{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,24]],"date-time":"2026-02-24T17:15:53Z","timestamp":1771953353901,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":53,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,12,6]],"date-time":"2021-12-06T00:00:00Z","timestamp":1638748800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,12,6]]},"DOI":"10.1145\/3485832.3485914","type":"proceedings-article","created":{"date-parts":[[2021,12,6]],"date-time":"2021-12-06T13:42:32Z","timestamp":1638798152000},"page":"900-915","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":36,"title":["Don\u2019t hand it Over: Vulnerabilities in the Handover Procedure of Cellular Telecommunications"],"prefix":"10.1145","author":[{"given":"Evangelos","family":"Bitsikas","sequence":"first","affiliation":[{"name":"New York University Abu Dhabi, United Arab Emirates"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christina","family":"P\u00f6pper","sequence":"additional","affiliation":[{"name":"New York University Abu Dhabi, United Arab Emirates"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2021,12,6]]},"reference":[{"key":"e_1_3_2_1_1_1","first-page":"922","article-title":"Universal Mobile Telecommunications System (UMTS); Radio resource management strategies","volume":"125","author":"GPP.","year":"2007","unstructured":"3GPP. 2007. Universal Mobile Telecommunications System (UMTS); Radio resource management strategies. Technical Specification (TS) 125.922. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_tr\/125900_125999\/125922\/07.01.00_60\/tr_125922v070100p.pdf version 7.1.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_2_1","first-page":"331","article-title":"LTE; Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification","volume":"36","author":"GPP.","year":"2016","unstructured":"3GPP. 2016. LTE; Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification. Technical Specification (TS) 36.331. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/136300_136399\/136331\/13.00.00_60\/ts_136331v130000p.pdf Version 13.0.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_3_1","first-page":"331","article-title":"Universal Mobile Telecommunications System (UMTS); Radio Resource Control (RRC); Protocol specification","volume":"25","author":"GPP.","year":"2016","unstructured":"3GPP. 2016. Universal Mobile Telecommunications System (UMTS); Radio Resource Control (RRC); Protocol specification. Technical Specification (TS) 25.331. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/125300_125399\/125331\/13.01.00_60\/ts_125331v130100p.pdf Version 13.1.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_4_1","first-page":"899","article-title":"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on the security aspects of the next generation system (Release 14)","volume":"33","author":"GPP.","year":"2017","unstructured":"3GPP. 2017. 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on the security aspects of the next generation system (Release 14). Technical Specification (TS) 33.899. 3rd Generation Partnership Project (3GPP). https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=3045 Version 1.3.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_5_1","first-page":"129","article-title":"Digital cellular telecommunications system (Phase 2+) (GSM); Packet-switched handover for GERAN A\/Gb mode; Stage 2","volume":"143","author":"GPP.","year":"2017","unstructured":"3GPP. 2017. Digital cellular telecommunications system (Phase 2+) (GSM); Packet-switched handover for GERAN A\/Gb mode; Stage 2. Technical Specification (TS) 143.129. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/143100_143199\/143129\/14.01.00_60\/ts_143129v140100p.pdf version 14.1.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_6_1","first-page":"401","article-title":"5G; NG-RAN; Architecture description","volume":"38","author":"GPP.","year":"2018","unstructured":"3GPP. 2018. 5G; NG-RAN; Architecture description. Technical Specification (TS) 38.401. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/138400_138499\/138401\/15.02.00_60\/ts_138401v150200p.pdf Version 15.2.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_7_1","first-page":"331","article-title":"NR; Radio Resource Control (RRC); Protocol specification","volume":"38","author":"GPP.","year":"2019","unstructured":"3GPP. 2019. NR; Radio Resource Control (RRC); Protocol specification. Technical Specification (TS) 38.331. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/138300_138399\/138331\/15.06.00_60\/ts_138331v150600p.pdf Version 15.6.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_8_1","first-page":"809","article-title":"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects Study on 5G Security Enhancement against False Base Stations (FBS) (Release 17)","volume":"33","author":"GPP.","year":"2020","unstructured":"3GPP. 2020. 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects Study on 5G Security Enhancement against False Base Stations (FBS) (Release 17). Technical Specification (TS) 33.809. 3rd Generation Partnership Project (3GPP). https:\/\/portal.3gpp.org\/desktopmodules\/Specifications\/SpecificationDetails.aspx?specificationId=3539 Version 0.12.1.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_9_1","first-page":"554","article-title":"5G; Management and orchestration; 5G end to end Key Performance Indicators (KPI)","volume":"128","author":"GPP.","year":"2020","unstructured":"3GPP. 2020. 5G; Management and orchestration; 5G end to end Key Performance Indicators (KPI). Technical Specification (TS) 128.554. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/128500_128599\/128554\/16.06.00_60\/ts_128554v160600p.pdf version 16.6.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_10_1","first-page":"300","article-title":"5G; NR; NR and NG-RAN Overall description; Stage-2","volume":"38","author":"GPP.","year":"2020","unstructured":"3GPP. 2020. 5G; NR; NR and NG-RAN Overall description; Stage-2. Technical Specification (TS) 38.300. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/138400_138499\/138401\/16.03.00_60\/ts_138401v160300p.pdf version 16.3.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_11_1","first-page":"501","article-title":"5G; Security architecture and procedures for 5G System)","volume":"33","author":"GPP.","year":"2020","unstructured":"3GPP. 2020. 5G; Security architecture and procedures for 5G System). Technical Specification (TS) 33.501. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/133500_133599\/133501\/16.03.00_60\/ts_133501v160300p.pdf Version 16.3.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_12_1","volume-title":"Technical Report 128.313. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/128300_128399\/128313\/16.00.00_60\/ts_128313v160000p.pdf version 16.0.0.","author":"Self-Organizing GPP.","unstructured":"3GPP. 2020. 5G; Self-Organizing Networks (SON) for 5G networks. Technical Report 128.313. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/128300_128399\/128313\/16.00.00_60\/ts_128313v160000p.pdf version 16.0.0."},{"key":"e_1_3_2_1_13_1","first-page":"009","article-title":"Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); Handover procedures","volume":"123","author":"GPP.","year":"2020","unstructured":"3GPP. 2020. Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); Handover procedures. Technical Specification (TS) 123.009. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/123000_123099\/123009\/16.00.00_60\/ts_123009v160000p.pdf version 16.0.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_14_1","first-page":"300","article-title":"LTE; Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2","volume":"38","author":"GPP.","year":"2020","unstructured":"3GPP. 2020. LTE; Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2. Technical Specification (TS) 38.300. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/136300_136399\/136300\/16.02.00_60\/ts_136300v160200p.pdf version 16.2.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_15_1","first-page":"511","article-title":"Universal Mobile Telecommunications System (UMTS); LTE; Telecommunication management; Automatic Neighbour Relation (ANR) management; Concepts and requirements","volume":"132","author":"GPP.","year":"2020","unstructured":"3GPP. 2020. Universal Mobile Telecommunications System (UMTS); LTE; Telecommunication management; Automatic Neighbour Relation (ANR) management; Concepts and requirements. Technical Specification (TS) 132.511. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/132500_132599\/132511\/16.00.00_60\/ts_132511v160000p.pdf version 16.0.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_16_1","first-page":"500","article-title":"Universal Mobile Telecommunications System (UMTS); LTE; Telecommunication management; Self-Organizing Networks (SON); Concepts and requirements","volume":"32","author":"GPP.","year":"2020","unstructured":"3GPP. 2020. Universal Mobile Telecommunications System (UMTS); LTE; Telecommunication management; Self-Organizing Networks (SON); Concepts and requirements. Technical Specification (TS) 32.500. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/132500_132599\/132500\/16.00.00_60\/ts_132500v160000p.pdf Version 16.0.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_17_1","first-page":"502","article-title":"5G; Procedures for the 5G System (5GS)","volume":"123","author":"GPP.","year":"2021","unstructured":"3GPP. 2021. 5G; Procedures for the 5G System (5GS). Technical Specification (TS) 123.502. 3rd Generation Partnership Project (3GPP). https:\/\/www.etsi.org\/deliver\/etsi_ts\/123500_123599\/123502\/16.07.00_60\/ts_123502v160700p.pdf version 16.7.0.","journal-title":"Technical Specification (TS)"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/WIOPT.2016.7492906"},{"key":"e_1_3_2_1_19_1","unstructured":"Amarisoft. [n.d.]. Amarisoft Callbox Classic. https:\/\/www.amarisoft.com\/products\/test-measurements\/amari-lte-callbox\/"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243846"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0039"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3317549.3324927"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"crossref","unstructured":"A. Dabrowski G. Petzl and E. Weippl. 2016. The Messenger Shoots Back: Network Operator Based IMSI Catcher Detection. In RAID.","DOI":"10.1007\/978-3-319-45719-2_13"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664272"},{"key":"e_1_3_2_1_25_1","unstructured":"Ericsson. [n.d.]. Ericsson Mobility Report. https:\/\/www.ericsson.com\/en\/mobility-report\/reports."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSNDSP.2012.6292642"},{"key":"e_1_3_2_1_27_1","volume-title":"Proceedings of the 22nd USENIX Conference on Security (Washington, D.C.) (SEC\u201913)","author":"Golde Nico","year":"2013","unstructured":"Nico Golde, K\u00e9vin Redon, and Jean-Pierre Seifert. 2013. Let Me Answer That for You: Exploiting Broadcast Information in Cellular Networks. In Proceedings of the 22nd USENIX Conference on Security (Washington, D.C.) (SEC\u201913). USENIX Association, USA, 33\u201348."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSCCC.2018.8703355"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/IFIPNetworking.2016.7497239"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"crossref","unstructured":"Russell Housley W. Polk W. Ford and D. Solo. 2002. Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. (04 2002).","DOI":"10.17487\/rfc3280"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"crossref","unstructured":"S.\u00a0R. Hussain Omar Chowdhury Shagufta Mehnaz and E. Bertino. 2018. LTEInspector: A Systematic Approach for Adversarial Testing of 4G LTE. In NDSS.","DOI":"10.14722\/ndss.2018.23313"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23442"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354263"},{"key":"e_1_3_2_1_34_1","unstructured":"iPerf. [n.d.]. iPerf - The ultimate speed test tool for TCP UDP and SCTP. https:\/\/iperf.fr\/"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00038"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"crossref","unstructured":"Z. Li W. Wang Christo Wilson Jian\u00a0Jhen Chen C. Qian T. Jung L. Zhang K. Liu Xiangyang Li and Y. Liu. 2017. FBS-Radar: Uncovering Fake Base Stations at Scale in the Wild. In NDSS.","DOI":"10.14722\/ndss.2017.23098"},{"key":"e_1_3_2_1_37_1","volume-title":"Murat: Multi-RAT False Base Station Detector. CoRR abs\/2102.08780(2021). arxiv:2102.08780https:\/\/arxiv.org\/abs\/2102.08780","author":"Nakarmi Prajwol\u00a0Kumar","year":"2021","unstructured":"Prajwol\u00a0Kumar Nakarmi, Mehmet\u00a0Akif Ersoy, Elif\u00a0Ustundag Soykan, and Karl Norrman. 2021. Murat: Multi-RAT False Base Station Detector. CoRR abs\/2102.08780(2021). arxiv:2102.08780https:\/\/arxiv.org\/abs\/2102.08780"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2017-0027"},{"key":"e_1_3_2_1_39_1","volume-title":"White-Stingray: Evaluating IMSI Catchers Detection Applications. In 11th USENIX Workshop on Offensive Technologies (WOOT 17)","author":"Park Shinjo","year":"2017","unstructured":"Shinjo Park, Altaf Shaik, Ravishankar Borgaonkar, Andrew Martin, and Jean-Pierre Seifert. 2017. White-Stingray: Evaluating IMSI Catchers Detection Applications. In 11th USENIX Workshop on Offensive Technologies (WOOT 17). USENIX Association, Vancouver, BC. https:\/\/www.usenix.org\/conference\/woot17\/workshop-program\/presentation\/park"},{"key":"e_1_3_2_1_40_1","volume-title":"Detecting Fake 4G LTE Base Stations in Real Time","author":"Quintin Cooper","unstructured":"Cooper Quintin. 2021. Detecting Fake 4G LTE Base Stations in Real Time. USENIX Association, Presentation."},{"key":"e_1_3_2_1_41_1","unstructured":"Ettus Research. [n.d.]. USRP B210 SDR Kit - Dual Channel Transceiver (70 MHz - 6GHz). https:\/\/www.ettus.com\/all-products\/ub210-kit\/"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2820728"},{"key":"e_1_3_2_1_43_1","volume-title":"IMP4GT: IMPersonation Attacks in 4G NeTworks(Proceedings of the 27th Annual Network and Distributed System Security Symposium (NDSS))","author":"Rupprecht David","unstructured":"David Rupprecht, Katharina Kohls, Thorsten Holz, and Christina P\u00f6pper. 2020. IMP4GT: IMPersonation Attacks in 4G NeTworks. In IMP4GT: IMPersonation Attacks in 4G NeTworks(Proceedings of the 27th Annual Network and Distributed System Security Symposium (NDSS)). The Internet Society."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00006"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23236"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/3212480.3212497"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3317549.3319728"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/VTCSpring.2013.6692692"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453082"},{"key":"e_1_3_2_1_50_1","unstructured":"Huawei Technologies. 2016. eRAN TDD MRO Feature Parameter Description. Technical Specification (TS)\u00a001. HUAWEI TECHNOLOGIES CO.https:\/\/www.honorcup.ru\/upload\/iblock\/164\/7.pdf"},{"key":"e_1_3_2_1_51_1","volume-title":"Soft Computing in Data Science, Michael\u00a0W. Berry, Azlinah Mohamed, and Bee\u00a0Wah Yap(Eds.)","author":"van Do Thanh","unstructured":"Thanh van Do, Hai\u00a0Thanh Nguyen, Nikolov Momchil, and Van\u00a0Thuan Do. 2015. Detecting IMSI-Catcher Using Soft Computing. In Soft Computing in Data Science, Michael\u00a0W. Berry, Azlinah Mohamed, and Bee\u00a0Wah Yap(Eds.). Springer Singapore, Singapore, 129\u2013140."},{"key":"e_1_3_2_1_52_1","volume-title":"Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE. In 28th USENIX Security Symposium (USENIX Security 19)","author":"Yang Hojoon","year":"2019","unstructured":"Hojoon Yang, Sangwook Bae, Mincheol Son, Hongil Kim, Song\u00a0Min Kim, and Yongdae Kim. 2019. Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 55\u201372. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/yang-hojoon"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1186\/1687-1499-2013-27"}],"event":{"name":"ACSAC '21: Annual Computer Security Applications Conference","location":"Virtual Event USA","acronym":"ACSAC '21"},"container-title":["Annual Computer Security Applications Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3485832.3485914","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3485832.3485914","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T19:16:04Z","timestamp":1755890164000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3485832.3485914"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,12,6]]},"references-count":53,"alternative-id":["10.1145\/3485832.3485914","10.1145\/3485832"],"URL":"https:\/\/doi.org\/10.1145\/3485832.3485914","relation":{},"subject":[],"published":{"date-parts":[[2021,12,6]]},"assertion":[{"value":"2021-12-06","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}