News Google on why you should disable 2G on your Android phone

[The Helper]

SMS Blasters — which are also known as Stingrays, False Base Stations (FBS), and cell-site simulators — can be used by nefarious parties to “lure mobile devices to connect to them” and send fake text messages. One way to combat them is by disabling the insecure 2G connection on your Android device.

GSMA’s Fraud and Security Group (FASG) has developed a briefing paper for GSMA members to raise awareness of SMS Blaster fraud and provide guidelines and mitigation recommendations for carriers, OEMs and other stakeholders. The briefing paper, available for GSMA members only, calls out some Android-specific recommendations and features that can help effectively protect our users from this new type of fraud.
GOOGLE

Those fake messages, which are only possible over 2G, often perpetuate financial fraud, with increasing reports around the world of this in recent years. Attackers can easily fake the number that appears to make it seem like it’s from a known business. There are also reports of them being used to “disseminate malware, for example injecting phishing messages with a url to download the payload.”

SMS Blasters expose a fake LTE or 5G network which executes a single function: downgrading the user’s connection to a legacy 2G protocol. The same device also exposes a fake 2G network, which lures all the devices to connect to it. At this point, attackers abuse the well known lack of mutual authentication in 2G and force connections to be unencrypted, which enables a complete Person-in-the-Middle (PitM) position to inject SMS payloads.

These SMS Blasters, which can be portable, “are sold on the internet and do not require deep technical expertise” to use and localize. Compared to the SMS phishing (mass texts) you get today, this direct delivery “bypasses the carrier network and its anti-fraud and anti-spam filters, guaranteeing that all messages will reach a victim.”

Google on why you should disable 2G on your Android phone

One way to combat SMS Blasters and their fake texts is by disabling the insecure 2G connection on your Android device...

9to5google.com