I think it's leaked during initial registration to BTS. I'm not sure with handover, though.
There were active correlation attack if you know the phone number associated with the IMSI, you send silent SMS or silent call and repeat several times. The phone is paged and you see the TMSI.
On 9.7.2015 20:41, Radiarisainana Sitraka wrote:
I'm a student of telecommunication at Madagascar, and i make search of gsm. My problem is i want to get tmsi of some-one if i know his imsi by osmocom and motorola . Do you have any indication for that ? thank's for helping
chear sitraka,
Brmlab mailing list Brmlab@brmlab.cz https://brmlab.cz/cgi-bin/mailman/listinfo/brmlab