bottom of the menu and press About. Tap Status. On some phones like HTCs, this may be called ‘Phone Identity’. Tap IMEI Information. Your SIM number will show as either the ‘IMSI’ number, or the ‘ICCID number’.