← Back to Labs

IMSI Catchers & Cellular Downgrade Security

Step through 3GPP cell reselection heuristics, rogue base station power amplification, 2G GSM cipher downgrade, and IMSI exfiltration

TARGET UE5G SA / 4G LTE🔒SUBSCRIBER IDGUTI / Encrypted SUCI-85 dBm (Strong)LEGIT 5G/4G TOWERMCC: 310 | MNC: 260Online (Mutual Auth)🔑 Mutual Auth Active☠️ROGUE IMSI CATCHERHigh-Pwr 2G BTS + JammerStandby5G-AKA (128-bit AES)⚠️ No 2G Mutual AuthAIR INTERFACE PROTOCOL MONITORRRC & NAS Encrypted
STEP 1 OF 6

1. Handset Camped on 4G LTE / 5G SA

The smartphone starts securely camped on a 4G LTE or 5G Standalone network. In 5G/4G, mutual authentication prevents rogue base stations from spoofing towers, control plane messages are encrypted, and subscriber IDs are hidden behind temporary GUTI tokens or encrypted SUCI identifiers.

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →