Detection of Real-world Fake Base Station (FBS) Attacks in Thailand

It's been a while since we created our security tutorial, back in 2018. One of the items we discussed in there were the fake cell towers or the fake base stations. The issues highlighted there still exist as highlighted by AIS CISO, Pepijn Kok at The Telecom Threat Intelligence Summit (TTIS) 2024.

The cyber threat actors exploited GSM authentication vulnerabilities to use fake base stations as part of SMS phishing attacks to steal from real bank accounts. In his talk Pepijn explains how AIS worked with ecosystem partners in Thailand to detect and block these attacks.

The talk described two case studies. The first one was a report from Dec 2022 where certain bank customers and online retail platform users were receiving SMS messages masquerading as the bank or online platform itself (something not typically possible). The messages contained links to malicious content. The second one is a recent case from April 2024 where AIS customers started receiving fake SMS with malicious links. It was obvious in that case that the SMS did not come from the AIS network which triggered AIS to start investigating as they were sure there was a fake base station in operation. The talk describes how in both the scenarios the gangs were caught.

The talk is embedded below:

You can learn more about TTIS here. The video of all the talks from day 1 is here and day 2 is here.

Related Posts: 

• The 3G4G Blog: Attack Surfaces for Different Generations of Mobile Technologies
• The 3G4G Blog: Presentations from ETSI Security Conference 2023
• The 3G4G Blog: Top 10 New (2022) Security Standards That You Need to Know About!
• The 3G4G Blog: Authentication and Key Management for Applications (AKMA) based on 3GPP credentials in the 5G System (5GS)
• The 3G4G Blog: 5G and Cyber Security
• The 3G4G Blog: Realizing Zero Trust Architecture for 5G Networks
• The 3G4G Blog: Bug hunting in 5G Networks and Devices
• The 3G4G Blog: AT&T Cybersecurity Experts Provide 5G Security Overview
• The 3G4G Blog: Everything you need to know about 5G Security
• 3G4G: Overview of Security in Mobile Cellular Networks 

How many Cell Sites and Base Stations Worldwide?

I wrote a blog post on this topic nearly three years back on the Operator Watch Blog here. That post is very handy as every few months someone or other asks me about this number. Here is a slightly updated number, though I am not confident on its accuracy. 

Gabriel Brown, analyst at Heavy Reading shares this chart above in the annual online Open RAN Digital Symposium. Based on the chart above, there are 7 million physical sites and 10 million logical sites. As there are many sites hosting infrastructure from multiple operators, the number of logical sites are more than the number of physical sites.

Again, most of the sites have distributed RAN (D-RAN) so there may be one or more base stations (baseband unit or BBU) and each base station can serve one or more radios. See links at the bottom for tutorials on these topics.

Per MIIT, new China 5G BTS shipments to drop by a third in 2023 relative to 2022 shipments. https://t.co/6iCMCh0ht6

— Stefan Pongratz (@StefanPongratz) March 9, 2023

China Tower had nearly 2.1 million telecom towers installed with 3.36m tower tenants at end of 2022. An MIIT minister said that China's operators will deploy 600k 5G base stations in 2023, taking total to 2.9m.

Astonishing scale of investment and execution in #China for #5G, creating a pervasive connectivity fabric that is driving massive digital transformation. 1.4 million base stations for 5G alone!!! For perspective, that nearly 3x India's total base station count...@mandalainsights https://t.co/9djZiiy67t

— Shiv Putcha (@shivputcha) January 21, 2022

The number of 5G radios in India just crossed 100,000 according to latest data released by the Department of Telecommunications. A base station generally manages multiple radios so not sure how many base stations would be there for 5G and even for older Gs.

In South Korea, according to the Ministry of Science and ICT and the mobile communication industry, as of December 2021, had 460,000 5G wireless stations of which, base stations accounted for 94% of the total, or 430,000 units, while repeaters only accounted for 30,000 units, or 6%.

Light Reading reported in September 2022 that there are nearly 419,000 cell sites across the US, according to the newest figures from CTIA. 

China and USA are roughly the same size so you can see how China is ensuring their mobile networks provide the best QoE. It should also be noted that the population of China is over four times that of the USA. On the other hand, India and China have the same population but India is one third the size of China roughly.

Related Posts:

• Operator Watch Blog: How many 5G Cell Towers & Base Stations Worldwide?
• The 3G4G Blog: Different Types of RAN Architectures - Distributed, Centralized & Cloud
• The 3G4G Blog: Open RAN Terminology and Players 

Different Types of RAN Architectures - Distributed, Centralized & Cloud

I come across a question relating to the different type of RAN architectures once per month on an average. Even though we have covered the topic as part of some or the other tutorial, we decided to do a dedicated tutorial on this.

The video and slides are embedded below

Beginners: Different Types of RAN Architectures - Distributed, Centralized & Cloud from 3G4G

As always, feedback and comments welcome.

Related Posts:

• The 3G4G Blog: Open RAN Terminology and Players
• The 3G4G Blog: A quick tutorial on Open RAN, vRAN & White Box RAN
• The 3G4G Blog: Open RAN Explanation, Videos, White papers and Other Resources
• The 3G4G Blog: O-RAN Introduction for Beginners
• Telecoms Infrastructure Blog: NTT Docomo's 5G Network is based on 'Open RAN' Principles
• Telecoms Infrastructure Blog: NTT Docomo's 5G RAN Infrastructure
• The 3G4G Blog: 5G RAN Functional Splits
• The 3G4G Blog: From traditional RAN to Open RAN - O-RAN: Goals and Challenges
• 3G4G: Open RAN, OpenRAN and O-RAN 

5G New Radio Standards and other Presentations

A recent Cambridge Wireless event 'Radio technology for 5G – making it work' was an excellent event where all speakers delivered an interesting and insightful presentation. These presentations are all available to view and download for everyone for a limited time here.

I blogged about the base station antennas last week but there are other couple of presentations that stood out for me.

The first was an excellent presentation from Sylvia Lu from u-Blox, also my fellow CW Board Member. Her talk covered variety of topics including IoT, IIoT, LTE-V2X and Cellular positioning, including 5G NR Positioning Trend. The presentation is embedded below and available to download from Slideshare

Overview of standardisation status and 3GPP technology evolution trend from 3G4G

The other presentation on 5G NR was one from Yinan Qi of Samsung R&D. His presentation looked at variety of topics, mainly Layer 1 including Massive MIMO, Beamforming, Beam Management, Bandwidth Part, Reference Signals, Phase noise, etc. His presentation is embedded below and can be downloaded from SlideShare.

5G NR: Key features and enhancements from 3G4G

Related Posts:

• Base Station Antenna Considerations for 5G
• Introduction to Fixed Wireless Access (FWA)
• 5G Network Architecture Options (Updated)
• Automated 4G / 5G HetNet Design

Base Station Antenna Considerations for 5G

I first mentioned Quintel in this blog three years back for their innovations in 4T8R/8T8R antennas. Since then they have been going strength to strength.

I heard David Barker, CTO of Quintel at Cambridge Wireless event titled "Radio technology for 5G – making it work" talking about the antennas consideration for 5G. There are quite a few important areas in this presentation for consideration. The presentation is embedded below:

Base Station Antenna needs for the 5G RAN from 3G4G

Related Posts:

• Using 8T8R Antennas for TD-LTE
• Antenna evolution: From 4G to 5G
• The Art of Disguising Cellular Antennas
• AT&T Blog: "Providing Connectivity from Inside a Cactus"
• Automated 4G / 5G HetNet Design

#CWHeritage Talk: The History of Synchronization in Digital Cellular Networks

CW (a.k.a. Cambridge Wireless) held a very interesting event titled 'Time for Telecoms' at the Science Museum in London. I managed to record this one talk by Prof. Andy Sutton, who has also kindly shared slides and some other papers that he mentions in his presentation. You can also see the tweets from the event on Twitter.

The video playlist and the presentation is embedded below.

The history of synchronisation in digital cellular networks from 3G4G

The papers referred to in the presentation/video available as follows:

• Martin Kingston: The need for Synchronisation in Telecommunications
• Charles Curry: Time from the Sky
• Sébastien Jobert & Kenneth Hann: Synchronisation and Time Distribution in Modern Telecommunications Networks
• Tommy Cook & Tim Frost: Stepping up to the Challenge on Tighter Time Accuracy.
• Andy Sutton: The history of synchronisation in digital cellular networks

LTE Base station equipment

If interested, more details available in the NTT Docomo whitepaper here.