← Back to Logs
27-07-2026

How IMSI Catchers and Rogue Cell Towers Intercept Phones

cellular-securityimsi-catcherstingraygsm-encryptionmobile-surveillance
Try the interactive lab for this articleTake the quiz (6 questions)

Cellular network security depends heavily on protocol specifications negotiated over unencrypted radio channels before mutual authentication completes. Mobile handsets are engineered to continuously discover, evaluate, and attach to base stations offering the highest signal quality and priority. When an unauthorized transmitter impersonates a legitimate base station, it exploits fundamental architectural mechanisms built into cellular standards from 2G GSM through 4G LTE and 5G Non-Standalone networks.

Cell-site simulators, commercially referred to under trade names such as StingRay, Septier Guardian, or Rohde & Schwarz Neumann, function by operating as rogue base stations (RBS). By manipulating broadcast system information and transmitting at high power levels, these devices force target mobile User Equipment (UE) to disconnect from commercial carrier networks and camp on the rogue cell. Once attached, the rogue tower can extract permanent subscriber identity numbers, calculate physical geographic locations, grab hardware serial numbers, or force network downgrades to capture unencrypted voice and SMS data.

Understanding the mechanics of rogue base station interception requires dissecting the cellular Radio Access Network (RAN), physical layer measurement algorithms, protocol downgrade vectors, Layer 3 identity extraction frames, timing advance multi-lateration, baseband diagnostic logs, and modern cryptographic defenses introduced in 5G Standalone networks.

1. Cellular Radio Access Network (RAN) Mechanics

A mobile station cannot maintain a fixed connection to a single cell tower while moving. The Radio Access Network (RAN) relies on standardized algorithms executed by the mobile device modem to constantly evaluate candidate cells. The formal rules governing cell selection and reselection are defined in 3GPP TS 43.022 for GERAN (GSM), TS 36.304 for E-UTRA (LTE), and TS 38.304 for 5G NR.

Cell Selection: S-Criterion and Quality Thresholds

When a handset powers on or loses coverage, it performs an initial cell selection scan across supported frequency bands. The device measures physical layer signal metrics of detected carriers and evaluates two distinct cell selection criteria: the signal level criterion ($S_{rxlev}$) and the signal quality criterion ($S_{qual}$). A cell is deemed candidate-suitable if both calculated values are strictly greater than zero.

The signal level selection criterion $S_{rxlev}$ is defined in 3GPP TS 36.304 as:

$$S_{rxlev} = Q_{rxlevmeas} - (Q_{rxlevmin} + Q_{rxlevminoffset}) - P_{compensation} - Q_{offset_{temp}}$$

Where:

  • $Q_{rxlevmeas}$ is the measured Reference Signal Received Power (RSRP) in dBm at the UE receiver.
  • $Q_{rxlevmin}$ is the minimum required RSRP level in dBm broadcast by the base station inside System Information Block 1 (SIB1). Typical operator values range from -120 dBm to -110 dBm.
  • $Q_{rxlevminoffset}$ is an optional offset parameter used to prevent ping-ponging when monitoring visited Public Land Mobile Networks (PLMNs).
  • $P_{compensation}$ is an adjustment factor in dB derived from the difference between the maximum transmit power allowed for the cell ($P_{EMAX}$) and the maximum RF output power capability of the UE modem ($P_{UMAX}$):

$$P_{compensation} = \max(P_{EMAX} - P_{UMAX}, 0)$$

  • $Q_{offset_{temp}}$ is a temporary offset applied during specific evaluation states.

In networks configured for quality-based selection, the signal quality selection criterion $S_{qual}$ must also evaluate to a positive number:

$$S_{qual} = Q_{qualmeas} - (Q_{qualmin} + Q_{qualminoffset}) - Q_{offset_{temp}}$$

Where:

  • $Q_{qualmeas}$ is the measured Reference Signal Received Quality (RSRQ) in dB.
  • $Q_{qualmin}$ is the minimum required RSRQ level in dB broadcast in SIB1 (typically -19.5 dB to -14 dB).
  • $Q_{qualminoffset}$ is an offset parameter in dB applied to visited PLMNs.

The relationship between RSRP, RSRQ, and the total Received Signal Strength Indicator (RSSI) is governed by the structural allocation of Orthogonal Frequency Division Multiplexing (OFDM) resource elements:

$$RSRQ = rac{N imes RSRP}{RSSI}$$

Where $N$ represents the number of Resource Blocks (RBs) spanning the measurement bandwidth (for example, $N = 50$ for a 10 MHz LTE channel or $N = 100$ for a 20 MHz LTE channel). While RSRP measures only the average power of dedicated Reference Signals across the channel bandwidth, RSSI incorporates all thermal noise, co-channel interference, and active payload subcarriers. Rogue base stations exploit this relationship by transmitting unmodulated or heavily amplified pilot signals to maximize both RSRP and RSRQ while suppressing noise figures.

If both $S_{rxlev} > 0$ and $S_{qual} > 0$, and the candidate cell satisfies administrative checks (such as matching an allowed PLMN ID and not broadcasting a barred status flag), the UE modem terminates scanning and initiates attachment procedures.

Cell Reselection and R-Criterion Parameters

When the handset operates in an Idle state (RRC_IDLE), it constantly measures neighboring base stations to determine whether a higher quality serving cell exists. Cell reselection algorithms employ ranking criteria ($R$-criteria) to balance battery consumption against transition speed while avoiding rapid toggling between adjacent cells.

For the current serving cell $s$, the ranking score $R_s$ is calculated as:

$$R_s = Q_{meas,s} + Q_{hyst}$$

For a candidate neighbor cell $n$, the ranking score $R_n$ is calculated as:

$$R_n = Q_{meas,n} - Q_{offset,n} - Q_{offset_{temp}}$$

Where:

  • $Q_{meas,s}$ and $Q_{meas,n}$ represent the measured RSRP or RSRQ values of the serving and candidate neighbor cells.
  • $Q_{hyst}$ provides a hysteresis margin in dB broadcast in SIB3, preventing the modem from switching between two cells transmitting identical power levels.
  • $Q_{offset,n}$ specifies an offset applied to specific neighbor frequency channels broadcast in SIB5 (Q-OffsetFrequency).

If a candidate neighbor cell maintains a ranking score $R_n > R_s$ continuously throughout a duration defined by the parameter $T_{reselection}$ (typically configured between 1 and 2 seconds), the handset modem executes cell reselection and tunes its RF front-end to the new carrier frequency.

System Information Block (SIB) Broadcast Structure

Base stations broadcast operational parameters periodically over logical control channels. In LTE and 5G NR, these parameters are structured into a Master Information Block (MIB) transmitted on the Physical Broadcast Channel (PBCH) and multiple System Information Blocks (SIBs) scheduled on the Physical Downlink Shared Channel (PDSCH).

+-----------------------------------------------------------------------+
|                       Broadcast Channel (BCH)                         |
+-----------------------------------------------------------------------+
                                    |
            +-----------------------+-----------------------+
            |                                               |
+-----------------------+                       +-----------------------+
|  Master Information   |                       | System Information    |
|      Block (MIB)      |                       |     Block 1 (SIB1)    |
+-----------------------+                       +-----------------------+
| - System Frame Number |                       | - PLMN Identity List  |
| - Channel Bandwidth   |                       | - Tracking Area Code  |
| - PHICH Config        |                       | - Cell Identity       |
| - Transmit Antennas   |                       | - Cell Barred Flag    |
+-----------------------+                       | - q-RxLevMin          |
                                                +-----------------------+
                                                            |
                        +-----------------------+-----------+-----------+-----------------------+
                        |                       |                       |                       |
            +-----------------------+ +-----------------------+ +-----------------------+ +-----------------------+
            |          SIB2         | |          SIB3         | |          SIB4         | |          SIB5         |
            +-----------------------+ +-----------------------+ +-----------------------+ +-----------------------+
            | - RACH Config         | | - Cell Reselection    | | - Intra-Frequency     | | - Inter-Frequency     |
            | - PDSCH/PUSCH Parameters| |   Priority            | |   Neighbor Cell List  | |   Carrier Frequencies |
            | - Sounding RS Setup   | | - s-IntraSearch       | | - Blacklisted Cells   | | - E-UTRA EARFCN List  |
            +-----------------------+ +-----------------------+ +-----------------------+ +-----------------------+

The Master Information Block (MIB) provides basic physical layer parameters required to demodulate remaining downlink channels, including system bandwidth, Physical Hybrid-ARQ Indicator Channel (PHICH) configuration, and System Frame Number (SFN) bits.

System Information Block 1 (SIB1) carries administrative and cell-selection parameters. Its ASN.1 syntax layout defines critical fields parsed by the modem:

SystemInformationBlockType1 ::= SEQUENCE {
    cellAccessRelatedInfo SEQUENCE {
        plmn-IdentityList          PLMN-IdentityList,
        trackingAreaCode           TrackingAreaCode,
        cellIdentity               CellIdentity,
        cellBarred                 ENUMERATED {barred, notBarred},
        intraFreqReselection       ENUMERATED {allowed, notAllowed},
        csg-Indication             BOOLEAN
    },
    cellSelectionInfo SEQUENCE {
        q-RxLevMin                 Q-RxLevMin,             -- dBm (-70..-22) * 2
        q-RxLevMinOffset           INTEGER (1..8) OPTIONAL
    },
    p-Max                          P-Max OPTIONAL,         -- Maximum UE Transmit Power
    freqBandIndicator              FreqBandIndicator,
    schedulingInfoList             SchedulingInfoList,
    ...
}

The plmn-IdentityList inside SIB1 contains Mobile Country Codes (MCC) and Mobile Network Codes (MNC). For example, a base station in Germany broadcasting MCC 262 and MNC 01 advertises itself as a Telekom Deutschland network node. The handset checks this list against the home PLMN stored on its USIM. If a match occurs, administrative validation passes.

Subsequent SIB messages carry specialized radio resource and reselection control configurations:

  • SIB2: Common and shared channel configurations, Random Access Channel (RACH) preambles, uplink power control parameters, and Sounding Reference Symbol (SRS) setups.
  • SIB3: Cell reselection information common to intra-frequency, inter-frequency, and inter-RAT cell reselection, including cellReselectionPriority, s-IntraSearch, s-NonIntraSearch, and q-Hyst.
  • SIB4: Intra-frequency neighbor cell lists, individual cell offsets, and blacklisted cell vectors.
  • SIB5: Inter-frequency carrier lists, explicit E-UTRA Absolute Radio Frequency Channel Numbers (EARFCN), inter-frequency reselection priorities, and q-OffsetFreq values.

2. Rogue Base Station Architecture and Operation

Rogue Base Stations (RBS) exploit the asymmetry of cellular cell selection by actively broadcasting identical PLMN identities while artificially manipulating RF power levels, channel priorities, and SIB parameters.

RF Hardware Frontend and Transceiver Design

A modern cell-site simulator integrates specialized radio frequency hardware capable of generating stable cellular downlink channels while processing faint uplink signals from distant UEs.

+---------------------------------------------------------------------------------+
|                              Host Baseband Controller                           |
|                    (srsRAN / Open5GS RRC + NAS Protocol Engine)                |
+---------------------------------------------------------------------------------+
                                         |
                                 (USB 3.0 / PCIe)
                                         v
+---------------------------------------------------------------------------------+
|                             SDR Board (USRP B210)                               |
|        +-----------------------+             +-----------------------+          |
|        | Tx DAC (AD9361 Core)  |             | Rx ADC (AD9361 Core)  |          |
|        +-----------------------+             +-----------------------+          |
+---------------------------------------------------------------------------------+
                    |                                     ^
                    v                                     |
         +--------------------+                 +-------------------+
         | High-Power PA      |                 | Low-Noise Amp     |
         | (+37 dBm RF Output)|                 | (LNA +20 dB Gain) |
         +--------------------+                 +-------------------+
                    |                                     |
                    +------------------+------------------+
                                       |
                                +--------------+
                                | RF Duplexer  |
                                +--------------+
                                       |
                                       v
                             +-------------------+
                             | Directional Panel |
                             | Antenna Array     |
                             +-------------------+

The system hardware comprises four key operational subsystems:

  1. Software-Defined Radio (SDR) Transceiver: Commercial platforms such as the Ettus Research USRP B210, USRP N310, or LimeSDR rely on integrated RF transceivers like the Analog Devices AD9361 or AD9364. These direct-conversion (Zero-IF) chips operate across frequency ranges from 70 MHz to 6 GHz with tunable channel bandwidths between 200 kHz and 56 MHz. The transceiver handles analog-to-digital conversion (ADC), digital-to-analog conversion (DAC), IQ imbalance calibration, and DC offset cancellation.
  2. Clock Synchronization and Oscillators: Cellular base stations require tight frequency accuracy to prevent subcarrier inter-symbol interference and carrier frequency offsets (CFO). While low-cost SDRs feature standard Temperature-Compensated Crystal Oscillators (TCXO) with frequency stability around 0.5 to 2.0 parts per million (ppm), professional rogue stations incorporate GPS-Disciplined Oscillators (GPSDO) or Rubidium atomic clocks achieving stabilities better than 0.001 ppm (1 part per billion). High clock stability ensures that the generated downlink signal stays well within 3GPP carrier frequency error limits ($\le \pm 0.05 ext{ ppm}$ for macrocells), preventing modern UEs from rejecting the cell due to frequency drift.
  3. Power Amplification and RF Filtering: SDR outputs are low-power signals (typically -10 dBm to +10 dBm). Rogue base stations pass the transmit path through linear Power Amplifiers (PAs) to boost RF output power to levels ranging from +30 dBm (1 Watt) for portable units up to +47 dBm (50 Watts) for vehicle-mounted units. To operate in Frequency Division Duplex (FDD) modes where transmission and reception occur simultaneously over distinct frequency bands, high-isolation cavity duplexers are deployed. Duplexers provide $> 80 ext{ dB}$ isolation between the high-power transmit path and the sensitive Low-Noise Amplifier (LNA) receive path, preventing receiver saturation while maintaining a low noise figure ($NF < 2.5 ext{ dB}$).
  4. Directional Antenna Arrays: High-gain panel antennas or log-periodic dipole arrays (LPDA) concentrate radiated power toward target geographical sectors, creating localized power dominance without triggering immediate network-wide interference alerts on surrounding macrocells.

Software Stack Architecture and Protocol Layer Processing

The baseband computer executes software stacks modified from open-source projects such as srsRAN, OsmocomBB, Open5GS, or OpenAirInterface. The software architecture implements the complete 3GPP protocol stack:

+---------------------------------------------------------------------------------+
|                       Non-Access Stratum (NAS) Layer                            |
|             (EMM/MM State Machine, Identity Request Processing)                 |
+---------------------------------------------------------------------------------+
                                         |
+---------------------------------------------------------------------------------+
|                    Radio Resource Control (RRC) Layer                           |
|          (MIB/SIB Generation, Paging, Connection Setup/Release)                 |
+---------------------------------------------------------------------------------+
                                         |
+---------------------------------------------------------------------------------+
|               Packet Data Convergence Protocol (PDCP) Layer                     |
|                   (Ciphering Bypassed / Integrity Disabled)                     |
+---------------------------------------------------------------------------------+
                                         |
+---------------------------------------------------------------------------------+
|                     Radio Link Control (RLC) Layer                              |
|                    (Unacknowledged / Acknowledged Modes)                        |
+---------------------------------------------------------------------------------+
                                         |
+---------------------------------------------------------------------------------+
|                     Media Access Control (MAC) Layer                            |
|                     (Scheduling, Multiplexing, HARQ)                            |
+---------------------------------------------------------------------------------+
                                         |
+---------------------------------------------------------------------------------+
|                        Physical (PHY) Layer DSP                                 |
|            (OFDM Modulation/Demodulation, Turbo/LDPC Coding)                    |
+---------------------------------------------------------------------------------+

In an authentic base station, lower layers enforce cryptographic integrity protection and ciphering initialized during the Authentication and Key Agreement (AKA) procedure. A rogue base station stack alters this behavior by injecting custom control logic at the RRC and NAS layers:

  • Authentication Bypass: Disables mutual authentication requirements, causing the fake eNodeB/gNodeB to accept incoming attach requests without validating credentials with an authentic Home Subscriber Server (HSS) or Unified Data Management (UDM).
  • Custom Frame Injection: Allows operators to construct raw RRC and NAS frames with arbitrary Information Elements, overriding default parameter checks.
  • System Information Encoding: Dynamically alters MIB and SIB parameters generated by the RRC layer to force nearby handsets to select the rogue cell over legitimate commercial carriers.

Power Injection and Parameter Spoofing Tactic

Commercial macrocell base stations broadcast reference signals calibrated across wide sector coverage areas. To capture target UEs, an IMSI catcher scans local radio frequencies to identify active Absolute Radio Frequency Channel Numbers (ARFCN or EARFCN), Mobile Country Codes (MCC), Mobile Network Codes (MNC), and Tracking Area Codes (TAC) used by legitimate operators.

Once configured, the rogue station executes two synchronized tactics:

  1. RSRP Overpowering: The rogue station boosts its Reference Signal Received Power ($Q_{meas,n}$) so that it arrives at the target handset antenna 15 dB to 30 dB higher than the authentic carrier macrocell.
  2. SIB Parameter Manipulation: The rogue station broadcasts engineered parameters inside SIB1 and SIB3:
    • Sets $Q_{rxlevmin}$ to extremely low values (for example, -140 dBm), making the rogue cell appear exceptionally stable even under weak reception.
    • Sets cellReselectionPriority in SIB3 to the maximum integer value of 7, while forcing adjacent carrier priorities in SIB5 to 0.
    • Sets q-Hyst to 0 dB, removing hysteresis buffering.
    • Sets s-IntraSearch and s-NonIntraSearch to 0 dB, instructing the handset modem to immediately cease evaluating alternative intra-frequency and inter-frequency neighbor cells.

When nearby handsets calculate the $R$-criterion algorithm, the candidate score $R_{rogue}$ significantly exceeds the serving carrier score $R_{legitimate}$. The handset modem immediately drops its active carrier connection and initiates RRC signaling with the rogue base station transceiver.

3. Cellular Protocol Downgrade Attacks

While modern 4G LTE and 5G networks deploy mutual authentication protocols to secure the air interface, early 2G GSM networks do not authenticate the network to the mobile station. To inspect payload traffic or extract identity parameters unhindered by 4G/5G encryption, rogue base stations execute protocol downgrade sequences to force target devices down to 2G GSM channels.

2G GSM Frame Structure and Logical Channels

Understanding GSM downgrade mechanics requires examining the 2G physical layer structure defined in 3GPP TS 45.002. GSM relies on a hybrid Combination of Frequency Division Multiple Access (FDMA) and Time Division Multiple Access (TDMA).

The GSM time hierarchy organizes radio bursts into strict frame structures:

  • Bit Period: The basic time unit $T_{bit} = rac{15}{3.6923 imes 10^5 ext{ Hz}} pprox 3.6923 ext{ }\mu ext{s}$.
  • Timeslot: Consists of 156.25 bit periods, lasting $576.9 ext{ }\mu ext{s}$.
  • TDMA Frame: Comprises 8 timeslots (numbered 0 through 7), lasting $4.615 ext{ ms}$.
  • Control Multiframe: Comprises 51 TDMA frames ($235.36 ext{ ms}$), carrying logical control channels such as the Broadcast Control Channel (BCCH), Frequency Correction Channel (FCCH), Synchronization Channel (SCH), Paging Channel (PCH), and Access Grant Channel (AGCH).
  • Traffic Multiframe: Comprises 26 TDMA frames ($120 ext{ ms}$), carrying dedicated voice and data Traffic Channels (TCH).
  • Superframe: Comprises 51 traffic multiframes or 26 control multiframes (6.12 seconds / 1326 TDMA frames).
  • Hyperframe: Comprises 2048 superframes (3 hours, 28 minutes, 53.76 seconds / 2,715,648 TDMA frames). The frame number within the hyperframe ($FN$) drives the initialization vector for GSM encryption ciphers.

GSM defines five distinct physical burst types:

  1. Normal Burst (NB): Carries payload data and control signaling. Contains two 57-bit data payloads separated by a 26-bit training sequence and 2 stealing flags.
  2. Frequency Correction Burst (FB): Transmits 142 consecutive zero bits, generating a pure unmodulated sine wave offset by 67.7 kHz above the carrier frequency to allow UEs to calibrate local oscillators.
  3. Synchronization Burst (SB): Transmits a extended 64-bit training sequence and frame number ($FN$) parameters to synchronize modem TDMA timing.
  4. Access Burst (AB): Used by UEs for initial random access attempts, featuring a large 41-bit guard time to accommodate unknown propagation delays.
  5. Dummy Burst (DB): Transmitted on idle timeslots to maintain constant RF power density on the BCCH carrier.

RRC Connection Redirection Protocol Sequences

When a handset sends an RRCConnectionRequest to attach to a rogue 4G or 5G cell, the rogue station accepts the physical layer handshake but immediately issues an RRCConnectionRelease message configured with redirection instructions.

The ASN.1 frame structure of RRCConnectionRelease populated by a rogue station highlights the redirectedCarrierInfo Information Element:

RRCConnectionRelease-r8-IEs ::= SEQUENCE {
    releaseCause                    ReleaseCause (other),
    redirectedCarrierInfo           RedirectedCarrierInfo ::= CHOICE {
        geran                       ARFCN-ValueGERAN ::= 612, -- Forced 2G ARFCN
        utra-FDD                    ARFCN-ValueUTRA-FDD OPTIONAL,
        eutra                       ARFCN-ValueEUTRA OPTIONAL
    },
    idleModeMobilityControlInfo     IdleModeMobilityControlInfo OPTIONAL,
    ...
}

By populating redirectedCarrierInfo with a specific GERAN ARFCN in the 900 MHz (P-GSM/E-GSM) or 1800 MHz (DCS) frequency bands, the rogue base station terminates the LTE RRC connection and commands the target handset modem to immediately tune its synthesizer to the designated 2G frequency channel.

NAS Reject Code Exploitation

If a target handset modem is configured to prioritize 4G LTE and attempts to reconnect to surrounding LTE cells rather than obeying the redirection order, the rogue station uses unauthenticated Non-Access Stratum (NAS) Mobility Management reject messages to alter internal USIM state flags.

When the handset transmits a NAS Attach Request or Tracking Area Update (TAU) Request, the rogue station returns an Attach Reject or TAU Reject message containing specific Evolved Packet System Mobility Management (EMM) cause codes defined in 3GPP TS 24.301:

UE Modem (Handset)                                         Rogue 4G Base Station
        |                                                            |
        |------------------- RRC Connection Request ----------------->|
        |<------------------ RRC Connection Setup -------------------|
        |                                                            |
        |------------------- NAS Attach Request -------------------->|
        |                                                            |
        |<------------------ NAS Attach Reject ----------------------|
        |                    (EMM Cause #7: EPS Not Allowed)         |
        |                                                            |
   [UE disables 4G]                                                  |
   [Initiates 2G Scan]                                               |
        |                                                            |
        v                                                            v
UE Modem (Handset)                                         Rogue 2G Base Station
        |                                                            |
        |------------------- 2G BCCH Frequency Tune ---------------->|
        |------------------- Channel Request (RACH) ---------------->|
        |<------------------ Immediate Assignment -------------------|
        |                                                            |

The rogue station selects cause codes engineered to force radio technology fallbacks:

  • EMM Cause #2 (IMSI unknown in HSS): Forces the modem to mark the current USIM state as invalid. The modem halts 4G operations until a reboot or SIM re-insertion occurs.
  • EMM Cause #3 (Illegal UE): Informs the modem that its network identity is rejected by the core network, causing the modem to clear local LTE tracking area caches and drop to lower radio access technologies.
  • EMM Cause #6 (Illegal ME): Indicates that the International Mobile Equipment Identity (IMEI) is blacklisted. The handset disables 4G LTE packet capabilities.
  • EMM Cause #7 (EPS services not allowed): Instructs the UE that the network does not permit 4G packet data. The modem sets the EF_EPSLOCI elementary file on the USIM to "Disabled" and falls back to 3G or 2G modes.
  • EMM Cause #8 (EPS services and non-EPS services not allowed): Informs the UE that both packet-switched (PS) and circuit-switched (CS) services are barred on the current PLMN. This forces the modem to clear its cell memory and initiate a full spectrum scan, during which the high-power 2G signal of the rogue station is selected.
  • EMM Cause #11 (PLMN not allowed): Adds the target PLMN ID to the forbidden PLMN list (EF_FPLMN) on the USIM, forcing the handset to switch to alternative frequencies broadcast by the rogue station.
  • EMM Cause #12 (Location Area not allowed): Prevents the UE from requesting services within the current Tracking Area, triggering cell reselection.
  • EMM Cause #13 (Roaming not allowed in this location area): Triggers an automatic search for alternative network providers, directing the modem to candidate frequencies controlled by the cell-site simulator.

Asymmetry of 2G GSM Authentication Protocols

Once the target handset drops to 2G GSM, security relies on the authentication protocol defined in 3GPP TS 43.020. GSM authentication is strictly unilateral: the network authenticates the mobile station, but the mobile station cannot authenticate the network.

The 2G authentication sequence executes in three steps:

  1. The network generates a 128-bit random challenge (RAND) and transmits it to the mobile station over the air interface inside an Authentication Request frame.
  2. The Universal Subscriber Identity Module (USIM) executes the secret $A3$ authentication algorithm using RAND and the 128-bit subscriber secret key $K_i$ embedded in the SIM card, producing a 32-bit signed response (SRES).
  3. The SIM executes the $A8$ key derivation algorithm to derive a 64-bit ciphering key $K_c$:

$$SRES = A3(K_i, RAND)$$

$$K_c = A8(K_i, RAND)$$

  1. The mobile station transmits SRES back to the base station inside an Authentication Response frame.

Because 2G GSM lacks mutual authentication, a rogue base station does not need to verify whether SRES matches an authentic HLR database record. It accepts any SRES value returned by the handset, completes the authentication phase, and immediately commands the modem to enter cleartext or weakly encrypted mode.

Cryptanalysis of GSM Ciphers: A5/0, A5/1, and A5/2

Following authentication, the base station issues a Layer 3 Ciphering Mode Command (3GPP TS 44.018) instructing the handset to enable encryption on the dedicated traffic channel (TCH):

+-------------------+-------------------+
|  8  7  6  5  4  3 |  2  1  0          |
+-------------------+-------------------+
| Protocol Disc.    | Skip Indicator    |
| (0x06 - RR)       | (0x0)             |
+-------------------+-------------------+
| Message Type (0x35 - Ciphering Mode Command)  |
+-------------------+-------------------+
| Ciphering Mode IE | Cipher Response   |  --> Algorithm Select:
| (0x01)            | (0x0)             |      000 = A5/0 (Disabled)
+-------------------+-------------------+      001 = A5/1
                                               010 = A5/2
                                               011 = A5/3

The standard specifies four potential ciphering modes:

  • A5/0: Null encryption. Voice, SMS, and signaling frames are transmitted in unencrypted cleartext across the RF interface. Rogue base stations routinely set the cipher algorithm selector bits to 000 (A5/0) to capture all payload data directly without cryptanalytic overhead.
  • A5/1: The primary stream cipher used in GSM networks. A5/1 generates a pseudo-random keystream initialized with the 64-bit cipher key $K_c$ and the 22-bit frame number $FN$. The cipher relies on three Linear Feedback Shift Registers (LFSRs) of unequal lengths:
LFSR 1 (19 bits): [ R1_0, R1_1, ..., R1_18 ]  ---> Taps: 13, 16, 17, 18  (Clock bit: R1_8)
LFSR 2 (22 bits): [ R2_0, R2_1, ..., R2_21 ]  ---> Taps: 20, 21          (Clock bit: R2_10)
LFSR 3 (23 bits): [ R3_0, R3_1, ..., R3_22 ]  ---> Taps: 7, 20, 21, 22   (Clock bit: R3_10)

The shift registers clock according to a stop-and-go majority rule determined by bits $R1_8$, $R2_{10}$, and $R3_{10}$:

$$Majority(R1_8, R2_{10}, R3_{10}) = (R1_8 \cdot R2_{10}) \oplus (R1_8 \cdot R3_{10}) \oplus (R2_{10} \cdot R3_{10})$$

An individual LFSR is clocked if its clock bit equals the calculated majority value. Once clocked, the output bit is generated by XORing the candidate output bits of all three registers.

Due to the small 64-bit key space and linear properties of the shift registers, A5/1 is susceptible to Time-Memory Trade-Off (TMTO) rainbow table attacks. An adversary capturing 8 consecutive GSM burst frames (providing 114 bits of keystream per burst) can match the keystream against precomputed rainbow table indices (such as the 2 TB Kraken table set) to recover the session key $K_c$ in under 1 second on commodity hardware.

  • A5/2: A stream cipher designed for export containing intentional security flaws. It incorporates a fourth 17-bit LFSR to control clocking and can be broken in real time with zero delay using linear algebraic equations. The 3GPP consortium officially deprecated A5/2 in 2006.
  • A5/3 (KASUMI): A block cipher based on the MISTY architecture operating with a 128-bit key size. While resistant to real-time air-interface attack, rogue base stations prevent its selection by claiming lack of A5/3 support in broadcast configuration tables.

4. IMSI Extraction, Hardware Grabbing, and Location Tracking

The primary function of a cell-site simulator is capturing subscriber identities, grabbing hardware serial numbers, and tracking target physical coordinates.

NAS Identity Request Protocol Flow

When a handset attaches to a rogue cell, it initiates a Location Update Procedure by transmitting a Layer 3 NAS Location Updating Request message. Under standard network conditions, UEs avoid broadcasting permanent identities over the air by presenting a 32-bit Temporary Mobile Subscriber Identity (TMSI) assigned by the VLR (Visitor Location Register).

Because the rogue station has no record of the assigned TMSI, it triggers 3GPP TS 24.008 protocol procedures allowing the base station to request permanent identities:

Handset (UE)                                              Rogue Base Station
     |                                                            |
     |--- RRC Connection Request -------------------------------->|
     |<-- RRC Connection Setup -----------------------------------|
     |--- RRC Connection Setup Complete ------------------------->|
     |    (NAS Location Updating Request with Old TMSI)           |
     |                                                            |
     |<-- NAS Identity Request -----------------------------------|
     |    (Identity Type = 0x01 [IMSI])                           |
     |                                                            |
     |--- NAS Identity Response --------------------------------->|
     |    (Payload: Cleartext 15-Digit BCD IMSI)                  |
     |                                                            |
     |<-- NAS Identity Request -----------------------------------|
     |    (Identity Type = 0x02 [IMEI])                           |
     |                                                            |
     |--- NAS Identity Response --------------------------------->|
     |    (Payload: Cleartext 15-Digit BCD IMEI)                  |
     |                                                            |

The Layer 3 Identity Request frame contains the Identity Type Information Element. By setting this field to specific integer flags, the rogue base station mandates identity disclosure:

+-------------------+-------------------+
|  8  7  6  5  4  3 |  2  1  0          |
+-------------------+-------------------+
| Security Header / | Message Type      |  --> Type 0x18 (Identity Request)
| Protocol Disc.    | (0x18)            |
+-------------------+-------------------+
| Reserved (0x0)    | Identity Type     |  --> 001 = IMSI    (0x01)
+-------------------+-------------------+      010 = IMEI    (0x02)
                                               011 = IMEISV  (0x03)
                                               100 = TMSI    (0x04)

Upon receiving an Identity Request with Identity Type set to 0x01, the handset modem firmware is obligated by 3GPP specifications to return an Identity Response (0x19) carrying the raw 15-digit IMSI stored on the USIM. If set to 0x02 or 0x03, the modem returns the hardware International Mobile Equipment Identity (IMEI) or IMEI Software Version (IMEISV), allowing adversaries to link SIM identities to physical smartphone hardware serial numbers.

Binary Coded Decimal (BCD) Identity Encoding

Identity strings are encoded inside the Identity Response message using Binary Coded Decimal (BCD) format, where each decimal digit is packed into a 4-bit nibble.

Consider a 15-digit IMSI string 262019876543210 packed into an 8-byte payload:

Identity Length: 0x08 (8 Bytes)
 
Byte 1: [ Digit 1 (2) | Odd/Even Flag (1) | Identity Type (001 = IMSI) ]
        Binary: 0010 0 001  --> Hex: 0x21
 
Byte 2: [ Digit 3 (2) | Digit 2 (6) ]
        Binary: 0010 0110  --> Hex: 0x26
 
Byte 3: [ Digit 5 (1) | Digit 4 (0) ]
        Binary: 0001 0000  --> Hex: 0x10
 
Byte 4: [ Digit 7 (7) | Digit 6 (9) ]
        Binary: 0111 1001  --> Hex: 0x79
 
Byte 5: [ Digit 9 (5) | Digit 8 (8) ]
        Binary: 0101 1000  --> Hex: 0x58
 
Byte 6: [ Digit 11 (3) | Digit 10 (4) ]
        Binary: 0011 0100  --> Hex: 0x34
 
Byte 7: [ Digit 13 (1) | Digit 12 (2) ]
        Binary: 0001 0010  --> Hex: 0x12
 
Byte 8: [ Filler (0xF) | Digit 14 (0) ]
        Binary: 1111 0000  --> Hex: 0xF0

The rogue base station decodes these nibbles to log the target subscriber IMSI, Mobile Country Code (MCC), Mobile Network Code (MNC), and Mobile Subscriber Identification Number (MSIN).

The IMEI structure extracted via Identity Type 0x02 follows a similar BCD nibble pattern, exposing:

  • Type Allocation Code (TAC): 8 digits identifying the specific smartphone manufacturer and device model (for example, iPhone 15 Pro vs Samsung Galaxy S24).
  • Serial Number (SNR): 6 digits representing the individual manufacturer hardware serial sequence.
  • Luhn Check Digit / Software Version Number (SVN): 2 digits verifying payload integrity or software build revisions.

Silent Paging and High-Frequency Tracking

Once target IMSI and IMEI parameters are cataloged, rogue base stations do not need to maintain an active call connection to track movement. They utilize Silent Paging procedures.

In normal operations, base stations issue RRC Paging frames over the Paging Control Channel (PCCH) to alert idle UEs of incoming voice calls or data payloads. Handsets monitor paging frames at predefined Discontinuous Reception (DRX) cycles ($T_{DRX} \in {32, 64, 128, 256}$ frames) to conserve power.

A cell-site simulator issues continuous RRC Paging messages populated with the target's S-TMSI or raw IMSI:

Paging ::= SEQUENCE {
    pagingRecordList                PagingRecordList OPTIONAL,
    systemInfoModification          ENUMERATED {true} OPTIONAL,
    etws-Indication                 ENUMERATED {true} OPTIONAL,
    ...
}
 
PagingRecordList ::= SEQUENCE (SIZE(1..maxPageRec)) OF PagingRecord
 
PagingRecord ::= SEQUENCE {
    ue-Identity                     PagingUE-Identity ::= CHOICE {
        s-TMSI                      S-TMSI,
        imsi                        IMSI ::= SEQUENCE (SIZE(6..8)) OF BCD-Digit
    },
    cn-Domain                       ENUMERATED {ps, cs}
}

When the target modem detects its IMSI inside a paging record, it immediately responds by transmitting an RRC Connection Request burst on the Random Access Channel (RACH). The rogue station logs the incoming RACH burst timestamp, measures uplink signal parameters, and immediately drops the connection, allowing silent tracking without displaying any alert on the smartphone user interface.

Alternatively, operators issue Silent SMS messages (also known as Type 0 SMS). Constructed using short message Protocol Data Unit (PDU) formats defined in 3GPP TS 23.040, a Silent SMS sets the TP-Protocol-Identifier (TP-PID) header to 0x40 (Short Message Type 0) and the Data Coding Scheme (TP-DCS) to 0x04 (8-bit data):

+---------------------------------------------------------------------------------+
|                       Silent SMS (Type 0) PDU Structure                         |
+---------------------------------------------------------------------------------+
| SMSC Address | SMS-DELIVER | TP-Originating | TP-PID   | TP-DCS   | TP-UserData |
| Info         | Header Byte | Address        | (0x40)   | (0x04)   | Length (0)  |
+---------------------------------------------------------------------------------+

When the baseband processor receives a Type 0 SMS PDU, 3GPP rules require the modem to send an unencrypted SMS-DELIVER-REPORT acknowledgment back to the transmitting station while discarding the message payload without triggering ringtones, vibrations, or notification log entries in the mobile operating system.

Timing Advance (TA) Range Calculation and Multi-Lateration

Rogue base stations calculate physical distance to a target handset using the Timing Advance (TA) parameter.

Radio signals propagate through air at the speed of light ($c pprox 299,792,458 ext{ m/s}$). Signals transmitted by UEs located far from a cell tower experience propagation delays. To prevent uplink slot overlap on TDMA or SC-FDMA frames, the base station measures the arrival offset of the UE RACH preamble and commands the handset to advance its transmit timing by an integer TA index.

GSM Timing Advance Calculation

In GSM networks, each TA index step corresponds to 1 bit period of timing offset ($T_{bit} pprox 3.6923 ext{ }\mu ext{s}$). The total round-trip distance $D_{RT}$ associated with 1 TA step is:

$$D_{RT} = T_{bit} imes c = 3.6923 imes 10^{-6} ext{ s} imes 299,792,458 ext{ m/s} pprox 1106.9 ext{ metres}$$

Because the signal travels from the tower to the UE and back, the one-way radial distance step $D_{OW}$ per GSM TA index is:

$$D_{OW} = rac{D_{RT}}{2} pprox 553.45 ext{ metres}$$

A target handset transmitting with a GSM TA index of 2 is located inside a radial ring situated between $553.45 ext{ m}$ and $1,106.9 ext{ m}$ from the rogue antenna.

LTE Timing Advance Calculation

In 4G LTE, timing resolution is refined. The basic LTE time unit $T_s$ is defined relative to subcarrier spacing:

$$T_s = rac{1}{15000 imes 2048} pprox 32.552 ext{ ns}$$

The LTE TA index $T_A$ ranges from 0 to 1280. The physical timing adjustment offset $N_{TA}$ is defined as $N_{TA} = T_A imes 16$. The time offset $\Delta t_{LTE}$ per TA unit is:

$$\Delta t_{LTE} = 16 imes T_s = 16 imes 32.552 imes 10^{-9} ext{ s} pprox 0.52083 ext{ }\mu ext{s}$$

The corresponding one-way radial distance step $D_{LTE}$ is:

$$D_{LTE} = rac{\Delta t_{LTE} imes c}{2} = rac{0.52083 imes 10^{-6} ext{ s} imes 299,792,458 ext{ m/s}}{2} pprox 78.07 ext{ metres}$$

5G NR Timing Advance Calculation

In 5G NR (TS 38.213), timing precision scales with subcarrier spacing (SCS). The basic 5G time unit $T_c$ is:

$$T_c = rac{1}{\Delta f_{max} \cdot N_f}$$

Where $\Delta f_{max} = 480 imes 10^3 ext{ Hz}$ and $N_f = 4096$, yielding $T_c pprox 0.509 ext{ ns}$. For a standard 30 kHz subcarrier spacing, the distance resolution per TA unit drops below 10 metres.

Direction Finding (DF) and Multi-Lateration Mechanics

To convert a radial distance ring into precise geographic coordinates, cell-site simulators deploy Direction Finding (DF) antenna arrays or multi-lateration algorithms.

Using an Angle of Arrival (AoA) phased antenna array, the receiver measures the relative phase differences of incoming uplink signals across multiple antenna elements:

                         [ Rogue Base Station ]
                                   |
                       /-----------|-----------                      /     TA Ring Radius                           /     (e.g., 234 metres)                        |                             |
                    |          Target UE          |
                    |          [ * ]              |
                     \        /                  /
                      \      / RSSI Peak Signal /
                       \----/------------------/
                           /  Angle of Arrival (AoA) = 142°
                          v

By correlating the measured Angle of Arrival (AoA) peak with the Timing Advance radial distance $D_{OW}$, a single mobile unit mounted inside a vehicle can isolate target subscriber coordinates to within 5 metres.

When multiple receiver nodes ($N \ge 3$) are available, target position $(x, y, z)$ is solved via non-linear multi-lateration equations based on measured Time Difference of Arrival (TDOA):

$$(x - x_i)^2 + (y - y_i)^2 + (z - z_i)^2 = (d_i)^2 \quad ext{for } i \in {1, 2, 3}$$

Where $(x_i, y_i, z_i)$ represent the known positions of intercept receiver nodes and $d_i$ represents the calculated distance derived from propagation delay.

5. Countermeasures, Baseband Diagnostics, and 5G Protections

Defending against rogue base station attacks requires OS-level radio controls, real-time baseband diagnostic monitoring, and modern 5G Standalone cryptographic enhancements.

Mobile Operating System Controls

Modern smartphone operating systems have introduced hardware abstraction layer controls to mitigate protocol downgrade vectors:

  • Android 2G Toggle: Introduced in Android 12, this control interfaces directly with the modem Hardware Abstraction Layer (HAL) via setRadioPower and setAllowedNetworkTypesBitmap APIs. Disabling 2G instructs the baseband firmware to remove GERAN band capabilities from its active radio stack, causing the modem to ignore RRC redirection commands to 2G frequencies.
  • iOS Lockdown Mode: Available in iOS 16 and later, Lockdown Mode disables 2G cellular band attachment entirely, blocks unencrypted cellular configurations, and restricts cellular profile installations.

Baseband Diagnostic Logs and Anomaly Detection

Diagnostic tools running on rooted Android devices interface with vendor diagnostic ports (such as Qualcomm /dev/diag, /dev/smd11 or Samsung Shannon IPC channels) to capture raw Radio Layer 3 and NAS event logs.

Qualcomm diagnostic logging tools decode specific log packets to monitor air-interface security state transitions:

  • 0x184E: LTE RRC OTA (Over-The-Air) Decoded Signaling Messages (captures MIB, SIB, RRCConnectionRelease).
  • 0x713A: GSM L3 Signaling Messages (captures Ciphering Mode Command and Identity Request).
  • 0x11EB: NAS EMM Plain OTA Incoming Messages (captures Attach Reject and TAU Reject cause codes).

Detection engines (such as SnoopSnitch or Android Network Security tools) execute real-time heuristic algorithms over decoded log streams to flag rogue base station indicators:

+---------------------------------------------------------------------------------+
|                       Cellular Anomaly Detection Heuristics                     |
+---------------------------------------------------------------------------------+
|  Anomaly Metric           | Threshold Condition          | Threat Classification|
+---------------------------+------------------------------+----------------------+
|  Cell ID Consistency      | LAC/TAC mismatch relative to | High (Fake Tower     |
|                           | OpenCelliD database          | Identifier)          |
+---------------------------+------------------------------+----------------------+
|  Unrequested Identity Req | NAS Type 0x01 issued without | Critical (IMSI       |
|                           | prior mutual auth            | Extraction)          |
+---------------------------+------------------------------+----------------------+
|  SUDDEN 2G Fallback       | RRCRelease with GERAN ARFCN  | High (Protocol       |
|                           | under strong 4G coverage     | Downgrade)           |
+---------------------------+------------------------------+----------------------+
|  Cipher Mode Null         | Ciphering Mode Command specifying| Critical (Unencrypted|
|                           | A5/0 algorithm               | Eavesdropping)       |
+---------------------------+------------------------------+----------------------+

The underlying anomaly evaluation logic processes incoming diagnostic packets according to a structured decision flow:

                     [ Incoming Diagnostic Packet ]
                                   |
                                   v
                    /-----------------------------                   /  Is Message Type = 0x18                         <   (NAS Identity Request)?       >
                   \                               /
                    \-----------------------------/
                                   |
                         YES       |       NO
            +----------------------+----------------------+
            |                                             |
            v                                             v
 /---------------------\                       /---------------------/  Was Mutual Auth      \                     /  Is RRCRelease GERAN  <  Completed First?     >                     <  Redirection Present? >
 \                     /                       \                     /
  \-------------------/                         \-------------------/
     |             |                               |             |
  NO |         YES |                            YES|           NO|
     v             v                               v             v
[CRITICAL ALERT:  [PASS: Normal               [HIGH ALERT:    [PASS: Normal
 IMPLICIT IMSI     Identity Check]             Forced 2G       RRC Traffic]
 EXTRACTION]                                   Downgrade]

5G Standalone (SA) Cryptographic Protections: SUCI and ECIE

The 3GPP 5G Standalone architecture specification (TS 33.501) introduces a fundamental cryptographic redesign that mitigates classical IMSI catching: the Subscription Concealed Identifier (SUCI).

In 5G networks, the permanent subscriber identity is named the Subscription Permanent Identifier (SUPI), which corresponds to the 4G IMSI. Under 5G SA rules, the raw SUPI is never transmitted in cleartext over the air interface.

+---------------------------------------------------------------------------------+
|              5G Subscription Concealed Identifier (SUCI) Frame                  |
+---------------------------------------------------------------------------------+
|  MCC   |  MNC   | Routing   | Protection | Home Network | Ephemeral PK | Cipher |
| (3 Dig)| (2 Dig)| Indicator | Scheme ID  | Public Key ID| (Curve25519) | text   |
+--------+--------+-----------+------------+--------------+--------------+--------+
|   Cleartext Info  |                     ECIE Encrypted Payload                 |
+---------------------------------------------------------------------------------+

Before transmitting identity parameters across the radio link, the USIM encrypts the Scheme Output (containing the MSIN) using the Elliptic Curve Integrated Encryption Scheme (ECIE):

  1. The USIM stores the fixed Home Network Public Key ($PK_{HN}$).
  2. The USIM generates an ephemeral elliptic curve keypair $(sk_{ephem}, PK_{ephem})$ on Curve25519 (Profile A) or secp256r1 (Profile B).
  3. The USIM performs ECDH key agreement between $sk_{ephem}$ and $PK_{HN}$ to derive a shared secret $Z$.
  4. A Key Derivation Function (KDF) transforms $Z$ into symmetric encryption keys ($K_{enc}, K_{mac}$).
  5. The MSIN payload is encrypted using AES-128-CTR (Profile A) or AES-128-CBC (Profile B) and authenticated via HMAC-SHA256, generating the SUCI ciphertext.

3GPP TS 33.501 defines two cryptographic profiles alongside a fallback mode:

  • Profile A: Curve25519, HKDF-SHA256, AES-128-CTR, HMAC-SHA256-128 output.
  • Profile B: secp256r1 curve, HKDF-SHA256, AES-128-CBC, HMAC-SHA256-128 output.
  • Null Scheme (Scheme ID 0x00): Transmits the SUPI in cleartext. This mode exists only for emergency call scenarios or unconfigured test networks. If misconfigured by carriers, rogue base stations can still extract identity parameters.

When a rogue 5G base station issues an Identity Request to a 5G SA handset, the device returns the encrypted SUCI payload. Because the rogue station does not possess the private key of the carrier Home Network ($SK_{HN}$), it cannot decrypt the ciphertext to recover the underlying SUPI. Furthermore, 5G AKA enforces Home Network control: the home network generates an authentication vector containing an Authentication Token ($AUTN$) that allows the USIM to cryptographically verify network authenticity before accepting any radio commands, preventing rogue base station attachment and eavesdropping attacks.