SEOUL, November 04 (AJP) - Detectors designed to catch fake base stations, rogue devices that pose as cell towers to hijack nearby smartphones, missed attacks when tested on a new platform built by a KAIST-led research team, the institute said Wednesday.
The platform, called Devilray, reproduces 2,592 distinct ways a fake base station can operate. When the team ran it against seven existing detection systems, each one failed to catch at least 192 of those configurations.
Closing the gaps proved harder than adding new rules. A machine learning detector retrained on the attacks it had missed caught more of them, but it also began flagging ordinary network traffic as attacks, according to the team led by Kim Yong-dae, a professor in KAIST's School of Electrical Engineering.
Once a phone connects to a fake base station, the device can collect its identifying information, track its location, cut off service or inject text messages. Criminals in several countries now drive such devices around in vehicles to send phishing texts posing as banks or delivery companies, KAIST said.
Detection research goes back about two decades, but commercial devices are expensive and tightly restricted. Labs, carriers and law enforcement agencies have therefore tested detectors against a handful of known attacks or homemade prototypes, while real attackers can reach the same goal through different messages and procedures.
The team built Devilray by analyzing a commercial fake base station alongside the global 3G, 4G and 5G technical standards. It then combined the steps an attacker can vary into 2,592 configurations, each confirmed to work on a real smartphone.
The figure is not a count of real-world attacks or of detectors actually evaded. It is the number of behaviors the platform can reproduce within the scope the researchers defined.
Some detectors missed attacks because they watch for a specific message that a different procedure avoids. Others could not separate attack behavior that closely resembled a normal network.
"Fake base station attacks and detection should, by nature, be a competition in which attackers and defenders evolve against each other, but until now it has been a playing field tilted in the attacker's favor," Kim said.
The team has given the Electronic Frontier Foundation, a U.S. digital rights group, attack cases its detection tool Rayhunter fails to catch, and presented the platform to a security working group of the GSMA, the global association of mobile operators.
The study was conducted with the National Security Research Institute, Kyung Hee University, the University of Florida and U.S. mobile carrier Cape. It will be presented at the IEEE Annual Computer Security Applications Conference (ACSAC 2026) in Los Angeles, which runs Dec. 7 to 11.
[Reference Information]
Journal/Source: IEEE Annual Computer Security Applications Conference (ACSAC 2026)
Title: Devilray: A Reconfigurable Adversarial Baseline for Revealing Blind Spots in Fake Base Station Detection
Link/DOI: https://arxiv.org/abs/2605.19232
Copyright ⓒ Aju Press All rights reserved.