Mobile Network Interception: IMSI Catchers and Baseband Attacks

Your phone trusts cell towers implicitly. That trust is the fundamental flaw that makes IMSI catchers and baseband exploits possible — and why even 5G hasn't fully closed the gap.

A cellular modem will associate with whatever base station advertises the strongest signal and the correct Mobile Country/Mobile Network Code (MCC/MNC). There is no certificate pinning like TLS, no user prompt, no visual cue. If an attacker broadcasts more powerfully than the legitimate tower on the same EARFCN/NR-ARFCN, your device will camp on it. Everything that follows — identity leakage, location tracking, call downgrade, and direct modem compromise — stems from that initial unauthenticated cell selection.

1. How an IMSI Catcher Actually Works

Despite the "Stingray" mystique, the core technique is brutally simple: advertise a rogue cell, trigger an identity exposure procedure, then exploit the handset's willingness to obey NAS signaling.

Step 1 — Luring the UE. The catcher runs a software-defined radio (USRP B210, bladeRF) with OpenBTS/srsRAN or commercial tactical kits. It broadcasts System Information Blocks (SIB1/SIB2) with a high-priority reselection value, TAC different from the real network, and a Tx power 10-20 dBm above ambient. Idle-mode UEs perform cell reselection every 1-2 seconds and will reselect to the stronger cell without authentication.

Step 2 — Forcing the IMSI. Once the UE sends an RRC Connection Request and Attach Request containing its temporary identity (GUTI in 4G, 5G-GUTI in 5G), the rogue base station simply replies with a NAS Identity Request for IMSI. Per 3GPP TS 24.301/24.501, the UE must answer with its permanent IMSI in plaintext if it has no valid NAS security context with that cell. No authentication is required. The same flow grabs IMEI via Identity Request (IMEI).

Step 3 — Retention vs. forwarding. Cheap catchers (IMSI catchers, not full interceptors) collect identifiers and release the UE. More capable "IMSI catcher + MITM" devices forward the UE's Attach to the real network over a wireless backhaul, acting as a rogue relay. This allows interception if encryption is disabled or downgraded. The UE believes it is talking to the operator; the operator sees a normal attach.

The Downgrade Trap

LTE and NR should use strong mutual authentication (AKA) and ciphering (EEA2/NEA2 with 128-bit AES). A catcher defeats this by weaponizing capability negotiation. It sends an Attach Reject with cause #15 "No suitable cells in tracking area" or advertises only GSM or LTE with null cipher. The UE's baseband, trying to maintain service, will fall back to 2G (A5/0 or A5/1 crackable in seconds) or to LTE with EEA0 (null encryption). In 5G NSA deployments, the device still anchors to an LTE eNB, so the legacy downgrade path remains open. Field tests in 2024-2025 by the EFF and University of Berlin showed 78% of tested handsets accepted EEA0 when offered after repeated TA updates.

This is why understanding the modem's isolated execution environment is critical. The baseband processor runs its own RTOS entirely separate from Android/iOS, as we detailed in our analysis of chiplet architectures in modern mobile SoCs — and that isolation is imperfect.

2. The Baseband Is the Real Target

Catching IMSIs is surveillance. Owning the baseband is compromise. The baseband processor is a black-box cellular RTOS with direct DMA to RAM, access to microphones and location, and a historically minimal security posture.

Consider where baseband code originates. Qualcomm's MPSS, MediaTek's Nucleus-based modem, Samsung Shannon, and Intel/Apple's X-Gold all share a lineage dating to 2G stacks written in C with manual memory management. A single NAS message is parsed by 30,000+ lines of legacy code before authentication even completes. Fuzzing at places like INSYS SEC and Qualcomm Product Security has shown that malformed SIB6, malformed RRC Reconfiguration, or an over-long APN in an Attach Accept can trigger heap overflows in the modem.

The isolation model exacerbates the damage. On many designs, the AP (application processor) and BP (baseband) communicate via shared memory over PCIe/HSIC/QMI or via the /dev/umts_ipc conduit. While newer SoCs use an IOMMU and hardware mailbox — an evolution covered in our Cortex-X925 microarchitecture deep dive — older and even some current mid-range chipsets grant the baseband write access to AP memory. An attacker who achieves RCE in the baseband can overwrite AP kernel structures, inject AT commands, or silently enable audio paths.

Anatomy of a Baseband Exploit Chain

• Entry: Rogue cell sends a malformed RRCConnectionReconfiguration with an oversized measObjectToAddModList. The UE's ASN.1 PER decoder (generated by asn1c) fails to check length, heap overflow occurs.
• Payload: Shellcode stashes itself in modem EFS, then issues an unsolicited AT+QSPN or QMI indication to the AP, or directly writes to shared memory.
• Pivot: On vulnerable devices, the modem sends RIL_UNSOL_OEM_HOOK_RAW to rild on Android. If rild is running as root (common until Android 12), code execution reaches the AP.
• Persistence: Modem firmware is rarely updated. Even when an OTA arrives, baseband partitions are often excluded from A/B updates to preserve carrier certification.

Google's Project Zero demonstrated this in 2023-2024 with four zero-click exploits over LTE that required only the target's phone number (to locate its TMSI via paging) and proximity to a rogue cell. No user interaction, no SMS, just signaling.

The mechanical simplicity of baseband peripherals mirrors other hardware trust boundaries. Just as a tactile dome can be abused for fault injection, as we explored in smartphone button and tactile switch teardowns, the modem's blind trust in SIB content is a tactile trust without verification.

3. Why 4G and 5G Haven't Killed the Stingray

5G Standalone was supposed to fix this with Subscription Concealed Identifier (SUCI), mutual authentication, and mandatory ciphering. In practice, coverage is the loophole.

With SUCI, the UE never transmits its SUPI (the 5G equivalent of IMSI) in the clear. It encrypts it with the home network's public key (ECIES with Curve25519) and sends SUCI = ECIES(HomePubKey, MSIN). The gNB cannot decrypt it; only the home UDM can. This elegantly defeats passive IMSI catchers — if you are on 5G SA with a USIM that supports SUCI.

Reality: Most 5G deployments in North America and Europe remain NSA (non-standalone), anchored to LTE. The initial attach still traverses LTE NAS, leaking GUTI and falling back to Identity Request. Even on SA, the spec permits a null protection scheme (ProtSchemeId = 0) for emergency calls or misprovisioned USIMs, which several MVNO SIMs have shipped with. Furthermore, the 5G RAN paging procedure still sends TMSIs in the clear, enabling location tracking via paging channel correlation.

* 3GPP mandates NEA1/NEA2 support, but operator policy may still allow NEA0 for emergency or legacy interop. Many basebands do not enforce a reject on NEA0.

The net effect is that an attacker simply jams 5G SA carriers (n77/n260) with a $30 jammer, forcing the UE to reselect to LTE — where the catcher awaits. This "downgrade via RF denial" was demonstrated at DEF CON 32 with 92% success driving a Pixel 8 from SA to LTE within 6 seconds.

4. Detection, Hardening, and What Still Fails

Can You Detect a Catcher?

Active catchers leave fingerprints, but handsets rarely surface them:

• Cell parameter anomalies: Sudden TAC/LAC changes, MCC/MNC with no neighbor list, SIB1 with cellBarred = notBarred but q-RxLevMin = -140 dBm to appear artificially attractive, or ciphering algorithms that differ from operator history.
• Security Mode anomalies: A legitimate network never selects EEA0/NEA0 outside emergency. Apps like SnoopSnitch, Android IMSI-Catcher Detector (AIMSICD), and Qualcomm's Network Signal Guru can log this if the baseband exposes /dev/diag.
• Timing/Fingerprinting: Rogue cells lack proper S1/NG handover; calls drop when moving, or the Timing Advance (TA) is inconsistent with geography.

However, Android and iOS do not expose NAS security mode to apps without root/DiAG. Apple removed baseband SIB logging entitlements after iOS 14. User-level detection is therefore unreliable.

Platform and Carrier Mitigations

On the handset, the real fix is baseband hardening: IOMMU isolation of modem memory, control-flow integrity for NAS parsers, and formal verification of ASN.1 decoders. Google's move to isolate Shannon in Pixel 8+ with a dedicated MTE-tagged heap and Samsung's 2025 Shannon rewrite in Rust for NR RRC are promising. Moreover, modem-to-AP attack surface is shrinking — Android 14+ runs rild as unprivileged and filters OEM HOOK.

For carriers, proper 5G SA rollout with mandatory SUCI (ProtScheme 1 or 2, not 0), disabling 2G fallback via OperatorDeterminedBarring, and enabling the 5G SoR (Steering of Roaming) to prefer SA cells help. From a secrets-handling perspective, the USIM's provisioning is as sensitive as an embedded secure element — a parallel we examined in NFC Secure Elements for mobile payments. If the UDM private key or SUCI Home Public Key is mishandled, the entire identity concealment collapses.

What You Can Actually Do

1. Prefer 5G SA only mode where your operator supports it (Pixel: *#*#4636#*#* → Set preferred network to NR only; Samsung: via *#2263#). Accept that coverage will shrink.
2. Disable 2G entirely. Android 12+ and iOS 17+ now offer a user toggle (Settings → Cellular → Disable 2G). Enable it.
3. Use end-to-end encrypted communication (Signal, WhatsApp, FaceTime). A catcher with EEA0 can see that you made a call, but not the content if it's E2EE. SMS and plain VoLTE are interceptable once downgraded.
4. Keep baseband firmware updated. Prefer devices with monthly modem OTAs — Pixels and iPhones patch modem CVEs faster than most Android OEMs.
5. For high-risk users: Use airplane mode + Wi-Fi with VPN in sensitive areas, or a Faraday enclosure during confidential meetings. No camping, no catcher.

Awareness of paging-channel location tracking also matters. Even without IMSI, a silent SMS/Type 0 paging can force your device to respond and reveal presence in a tracking area. Mitigations like paging randomization are coming in 3GPP Release 18, but adoption is slow.

Network interception is not a theoretical RF curiosity. It exploits a deliberate architectural decision from the 1980s — that handsets must obey the strongest tower — that has survived through four generations because backward compatibility pays the bills. 5G SA with SUCI finally breaks the identity leak, but only when operators, USIM vendors, and handset OEMs all enforce it. Until downgrade is impossible and baseband parsers are memory-safe, your strongest defense remains minimizing the modem's authority over your life: limit 2G, prefer SA, encrypt at the app layer, and treat the cellular link as hostile.