SeaGlass: City-Wide IMSI-Catcher Detection (2017)

BOM from the paper: Telit GT-864 QUAD/PY GSM modem $65 External antenna $25 Raspberry Pi 2B+2 $35 GPS (GlobalSat BU-353) $30 Bait Phone (Motorola Moto-G 4G LTE) $95 4G Hotspot (ZTE Z917) + 3 month plan $100 DC/AC inverter $26 Powered USB Hub $17 Pi accessories $15 SD Card (32 GB) $17 Modem accessories $30 Cables $35 Box $12 Total $502 https://seaglass-web.s3.amazonaws.com/SeaGlass___PETS_2017.p...

You could possibly achieve interesting results with a single handset to keep in your pocket as you go about your day. The Samsung Galaxy S3 is ideal due to the fact that Android apps are written to access low level data from it's baseband which is normally not available to end-user applications. In fact there is a company that sells re-modded S3's at a decent price for this exact purpose [1]. Save some money and find an old handset and…

As it turns out, you do not even need cell site simulators / false base station to do IMSI catching. In my research, I developed a technique to attack a phone with low power from km away, without being able to be detected at all with traditional tools like SeaGlass or Crocodile Hunter. It‘s published here and works against production LTE networks, no downgrade attacks whatsoever necessary: https://dl.acm.org/doi/10.1145/3495243.3560525