A phone trusts the strongest cell tower it can hear, and a fake base station exploits that trust to collect identifiers, push phones down to 2G and deliver scam texts that bypass every operator filter. IMSI catchers (also called cell-site simulators or stingrays) and the newer "SMS blasters" used by fraud gangs both impersonate a legitimate radio cell. The baseband, the separate processor and firmware that runs the cellular protocol stack inside every phone, modem and IoT module, decides whether to accept that cell. This guide explains where the weaknesses sit in each radio generation, what the 3GPP standards and mobile platforms now offer as defences, how to detect fake base stations, and how to set policy for a managed fleet. It is written for mobile security, telecoms and fraud teams, and stays at the level of detection and policy: it does not describe how to build or operate such equipment. For the operator core and signalling side, see the Telecom Network Security Guide.
Key takeaways
- The radio link is the weak point, not the SIM. Fake base stations rely on protocol behaviour before security is established: identity requests, release and redirect messages, and legacy 2G that has no mutual authentication.
- Downgrade is the common thread. Whatever the attacker's goal, the usual route is pushing the device to 2G, or to a null cipher, where it cannot verify the network.
- Disabling 2G is the single most effective control. Android exposes a 2G toggle and an enterprise restriction (
DISALLOW_CELLULAR_2G); iOS turns off 2G and 3G in Lockdown Mode. - Detection is possible but noisy. Network-side anomaly reports, Android cellular transparency notifications and open-source sensors such as EFF Rayhunter each see part of the picture; correlate before you escalate.
- SMS blasters are a fraud problem first. Their texts never cross the operator's SMS filters, so user awareness, sender authentication and fast reporting to the operator and police matter as much as handset settings.
How fake base stations work, at the level defenders need
A mobile device selects a cell from what it hears on the air and from broadcast system information. A fake base station advertises itself as a cell of a real operator with a stronger signal, so nearby devices camp on it. What happens next depends on the radio generation the device will accept.
| Generation | Weakness exploited | Defender's view |
|---|---|---|
| 2G (GSM) | The network authenticates the subscriber but the subscriber does not authenticate the network, so any transmitter can pose as a cell; weak or null ciphering is selected by the network | The core reason to disable 2G on managed devices. Android's own platform documentation states that 2G has no mutual authentication between device and base station. |
| 3G (UMTS) | Mutual authentication added, but identity can still be requested in clear and the device can be redirected to 2G | Largely switched off in many markets; still a downgrade stepping stone where it remains |
| 4G (LTE) | Pre-authentication messages (identity request, attach reject, connection release with redirect) are not protected, and broadcast system information is unsigned | Fake LTE cells can harvest the IMSI or push the device to 2G even though they cannot complete authentication |
| 5G (NR) | The permanent identifier (SUPI) is concealed as a SUCI using the home network public key, but only if the operator provisions a protection scheme other than the null scheme; broadcast information is still unsigned | Check the SUCI scheme with your operator and do not allow fallback to 2G. See the 5G Security Guide. |
3GPP has studied the remaining problem directly: TR 33.809, "Study on 5G security enhancements against False Base Stations (FBS)", is a Release 18 technical report (version 18.1.0 at the time of checking, October 2026). It is a study, not a mandatory specification, so do not assume its options are deployed in your operator's network.
Two different threat actors
- Surveillance IMSI catchers: aim to identify and locate specific devices, sometimes to intercept 2G traffic. Relevant to executives, journalists, staff travelling to high-risk countries and anyone at protests or sensitive sites. See the Mobile Communications Protection for High-Risk Individuals Guide.
- SMS blasters: criminal devices, often carried in a vehicle, that pull nearby phones onto a fake cell (usually 2G) and broadcast phishing texts impersonating banks, couriers or government. In January 2026 Hellenic Police arrested suspects near Athens with a system hidden in a car boot and a roof antenna disguised as a shark fin; reporting said it downgraded phones from 4G to 2G and sent bank and courier lures. In April 2026 Toronto Police announced 44 charges against three men over a vehicle-mounted device, with authorities reporting more than 13 million network disruptions, including effects on access to 911.
The baseband as an attack surface
The baseband processor runs a large, mostly proprietary protocol stack that parses every message a cell sends, including messages that arrive before any authentication. That makes it a parser exposed to untrusted radio input, with its own firmware and update cycle separate from the application processor.
- Patch the modem, not only the OS: baseband fixes ship in vendor security bulletins and firmware updates. Track the modem firmware version as an inventory attribute for phones, routers and cellular IoT modules.
- Isolation matters: on many modern phones the baseband is isolated from the application processor in hardware, but cellular routers and IoT modules often expose the modem over USB or serial with an AT command interface. Treat that interface as privileged. See the Debug Interfaces Security Guide.
- IoT fleets cannot use a settings toggle: many cellular modules allow the radio access technology to be restricted in configuration. Where the module and the operator support LTE-M, NB-IoT or LTE only, lock it there instead of leaving automatic fallback to 2G.
- The SIM is a separate trust anchor: SIM keys and over-the-air SIM management are operator concerns; the fake base station problem sits on the radio side and cannot be fixed by changing SIM vendor.
Platform controls for mobile fleets
Both major mobile platforms now provide controls that close the downgrade path. The names below are from the platform documentation and source code.
| Control | Platform | What it does | Management route |
|---|---|---|---|
| Allow 2G toggle | Android (user setting) | Lets a user stop the device using 2G; emergency calls are excepted | User education; not enforceable alone |
DISALLOW_CELLULAR_2G user restriction (no_cellular_2g) | Android Enterprise | Stops the device using 2G; set by a device owner, or a profile owner of an organisation-owned managed profile on the parent profile; applies to the whole device; emergency calls still use 2G if needed | EMM/MDM policy, needs the MANAGE_DEVICE_POLICY_MOBILE_NETWORK permission or device owner rights |
| Null cipher and integrity rejection | Android (setNullCipherAndIntegrityEnabled, system API) | Allows the device to refuse null-ciphered and null-integrity connections; the modem ignores it for emergency calls; throws if the modem does not support it | Depends on device and modem support; check per model |
| Cellular identifier disclosure notifications | Android (system API) | Notifies when the device sent a cellular identifier on the NAS layer before a security context existed, that is in the clear | Device and modem dependent; feature-flagged in AOSP |
| Null cipher notifications | Android (system API) | Notifies when the modem is using null cipher or integrity algorithms | Device and modem dependent |
| Lockdown Mode | iOS and iPadOS | Among other restrictions, turns off 2G and 3G cellular support and stops automatic joining of non-secure Wi-Fi | User-enabled; heavy functional impact, so reserve for high-risk users |
The Android null cipher and transparency APIs are marked as system APIs in AOSP, which means availability depends on the handset maker and the modem. Test on each model in your fleet rather than assuming the setting exists. See the Mobile Device Management Security Guide for how restrictions are delivered.
Decision guidance: who gets which control
| Population | Recommended baseline | Trade-off |
|---|---|---|
| All corporate-owned Android devices | DISALLOW_CELLULAR_2G on, null cipher rejection where supported | Loss of service where only 2G exists (rural, some roaming destinations); emergency calls unaffected |
| Corporate iPhones, general staff | No 2G control outside Lockdown Mode; rely on awareness and phishing controls | Platform gap; document it as accepted risk |
| Executives, journalists, staff travelling to high-risk countries | Lockdown Mode on iOS, 2G disabled on Android, end-to-end encrypted messaging and calling, no SMS one-time codes | Lockdown Mode breaks some web and messaging features; brief users before travel |
| BYOD and work profiles | Encourage the user 2G toggle; a work profile on a personal device cannot set the device-wide restriction | Limited enforcement; focus on app-level controls |
| Cellular IoT and routers | Restrict radio access technology to LTE, LTE-M, NB-IoT or 5G where coverage allows; keep modem firmware current | Coverage loss where networks have not retired 2G; check with the operator |
Small organisations without an MDM should at least publish a short instruction to switch off 2G on Android phones and offer Lockdown Mode to the few people who need it. Large organisations should treat 2G as a configuration baseline item and report compliance per model.
Where identity fits
Fake base stations matter to identity teams because SMS remains a delivery channel for one-time codes, account recovery links and bank alerts. A device camped on a fake 2G cell may receive a convincing text from a spoofed sender name, and on 2G the traffic itself lacks network authentication. Move workforce MFA off SMS to phishing-resistant authenticators, and treat any SMS-delivered recovery flow as a phishing surface. See the SIM Swap Fraud Guide and the Vishing and Smishing Guide. For cellular IoT, the device's network credentials and any SMS-based management commands are machine identities: restrict which numbers may send configuration SMS and prefer authenticated management channels.
Detecting fake base stations
No single signal proves a fake base station. Combine handset, sensor and operator evidence.
Indicators and where they come from
| Indicator | Source | Notes |
|---|---|---|
| Identity (IMSI or IMEI) requested and then the connection released without authentication | Rayhunter "IMSI Requested" heuristic; Android identifier disclosure notification | Strongest single sign; legitimate networks also request identity occasionally |
| Connection release with redirect to a 2G carrier | Rayhunter "Connection Release/Redirected Carrier 2G Downgrade" | The downgrade step itself |
| LTE system information (SIB6 or SIB7) giving 2G or 3G higher priority than 4G | Rayhunter "LTE SIB6/7 Downgrade" | Pushes idle devices toward legacy networks |
| Null cipher (EEA0) at the RRC or NAS layer | Rayhunter "Null Cipher" and "NAS Null Cipher"; Android null cipher notification | Unexpected on a commercial network after authentication |
| SIB1 lacking scheduling for expected further SIBs | Rayhunter "Incomplete SIB" | May be misconfiguration alone; strong when combined with identity requests |
| Clusters of smishing reports from one area at one time | Users, fraud team, operator spam reporting | Typical SMS blaster pattern, since the messages never pass through operator filters |
| Local service disruption or dropped calls in a moving pattern | Operator network monitoring | Toronto investigators cited more than 13 million network disruptions |
Using sensors safely
- EFF Rayhunter: an open-source (GPL-3.0) Rust project that runs on supported mobile hotspots, originally the Orbic RC400L, and analyses the device's own diagnostic traffic against the heuristics above. Its heuristic documentation notes it is designed to minimise false positives and that some analysers are disabled by default as experimental or noisy.
- Passive only: sensors should observe the device's own signalling. Transmitting, jamming or interfering with cellular networks is unlawful in most jurisdictions; leave active investigation to the operator and law enforcement.
- Data handling: captures contain subscriber identifiers and location context. Store them as personal data, restrict access and set a retention period.
Responding to a suspected fake base station
- Preserve evidence: keep sensor captures, handset notifications with timestamps and location, and screenshots of received texts including the sender name.
- Protect users: warn staff in the area, remind them that no legitimate bank or courier needs credentials by text, and ask them to enable the 2G restriction or Lockdown Mode where appropriate.
- Report to the operator: operators can correlate with radio network data and are usually the party able to confirm a rogue cell.
- Report to police: both the Greek and Canadian cases ended in arrests after reports and investigation; in Toronto the investigation began with a tip from a cybersecurity partner. See the Engaging Law Enforcement During a Cyber Incident Guide.
- Check for fraud follow-on: search for credential use from phishing sites in the same period, reset affected accounts and block reported domains.
- Review: record which controls were missing on affected devices and fix the baseline.
Implementation roadmap
- Inventory: list device models, OS versions and modem firmware; record which models support the 2G restriction and null cipher controls.
- Pilot: enable
DISALLOW_CELLULAR_2Gon a pilot ring that includes frequent travellers; collect connectivity complaints for two to four weeks. - Exceptions: define an exception route for roles that genuinely need 2G coverage, with an expiry date. Rollback is a policy change in the MDM that removes the restriction.
- Roll out: extend to all corporate-owned Android devices; offer Lockdown Mode to high-risk iPhone users with a briefing.
- IoT: restrict radio access technology on cellular modules during the next maintenance window, testing coverage at each site first.
- Detection: route smishing reports to one queue, agree a reporting contact at each operator and, where risk justifies it, deploy passive sensors at sensitive sites.
Measuring it
- 2G restriction coverage: percentage of corporate-owned Android devices with
DISALLOW_CELLULAR_2Gapplied (target close to 100 per cent, minus documented exceptions). - High-risk user coverage: percentage of designated high-risk users with Lockdown Mode or the Android equivalent enabled.
- Modem patch latency: median days from a baseband fix in a vendor bulletin to deployment across the fleet.
- SMS-based MFA remaining: number of workforce accounts still using SMS codes.
- Time to operator report: hours from first smishing cluster report to notification of the operator.
- IoT legacy fallback: number of cellular modules still allowed to fall back to 2G.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SC-40 Wireless Link Protection; SC-40(3) Imitative or Manipulative Communications Deception | Protecting wireless links against imitative signals |
| NIST SP 800-53 Rev. 5 | AC-18 Wireless Access; SC-8 Transmission Confidentiality and Integrity; SI-4 System Monitoring | Restricting radio technologies, protecting traffic, monitoring |
| NIST CSF 2.0 | PR.PS-01, PR.DS-02, DE.CM-01 | Configuration baselines, data in transit, network monitoring |
| MITRE ATT&CK for Mobile | T1638 Adversary-in-the-Middle; T1660 Phishing | Interception position and SMS lure delivery |
| MITRE CAPEC | CAPEC-617 Cellular Rogue Base Station | The attack pattern itself |
| ISO/IEC 27001:2022 Annex A | A.8.1 User endpoint devices; A.8.20 Networks security | Device configuration and network protection |
The older ATT&CK for Mobile techniques for rogue cellular base stations and protocol downgrade are revoked in ATT&CK v20, so map to T1638 instead.
Common failure patterns
- Assuming 5G phones are immune: a 5G device that still accepts 2G can be pushed there; the strong 5G protections only apply while the device stays on 5G.
- Relying on BYOD settings: a work profile cannot enforce the device-wide 2G restriction, so the policy silently covers only part of the fleet.
- Treating smishing as an email-style filter problem: SMS blaster texts never touch the operator's SMS firewall, so filtering investments do not help; reporting and authentication of the request do.
- Forgetting cellular IoT: routers, meters and trackers left on automatic network selection keep the 2G fallback path open for years.
- Acting on a single heuristic: escalating every identity request or incomplete SIB alert as an attack burns trust in the detection programme; correlate indicators first.
- Running active countermeasures: jamming or transmitting to "find" a fake cell is illegal in most countries and can disrupt emergency calls.
Practitioner checklist
- Inventory device models, OS versions and modem firmware, including cellular IoT modules.
- Apply
DISALLOW_CELLULAR_2Gto corporate-owned Android devices after a pilot ring. - Enable null cipher rejection and cellular transparency notifications on models that support them.
- Offer and brief Lockdown Mode for high-risk iPhone users and before travel to high-risk destinations.
- Restrict radio access technology on cellular IoT where coverage allows.
- Move workforce MFA and account recovery away from SMS.
- Confirm with your operator that the 5G SUCI protection scheme is not the null scheme.
- Agree operator and police reporting contacts and an evidence checklist for suspected fake base stations.
- Track the six metrics above and review exceptions quarterly.
Standards and references
- 3GPP: TR 33.809 Study on 5G security enhancements against False Base Stations
- Android Open Source Project: UserManager (DISALLOW_CELLULAR_2G)
- Android Open Source Project: TelephonyManager (null cipher and identifier disclosure APIs)
- Apple: About Lockdown Mode
- Electronic Frontier Foundation: Rayhunter heuristics
- MITRE CAPEC: Cellular Rogue Base Station
- MITRE ATT&CK: Adversary-in-the-Middle (Mobile)
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Telecom Network Security Guide · 5G Security Guide · SS7 and Diameter Signalling Security Guide · Scam Prevention in Telecoms Guide · Mobile Device Security Guide