Reference this if you're evaluating on-device mobile network monitoring tools, or want a concrete example of turning baseband diagnostics into a defensive signal rather than just an attack surface.
A practical, defender-focused walkthrough of SnoopSnitch, the Android tool Karsten Nohl's team built to detect IMSI catchers, silent SMS, and SS7 attacks directly from a phone's own baseband logs.
Call flow illustrating how an unauthenticated Network Function (Rogue NF Consumer) queries the NRF for discovery and retrieves access tokens without adequate TLS mutual auth or token scoping.
Rogue NF queries NRF discovery endpoint to enumerate registered UDM instances in PLMN.
Core network architecture in 5G Standalone (SA) where Network Functions (AMF, SMF, NRF, UDM) communicate via HTTP/2 REST APIs with OAuth2 authentication.
Vulnerable to NRF token abuse, unauthorized REST discovery, and API gateway parameter tampering.
Karsten Nohl discusses active defensive tactics against mobile network attacks. The talk introduces tools like SnoopSnitch to help users detect network-level anomalies, IMSI catchers, and SMS/SS7 exploits, shifting from vulnerability discovery to community-driven defense.
Karsten Nohl: Mobile networks remain structurally insecure, but users and enterprise defenders do not have to remain passive.
Radio threat models: Attackers use both passive eavesdropping via cheap RTL-SDRs and active rogue base stations to intercept communications.
We built SnoopSnitch to tap into diagnostic logs directly from the Qualcomm cellular modem chip, bypassing high-level Android API abstractions.
Detecting fake cell towers: SnoopSnitch flags sudden cipher mode downgrades (e.g. A5/1 to A5/0), anomalous location update rejections, and irregular neighbor cell measurements.
Silent SMS (Type 0 SMS) tracking: Attackers ping targets to generate radio acknowledgments without alerting the user. SnoopSnitch detects and logs these stealth paging events.
Shifting to crowdsourced defense: By pooling anonymous baseband telemetry, security teams can construct global maps of SS7 exploitation and IMSI catcher activity.
