With the recent (and not so recent) news about fake cell towers popping up in different part of the world, I was wondering how these are detected (from a technical point of view).
I'm not really looking for information about how an end user could detect or protect himself, but rather I'm wondering how a fake cell tower is identified (even with specialized equipment)
Well, if said end user had a rooted Galaxy S3, they could use Darshak on their phone to check for "baseband attacks" that indicate they are communicating with a rogue tower. There's a company called ESD that sells a "cryptophone" that can do the same thing, but for a hefty price tag (like 1,300 USD!). Edit: Here's another cool app I found from a comment by @wesleyac: Android IMSI Catcher Detector.
Unfortunately, no one seems to have a good explanation of how it's done. But ESD does release the source code for their phones freely for security audits, and the SecUpwn group has released their app on Github. If you want to wade into the implementation details, that would be a good place to start. A brief technical explanation of the GitHub app is here.
These towers seem to be the modern-day number stations. We may never know, but we'll always get that creepy feeling when we think of them ;)
(I am not affiliated with either of these products.)
I couldn't find a comprehensive explanation, but a recent Wired article about GSMK's cryptophone (which has fake tower detection capabilities) provides some clues on how it's done:
But GSMK’s CryptoPhone firewall aims to combat this by monitoring all connections to the phone’s baseband. It checks whether a particular cell tower lacks an ID like its neighboring towers—for example a name that identifies it as an AT&T or Verizon tower—whether it has a different signal strength, and whether the tower is operating as expected or trying to manipulate phones. It will also alert you when the mobile network’s encryption has been turned off or when the phone has suddenly switched from using a 3G or 4G to a 2G network—a less secure network that doesn’t authenticate cell towers and makes it easier to decrypt communication. IMSI catchers will often jam 3g and 4G signals to force a phone to use the less secure 2G network, and the CryptoPhone firewall will alert users when this occurs.
“At the same time, the firewall is monitoring every instruction coming into and out of the base station—and it’s showing you what baseband activity occurred but was not controlled by the operating system,” says Les Goldsmith, CEO of ESD America. For example, Goldsmith continues,”someone can send a message straight to your base station to operate the camera in your phone, and the firewall will show you that the camera has been actuated [even though] the user hasn’t pressed a button to do it.”
It also allows you to see if your phone made suspicious connections that are brief—say, a minute and half connection that occurred in the middle of the night when you were doing nothing on the phone and no applications were updating.
Source: Phone Firewall Identifies Rogue Cell Towers Trying to Intercept Your Calls
