1G AMPS cloning, GSM A5/1 flaws, 3G AKA, 4G downgrade, 5G SA security.
Ameritech launched the first commercial 1G AMPS cellular network in Chicago, but cleartext transmission of ESN and MIN identifiers quickly led to widespread over-the-air cellular cloning.
The European Telecommunications Standards Institute (ETSI) deployed 2G GSM, introducing digital subscriber identity modules (SIM cards) and the A5/1 stream cipher for over-the-air voice privacy.
Underground syndicates commercialized "Clone King" EPROM modification kits, allowing widespread cellular subscription fraud and free international calls across North American carriers.
David Wagner and Ian Goldberg (UC Berkeley ISAAC Group) completely cracked the GSM COMP128-1 algorithm, allowing extraction of SIM master keys (Ki) and physical cloning of SIM cards.
Attackers spoofed ICMP Echo Requests to IP directed-broadcast addresses — including Portuguese academic backbones FCCN/RCTS — producing 100x amplification floods that downed victims' uplinks.
3GPP Release 99 standardized 3G UMTS, introducing bidirectional mutual authentication (3G AKA) to defeat rogue base stations (IMSI catchers) and replacing A5/1 with the KASUMI block cipher.
Elad Barkan, Eli Biham, and Nathan Keller published an instant ciphertext-only attack against the GSM A5/2 cipher, recovering the session key in under 1 second on a standard PC and forcing 3GPP to deprecate the cipher globally.
Hackers breached T-Mobile's backend web customer-care interface, gaining unauthorized access to Danger cloud servers and publishing private celebrity phonebooks, SMS logs, and photos.
Karsten Nohl and the Chaos Computer Club published a 2-terabyte rainbow-table set at 26C3 enabling real-time over-the-air decryption of A5/1-protected 2G GSM calls and SMS with inexpensive hardware.
Sylvain Munaut and Harald Welte demonstrated OsmocomBB at 27C3, releasing an open-source GSM baseband stack that enabled over-the-air call decoding on $15 consumer handsets.
Joshua Drake (Zimperium) disclosed multiple critical vulnerabilities in Android's Stagefright media engine that allowed attackers to execute remote code on 950 million phones via a single silently received cellular MMS video message.
Cybercriminals abused SS7 roaming interfaces to intercept bank-issued SMS one-time passcodes (OTPs), draining accounts of customers at O2 Germany and Metro Bank UK.
5G Standalone (Release 16, 2020) replaced SS7/Diameter trust assumptions with HTTP/2 service-based APIs over TLS, OAuth 2.0 token authentication, and cryptographically concealed subscriber identities (SUCI).
Federal indictments exposed international cybercrime rings bribing retail store employees at AT&T, Verizon, and T-Mobile to execute unauthorized SIM swaps, stealing tens of millions of dollars in cryptocurrency.
Attackers executed an unauthorized SIM swap against the phone number tied to the US SEC official X account, broadcasting a fraudulent Bitcoin ETF approval that caused hundreds of millions in market swings.
3GPP SA3 finalized Release 19 security specifications integrating NIST Post-Quantum Cryptography (FIPS 203 ML-KEM and FIPS 204 ML-DSA) to protect 5G subscriber privacy (SUCI) and inter-operator Service-Based Architecture (SBA) tunnels against Harvest-Now-Decrypt-Later threats.