I am not sure about the authentication protocol. But along the same lines of thinking, it really seems like this should be detectable with software. For example, what if you used crowd sourced cell tower information to notify users / block transmissions from any cell phone tower newly detected for 24 hours or so. It seems like a temporary tower setup for a few hours should be easily noticeable compared against static, permanent ones.

Also, judging by how ridiculously hard the company who makes them is trying to keep them hidden (NDA's, etc.), it seems like they may realize that if the details of the product were known it could be easily circumvented.

IMSI catchers ('Stingrays') are indeed detectable, an example is the 'Android IMSI-Catcher Detector (AIMSICD)' project:

http://secupwn.github.io/Android-IMSI-Catcher-Detector/

It would be interesting to test this out

I tend to believe that the reason that the company uses NDA's is to give the Authorities plausible deniability. "We couldn't apply for a warrant Your Honor, because we would have been breaking our NDA". The cops probably love the NDA, it is probably a feature of the product!

Submitting data to wigle.net using their Android app is one way to start building enough cell tower information to make this very visible.

wasn't wigle very unfree? I'd love to contribute to an open cell collection project where I can download everything.

I think this might be similar to what we are looking for? http://opencellid.org/

The police has no agreement with the telcos, in the contrary, IMSI catchers ('Stingrays') are a convenient way for lawful interception without involvement of telcos. From a telco's perspective, IMSI catchers kind of hack their network. In any case, you can build your own IMSI catcher, German hackers – among others – published instructions already years ago.

There are agreements in place

Do you have a source for that? Basically, IMSI catching does not require any cooperation with telcos. On the other hand, it is easy to imagine that some telcos might betray their customers – especially under the cover of secrecy.

There are sources available that can be found with some digging. I'm just speaking on the stuff that relates to the work I do.

GSM has cryptographic challenge-response authentication, but only handset authenticates itself to the network, not the other way around. Also, network can just not require authentication at all (which is how devices like this work).

Having authentication credentials preloaded is impractical for both GSM and UMTS/W-CDMA, as authentication uses secret shared key that is (should be) unique to each customer.

I think this might be what you're referring to?

https://neosmart.net/blog/2011/how-to-recognize-a-stellar-ne...

Interesting... Nice that IOS gives you a warning. I wonder if Android does the same?

It's called 'Ciphering Indication Feature' – and can be suppressed on the network side … so you can assume that an IMSI catcher ('Stingray') will not let your mobile know that it is using no or weak encryption.

It's actually a bit set on the SIM card, nothing to do with the network. Check out GSM 11.11, 10.3.18

Thanks, you are of course right. I should have written network operator. The operator can turn on/off OFM on the SIM.

Technically yes, but if you're talking about a stingray then I don't think they're going to have the ability to alter your sim card without authenticating with it; which is a lot harder than just using a null cipher over the air.

That doesn't actually happen