KAIST finds 2,592 blind spots in fake base station detection

South Korean researchers have developed a technology capable of identifying security vulnerabilities in fake base stations — rogue devices used to steal personal information from smartphones or track users' locations.

KAIST announced Wednesday that a research team led by Professor Kim Yong-dae of the Department of Electrical Engineering developed a test platform called Devilray in collaboration with the National Security Research Institute, Kyung Hee University, the University of Florida and Cape. The platform can replicate the various behaviors of fake base stations and verify weaknesses in existing detection technologies.

A fake base station is a device that masquerades as a legitimate mobile network tower to lure nearby smartphones into connecting to it. Once connected, it can be exploited to collect device identification data, track users' locations or disrupt communications.

The threat has grown more sophisticated in recent years, with criminals worldwide mounting fake base stations on vehicles and driving through populated areas to send phishing text messages impersonating financial institutions or delivery companies — a scheme known as SMS blasting.

The core problem is that existing detection technologies struggle to catch all the rapidly evolving attack methods.

To overcome this limitation, the research team conducted a comprehensive analysis of real commercial fake base station operations, prior academic research and the 3GPP international mobile communications standard.

The team broke down fake base station behavior into four stages — scanning nearby networks, transmitting rogue signals, luring smartphones into connecting and executing attacks — and identified seven key parameters that an attacker can manipulate.

Applying 21 rules to exclude combinations that cannot occur in actual communications, the team produced a total of 2,592 distinct attack configurations. The researchers also verified, using real smartphones, that every configuration operates in accordance with actual communications protocols.

Using this framework, the team evaluated seven existing fake base station detection systems that operate on different principles, including analysis of communications messages, radio signals, base station information and machine learning.

As a result, all seven systems each failed to detect at least 192 of the 2,592 attack configurations.

The evaluation also exposed a new problem in efforts to improve detection performance. When machine learning-based detection systems were retrained on previously missed attacks, their detection rates improved — but so did the rate of false positives, with normal communications being incorrectly flagged as attacks.

A key feature of Devilray is that it allows researchers to replicate a wide range of attack scenarios and repeatedly test detection technologies without having to obtain expensive commercial fake base station equipment.

The research team plans to develop technology that combines data gathered from smartphones, mobile carrier networks and dedicated radio signal collection devices to detect fake base stations in real time and pinpoint their locations.

Because the structural vulnerabilities of the widely deployed LTE network are difficult to eliminate in the short term, the team said it will focus on building a multi-point monitoring system that can observe and respond to attack signals from multiple locations.

"Devilray provides defenders with visibility into the full range of actions available to attackers, making it a research foundation for advancing security technology," Kim said. "Mobile carriers and intelligence and law enforcement agencies will be able to test a wide variety of attack scenarios and develop and verify defensive technologies without having to acquire every piece of commercial equipment."