Zoe · Oct 24, 2026 · 3:44 PM UTC

Zoe

Lμke Switzer retweeted

Oct 24

If an attacker parks outside your building with a $1,500 software-defined radio, a 5G smartphone will still drop its connection, connect to a fake 1991-era GSM tower, and hand over its permanent hardware identity in cleartext.

Every modern baseband modem still carries legacy 2G mpatibility, and that 2G stack has no way to verify if a cell tower is real.

1. The architectural flaw: One-way tower trust

In 4G (LTE) and 5G, mobile networks enforce mutual authentication after the initial attach.

When your phone connects to an LTE tower, the network sends a random cryptographic challenge (RAND) alongside an Authentication Token (AUTN). Inside your SIM card, a secure processor checks that token against a 128-bit secret root key (K) burned in at the factory. If the tower cannot prove it shares that key with your carrier, the baseband drops the connection before any voice or text data flows.

In 2G (GSM), that check only runs in one direction.

When GSM was standardized in 1991, commercial software-defined radios did not exist. The protocol was built so the tower authenticates the SIM card to stop billing fraud, while the SIM card never authenticates the tower.

A 2G baseband processor will connect to any transmitter broadcasting a valid Mobile Country Code and a stronger signal (RXLev) than the surrounding towers.

2. How rogue base stations force the downgrade

Because a rogue tower cannot forge a 4G cryptographic signature, it forces the phone's baseband to abandon 4G and 5G entirely.

An attacker using an Ettus USRP B210 and a 10-watt RF power amplifier triggers this fallback in two ways:

* Selective RF jamming: The radio floods local 4G and 5G downlink frequencies with noise while leaving a 2G GSM frequency clean. When the phone loses its LTE signal, the baseband's cell reselection state machine scans all supported bands and locks onto the attacker's clean 2G beacon.
* Protocol downgrade injection: The attacker broadcasts a rogue LTE signal just long enough to catch the phone's tracking area update, then replies with an unauthenticated Tracking Area Update Reject (EMM Cause #7: EPS services not allowed) or an RRCConnectionRelease redirecting the modem straight to a 2G frequency.

The baseband assumes you walked into a dead zone and switches to 2G in about 10 seconds without prompting the user.

3. Identity theft, A5/0, and the SMS relay catch

Once the phone camps on the rogue 2G station, the attacker sends a standard Identity Request packet. The phone replies in cleartext with its 15-digit International Mobile Subscriber Identity (IMSI) and its hardware IMEI.

Next comes encryption. Normal 2G traffic uses the 64-bit A5/1 stream cipher, which can already be cracked in seconds using 2TB Kraken rainbow tables. Worse, the 3GPP specification (TS 44.018) requires every phone to obey a Ciphering Mode Command set to A5/0 (null cipher).

When the rogue tower sends A5/0, the phone turns off air-interface encryption completely. Any outgoing SMS or call from the victim's phone travels to the attacker's laptop as unencrypted GSM 7-bit bytes.

To intercept incoming two-factor SMS codes from a bank, the attacker has to go one step further. Because a rogue SDR in a car is not wired into your real carrier's core network, the bank's SMS won't route to the attacker's laptop automatically. Either the attacker uses a second radio to relay your phone's handshake back to the real carrier's 2G tower and cracks the A5/1 downlink key, or they simply jam 4G so your phone drops onto the real carrier's 2G tower and passively crack the A5/1 air traffic in Wireshark.

4. The modern defense: Cutting legacy silicon

You cannot patch a 1991 radio handshake without breaking backward compatibility, so OS vendors finally gave users a kill switch for the baseband:

* Android 12+ 2G kill switch: Android added the setAllowedNetworkTypesForReason API to the Radio Interface Layer (RIL). Turning off "Allow 2G" instructs the modem firmware to disable its GSM stack at the silicon level. If 4G is jammed, the phone stays in "No Service" instead of dropping to 2G.
* Android 14 & 15 null-cipher locks: Android 14 added a modem toggle to reject A5/0 null-cipher connections outright on supported hardware, and Android 15 added live system alerts whenever a tower requests an unencrypted connection or cleartext IMSI.
* iOS Lockdown Mode: Turning on Lockdown Mode disables the 2G baseband stack on iPhones.
* 5G Standalone (5G SA) SUCI: Even on 4G LTE, a phone still sends its IMSI in cleartext during the very first attach request before encryption starts. Pure 5G Standalone fixes this last gap: the SIM card uses ECIES public-key cryptography to encrypt your IMSI into a Subscription Concealed Identifier (SUCI) before a single packet leaves the antenna.

139

1,141

66,228