Researchers at KAIST have developed a testing platform called 'Devilray' that can simulate 2,592 different operations of fake cell towers, which deceive smartphones to steal personal information. Testing revealed that all seven existing detection systems failed to identify at least 192 of these operational configurations.
Professor Kim Yong-dae and his team from the Department of Electrical Engineering collaborated with the National Security Research Institute, Kyung Hee University, the University of Florida, and Cape to create Devilray, as announced on November 4.
Fake cell towers are devices that emit signals mimicking legitimate towers to lure nearby smartphones into connecting. They can be used to collect smartphone identification information, track locations, and disrupt communications. Recently, criminals have been using fake cell towers mounted in vehicles to send phishing messages impersonating financial institutions or delivery companies, a crime known as 'SMS Blaster' that has been reported globally.
Despite over 20 years of research into detection methods, acquiring various real devices for testing has proven challenging. Commercial products are expensive and difficult to obtain, making it hard for university researchers, mobile carriers, and law enforcement agencies to have access to all equipment and new variants. Attackers can alter messages and communication procedures, creating gaps in detection technologies that have only tested a few known attacks.
The research team analyzed the operations of commercial fake cell towers alongside existing studies and the international telecommunications standard 3GPP. They categorized the operations of fake cell towers into four stages: scanning surrounding networks, transmitting fake signals, inducing smartphone connections, and executing attacks. They identified seven key elements that attackers can modify.
By applying 21 rules to filter out combinations that cannot be used in actual communications, they implemented 2,592 distinct operational configurations. This number represents the various methods that can be simulated on the platform, not the actual number of attacks or instances of evading detection. The team connected all configurations to real smartphones to verify that the entire communication process functioned normally.
The team evaluated seven existing detection systems using Devilray, which employ different principles such as communication messages, base station information, radio signals, statistical features, and machine learning. The primary reasons for detection failures were twofold: systems that relied on specific messages as clues missed attacks conducted through different procedures, and some attacks were indistinguishable from normal network communications.
Simply strengthening detection criteria was insufficient. When the team trained machine learning-based detectors on previously missed attacks, detection rates improved, but false positives—normal communications misidentified as attacks—increased as well. This indicates the need to evaluate both the accuracy of detecting attacks and the precision of identifying normal communications.
The research team shared instances of attacks missed by the Electronic Frontier Foundation's (EFF) detection tool 'Rayhunter' with EFF, which is currently researching new methods to capture these attacks. They were also invited to present Devilray at the Global System for Mobile Communications Association (GSMA) Fraud and Security Working Group meeting, discussing future detection strategies with industry representatives from various countries.
Professor Kim Yong-dae stated, 'The relationship between fake cell tower attacks and detection should ideally be a competitive one between attackers and defenders. However, until now, it has been an uneven playing field favoring attackers. The goal of Devilray is not to disable existing detectors but to provide defenders with a variety of actions that attackers can choose from, creating a research foundation for the simultaneous advancement of both attack and defense.'
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.