Methods and principles of using GSM defects to impersonate Mobile Base Stations

Counterfeit mobile base station Method

Let's talk about the working principle of the mobile base station:

To work with a mobile base station, we must first use a dedicated channel to say, "lalala, I am a mobile base station. Come and connect to me ". After receiving this signal, the mobile phone reads an IMSI Code allocated by the operator from the SIM card and tells the base station, "My base station is XXX, and my IMSI code is a XXXX-XXXX, you sent it to me. Please call me ". After receiving the IMSI code, the base station verifies whether the terminal (mobile phone) is a valid Terminal and then determines whether to allow it to access the network. If terminals are connected to each other in a unified manner, the base station will issue an TMSI code to the terminal for subsequent communication authentication. The work process is roughly like this.

Next, let's talk about the GSM vulnerability.:

When the base station works normally, it will verify the client, but the client will not verify the base station. That is to say, as long as you can transmit a radio signal similar to that of the GSM base station, you can connect the GSM mobile phone around to your counterfeit base station, then you can send a group of text messages to the mobile phone that is connected to your base station.

Finally, let's talk aboutCounterfeit mobile base station Method:

Most of our living environments are in residential intensive areas. In this case, the signal of base stations in some places is weak. In this case, if the illegal base station is near these locations, it is easy to cheat clients in this area, connect them to illegal base stations.

The equipment required by the counterfeit base station, the hardware USRP, and the software GNURadio + OpenBTS are easy to use and the cost is not high. You can get a set of devices over 10 thousand.

More references:
Http://www.cecm.sfu.ca /~ Lisonek/cryptography/Karsten.Nohl.GSM.pdf
Http://www.cse.ohio-state.edu /~ Champion/4471/IMSI_Catcher.pdf