IMSI-Catchers (commonly known as StingRays) are rogue cellular base transceiver stations configured to broadcast excessive power to trick nearby mobile phones into connecting.

1. Technical Anatomy of an IMSI-Catcher Attack

  • Forced 2G Downgrade: The rogue tower claims 4G/5G capabilities are unavailable, forcing the handset to negotiate legacy 2G GSM connections where mutual authentication is absent.
  • Null Encryption (A5/0): The fake base station commands the phone to disable ciphering, allowing plain-text voice, SMS, and IMSI identifier harvesting.
  • Detection Heuristics: Security tools detect rogue towers by monitoring sudden signal power spikes, rapid cell re-selection anomalies, and missing Neighbor Cell broadcast lists.