MSISDN - Subscriber...
 
Notifications
Clear all

MSISDN - Subscriber phone number

8 Posts
4 Users
0 Likes
3,262 Views
(@beish)
Posts: 6
Active Member
Topic starter
 

Hello,
i know that Mobile Subscriber International ISDN Number (MSISDN) is a number that identifies the phone number used by the headset.

Question Is there a safe way (by using UFED Cellebrite) to determine the phone number from the SIM card except asking for this number from the telecom provider (providing IMSI and ICCID).

In several cases the report from UFED Cellebrite shows one MSISDN phone number but checking that info with telecom provider we received different phone number for same SIM card.

 
Posted : 16/08/2017 12:51 am
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
 

3GPP TS (Technical Standard) 31.102 shows an EF Elementary File MSISDN which resides on the USIM Universal SIM, go to page 44 to see yourself

http//www.etsi.org/deliver/etsi_ts/131100_131199/131102/14.03.00_60/ts_131102v140300p.pdf

 
Posted : 16/08/2017 1:23 am
(@trewmte)
Posts: 1877
Noble Member
 

Based upon the question you are posing….some observations

MSISDN can be problematical as the MSISDN elementary file's content may be changed by the user. Some commands issued via the handset keys may reveal internal memory but can be difficult if the handset is drawing information directly form the U/SIM MSISDN-EF?

The incident knowledge you seek MIGHT NOT be determined via the U/SIM itself but what activity has occurred on the seized handset associated with the seized U/SIM. You can look to 'My Profile' in Contacts, or in Contacts 'Own Number' etc., to see what number is recorded there?

Also check the phonebook/EF-ADN, as some people record their own number as an 'aid-memoire'. Also worth checking any SMS text messages etc.?

Where MSISDN MIGHT be obtained, if the handset uses one U/SIM containing more than one IMSI/MSISDN or uses two U/SIMs (two IMSIs) then on a seized handset switch between accounts/networks may reveal traces in the handset (this is NOT forensic) that is user accessible from the handset?

Certain mobile operators have a *# number # that when used with a U/SIM inserted into a clean handset, dial the *# number # and press 'send'; some networks may identify the MSISDN number (this is NOT a forensic process), so you have got to know what you are doing?

Another but non-forensic test is using the target U/SIM in a clean handset to call a lab mobile number (without being answered) to reveal the CLI (Caller Line Identification) of the seized U/SIM (IMSI) on the test handset (again, you have got to know what you are doing)?

Lastly, if you seized the handset associated with the seized U/SIM a JTAG/Chip off dump may reveal MSISDN in physical memory used with the seized handset.

PS - don't shoot the messenger

 
Posted : 16/08/2017 3:31 am
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
 

Thank you trewmte, good that you are the expert.

 
Posted : 16/08/2017 12:56 pm
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
 

The codes are called Unstructured Supplementary Service Data USSD and are different by operator (e.g. *130*125# Swisscom).

 
Posted : 16/08/2017 1:25 pm
(@beish)
Posts: 6
Active Member
Topic starter
 

Thank you for your answers, very helpfull.

I was aware that people insert their own number in contacts list, also phone number can be find in viber app in contacts–>My Number but i can't claim that it is a precise number from the SIM card.

As i said in first post that in several cases the report from UFED Cellebrite shows one MSISDN phone number but checking that info with telecom provider we received different phone number for same SIM card.

The only certain way getting exact phone number is by dialing lab mobile number but as you mr. trewmte said non-forensic.

 
Posted : 17/08/2017 12:43 am
SamBrown
(@sambrown)
Posts: 97
Trusted Member
 

The problem is that the MSISDN is only stored on some SIM cards, not on every SIM. And, as you noted if there actually is a MSISDN, it might not be the current number. That's, because the user ported a different phone number into this current contract.

So no, in many cases you cannot determine the phone number from the device/sim card itself but you have to resort to other methods.

I always check for the WhatsApp Phone number, keeping in mind that this might be an entirely different number.
There are also certain USSD-Codes you can run if you put the SIM into another phone
*#62# gives you the number of the mailbox where the call is routed if the user is unreachable. Often, this number is almost identical to the real phone number. Some providers just insert 33 or 99 between the prefix and the last part of the number (at least in Germany).
Also, some providers have specific codes to show the number, like *135# for Telekom Germany, *132# for Lycamobile Germany.

For Germany, i also know a toll free number I can call using the SIM even if it has no credit which will then automatically read the phone number to me.

 
Posted : 24/08/2017 6:51 am
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
 

Pls post the toll free number to get the MSISDN because it would be interesting where this will geht the data for all operators from (inter-operator or foreign country reverse in-calling).

 
Posted : 24/08/2017 10:04 am
Share: