2019/01/29: Stingrays (AKA IMSI catchers) are a widespread class of surveillance devices that target cellular phones by impersonating cellular towers to them (they're also called "cell-site simulators").
IMSI catchers are so easy to build and operate that they have leapt from police agencies to criminals, and foreign and corporate spies, exposing us all to potential surveillance from all quarters.
That's why it was so important that the new 5G mobile protocol be designed to foil IMSI catchers, and why the 3rd Generation Partnership Project, or 3GPP (the body standardizing 5G) updated the Authentication and Key Agreement (AKA) to resist IMSI catching techniques.
But new research from ETH Zurich and Technische Universität Berlin has revealed a critical flaw in AKA, a defect that not only allows attackers to track the number of calls and texts being sent while a user is connected to the fake tower, but also a count of calls and texts from before the device was compromised. More importantly, the attack allows for fine-grained location tracking.