\n
LG U+ IMSI Issue: The IMSI Controversy and LG U+’s Hidden Security Vulnerability
Why has the International Mobile Subscriber Identity (IMSI) become a dangerous clue exposing LG U+ customers’ phone numbers? To get straight to the point, IMSI is originally a value meant solely to “identify a subscriber,” not to contain hints that can be used to infer phone numbers. However, the recent LG U+ IMSI issue began precisely because this taboo was broken due to a flawed structural design.
Why IMSI Needs to Be Secure: The Starting Point of Network Authentication
The IMSI (International Mobile Subscriber Identity) is a critical identifier used by mobile networks to distinguish and authenticate subscribers. When a user powers on their phone and connects to a network, the carrier must determine “who is this device (which subscriber)?”—and in that process, the IMSI plays a crucial role.
In other words, because IMSI is the value placed at the very first gateway of network access control and subscriber authentication, if it is exposed or becomes predictable, security risks inevitably escalate.
The Core of the LG U+ IMSI Issue: Subscriber Code Combined with Phone Numbers
The essence of this controversy is simple.
- SK Telecom and KT have strengthened security by assigning random or otherwise hard-to-predict values in IMSI’s subscriber identification segment.
- In contrast, LG U+ is known to have used a design that combines the subscriber code portion directly with the phone number.
Why is this difference so critical?
If the IMSI is exposed externally (e.g., possible leakage of identifiers in certain environments or attackers analyzing collected identifier data), the IMSI value instantly becomes a clue that can be used to infer the phone number. While a random-value structure makes meaningful backward tracing difficult even if leaked, a phone-number-combination structure creates “patterns,” and those patterns expand the attack surface.
The Explanation of “Unclear Standards” and the Remaining Structural Problem
LG U+ explained that at the initial stage of 4G adoption, international standards for IMSI generation were unclear, so they maintained the 2G-era practice. The logic behind “it was not a standards violation” stems from this point.
Yet the more realistic concern from a security perspective goes beyond “whether it was a violation.”
- When standards have loopholes, operators must design more conservatively (more securely).
- If other carriers in the same environment have adopted stronger methods based on randomness, LG U+ not only maintained but operated a more predictable identification system for a long period.
Ultimately, the LG U+ IMSI issue is not merely a configuration mistake but a case that belatedly reaffirmed the fundamental security principle that “identifiers must be designed to be unpredictable, just like proper identifiers.”
Why Does It Lead to ‘SIM Card Replacement’: IMSI Is a SIM-Based Identifier, Not Just a Device Setting
Here, many people naturally wonder, “Why not just change settings? Why replace all customers’ SIM cards?”
IMSI typically operates as an identification system linked with subscriber information inside the USIM (SIM card). Therefore, to fundamentally change the IMSI system, subscriber identity values created under the old structure must be reissued and reset to the new system, and replacing or resetting SIM cards becomes the practical solution.
This is why LG U+ is pushing a free SIM card replacement and applying IMSI randomization for all customers.
The key takeaway in this section is one thing:
This controversy is not simply about whether IMSI was leaked—it has evolved into a matter of trust and design principles because the IMSI itself was structurally designed to enable phone number inference.
LG U+ IMSI Issue: Why Is the IMSI System So Different? The Technological Gap Among Carriers
SK Telecom and KT use randomized IMSIs, so why has LG U+ held onto an IMSI structure combined with phone numbers for so long? The key question here isn’t simply about “compliance or violation” but rather about what security choices were made during ambiguous standard periods. In other words, even though all use the name IMSI, their design philosophies and risk models were fundamentally different.
What Should IMSI Originally Conceal? The ‘Identifier’ Becomes the ‘Attack Surface’
IMSI (International Mobile Subscriber Identity) is a crucial identifier used to recognize and authenticate subscribers within mobile networks. The problem is that this value is not just an internal management number—it is an identifier that can be exposed during network access processes involving various equipment and procedures.
- If IMSI is exposed externally, attackers could exploit it for scenarios such as subscriber tracking or targeted attacks against specific users.
- Especially if the IMSI contains predictable information (e.g., part or all of the actual phone number), the “identifier” turns directly into “personal data,” escalating the risk dramatically.
Hence, competitors chose a straightforward path: Don’t embed meaningful personal information within the IMSI itself—make it unpredictable through randomization.
SK Telecom & KT vs. LG U+: The Crucial Difference Between “Randomization” and “Phone Number Combination”
An IMSI typically consists of a Mobile Country Code (MCC), a Mobile Network Code (MNC), and a Mobile Subscriber Identification Number (MSIN). Differences among carriers mainly stem from how the MSIN (subscriber identifier section) is assigned.
1) Randomized IMSI (Unpredictable) — SK Telecom and KT’s Approach
- The subscriber identifier is based on random numbers, making pattern inference difficult.
- Even if an attacker obtains part of the IMSI externally, it’s very hard to reverse-engineer the phone number from that value alone.
- Essentially, their design reduces the potential damage when IMSI exposure occurs.
2) Phone Number Combined IMSI (Predictable) — LG U+’s Past Method
- Combining the actual mobile phone number within the subscriber identifier simplifies management and operations.
- However, theoretically, if the IMSI is leaked or observed, it inherently risks phone number traceability.
- This exact point is the core of the current LG U+ IMSI issue. It creates a structure where the question “Can IMSI serve as a clue to the phone number?” legitimately arises—and that’s the problem.
What Does “Standards Were Unclear” Really Mean? Legality and Security Are Not the Same
LG U+ explains that during 4G’s early days, international standards did not clearly define IMSI creation methods, and they simply extended the 2G-era approach. Two key points arise here:
1) A gap in standards is not ‘permission’ but a ‘choice’ area
Just because a standard does not prohibit something doesn’t mean that choice is optimal security design. If competitors, under the same conditions, chose a stronger method (randomization), then the difference is not about “compliance” but about a “security design philosophy.”
2) Legacy inertia (maintaining the 2G method) comes at a cost
What was initially chosen for simplicity became technical debt as subscribers grew and threat models evolved. The fact that a USIM replacement affecting 11 million users is now under discussion highlights how costly such initial design inertia can be.
What Specific Risks Increase Technically? ‘Traceability’ and ‘Mass Targeting’ Concerns
The danger of the phone number-combined structure goes beyond “phone number included or not.” In security, guessability directly influences attack difficulty.
- Pattern-Based Matching: Enables estimating number blocks, regions, or subscriber groups.
- Reduced Targeting Cost: Attackers need less info to target “specific numbers or individuals,” rather than “broad, unspecified groups.”
- Cascading Linkage Risks: When IMSI clues combine with other leaked info (names, accounts, device info), the damage escalates.
Of course, successful attacks require additional factors—but security design must prepare not for “normal conditions” but for the worst-case combinations (leakage, observation, and correlation).
Conclusion: The Essence of Technological Gap Lies Before Encryption
This LG U+ IMSI issue isn’t resolved simply by “encrypting with SUCI in 5G SA.” The real difference lies much earlier—whether unpredictability was incorporated from the design stage of the identifiers.
- SK Telecom and KT: Designed around randomization to render exposure meaningless.
- LG U+: Clung to a structure allowing phone number clues due to operational inertia, now facing large-scale transition costs.
The next section will explore how 5G SA and SUCI solve these structural problems and exactly how USIM replacement and IMSI reallocation are being carried out in practice.
LG U+ IMSI Issue: A Relic of the Past, Problems Born from the Absence of 4G Early Standards
In the early days of 4G, when international standards were unclear, LG U+ clung to outdated methods. Is this merely a simple mistake, or a fundamental limit in system design? The LG U+ IMSI issue reveals the traces of structural decision-making that cannot be swept away by the mere explanation that “it was not a regulation violation.”
Where Standards Were Empty, ‘Custom’ Became Design
The early adoption of 4G was a time of technological upheaval. The network architecture shifted from a 2G/3G focus to LTE (4G), but not every detail was meticulously defined in international standard documents. Especially for operational and design-linked areas like the IMSI (International Mobile Subscriber Identity) generation and assignment method, the absence of clear prohibitions made it easy to transplant old customs intact.
According to LG U+, the choice to continue the 2G-era method (phone number-based composition) into early LTE was a decision to “fill the regulatory void with custom.” The issue is that this void represented not freedom but responsibility.
The Dangerous Structure Created by IMSIs Embedding Phone Numbers
IMSI is not merely an identifier—it is a critical key that authenticates subscribers and controls access within mobile networks. Typically, an IMSI consists of:
- Mobile Country Code (MCC)
- Mobile Network Code (MNC)
- Mobile Subscriber Identification Number (MSIN)
The core question lies in how the subscriber identification area is assigned. While competitors designed this part using unpredictable random numbers to make it difficult to reverse-engineer user information solely from the IMSI, LG U+ revealed it had been using a method directly combining phone numbers.
The danger of this structure is clear:
- If there is any path where the IMSI is exposed externally, attackers can analyze IMSI patterns to estimate a specific subscriber’s phone number.
- This design creates a link (inferability) from IMSI to personal identifying information.
- In other words, even if no actual incident has yet occurred, the design itself expanded the attack surface.
The gravest security flaw is not “has it been breached now?” but “has it been designed to be vulnerable?” This is exactly why the LG U+ IMSI issue draws criticism.
Why “It Was Not a Violation” Fails as an Explanation
During a time when standards were ambiguous, there were two choices:
1) Continue the legacy method to reduce operational risk.
2) Proactively adopt a stronger security design from the start.
LG U+ leaned toward option 1), while other operators went closer to option 2)—a difference that ultimately underpins the controversy. Security is never about meeting the minimum standards. As soon as a standard remains a ‘minimum,’ operators must strengthen their design by modeling threats and anticipating worst-case scenarios tailored to their environment.
In the end, this issue is not simply about “there were no early standards” but reflects systemic limitations such as:
- Decision-making with low prioritization of security when filling the gaps
- Legacy lock-in, which forces long-term maintenance of initially established systems
- Violation of fundamental principles in designing personal identification information that renders the logic of “there was no problem” untenable
Legacy Remains Not Just Technology but a ‘Cost Structure’
Why has it been so difficult to change until now? The IMSI system is not simply a numeric rule—it is deeply intertwined with USIM issuance and replacement, subscriber management, authentication, billing, and overall network operations. Once established, changing it triggers massive customer impact, operational costs, and system risks.
This makes a far more important lesson clear: in security design, initial choices are not something you can “fix later”; rather, the likelihood of being unable to fix them later is very high. The LG U+ IMSI issue is less a matter of technical flaw and more a case showing how legacy becomes absorbed into an organization’s cost structure, forming an “inertia of change that is nearly impossible to overcome.”
LG U+ IMSI Issue: Are 5G Standalone Mode and SUCI Transition the Fundamental Solution?
Can LG U+’s transition to 5G Standalone mode (SA) and the IMSI encryption technology called SUCI truly “shut down” the structural vulnerabilities that have been pointed out so far? To conclude upfront, the direction is correct. However, understanding the segment where SUCI is applied separately from the scope addressed by SIM replacement/randomization is essential to grasp the true nature of this solution.
The Heart of LG U+ IMSI Issue: Does It Break the “Traceable Upon Exposure” Structure?
The reason the LG U+ IMSI issue raised concerns is not merely because IMSI itself is sensitive information. If part of the IMSI is combined with the phone number, theoretically, the subscriber’s actual number can be inferred if the IMSI is obtained.
In other words, the key point is “how much damage occurs once IMSI is leaked,” and the countermeasures must be designed to either no longer expose the IMSI (encryption) or render it meaningless even if exposed (randomization).
First Pillar of LG U+ IMSI Issue Response: What SUCI Does in 5G SA (Technically Speaking)
SUCI (Subscriber Concealed Identifier) is an identifier protection mechanism introduced in 5G that requires the device to send the IMSI (SUPI) not in plaintext but in an encrypted form (SUCI) when initially connecting to the network.
The technically significant points are:
- Protected segment: It significantly reduces exposure during the process of “presenting initial identification information” between the device and the base station/core network.
- Operation method: The device (SIM/USIM) encrypts the subscriber identifier into SUCI using the operator’s public key, and the network decrypts it with a private key to verify the subscriber.
- Effect: Even if an attacker collects identifiers over the air interface or initial authentication phase, gathering and analyzing plain IMSIs as done in the past becomes very difficult.
In summary, SUCI is closer to a design that does not leak IMSI in the first place. Therefore, as the transition to 5G SA progresses, it structurally reduces the impact of issues like the current one.
Second Pillar of LG U+ IMSI Issue Response: The Meaning of Free SIM Replacement + IMSI Randomization
The free SIM replacement for all customers and the new IMSI system (subscriber code randomization) announced by LG U+ serve a different role from SUCI.
This measure is crucial to ensure that when IMSI is observed or stored via any route, the value no longer serves as a clue connected to a phone number.
- Randomization effect: Removing phone number regularities within the IMSI drastically lowers the possibility of backtracking the phone number from an IMSI.
- Why SIM replacement is necessary: IMSI and related subscriber authentication data are typically linked to the SIM (USIM/eSIM profile). Changing the system requires issuing new profiles/SIMs or resetting procedures.
- Advantage of immediacy: Even before SA commercialization (and 100% SUCI application), randomization can be an emergency remedy that first lowers the “risk inherent in the IMSI value itself.”
However, practically, until all customers complete replacement, the old and new systems must coexist, and the longer this transition lasts, the more challenging management becomes (customer guidance, system compatibility, handling exceptions).
LG U+ IMSI Issue Perspective Conclusion: “Perfect Blocking” Is Possible Under Conditions
SUCI and randomization block threats at different levels.
- SUCI (5G SA): Hides IMSI “during transmission,” reducing the attack surface based on collection and eavesdropping
- IMSI randomization (SIM replacement): Eliminates the possibility of inferring phone numbers “based on the value” of the IMSI
Thus, the two must go hand in hand to approach a “fundamental solution.”
However, the term “perfect blocking” comes with conditions:
- Is the 5G SA transition sufficiently advanced to ensure widespread real-world application of SUCI?
- Is SIM replacement/reset done at a high rate to rapidly reduce phone-number-linked IMSIs in the market?
- During the transitional period before replacement is complete, are consistent security policies and monitoring maintained even with old devices/legacy network configurations?
Ultimately, while the countermeasures are technically sound, success hinges less on “technology introduction” and more on the speed of transition and operational completeness.
LG U+ IMSI Issue: The Bright and Dark Sides of Strengthening Security and Taking Preemptive Measures
Is LG U+’s recent security measure enough to restore trust? The LG U+ IMSI issue is less about whether an incident has just occurred and more about how the identifier’s design has accumulated risks over time. While the free replacement of all customer SIM cards and security enhancements based on 5G SA are certainly bold steps, several conditions must still be met before these actions can be acknowledged as a complete resolution.
Positive Signals from the LG U+ IMSI Issue: A Declaration to Fix the System
This response is significant not simply because of configuration changes, but because it involves redesigning the identification system itself.
- Applying IMSI randomization: By changing the subscriber code area from being phone number-based to random number-centered, the structural possibility of deducing phone numbers from IMSI is fundamentally lowered.
- Free replacement of all customer SIM cards: By targeting the entire customer base—not just some users or new subscribers—LG U+ is making the most decisive security move. Partial replacements leave residual risks with identification issues.
- Mandatory 100% application of SUCI in 5G SA: The technical core is “not transmitting the IMSI directly to the network.” SUCI enables the device to generate an encrypted identifier from the IMSI, which is transmitted and then decrypted or mapped to verify the subscriber only within the network. Thus, even if identifiers are gathered over the wireless segment, the original IMSI itself becomes extremely hard to obtain—this is the essence of 5G security design.
In summary, taking on both the “weakness in IMSI design” and “exposure over the wireless segment” simultaneously is clearly a preemptive approach.
The Shadow Left by the LG U+ IMSI Issue: ‘Technical Fixes’ and ‘Restoring Trust’ Are Different
However, in security, trust cannot be regained by technology alone. Especially in this case, the debate often focuses less on standards compliance and more on how quickly best security practices were adopted.
1) Accountability for design choices maintained over a long period
The explanation that “early 4G standards were unclear” helps argue non-violation of regulations, but from the user’s perspective, it leaves the question: “Why wasn’t a safer choice made earlier?” Security is often judged not by avoiding prohibited actions but by efforts to reduce possible risks.
2) Risks of implementing a solution at the scale of 11 million users (Operations, Fieldwork, User Experience)
The free SIM replacement for all customers isn’t just a declaration; real bottlenecks include:
- SIM supply and handling capacity at dealerships and onsite
- Designing customer visit and delivery channels (including the elderly and vulnerable populations)
- Managing residual risks from customers delayed in replacement
- Ensuring safe identity verification and re-authentication during replacement (addressing proxy receipt and social engineering attacks)
In other words, the standard of trust lies not in “deciding to change” but in “how quickly and safely the change was executed.”
3) Potential delay in covering all users immediately under 5G SA and SUCI
SUCI requires alignment between the 5G SA network, device, USIM, and configuration settings for proper operation. In reality, environments such as LTE/NSA, older devices, or certain roaming/additional service conditions mean full adoption will take time. Therefore, during this transitional phase, the randomized IMSI system and operational policies remain the core defensive security lines.
The Warning from the LG U+ IMSI Issue to the Telecom Industry: “Identifiers Are Attack Surfaces”
This incident sends a message beyond LG U+ to the entire telecom industry:
- Identifier design must prioritize privacy over convenience. Embedding values directly linked to real-world identities, like phone numbers, inside identifiers can turn even minor leaks into major damages.
- Standard gaps present the greatest risks. Where something is “not explicitly forbidden,” the security depends heavily on the designer’s judgment. Ultimately, competitive gaps may appear less technical and more decision-driven.
- True security is “sustained operation,” not reactive fixes. The free SIM replacement program must not end as a one-time event but requires ongoing management adapting to changes in residual customers, new users, device replacements, roaming, and other use cases.
In the end, the conclusion of the LG U+ IMSI issue lies not in whether actions were taken, but how thoroughly these actions are implemented and how transparently transitional risks are managed. Whether this response becomes the starting point for restoring trust or is remembered as a late patch depends entirely on the operations going forward.
Comments
Post a Comment