[red0point]

As it turns out, you do not even need cell site simulators / false base station to do IMSI catching.

In my research, I developed a technique to attack a phone with low power from km away, without being able to be detected at all with traditional tools like SeaGlass or Crocodile Hunter. It‘s published here and works against production LTE networks, no downgrade attacks whatsoever necessary:

https://dl.acm.org/doi/10.1145/3495243.3560525

[1vuio0pswjnm7]

Direct link to PDF

https://arxiv.org/pdf/2106.05039.pdf

https://www.research-collection.ethz.ch/bitstream/handle/20....

[eru]

(For people wary of ACM's paywalls: this specific paper seems to be open access. Nice!)

[abwizz]

https://sci-hub.st/

you're welcome

[darkclouds]

In the UK Vodafone use 5G-NSA, other telco's use 5G-SA as its more battery friendly.