New possible indicators

A group of researchers from University of Florida and ETḦ Zurich presented a paper *[Detecting IMSI-Catchers by Characterizing Identity Exposing Messages in Cellular Traffic](https://www.ndss-symposium.org/ndss-paper/detecting-imsi-catchers-by-characterizing-identity-exposing-messages-in-cellular-traffic/)*.

Video of presentation is here:
https://m.youtube.com/watch?v=jY3idyn11Tc

Most important finding:

_In this paper, we focus on the messages an adversary must send as opposed to behaviors their IMSI-Catcher might exhibit. We develop a detection methodology that searches cellular downlink traffic for all possible messages an adversary can use to force a mobile phone to reveal its IMSI.

...

That is, our approach focuses on causal attributes rather than correlated ones. We systematically analyze message flows that would lead to IMSI exposure (most of which have not been previously considered in the research community), and identify 53 messages an IMSI-Catcher can use for its attack._

Also, at 8:30 (in Youtube) he is talking about "attach reject messages". I already mentioned on Mattermost that we should be watching Location Update Reject messages. I believe something like this is quite important to implement.

Interestingly, at 10:20 he is talking about downlink overshadowing attack, when the attacker is not using fake base station, but can only inject fake messages to downlink.

Here is the code: https://zenodo.org/records/14262356

I understand, that they are using SDR, but probably we can add some indicators based on their findings.