Fake BTS Attacks of GSM System on Software Radio Platform

The 2G GSM communication system only provides one-way authentication mechanism which just authenticate the identities of mobile users. As we know, this is not resistant to fake BTS attack. But for the huge cost for building a fake BTS before, this kind of attack were not really implemented before. This paper presents an implement of fake BTS based on software radio technologies. Furthermore, this paper discusses two types of fake BTS attacks on our software radio platform. The first attack is IMSI/IMEI catch attack, which can get the mobile phone’s IMSI and IMEI. With this information, attacker can got the track of the man with this phone. The second attack is selective jamming attack. After get the IMSI and IMEI of the mobile phone, the attackers can decide whether the mobile phone is blocked or not. We will analyze the GSM protocol which is relevant to the interception system and later present the performance of such a system by real tests and demonstrate its feasibility.