Rogue Base Station (Fake BTS)

A rogue base station is unauthorised radio infrastructure operated by an attacker that broadcasts a stronger signal than legitimate cells to attract nearby devices. Once attached, the attacker can perform IMSI capture, force cipher downgrade, inject silent SMS, or relay traffic for interception. Rogue base stations are the operational delivery mechanism for IMSI catchers and continue to threaten 2G and 3G networks; 5G's mutual authentication and SUCI mitigate but do not entirely eliminate the risk where fallback to legacy generations is permitted.

Categories: Radio Access NetworkSignalingIdentity and Subscriber

Rogue Base Station (Fake BTS) in context

The radio access network is the layer where mobile devices attach to the operator's infrastructure. Attacks in this layer include IMSI catching, rogue base stations, downgrade attacks and jamming, and defenses hinge on mutual authentication, integrity-protected signaling and Open RAN supply-chain hygiene.

Signaling protocols carry the control-plane instructions that set up calls, register subscribers, hand over sessions and route SMS. SS7, Diameter, GTP-C and SIP are the four dominant families, and interconnect exposure of any of them is treated by GSMA FS.11 / FS.19 / FS.20 as a top-tier telecom risk.

To place Rogue Base Station (Fake BTS) in the wider telecom-security picture, review BTS Impersonation (Fake BTS), SUPI Catcher, IMSI Catcher (Cell Site Simulator), Man-in-the-Middle (MITM), SMS Pumping and UMTS.

Related terms

Equipment

Base stations (BTS, NodeB, eNodeB, gNodeB)

Articles in the P1 mobile network security guide

Related topic hubs

  • IMSI Catcher Rogue base stations, IMSI capture and detection.
  • Signaling Firewall Unified SS7/Diameter/GTP/SMS signaling firewall framework.
  • 5G Security 5G SBA, SEPP, SUCI, 5G-AKA, N32 and service-based interface security.
  • NAS Security Non-Access Stratum security, integrity and ciphering algorithms.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.