LeopardSeal: Detecting Call Interception via Audio Rogue Base Stations

Audio Rogue Base Stations (ARBSs) allow an adversary to intercept cellular calls. These devices represent a substantial escalation in the threat posed by traditional rogue base stations, which only collect device identity information. This work presents the first technique for detecting call eavesdropping via an ARBS. Our system, which we call LeopardSeal, uses distance bounding over the call audio channel to determine whether or not extra wireless hops (and therefore increased audio delay) that are characteristic of ARBSs are present during a call. We implement a proof of concept ARBS using open-source guides and perform a measurement study across the United States. We demonstrate the ability to detect all attacks (with zero false positives) due to a statistically significant difference in round trip times between benign and attack call audio (i.e., t-test: p≪0.01) due to the large cost of additional wireless hops. Through this effort, we demonstrate the ability to robustly detect these eavesdropping devices.