Detecting Fake 4G LTE Base Stations in Real Time

This talk explains how fake 4G/LTE base stations, or IMSI catchers, work and demonstrates an open-source project using relatively inexpensive hardware to detect them in real time. It covers decoding broadcast and system information, mapping antennas, identifying anomalies, and future plans to limit IMSI catcher capabilities.

Syllabus

Intro
What is a Cell-Site Simulator
Our First Efforts to Detect Cell Site Simulators
The Stingray
How do 4G/LTE CSS Work
How Often are CSS Being Used
Previous Efforts to Detect CSS
Crocodile Hunter Software and Hardware
Decode Broadcast Messages SRSLTE scans a list of frequencies for information blocks Decode system information blocks and send over socket
Mapping out antennas in real time
Looking for Anomalies
Oakland, CA
What's With the Name?
Future Work
Key Takeaways