Google recommends disconnecting from your 2G network to prevent SMS scams.

Google's warning is considered crucial to protect users from the lurking dangers of SMS attacks, which exploit security vulnerabilities in outdated network protocols such as 2G networks.

SMS phishing attacks have become a growing concern in recent years. These scams often involve cybercriminals sending messages impersonating trusted organizations such as banks and government agencies. These messages typically contain phishing links or malware designed to steal sensitive user data or infect devices with viruses.

Google has pointed out that the most serious SMS scams target security vulnerabilities in 2G networks, a weakness in the outdated 2G mobile network system that allows cybercriminals to easily infiltrate and carry out fraudulent activities.

How do fake BTS stations work?

A fake BTS (Base Transceiver Station) is a counterfeit device that mimics a real mobile base station (BTS) in order to deceive and attack mobile phones within its coverage area.

When using a fake BTS station, malicious actors can place the device between the phone's connection and the real BTS station, performing a man-in-the-middle attack to steal information or scam users.

Fake base stations operate by exploiting security vulnerabilities in 2G mobile networks and the phone's mechanism of always connecting to the station with the strongest signal. The fake base station is placed in an intermediate position between the phone and the real base station, then broadcasts a stronger signal to "trick" the phone into connecting.

To send messages to users, a common tactic used by cybercriminals is to create a fake base station (BTS) that can cover an area of ​​about 2km. The fake BTS interferes with the 3G or 4G signals around the network provider's base station and broadcasts at a higher power to force phones to switch to a 2G connection with the fake BTS. Once a phone connects to the fake BTS on 2G, the fake BTS sends messages to subscribers, causing phones within the coverage area to receive the message. This is also why many people in the same area receive the same message. A single fake BTS device can distribute up to 70,000 messages per day.

While 4G and 5G mobile networks are becoming increasingly common, the outdated 2G network remains a critical vulnerability for many mobile devices. Even with the latest technologies in their phones, the inability to connect to 2G networks persists, creating a serious security loophole that hackers can exploit to carry out phishing attacks.

The problem stems from a security vulnerability in the GSM (2G) mobile network, which only has one-way authentication, meaning it allows the network to authenticate the user, but not the user to re-authenticate the network. Therefore, when mobile subscribers approach fake base stations, due to the strong signal from the fake base station, the subscriber is temporarily transferred to the fake base station's control, and then malicious actors exploit this to spread spam and phishing messages.

Counterfeit BTS (Base Transceiver Station) equipment is often smuggled into Vietnam through unofficial channels. These devices are very compact, making them difficult for authorities to detect and inspect. During the commission of these violations, perpetrators often use these fake BTS stations on mobile devices such as cars and motorcycles.

Google's advice for Android users.

To protect themselves from the potential risks of outdated 2G networks, Google recommends that Android users proactively enhance the security of their mobile devices. One of the simplest and most effective ways is to completely turn off 2G connectivity by going to Settings -> Network & Internet -> SIM Card -> Turn off 2G.

Although most Android phones allow users to turn off 2G connectivity, not all devices have this option. To ensure information security, users should regularly check and update the software on their mobile devices. Updates will help users have the latest security features and eliminate potential security vulnerabilities.

In addition to disabling 2G, Google is also working on a feature to combat fake base stations. This feature will warn users when their mobile device connects to an untrusted network. This feature may appear in the Android 15 update, starting with Pixel devices and then expanding to other brands.

What about iPhone users?

Apple currently does not offer a direct option to turn off 2G. To disable 2G connectivity, iPhone users must activate "lock mode," a strict security feature that also disables many other iPhone functions.

The iPhone lock screen is designed to provide maximum protection against cyber threats. Many iPhone users wish Apple would offer a more flexible solution, allowing them to turn off 2G without affecting their device experience.

The use of fake BTS stations to spread phishing messages in Vietnam.

In Vietnam, over the past years, the Radio Frequency Department (Ministry of Information and Communications) has coordinated with professional units under the Ministry of Public Security using technical equipment to identify the source of fake BTS (Base Transceiver Station) broadcasts. Specifically, in 2023, 19 cases of using fake BTS stations were apprehended, and in the first six months of 2024, 5 cases of using fake BTS equipment to spread fraudulent and obscene messages were apprehended.

The people behind this scheme are mostly foreigners who hire local individuals to deploy and spread the scam messages. The group uses devices installed on cars and motorcycles, frequently traveling along various routes without a clear pattern. Furthermore, the fake base stations are set up to switch on and off intermittently, making detection difficult and complex.

To effectively prevent phishing messages, in addition to coordinating with relevant agencies to strengthen propaganda, inspection, and control, the Radio Frequency Department has a new solution to detect and apprehend individuals using fake BTS stations. This involves coordinating with network operators and the police. When a fake BTS station is found operating, the network operator will identify and pinpoint its location. After accurately locating and identifying the fake BTS stations, the Radio Frequency Department will coordinate with professional units of the Ministry of Public Security to conduct on-site arrests.

To avoid risks, the Cybersecurity Department advises mobile users to absolutely not open links or messages from unknown sources, and not to log in to their personal accounts on such sites. To avoid falling into scams, people should be cautious before conducting any financial transactions through social media.