Detection of malicious base station attacks through the carrier analysis

In 2G and 3G mobile standards there are vulnerabilities caused by the use of false Base Station (BS). In 3G security architecture offers protection against BS attacks, however when the User Equipment (UE) is configured in automatic GSM/3G mode this UE can accept connections coming from GSM/GPRS BSs that are configured as an attacker finally establishing a connection with such malicious BTS located within the UE´s coverage area. Even without the use of a frequency jammer, potential attack danger exists because the connection between an UE and the fake BTS can be achieved if the BS is transmitting with more power than the real base station, and the UE enters in the handover process imposed by the 2G standard.