Newer systems using 3GPP-type authentication (LTE, and I think UMTS) require mutual authentication between the SIM and the network (details in [1] section 6.3). If the network doesn't provide a satisfactory AUTN, the mobile can't proceed with connecting to the network because later steps in the connection procedure need some keys derived from the authentication procedure.
I think in older GSM-derived systems, the SIM just computed an authenticator based on a nonce provided by the network.
I know for sure that CDMA (IS-95 and 2000) and later AMPS systems supported one-way authentication or not, as selected by the network.
I've heard rumors that attackers have to force a protocol downgrade to something without mutual authentication by jamming the legitimate signal. The other options for the attack would seem to include
- obtaining the secret key value (or a set of authentication vectors) from the legitimate network.
Either of these seems more difficult to obtain than the actual locations that the attackers claim to want.
- obtaining K from SIM manufacturers, which has happened [2].
- exploiting implementation defects in SIMs or mobiles.
[1] 3GPP/ETSI TS 133 102 "3G security: security architecture", http://www.etsi.org/deliver/etsi_ts/133100_133199/133102/13....
[2] https://hn.algolia.com/?query=gemalto&sort=byPopularity&pref...
I think in older GSM-derived systems, the SIM just computed an authenticator based on a nonce provided by the network.
I know for sure that CDMA (IS-95 and 2000) and later AMPS systems supported one-way authentication or not, as selected by the network.
I've heard rumors that attackers have to force a protocol downgrade to something without mutual authentication by jamming the legitimate signal. The other options for the attack would seem to include
- obtaining the secret key value (or a set of authentication vectors) from the legitimate network. Either of these seems more difficult to obtain than the actual locations that the attackers claim to want.
- obtaining K from SIM manufacturers, which has happened [2].
- exploiting implementation defects in SIMs or mobiles.
[1] 3GPP/ETSI TS 133 102 "3G security: security architecture", http://www.etsi.org/deliver/etsi_ts/133100_133199/133102/13....
[2] https://hn.algolia.com/?query=gemalto&sort=byPopularity&pref...