drankitagarwal.in

Beyond the Cell Tower: Forensic Analysis of Satellite Direct-to-Cell (NTN) IMSI Catching

cs.ankit11@gmail.com

Introduction

The convergence of satellite telecommunications and standard cellular architecture has reached a major milestone. With the widespread adoption of 3GPP Release 17 and Release 18 Non-Terrestrial Networks (NTN), off-the-shelf smartphones can now establish direct voice, SMS, and data connections with Low Earth Orbit (LEO) satellite constellations without requiring specialized ground hardware. While this technology eliminates dead zones for emergency responders and remote travelers, it fundamentally alters the mobile threat landscape.

Historically, rogue base stations—commonly referred to as IMSI Catchers or Stingrays—were constrained by terrestrial physics. Attackers needed physical proximity, high-gain directional antennas, or compromised cellular towers to intercept traffic. Direct-to-Cell satellite links expand this attack vector to the sky. Threat actors can now simulate orbital satellite payloads or deploy high-altitude balloon relays to trick User Equipment (UE) into attaching to malicious Non-Terrestrial cells. In this deep dive, we will examine the mechanics of direct-to-cell signal hijacking, analyze the baseband forensic artifacts left behind, and establish actionable detection frameworks for incident responders.

Understanding 5G NTN Direct-to-Cell Architecture

To analyze how satellite signal hijacking occurs, digital forensics and incident response (DFIR) professionals must first understand the structural baseline of 3GPP 5G NR NTN architecture. In a standard terrestrial network, a mobile phone connects to a stationary Next Generation NodeB (gNodeB). In an NTN environment, the cell site moves at extreme orbital velocities (roughly 7.5 km/s for LEO satellites) or operates as a transparent transponder relaying signals back to a ground gateway.

This dynamic introduces two critical technical operational challenges that cellular basebands must accommodate:

To enable synchronization, 5G NTN relies on System Information Block 19 (SIB19). SIB19 broadcasts essential satellite assistance data, including satellite Ephemeris parameters (orbital position and velocity vectors) and precise timing advance offsets. This broadcast mechanism creates the exact opening exploited by satellite-focused IMSI catching techniques.

Anatomy of an Orbital IMSI Catching Attack

An Airborne or Orbital Fake Base Station (Orbital FBS) does not necessarily need to be in outer space. Attackers can leverage rogue ground stations, high-altitude pseudo-satellites (HAPS), or unmanned aerial vehicles (UAVs) transmitting at elevated power levels while spoofing valid 3GPP NTN parameters.

Step 1: Broadcast Spoofing and Ephemeris Manipulation

The rogue station broadcasts high-power 5G NR NTN synchronization signals (PSS/SSS) matching legitimate NTN Mobile Country Codes (MCC) and Mobile Network Codes (MNC). The malicious transmitter broadcasts a forged SIB19 payload containing altered satellite position data designed to match the attacker’s relative position or force the mobile device to disable local terrestrial fallback searches.

Step 2: Forceful Down-Selection and Target Attachment

Mobile baseband modems are hardcoded to continuously search for the strongest Signal-to-Interference-plus-Noise Ratio (SINR). By overpowering legitimate orbital signals—which suffer approximately 160–170 dB of Free Space Path Loss (FSPL)—a local or elevated rogue transmitter easily wins the baseband selection algorithm. The target device initiates a Registration Request over the radio access interface.

Step 3: Identity Downgrade and Extraction

While 5G Standalone (SA) introduces the Subscription Concealed Identifier (SUCI) to encrypt public user identities (SUPI/IMSI), legacy fallback mechanisms or misconfigured non-standalone NTN implementations allow attackers to inject Identity Request frames demanding the plain-text IMSI or IMEI, achieving target identification and location tracking.

Key Insight: Ground-based rogue transponders exploiting NTN frequencies frequently fail to simulate realistic Doppler shifts, providing forensic examiners with a vital signature for detection.

Digital Forensic Artifacts of Satellite Signal Spoofing

When investigating suspected wireless interception or unauthorized location tracking, forensic examiners must extract and correlate data from both device baseband diagnostics and system-level logging.

1. Baseband Diagnostic Logs (QXDML / DIAG Artifacts)

Extracting diagnostic traces from Qualcomm or MediaTek basebands reveals raw Radio Resource Control (RRC) layer messages. Look for severe mismatches in the following parameters inside LTE/5G NAS ESM/MM Log Packets:

2. Android Protocol Buffer and Cellular Telemetry Logs

On Android devices running custom forensic builds or engineering firmware, parsing cellular status via dumpsys telephony.registry yields key anomalous states:

mServiceState=CellNetworkScanResult {
  mCellId=28491024,
  mTac=4091,
  mNrFrequency=2170000 (S-Band Direct-to-Cell),
  mSignalStrength=-68dBm, -- Anomalously strong for LEO NTN
  mIsNtn=true
}

A signal strength of -68 dBm on an S-band or L-band NTN carrier frequency is physically improbable for a legitimate space-borne satellite communicating with an unamplified smartphone antenna. Legitimate space-to-ground signals typically register between -105 dBm and -125 dBm.

Practical Detection: Correlating GNSS with SIB19 Telemetry

To automate the detection of satellite IMSI catching, defenders can correlate the device’s hardware Global Navigation Satellite System (GNSS) position against the orbital parameters claimed in the broadcasted SIB19 frame.

The Python script snippet below demonstrates the logic required to validate broadcasted satellite Ephemeris parameters against physical propagation metrics during baseband trace parsing:

def validate_ntn_cell_legitimacy(measured_rssi, measured_rtt_ms, sib19_ephemeris_data):
    """
    Validates whether a 5G NTN base station signal aligns with orbital physics.
    """
    # Threshold 1: Received Signal Strength Indicator (RSSI) Check
    # LEO signals over unamplified mobile antennas rarely exceed -100 dBm
    if measured_rssi > -85:
        return {
            "status": "SUSPICIOUS",
            "reason": f"RSSI standard anomaly: Signal strength ({measured_rssi} dBm) too high for orbital source."
        }
    
    # Threshold 2: Physical Round-Trip Time Check
    # Minimum LEO altitude (~500km) dictates a absolute physical RTT lower bound (~3.3ms)
    if measured_rtt_ms < 3.0:
        return {
            "status": "MALICIOUS",
            "reason": f"Propagation RTT ({measured_rtt_ms} ms) indicates ground proximity. Likely IMSI Catcher."
        }
        
    return {"status": "CLEAN", "reason": "Parameters fall within expected NTN bounds."}

# Example Test Case: Ground-based Rogue Transmitter Spoofing NTN
test_scan = validate_ntn_cell_legitimacy(measured_rssi=-72, measured_rtt_ms=0.4, sib19_ephemeris_data={})
print(f"Detection Alert: {test_scan['status']} -> {test_scan['reason']}")

Hardening Strategy and Incident Mitigation

Defending mobile enterprise fleets and sensitive field operators against direct-to-cell interception requires a layered operational security posture:

  1. Enforce 5G SA SUCI Strict Mode: Mobile Device Management (MDM) profiles should restrict cellular modems from falling back to 5G Non-Standalone (NSA) or legacy 3G/4G modes in areas where NTN services are active, ensuring identity keys remain encrypted.
  2. Cross-Layer Telemetry Auditing: Implement mobile threat defense (MTD) agents capable of cross-referencing cell broadcast power levels with hardware GNSS telemetry to flag impossible propagation characteristics.
  3. Spectrum Monitoring in Secure Facilities: Sensitive sites must update radio frequency (RF) monitoring tools to capture incoming upper S-band (2.1 GHz) and L-band (1.5–1.6 GHz) frequencies allocated for 3GPP NTN, alerting security teams when localized high-power transmitters appear.

Conclusion

The expansion of cellular networks into orbit closes critical communication gaps, but it fundamentally redefines mobile wireless threat modeling. Rogue base stations are no longer strictly limited to mimicking local ground towers; they can masquerade as overhead satellite arrays to harvest identities and intercept traffic. By mastering baseband diagnostic forensics, monitoring Doppler variances, and enforcing physical bounds checking between GNSS data and RF telemetry, security teams can effectively detect and neutralize skyward evasion tactics.

Exit mobile version