Why does this work? How simple is it to follow the sms protocol, I thought there were spam filters in place on the phones to prevent receiving any traffic from towers which are not registered to a well known network provider (or what have you).
If you can pretend to be a 2G/3G tower and jam the real tower, you can force phones to connect to you and you can send whatever calls and texts you want.
This is mostly a 2G issue. Modern Android devices, and perhaps iOS devices, have a toggle to disable 2G for this reason.
With fully compliant 5G, even police IMSI catchers become pretty difficult to use.
My Android phone, Motorola Edge 20, has a setting for preferred network type. Options are 5G/4G/3G/2G, 4G/3G/2G, 3G/2G, or 2G only. Doesn't seem to be a way to disable 2G or 3G, even though most networks here (UK) no longer support them.
I do have my phone set to 4G+5G only through that same screen, though, as my modem lacks the 2G toggle as well. If there are missing options in the dropdown, try dialing *#*#4636#*#* and see if you can configure it through there.
I don't know exactly what determines what configuration is exposed to the UI, it's possible your modem simply lacks support for disabling entire generations of cellular technology.
I know for a fact a local network has 3G here, but it’s not exposed on my phone to choose, presumably because it knows there’s 4G and 5G and carriers don’t want some dolt camping on 3G and eating more mhz/bit. I used to camp on 3G because Canada sent out too many dumb “emergency alerts” for custody disputes 1000km away, but those only operated over LTE, not 3G.
People don’t believe me when I say you can see, and sometimes connect to, US networks from a tall building in Toronto from over the lake because Canadian SIMs have rules/conditions to hide them, but if you put in an overseas SIM, you’ll see them on a scan.
Have also had a world of a time with a French SIM refuse to connect to a Canadian tower because it really preferred the US towers (lower roaming costs maybe?).
I was under the impression that most European countries were keeping 2G around for legacy applications and voice calls on roaming (until VoLTE roaming and emergency calls finally become equally reliable), shutting down 3G if anything?
It’s like saying “postcards are delivered in the leftover part of the mail truck unused by letters and parcels” :)
In modern standards, it is indeed not a “leftover” (although RCS exists which is another can of worms), but originally it was transmitted in a best-effort manner using what is essentially a "hack" on SS7 (unlike phone calls which is guaranteed reception - or at least not going through).
In GSM, SMS are delivered either over the SDCCH (when no voice call is happening simultaneously) or the SACCH (when a voice call is already in progress). In the latter case, you might argue that they're piggy-backing onto existing resources, but in the former, there are definitely dedicated resources being allocated specifically for SMS delivery.
SMS delivery has also always been reliable, both on the lower level (both SDCCH and SACCH are reliable) and the upper one (the phone reports successful delivery back to the sending SMSC), so while there are no timing guarantees (is that what you mean by best-effort?), delivery always eventually succeeds once resources are available.
The protocol even goes to significant lengths to ensure timely (re)delivery in case various error scenarios, such as a full inbox on a phone or a phone being out of reception.
While 140 bytes aren't much, reliability is actually great, until you add spam filtering, roaming, and inter-network delivery to the mix, when things can quickly go off the rails. (One unexpected consequence of how it's implemented is that for mutual reachability, it doesn't only matter what operators the sender and recipient have a contract with, but also in which network the recipient is currently roaming.)
That's the opposite of my experience in the early 2000s. I mean, the whole reason you'd always enable delivery reports is because delayed delivery or failed delivery were almost a daily occurrence. Anyone who sent SMS blind would quickly learn to either enable delivery reports, or just start calling people more.
Whether or not the victim will be notified about the absence of encryption, depends on the state of a single bit on the SIM card [1]. In 99% of the cases, there is no warning that the handset is currently using A5/0.
From now on, you are at the grace of the rogue network operator - they can send you anything from any number, sit in the middle of every call and capture every frame of data.
I don't think the current level of technological education of the general public is enough for most of them to know why it is important to force your phone to work only with modern network standards and that is what police and other government agencies interested in operating IMSI catchers exploit.
[1] http://blog.taddong.com/2011/02/does-your-phone-warn-you-whe...
Is encryption really significant to whether or not the police are able to monitor cellular phones? As bandwidth is already centrally allocated, there is a limited number of legal cellular network operators, and a competent authority could already compel (indeed, could have already compelled) mobile operators to provide master keys and diversification information under the Snooper Charter 2016[1].
Consider intelligence operation abroad, for example.