How a fake base station works, and why it still works

The behaviour at the centre of this is a design decision from the era from the era when mobile networks were being built to work. A handset arriving in a new area surveys what it can hear, picks the cell that offers the best service, and asks to attach. The network then verifies the subscription, using the key held on the subscriber module, and admits it.

What that sequence lacks is the mirror image. The network establishes that the subscription is genuine; the handset establishes nothing whatever about the network. In the second generation this was explicit and unremedied, and a device that broadcast the right identifiers and a strong enough signal would be selected on its merits, because signal strength was the merit being assessed. Later generations added mutual authentication, which closes the impersonation of an established session, but the disclosure being discussed here happens earlier than that: before there is a session to protect.

This is why the technique is not really an exploit in the usual sense. It does not depend on a flaw in an implementation, a weak key or a protocol error. It depends on the handset doing what it is supposed to do, at the one moment when it has no basis for doing anything else. Whether a device using that opening is operating under an authorisation is a separate question, and one the mechanism cannot answer: see the comparison with interception inside the network.

Networks were aware that transmitting a permanent identity in the open was undesirable, and they addressed it with temporary identifiers: once a subscription is known, it is addressed by a short-lived value instead, and the permanent identity stays off the air. In steady state this works.

The weakness is in the fallback. There has to be a way to establish the permanent identity in the first place, and there has to be a way to recover when the temporary value is unknown to the network, has expired, or belongs to a different network. So the protocol retains a message that asks the handset for its permanent identity, and the handset answers it, because a handset that refused would be unable to attach anywhere new.

An interception device therefore does not need to defeat anything. It needs to be selected, and then to be in a position where asking the ordinary question is reasonable. Both halves are available to it: the first because cell selection favours the strongest candidate, the second because a network that has never seen a given subscription before is exactly the situation the fallback exists for.

A related move makes the position easier still. The older the generation, the weaker the protections that follow the initial exchange, so a device that can persuade a handset to prefer an older technology inherits a simpler problem. That preference is influenceable, and the resulting drop is the signal detection leans on most heavily, precisely because an attacker has a use for it.

The countermeasure does not try to make cell selection safe, which would mean solving the problem of trusting a stranger before any relationship exists. It removes the prize instead. The permanent identifier is encrypted on the device, using a key belonging to the home operator, before it is ever transmitted, so the ordinary question can still be asked and the ordinary answer is no longer worth collecting: it cannot be resolved to a subscription by anyone but the home operator, and it does not repeat, so two sightings cannot be matched to each other. The concealment page sets out the mechanism and its limits.

Three things are deliberately left alone. Cell selection still prefers the best signal, so a handset can still be induced to attach to a device that is not what it claims. The routing prefix that says which operator to ask remains readable, because the network that receives the request has to know where to send it. And the concealment applies to the subscriber identity and not to the equipment identifier, which is a distinction with consequences for anyone relying on a change of subscription as a precaution.