BlogDetecting IMSI/IMEI Change Across 2G/3G/4G/5G

Security & Hacking Telecom Musings Tản Mạn Viễn Thông #4G #5G #2G/3G #Sip #SS7 #Diameter #Http/2 #GTP #Telecom Musings

Bố cục bài viết

Detecting IMSI/IMEI Change Across 2G/3G/4G/5G Consolidated signaling reference for correlation/monitoring pipelines 1. 2G/3G (GSM/UMTS — MAP/SS7, GTPv1-C) 2. 4G (EPS — Diameter S6a/S6d/S13, GTPv2-C, NAS/S1AP) 3. 5G (5GC/SA — SBI/HTTP2, NAS/N1) 4. Correlation strategy (generation-agnostic)

Trang này

Sunex 28/07/2026 · 5 phút đọc

Ngày tạo

28/07/2026

Cập nhật

28/07/2026

Lượt xem

Đọc

Detecting IMSI/IMEI Change Across 2G/3G/4G/5G

Consolidated signaling reference for correlation/monitoring pipelines

There is no single “IMSI/IMEI changed” alarm native to any generation of 3GPP core network — detection is achieved by correlating the (IMSI, IMEI/PEI) pairing across signaling touchpoints over time and flagging anomalous churn. This document lists every relevant signal per generation, what it carries, and how it fits into a correlation pipeline.

1. 2G/3G (GSM/UMTS — MAP/SS7, GTPv1-C)

Point	Message / Service	What you get	Notes
Um/Uu (UE↔BSS/RNC), NAS (MM/GMM)	Identity Request/Response (Identity Type = IMEISV)	IMEI(SV) directly from UE	Direct source, cleartext over NAS
NAS	GPRS Attach Request / Routing Area Update Request	P-TMSI, optionally IMEISV
SS7 MAP (VLR/SGSN↔HLR)	Update Location (MAP)	IMSI-level location/subscription sync	Equivalent of 4G’s ULR
SS7 MAP (VLR/SGSN↔HLR)	Insert Subscriber Data (MAP)	Subscriber profile push	HLR itself does not store IMEI
SS7 MAP (MSC/SGSN↔EIR)	MAP_CHECK_IMEI (`checkIMEI` operation)	Blacklist/greylist/whitelist verdict, carries IMEI in request	Canonical per-attach IMEI check point — equivalent of 4G’s S13
SS7 MAP (gsmSCF↔HLR/VLR/SGSN)	MAP_OBTAIN_IMEI	On-demand IMEI retrieval for a given subscriber	The actual “fetch current IMEI” service
SS7 MAP (VLR/SGSN→gsmSCF, Gc interface)	NoteMM-Event (`noteMM-Event` operation)	Notification that a subscribed Mobility Management event occurred (e.g. IMSI Attach, MS available after IMSI Detach) for a subscriber provisioned with M-CSI/MG-CSI	Does not carry IMEI — it’s a CAMEL event-notification trigger, not an identity source. Useful only as a timestamp marker for MM events, not for IMEI correlation.
SS7 MAP (old SGSN↔new SGSN)	Send Identification	IMSI + security context transfer during inter-SGSN RAU
GTPv1-C (Gn/Gp, SGSN↔SGSN)	SGSN Context Request/Response	IMSI + MM Context during handover
CDR/billing	S-CDR / M-CDR / G-CDR	IMEISV embedded	Primary offline correlation source

2. 4G (EPS — Diameter S6a/S6d/S13, GTPv2-C, NAS/S1AP)

Point	Message	What you get	Notes
NAS (UE↔MME)	Attach Request / TAU Request	Optional IMEISV field
S1AP (eNB↔MME)	Initial UE Message / UE Capability Info	May carry IMEISV via NAS container
S13 (MME↔EIR)	ME-Identity-Check-Request/Answer (ECR/ECA)	IMEI(SV) sent for blacklist/greylist/whitelist check	Direct equivalent of MAP_CHECK_IMEI
S6a (MME↔HSS)	ULR — Terminal-Information AVP (IMEI + Software-Version)	IMEI on every location update	See earlier ULR breakdown
S6a (MME↔HSS)	Notify-Request (NOR)	New Terminal-Information when IMEI(SV) changes without a full location update	The dedicated “IMEI changed mid-session” signal — §5.2.5.1.1 of TS 29.272
S6a/S6t (SCEF↔HSS)	Monitoring-Event-Configuration — IMSI-IMEI(SV) association monitoring type	Async notification when the IMSI-IMEI pairing changes	IoT/SCEF-oriented, requires subscription
CDR/billing	S-CDR / M-CDR	IMEISV embedded	Offline correlation source

3. 5G (5GC/SA — SBI/HTTP2, NAS/N1)

Point	Message/Service	What you get	Notes
N1 (UE↔AMF), NAS	Registration Request	5G-GUTI or SUCI (encrypted SUPI); PEI only if requested	SUPI is not sent in clear
N1, NAS	Identity Request/Response (Identity Type = PEI)	IMEI(SV) as PEI, equivalent of the 2G/3G/4G Identity Request
N8 (AMF↔UDM), SBI/HTTP2	Nudm_UECM_Registration	AMF registers UE with UDM, includes PEI	5G equivalent of ULR
N8 (AMF↔UDM), SBI/HTTP2	Nudm_UECM_Update	Updates PEI/serving-node info without full re-registration	5G equivalent of S6a Notify-Request
N8, SBI/HTTP2	Nudm_SDM_Get / Nudm_SDM_Subscribe	Subscription data pull	Equivalent of ULA’s Subscription-Data
N17 (AMF↔5G-EIR), SBI/HTTP2	N5g-eir_EquipmentIdentityCheck_Get	PEI blacklist/greylist/whitelist verdict	Direct SBI equivalent of S13 ME-Identity-Check
N12 (AMF↔AUSF)	Nausf_UEAuthentication	Ties SUPI (deconcealed from SUCI) to the auth event	Needed before you can key your IMSI table at all
N40/CHF	5G Charging Data Records	PEI embedded	Offline correlation source, same role as CDRs in earlier gens

Key structural difference vs. 2G/3G/4G: SUPI (IMSI) is not sent in cleartext over N1/radio — the UE sends SUCI (encrypted). SUPI is only recoverable after AUSF/UDM deconcealment. This means your IMSI-IMEI correlation table for 5G must be anchored on N8 (Nudm_UECM_Registration) events, not radio-side capture — unlike earlier generations where both identifiers could appear in cleartext NAS before core-side security context was established.

4. Correlation strategy (generation-agnostic)

Build a rolling table keyed both ways: last-known-IMEI-per-IMSI and last-known-IMSI-per-IMEI, refreshed from the strongest available signal per generation (S13/N17/MAP_CHECK_IMEI for verified IMEI, S6a ULR+NOR / N8 UECM for HSS/UDM-visible IMEI).
Flag anomalies, not just changes:
- Rapid IMEI churn on one IMSI (multiple IMEIs within minutes/hours) → possible cloning.
- Same IMEI reused across multiple concurrent IMSIs → classic SIM-box / IMEI-cloning signature.
- A blacklisted IMEI (from EIR/5G-EIR/CEIR) reappearing under a new IMSI → stolen-device reuse.
Prefer EIR/5G-EIR-sourced IMEI over self-reported NAS IMEI where possible — NAS-layer IMEISV is UE-asserted and unauthenticated; EIR-layer values are the ones actually checked against blacklists.
5G-specific caveat: correlation cannot begin until SUPI deconcealment (post-AUSF), so a purely radio-side capture pipeline (as used for 2G/3G/4G cleartext IMSI) will not work for 5G SA — you need visibility at N8/N12, not N1.

Compiled from 3GPP TS 29.002 (MAP), TS 29.272 (S6a/S6d), TS 29.336 (SCEF), TS 29.503/29.510 (SBI/UDM/5G-EIR), TS 23.502 (5GS procedures).