This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located relatively close to the victim's device.
Assuming this scenario, I have the following questions:
- Is the attacker able to intercept only traffic FROM the mobile phone or also TO the mobile phone? I would imagine that a carrier does not forward SMS or voice calls intended for the victim's device to a fake base station as he knows which base stations belong to his network, isn't it?
- How does the integration of the fake base station into acarrier's network work? I'd assume that there has to be some sort of authentication?