DEV Community: IntSpired®

Not All Threat Vectors Are Wired

IntSpired® — Tue, 21 Jul 2026 19:08:34 +0000

Most traditional security operations centres (SOCs) were built around IP-based enterprise infrastructure. Firewalls, endpoints, servers, identity systems, cloud logs and network traffic form the core of the detection stack.

That approach assumes suspicious activity will eventually surface through an IP connection, a managed device, an application log or another monitored part of the enterprise environment.

For a long time, that assumption covered much of the attack surface. It no longer covers all of it.

Wireless systems have always introduced risks that conventional monitoring may not see directly. Wi-Fi, Bluetooth, radio-frequency identification (RFID) and earlier cellular generations all created activity beyond the visibility of standard endpoint and network sensors.

Radio frequency (RF) does not stop at Wi-Fi.

5G has expanded the wireless attack surface across user equipment, radio access networks (RAN), virtualised core functions, edge infrastructure, service-based interfaces and machine-to-machine communications. 6G is likely to extend that dependence on distributed, software-defined and radio-connected infrastructure further still.

RAN activity, over-the-air signalling, rogue radio infrastructure, interference, handovers between devices and base stations, and manipulation of radio-layer protocols may never touch the sensors used by a traditional enterprise SOC.

Some of the resulting activity may eventually appear in an IP log or core-network event. The initial radio-layer activity may remain unobserved.

If your monitoring stack only watches enterprise networks, hosts and cloud infrastructure, an entire class of wireless threats may be invisible by design, not by accident.

This is not a minor blind spot. It is a structural visibility gap.

Where there is no SOC at all — which is common among smaller operators, private-network operators, MVNOs, suppliers and technology vendors — the gap does not disappear. It means a different process is needed to identify and prioritise the risk before an incident occurs.

Threat modelling without a SOC

Without a SOC, you are not necessarily detecting live attacks.

You are anticipating plausible attack paths, identifying what you could observe, exposing what you could not observe and deciding where controls should be strengthened.

That shifts the workflow from continuous detection towards structured prioritisation, but the underlying threat-modelling frameworks still provide a practical foundation.

Image 1: Threat modelling without a SOC. An IntSpired-style workflow combining the Diamond Model, MITRE FiGHT and ATT&CK, visibility-gap analysis, GSMA and ENISA guidance, baseline control mapping, and a prioritised risk register.

1. Diamond Model — frame the scenario

Before moving into technical detail, define the hypothetical event.

Who is the likely adversary? What infrastructure could they use? What capability would they need? Which device, service, network function, organisation or user would be the victim?

These four elements form the principal vertices of the Diamond Model:

Adversary
Infrastructure
Capability
Victim

The purpose is not to name a specific attacker without evidence. It is to create a structured scenario.

The adversary might be a financially motivated group, hostile operator, insider, criminal service provider or opportunistic attacker.

The infrastructure could include rogue radio equipment, rented cloud services, compromised network functions, malicious applications or attacker-controlled signalling infrastructure.

The capability might involve radio reconnaissance, identity manipulation, signalling abuse, denial of service, exploitation of a network function or unauthorised access to subscriber information.

The victim could be user equipment, a base station, private 5G deployment, core-network function, connected enterprise or the operator itself.

This is the scaffolding on which the rest of the analysis is built.

2. FiGHT and ATT&CK — enumerate the techniques

The capability vertex can then be expanded into specific adversary behaviours.

MITRE ATT&CK provides a structured knowledge base for tactics and techniques affecting enterprise, cloud and mobile environments.

MITRE FiGHT performs a similar role for 5G environments, covering techniques associated with user equipment, radio access, the core network, telecom services and supporting infrastructure.

The two should not be treated as competing frameworks. A realistic attack path may involve both.

An adversary might begin with activity against the radio or telecom environment and later use conventional enterprise techniques for credential access, persistence, lateral movement, command and control or data exfiltration.

The reverse is also possible. An attacker may first compromise an enterprise system, cloud service or management platform and then use that access to affect mobile-network infrastructure.

The technique-mapping stage should therefore ask:

Which FiGHT techniques are relevant to the RAN, core and telecom environment?
Which ATT&CK techniques become relevant once the attack reaches enterprise, cloud, identity or endpoint infrastructure?
Where do the two sets of behaviours connect?

This produces a more complete technique list than using either framework in isolation.

3. The coverage gap — flag what you cannot see

This is the step many threat-modelling exercises skip.

Identifying a plausible technique does not mean the organisation can detect it.

Traditional SOC monitoring commonly provides visibility into:

Firewalls
Endpoints
Servers
Identity systems
Applications
Cloud logs
IP and network traffic
Managed network devices

Visibility into the wireless and radio domain may be far more limited. This can include:

RF-spectrum activity
Air-interface behaviour
RAN signalling
Over-the-air traffic
Rogue or unauthorised radio infrastructure
Device-to-tower handovers
Radio interference and jamming
Subscriber identity activity involving SIM or eSIM systems
Manipulation of mobility or control-plane procedures

Some telecom operators have specialist RAN, signalling and network-assurance capabilities. Some private-network environments also collect detailed telemetry from radio and core components.

Many enterprise SOCs, however, have little or no direct visibility into those layers.

For every technique identified during the FiGHT and ATT&CK stage, the threat model should record one of three conditions:

Visible: the organisation has appropriate telemetry and can reasonably detect the activity.

Partially visible: some evidence may appear, but the initial activity or complete attack path cannot be observed.

Not visible: the organisation has no reliable source of telemetry for the technique.

This creates a visibility matrix, not merely a list of threats.

A control may exist while the telemetry required to confirm its effectiveness does not. That distinction matters.

4. GSMA FS.40 and ENISA — validate against known risk categories

Technique mapping should then be checked against broader telecom-security guidance.

GSMA FS.40 provides guidance on security considerations for 5G networks, while ENISA's work on the 5G threat landscape provides a wider view of threat actors, assets, vulnerabilities and attack scenarios affecting mobile infrastructure.

This cross-check helps prevent the threat model from becoming too narrow.

Working only from ATT&CK or FiGHT may produce a strong list of adversary techniques, but wider industry guidance can reveal categories that also need to be considered, including:

Fraud and identity abuse
Unauthorised access
Supply-chain compromise
Misconfiguration
Signalling exploitation
Eavesdropping and interception
Privacy and data exposure
Service disruption
Physical compromise
Third-party dependency
Virtualisation and cloud-infrastructure risk
Operational and management-plane weaknesses

The objective is not to copy every risk from every framework. It is to test whether the scenario has omitted an important category.

5. GSMA FS.31 — map to baseline controls

Once credible techniques and risks have been identified, they should be mapped against baseline security controls.

For each plausible attack path, ask:

Is there already a control intended to prevent it?
Is that control implemented across the relevant part of the architecture?
Can its effectiveness be verified?
Does the organisation have telemetry that would reveal failure or bypass?
Who owns the control? Is it operated internally, by a supplier or by a managed service provider?

This is where the exercise becomes an actual gap analysis.

A technique may be theoretically possible but already well controlled. Another may have a preventative control but no detection capability. A third may have neither.

The assessment should distinguish between:

Control present and monitored
Control present but not monitored
Control partially implemented
Control dependent on a third party
No effective control
Control status unknown

Unknown should not automatically be treated as secure. It should remain open until evidence is available.

6. Risk register — the output

Where there is no SOC converting the analysis into detection rules, alerts and response playbooks, the primary output is a prioritised risk register.

Each entry should contain enough information for leadership, engineering teams, suppliers or an MSSP to act on it, including:

Scenario and affected assets
Likely adversary
Relevant techniques
Existing controls
Visibility status
Potential impact
Likelihood or plausibility
Residual risk
Recommended action
Responsible owner
Target completion date

The result is not simply a list of theoretical wireless attacks.

It is a structured record of which attack paths matter to the organisation, which controls already reduce the risk and which areas remain exposed or invisible.

Where security monitoring is outsourced, the same register can be translated into specific requirements for an MSSP.

Instead of asking an MSSP to "monitor 5G security", the organisation can define the events, data sources, network functions and behaviours that must be covered.

Threats do not stay in one lane

None of this is as clean as placing wired and wireless into separate boxes.

The Extended Diamond Model adds meta-features such as timestamp, phase, result, direction, methodology and resources because a real intrusion is rarely a single isolated event.

It is more often an activity thread.

That thread can move from reconnaissance through weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. It may affect several systems or victims during the same campaign.

When multiple activity threads are connected, the result becomes an activity-attack graph rather than one standalone diamond.

Image 2: Threats do not stay in one lane. An IntSpired-style interpretation of how individual Diamond Model events can form activity threads and wider activity-attack graphs spanning the radio layer, telecom core, cloud infrastructure and enterprise environment.

The same principle applies to the distinction between wired and wireless infrastructure.

An attacker is unlikely to remain in one environment throughout an entire campaign.

A hypothetical attack might begin with RF reconnaissance against a radio site or device. It could continue through a malicious over-the-air interaction, exploitation of a modem or protocol weakness, compromise of a handset or subscriber identity, and access to data or services through the mobile core.

From there, the attacker may reach cloud infrastructure, management systems or enterprise networks.

The route can also move in the opposite direction.

An attacker might first compromise a cloud-hosted management service, supplier account, orchestration platform or enterprise administrator. That access could then be used to manipulate telecom services, network functions, subscriber systems or radio-connected devices.

The important point is not that every wireless event leads to a wired compromise.

It is that real attack chains can cross the boundary.

Treating wired and wireless as separate and absolute security categories misses how campaigns may progress in practice.

Wireless is not a separate security world. It is another layer of the same attack surface.

Why this matters

The Diamond Model, ATT&CK, FiGHT, GSMA guidance and ENISA threat analysis can help an organisation structure what it needs to examine.

They do not create telemetry.

They do not guarantee that a SOC can see radio-layer activity.

They do not confirm that a baseline control has been implemented correctly.

And they do not replace the need to understand the architecture being protected.

Where there is no SOC, threat modelling provides a method for identifying and prioritising credible exposures before monitoring capabilities are built or outsourced.

Where there is a SOC, the same process exposes the difference between what the organisation believes it monitors and what its sensors can actually observe.

That is where the value sits.

Wired infrastructure receives most of the conventional monitoring budget.

Wireless infrastructure often carries risk outside that conventional line of sight.
Threat modelling that does not account for the difference is not modelling the complete threat.

Need help identifying wireless and RF visibility gaps?

Speak to IntSpired®.

OFFENSIVE BY DESIGN. INTELLIGENT BY NATURE.

OWNED AT THE ANTENNA.The Attack Your VPN Cannot See

IntSpired® — Sat, 11 Jul 2026 08:28:54 +0000

Mobile communications did not begin as an app economy.

They began as RF engineering.

In 1973 Motorola built the first handheld cellular prototype. It weighed more than a kilogram, had no display, took around 10 hours to recharge and delivered about 35 minutes of talk time. A decade later, that development path led to the DynaTAC 8000X.

It was not a smartphone. It was not a software platform. It was a radio terminal.

Image 1: Motorola DynaTAC 8000X, FCC-approved in 1983 and widely recognised as the first commercial handheld mobile phone. This is where the handheld mobile era became real.

Four decades later, by 2012, mobile had crossed a line.

The smartphone was no longer emerging technology. It had become the default personal device of the modern internet era. Global mobile subscriptions had already reached billions. Smartphone sales were accelerating fast. Android and iPhone had reshaped the market. BlackBerry, Nokia and the old feature-phone model were visibly losing ground. Popular Mechanics ranked the smartphone number one in its list of 101 Gadgets That Changed the World, above the TV, the PC, the telephone and the light bulb.

That is why 2012 matters. It was not the year the smartphone began. It was the year the smartphone became normal.

Every security story has a starting point. And in that same year, an IEEE antenna-engineering lecture that most people never saw captured something important: the modern phone was already becoming a dense, multi-radio system.

A smartphone is not just a screen, an operating system and some apps. It is a radio device built around antennas, basebands, SIM identity, carrier signalling, roaming logic and legacy network compatibility. A lot of that sits below the layer most people think of as phone security.

Below the OS. Below the VPN. Below app permissions. Below the lock screen.

The antenna has always been part of the attack surface.

VULNERABILITY 01

You Are Carrying a Radio Array
A modern phone is not one radio. It is a collection of radios.

Cellular. Wi-Fi. Bluetooth. GPS/GNSS. NFC. Ultra-wideband. Multiple LTE and 5G bands. Multiple receive chains. Carrier aggregation. MIMO antenna paths. Roaming logic. Emergency calling logic. Legacy fallback logic.

A 2012 antenna-engineering slide already showed how crowded a phone PCB had become. UWB, RFID, FM, 2G/3G cellular, diversity receive, WLAN, Bluetooth, DVB-H and GPS were all competing for space inside a handheld device. That was 2012.

Image 2: Mobile-phone PCB showing multiple antenna systems competing for space inside a single handset. Adapted from IEEE AP-S Distinguished Lecture Program, 2012; © IMST GmbH. All rights reserved.

Today the problem is larger.
5G did not reduce the radio surface. It expanded it. More bands. More antennas. More tuning. More baseband logic. More decisions made automatically before the user sees anything.
That matters because your apps are not the first thing talking to the outside world.The modem is.

VULNERABILITY 02

The Downgrade Attack Still Matters
A brand-new 5G phone still has to live in the real world.

Coverage is uneven. Buildings block signal. Underground spaces degrade it. Crowded venues overload networks. Rural areas and roaming environments may still rely on older infrastructure. Even where 2G and 3G are being phased out, many devices and carrier profiles still retain legacy compatibility unless it is explicitly disabled.

That legacy matters.

An attacker does not always need to defeat 5G directly. They can try to move the device away from it.

False base stations and hostile RF environments can exploit the phone's need to maintain service. If stronger modern coverage is denied or degraded, and a weaker legacy path is allowed, the phone may be pushed toward a less secure network generation.

2G/GSM is the obvious risk. It was designed for a different era. It lacks the mutual authentication users expect from modern networks. Its legacy encryption options, including A5/1 and A5/2, have been publicly attacked for years.

The victim does not tap a malicious link. They do not install malware. They do not approve a permission prompt. Their signal bars may look normal.

The attack happens at the radio layer.

VULNERABILITY 03

IMSI Catchers Do Not Need Your Password
An IMSI catcher, also known as a Stingray or cell-site simulator, is a rogue base station.

Its purpose is not to guess your password. Its purpose is to make your phone identify itself.

Mobile networks rely on subscriber identity. Your SIM and device participate in attachment and authentication processes before your apps are involved. A rogue base station attacks that trust boundary. It broadcasts like infrastructure. Your phone evaluates it like infrastructure. Under the wrong conditions, your phone can be persuaded to reveal identifying information or attach to a hostile network environment before you have any meaningful visibility.

This is why a VPN is not the answer here.

A VPN protects IP traffic after connectivity exists. An IMSI catcher targets the cellular identity and radio attachment process before that tunnel matters.

The exposure is not your browser session. The exposure is that your device exists, where it is, and which subscriber identity or device identity it can be linked to.

VULNERABILITY 04

5G Improved Things. Legacy Did Not Disappear.
5G was designed with better subscriber identity protection than previous generations. That is true.

But 5G does not erase LTE. It does not erase roaming. It does not erase carrier implementation gaps. It does not erase fallback behaviour. It does not erase 2G where the device still supports it.

5G identity protection helps on genuine 5G connections. But a 5G-capable device can still be exposed through non-5G paths, especially where downgrade or fallback behaviour is possible.

The security of your 5G phone is not determined only by 5G. It is determined by the weakest network generation your phone is allowed to use, the carrier settings it accepts, the country you are in, the roaming partner you attach to and the RF environment around you.

The device in your hand may be modern. The trust chain around it may not be.

VULNERABILITY 05

SS7: The Network Behind the Network
SS7 is not an app-layer issue. It is not a phone setting. It is part of the signalling world that lets carriers route calls, deliver SMS, manage roaming and locate subscribers across networks. It was designed for a closed telecom environment where operators trusted each other. That assumption did not survive the modern telecom ecosystem.

SS7 weaknesses have been used for location tracking, surveillance and SMS interception. This is why SMS-based two-factor authentication is a weak choice for anything important.

The problem is not only whether your phone is infected. The problem is whether the signalling path delivering your one-time code can be manipulated before the message reaches you.

No malware on the handset. No handset exploit. No notification.

This is not theoretical. In 2017, German banking customers were hit when attackers abused SS7 to redirect SMS transaction codes used for payment approval. And in 2024, the EFF was still warning that SS7 remains a live risk because telecom providers stay connected to it for international roaming, enabling SMS interception and location tracking.

That is legacy telecom trust being abused in a world it was never designed for.

VULNERABILITY 06

Your Body and Environment Change the Radio Conditions
The human body affects antenna performance. That is not speculation. That is RF engineering.

Your hand, head, pocket, bag, car, building, basement or crowded venue can absorb energy, detune antennas, distort radiation patterns and weaken signal quality. The phone then tries to maintain service. It may adjust transmit power. It may change band. It may move cell. It may fall back where fallback is allowed.

Human-Mobile Interaction

Image 3: The human body affects RF exposure and antenna performance. Original IntSpired illustration. Concept informed by IEEE AP-S DLP 2012 / IMST GmbH antenna-engineering material.

Most of the time, that is normal radio behaviour. But in a hostile environment, radio conditions can be shaped.

Airports. Hotels. Underground car parks. Conference centres. Border zones. Executive venues. Sensitive meetings. Crowded places where users already expect poor reception.

That is useful cover for RF-layer manipulation.

What To Do

Disable 2G if your device and carrier settings allow it. On newer Android devices this may be exposed directly in network settings. On iPhone, Apple's Lockdown Mode turns off 2G and 3G cellular support, though it is designed for high-risk users and changes other device behaviour too.

Stop using SMS-based two-factor authentication on important accounts. Use an authenticator app, passkey or hardware security key instead.

Use Signal or another properly end-to-end encrypted messenger for sensitive calls and messages. If the transport layer is compromised, content encryption still matters.

Do not treat a VPN as RF-layer protection. A VPN helps with IP traffic after connectivity is established. It does not stop your phone identifying itself to cellular infrastructure before that tunnel exists.

Change your threat model in hostile environments. Conferences, sensitive meetings, border crossings, executive travel, investigative work and high-value business venues all deserve more caution than normal daily use.

Do not treat aeroplane mode as high-assurance RF silence. It is useful for reducing normal radio activity, but it still depends on the device, operating system and radio settings behaving as expected. For higher assurance, power the device off and physically separate it from the sensitive environment.

The Point
2012 was the year the smartphone became normal. The security briefing never came with it.

The world adopted the smartphone as a personal computer, camera, wallet, map, identity layer and communications hub. Underneath, it remained a radio device. A modem. A SIM. A set of antennas. A stack of legacy protocols. A negotiation with whatever network environment surrounds it.

From 2G to 5G, the story is not that everything is broken. The story is that part of the attack surface sits below where most users are looking.

Below the apps. Below the OS. Below the VPN.

The antenna is not just for signal.

The antenna is part of the attack surface.

It always was.

IntSpired® | Offensive Cyber & Wireless Security | UK

We test your defences the way adversaries would, under formal authorisation, to uncover what is actually exploitable.

intspired.co.uk

5G, IMSI Catchers and the Downgrade Problem

IntSpired® — Thu, 25 Jun 2026 05:17:31 +0000

5G makes IMSI catching harder, but fallback is where the risk remains.

The old IMSI catcher problem was fairly simple. A device could be pulled towards a stronger rogue cell, persuaded to connect, and then pushed into revealing identity information before the session was properly protected.

In 2G, 3G and 4G environments, that created a practical route to subscriber identification, tracking and follow-on targeting.

That weakness sits in the order of events. The device identifies itself before enough trust has been established.

5G Standalone changes that model. But that protection is not absolute in every real-world condition.

The permanent subscriber identity is no longer supposed to be exposed over the air in clear text. Instead, the device sends SUCI, the Subscription Concealed Identifier, which protects the underlying subscriber details using ECIES, the Elliptic Curve Integrated Encryption Scheme.

That means the fake base station may still attract the device, but it should not be able to read the permanent subscriber identity in clear text. That is a major architectural improvement.

But from an offensive security perspective, the important question is not simply:

Can 5G protect the identity?

The better question is:

Can the device be forced into a condition where that protection no longer applies?

This is where the operational risk remains. If a device, SIM, operator configuration or coverage environment allows fallback to 4G, then the older identity exposure path can still become relevant.

The attacker may not need to “break 5G” at all. They may only need to shape the radio environment, degrade service, manipulate selection behaviour, or force the user equipment into a weaker mode.

That is the part often missed in simplified security discussions.

Cryptography can be strong. The standard can be improved. The architecture can be better.

But the real world still depends on configuration, coverage, fallback behaviour, handset capability, operator maturity and the radio environment around the target.

For high-risk individuals, executives, journalists, legal teams, investigators and sensitive organisations, mobile surveillance risk should not be dismissed just because “5G is secure”.

The more realistic position is this:

5G Standalone makes traditional IMSI capture significantly harder, but mixed 4G/5G environments still create downgrade and exposure opportunities.

Consider:

What can be seen?

What can be forced?

What can be downgraded?

What can be tracked?

What happens when the device leaves the ideal security model and enters the real environment?

Security is not only about what the protocol promises. It is about what an attacker can make the target system do.

IntSpired® | Offensive Cyber & Wireless Security | UK

We test your defences the way adversaries would, under formal authorisation, to uncover what is actually exploitable.

intspired.co.uk

SIGINT: Know Before You’re Known

IntSpired® — Tue, 16 Jun 2026 06:18:02 +0000

Most security conversations begin at the point of impact: phishing, malware, ransomware, data breaches and compromised systems.

Those threats matter. But they are rarely where the adversary starts.

Before exploitation, there is collection.
Before intrusion, there is reconnaissance.
Before action, there is intelligence.

One area still under-discussed in the private security space is signals intelligence, or SIGINT.

Image 1: Understanding SIGINT in the Modern Threat Landscape.

Traditionally, SIGINT has been treated as a government, military or intelligence-agency discipline. But the modern threat landscape is no longer that cleanly separated.

Criminal groups, hostile actors and organised networks increasingly operate on the same principle. That is where cyber, physical security and intelligence begin to overlap.

The tools and techniques that once required state-level resource and access are increasingly available, affordable and understood beyond that world. Off-the-shelf hardware can monitor wireless environments. Geolocation data is commoditised. The barrier to conducting meaningful signals collection against a target has dropped considerably. That shift matters for any organisation that assumes its exposure begins and ends with its IT perimeter.

Image 2: Signals Intelligence Is No Longer Only a State-Level Concern.

Documented cases show organised criminal networks using phone metadata, geolocation data and signal disruption to identify law enforcement activity, evade surveillance and protect their operations. GPS jammers have been deployed to blind tracking systems during cargo theft. Counter-surveillance techniques once associated with state-level actors are now in active use by criminal organisations. The gap between state capability and criminal application is narrowing. That has direct implications for private sector organisations.

For private organisations, the lesson is clear: threat intelligence cannot stop at the firewall. The more important question is what an adversary already knows before the attack is even considered.

A mature security posture should ask:

What can an adversary observe before they attack?
What signals are we leaking?
What wireless or RF exposure exists around our people, sites, vehicles or operations?

Could location data, device behaviour, communications patterns or technical emissions be used to build intelligence against us?

Consider a straightforward example: a fleet of company vehicles passively broadcasting Bluetooth identifiers and Wi-Fi probe requests creates a pattern-of-life signature readable by anyone with basic monitoring equipment. Add mobile devices connecting to cell towers, and a picture of where your people are, how frequently they move and when routines deviate becomes available.

No breach required. No direct engagement with your systems.

Where are we visible before we are vulnerable?

Image 3: What Adversaries Can See Before They Attack.

At IntSpired®, our work is focused on that earlier phase of the threat lifecycle. We help organisations understand their own signal exposure before an adversary does, and identify where intelligence may already be accumulating against them.

That means looking beyond the obvious breach point: adversary visibility, pre-attack intelligence, wireless and RF exposure, OSINT, technical reconnaissance and the overlap between digital and physical risk.

The organisations that understand this earliest are the hardest to target.

INTSPIRED®
OFFENSIVE BY DESIGN. INTELLIGENT BY NATURE.

Sources / further reading:

This post draws on open-source reporting and public material, including:

National Crime Agency, National Strategic Assessment of Serious and Organised Crime (2024)

National Cyber Security Centre, Annual Review 2024 (2024)

Royal United Services Institute, Operation Destabilise: Russia, Organised Crime and Illicit Finance (2024)

Ofcom, Radio Frequency Jammers: Spectrum Offences under the Wireless Telegraphy Act 2006 (2023)

Privacy International, IMSI Catchers: UK Authorities Play Hide and Seek with Use of Intrusive Surveillance Technology (2023)

Satellite-to-Phone Connectivity

IntSpired® — Thu, 11 Jun 2026 05:45:44 +0000

Satellite phones are not new. What is changing is ordinary smartphones connecting directly to satellites.

For years satellite communication required specialist devices and dedicated terminals used by remote workers, maritime users, emergency responders, military personnel and journalists operating beyond normal mobile coverage.

Most people rely on terrestrial networks. That means everything connecting your phone or laptop to the internet through ground-based infrastructure. The cell tower in your street. The cables between exchanges. Your home broadband and Wi-Fi router. If it sits on the ground and carries your data it is part of the terrestrial network.

When those networks are unavailable, damaged, congested, jammed or out of range, connectivity fails. That is where direct-to-device satellite connectivity becomes relevant.

The shift has already started

Apple's satellite features allow compatible iPhones to contact emergency services with no cellular or Wi-Fi coverage. Starlink is developing direct-to-cell services using low Earth orbit satellites. AST SpaceMobile has received FCC approval to operate a constellation providing supplemental coverage through existing mobile partners.

Full satellite broadband to every phone as an everyday service is not here yet. But the move from specialist satellite hardware towards ordinary satellite-capable smartphones has begun.

Image 1: Starlink V1.5, V2 and V3.

Later Starlink satellites are expected to be larger and more capable to support direct-to-device connectivity. V3-class satellites are widely discussed as requiring Starship-scale launch capacity rather than routine Falcon 9 deployment. A larger antenna array can help the satellite focus a stronger and more precise signal beam towards a device on the ground. That is what makes connecting to an ordinary smartphone physically possible.

The signal strength problem

Many low Earth orbit communication satellites operate hundreds of kilometres above Earth. Research modelling often uses altitudes of around 550–560 km to illustrate the scale of the signal-strength challenge. Purpose-built ground terminals use large, focused antennas to receive these signals. Smartphones, by contrast, rely on much smaller built-in antennas. As a result, the received signal strength can be thousands of times weaker than with a dedicated ground terminal.

The solution is beamforming. Instead of broadcasting a signal in all directions, the satellite uses an array of antennas to focus power precisely towards a specific device. It is the difference between a lightbulb spreading light across a room and a torch aimed at a single point.

Image 2: Beamforming & Focusing the Signal.

Left: unfocused signal spreading in all directions with most power wasted. Right: beamforming concentrating power directly at the device on the ground.

A satellite has limited power. Beamforming focuses that power like a torch beam rather than spreading it like a lightbulb. This is one of the key techniques that allows a satellite to reach a standard smartphone without a specialist terminal on the ground.

Multiple satellites, one phone

Research published in 2026 by engineers at KTH Royal Institute of Technology shows how multiple satellites can coordinate to serve the same device simultaneously. Instead of connecting to one satellite a phone could receive data streams from several at once improving both speed and reliability. If one satellite moves out of range or is blocked, others may help maintain continuity. This coordination does not require the satellites to be precisely synchronised with each other removing one of the main practical barriers to real-world deployment.

Image 3: One Phone, Multiple Satellites.

Four satellites each sending a differently coloured beam to a single smartphone on the ground.

Future systems may allow a device to receive signals from several satellites simultaneously improving resilience and reducing the impact of movement, blockage or coverage gaps. Each satellite sends part of the data. The phone combines the signals.

Why this changes the risk landscape

Wider access creates wider exposure.

For ordinary users a satellite-capable phone can communicate outside normal network infrastructure even when that infrastructure is deliberately disrupted.

For organisations satellite-capable devices may bypass local network controls, corporate gateways or expected monitoring points.

The criminal threat: more than jamming

Jamming means broadcasting interference on the same frequency a satellite uses to block the signal. GPS jamming is already documented across multiple regions. Direct-to-device services use different frequencies but any wireless link can be vulnerable to interference if an attacker can affect the relevant signal path.

Spoofing mimics a legitimate signal. Spoofing or false-signal attacks could attempt to mislead devices or disrupt trust in the connection.

Covert communications. Historically, communicating beyond terrestrial network reach often required expensive and visible specialist hardware. A standard smartphone with satellite capability removes that barrier. Networks operating in remote areas, across borders or at sea gain a communications channel that no longer depends on infrastructure authorities can monitor or disrupt.

Evading lawful interception. Legal frameworks for intercepting communications are built around terrestrial infrastructure. When traffic routes through a satellite path it may complicate existing lawful intercept, monitoring and governance models that were designed for that environment.

Fraud and identity threats. SIM fraud, account compromise and interception attempts will follow satellite connectivity as they have followed every previous generation of mobile technology. Security frameworks built on terrestrial assumptions will need updating.

Physical security in sensitive locations. A satellite-capable phone carried into a restricted environment can communicate outside any local network controls in place. Existing device policies and physical security protocols may not account for this.

This technology does not create new crimes. It reduces friction, increases reach, and may weaken some existing assumptions around visibility, control and disruption.

The point for security awareness

Satellite connectivity is moving from specialist equipment into everyday phones and the infrastructure is being built now.

Criminal networks adapt quickly to new communications capabilities. They do not wait for policy frameworks to catch up. A new channel emerges, legitimate users adopt it, and those seeking to avoid detection follow.

The gap between how fast this technology is moving and how slowly security awareness tends to follow is where the risk lives.

IntSpired®
Offensive by Design. Intelligent by Nature.

References:
KTH Royal Institute of Technology, "Joint and Streamwise Distributed MIMO Satellite Communications with Multi-Antenna Ground Users" (2026)

NextBigFuture, "Satellite Direct to Cellphone — SpaceX Starlink vs Apple vs AST Space Mobile" (2025).

Tracking down a 1964 US Navy Satellite No One Could Switch Off

IntSpired® — Mon, 01 Jun 2026 06:05:54 +0000

They said it was dead. It kept transmitting.

Transit 5B-5. NORAD 965. OPS 6582.

Launched in December 1964 as part of the US Navy’s Transit satellite navigation system, the GPS of its era.

Nineteen days after launch, its navigation transmitters failed. The satellite stopped responding to commands. The telemetry transmitter could not be switched off.

This morning, from IntSpired, Cornwall, we tracked it.

Here is exactly how.

Image 1: Step 1 — Pull the orbital data.

Before you can track anything, you need to know where it is.

One command to CelesTrak. curl pulls the TLE directly from the source: two lines of orbital mechanics containing the epoch, inclination, eccentricity and mean motion.

That is everything Gpredict needs to compute where Transit 5B-5 will be, and when.

Written to 965.sat.

Ground truth established.

Image 2: Step 2 — Configure the ground station.

A satellite’s position means nothing without a reference point on Earth.

IntSpired, Cornwall, UK
50.5000°N, 5.0000°W
IO70MM
50 metres above sea level
Weather station: EGHQ

Every AOS time, LOS time, elevation calculation and Doppler prediction runs against this coordinate.

This is the anchor.

Get it wrong and nothing that follows is accurate.

Image 3: Step 3 — Wait for the geometry to align.

Forty-seven minutes to acquisition of signal.

Transit 5B-5 is 13,641 km away. Elevation -81°. Deep below the horizon. Eclipsed.

The red dotted line shows the incoming trajectory. Gpredict is computing the pass in real time. IntSpired is locked as the ground station and waiting.

This is the part nobody posts.

The prediction phase.

Knowing exactly when and where to look before anything appears.

That discipline is the skill. The SDR is just the receiver.

Image 4: Step 4 — Acquisition.

There it is.

Elevation 25.77°. Slant range 1,988 km.

Transit 5B-5 is inside IntSpired’s footprint on the map, the two points almost touching over the North Atlantic.

Doppler is at -362 Hz. The sign has already flipped, which means closest approach has passed and the satellite is now receding.

That zero-crossing happened live during the pass as the frequency shifted through zero.

That is observable proof of a real pass, not just a prediction on a screen.

Signal loss: 138.37 dB.
Orbit: 4108.
Observed from Cornwall with one dipole and one SDR.

Why this matters

Transit 5B-5 has no active operators. No mission control. No one managing it.

Its batteries failed decades ago. It appears to run directly from degraded solar cells. When it enters Earth’s shadow, the transmitter can drop within seconds. When sunlight returns, it recovers and transmits again.

It has continued doing this for more than 60 years because nobody can tell it to stop.

That is unmanaged RF exposure at the extreme end of the scale.

A signal crossing the sky that no one controls, few people monitor, and almost no one knows is there.

The workflow this morning was simple:

Gpredict.
One dipole.
One RTL-SDR.
One computer.

Nothing exotic.

The barrier to observing signals people assume are invisible is lower than most organisations think.

RF awareness is not only for signals intelligence units. It is a methodology.

It is knowing what is above your horizon, when it is there, and what it is transmitting.

That is our baseline.

Your adversary can do the same.

Watch the full pass

Countdown to AOS, acquisition, peak elevation and LOS — the complete observation recorded live from IntSpired, Cornwall:

tiktok.com

IntSpired® | Offensive Cyber & Wireless Security | UK

We test your defences the way adversaries would, under formal authorisation, to uncover what is actually exploitable.

intspired.co.uk

Hardware Not Required: WebSDR and the Open RF Layer

IntSpired® — Mon, 25 May 2026 09:33:04 +0000

Anyone with a browser can access live radio spectrum from receivers around the world.

No SDR dongle. No antenna. No local setup. Just a browser and an internet connection.

The WebSDR project began at the University of Twente in 2007. Since then, browser-based RF access has become widely available, with public receivers covering different countries, bands and antenna sites.

Examples of WebSDR in Use

Image 1: The public WebSDR directory, showing receivers across Europe with their own locations, antennas and frequency ranges.

Image 2: Qatar-OSCAR 100 at Goonhilly Earth Station, Cornwall. Live satellite RF from Es’hail-2, streamed through a browser.

Image 3: Hack Green, Cheshire. A former Cold War nuclear bunker, still transmitting.

What a waterfall reveals

Not every signal tells a story. Much of what appears on a waterfall is simply evidence of a transmission, on a frequency, at a point in time.

Where signals are left open or technically decodable, SDR tools can reveal more.

Frequency use. Timing. Signal type. Volume.

On their own, these details may look minor. Combined over time, they can reveal routines, system behaviour and operational change.

The layer most organisations do not monitor

Many organisations rely on wireless systems for communications, access control, logistics and safety. Few monitor the RF environment around them.

The assumption is often that signals disappear into noise and go unnoticed.

They do not.

WebSDR makes passive RF observation accessible. With the right receiver, antenna, band coverage and propagation conditions, a signal may be observable well beyond the site that transmitted it.

The RF layer should not be assumed private by default. It is a layer many security teams have not yet thought to look at.

If a signal is transmitted, it may be observable.

The RF layer is not invisible.

See for yourself: websdr.org

IntSpired® | Offensive Cyber & Wireless Security | UK

We test your defences the way adversaries would, under formal authorisation, to uncover what is actually exploitable.

intspired.co.uk

Satellite Signals Are Easier to Observe Than Many Realise

IntSpired® — Thu, 21 May 2026 17:31:34 +0000

Satellite communications underpin much of the world’s connectivity.

Recent research, including a 2025 academic study, has shown that some GEO satellite links still carry clear-text IP traffic, exposing voice calls, SMS messages and operational data.

These systems support cellular networks, aviation, maritime operations and remote infrastructure across vast regions.

When transmissions are not properly encrypted, sensitive information can become observable to anyone capable of monitoring the RF spectrum.

Satellite Signal Observation

Image 1: SDR monitoring setup used to observe satellite activity in real time.

Image 2: Signal activity captured during a satellite pass, visible in the spectrum waterfall.

Much of this activity sits in a layer many organisations rarely monitor: the RF signals their systems depend on.

As reliance on wireless and satellite-connected systems grows, understanding how signals behave across this space becomes increasingly important for modern security, resilience and intelligence work.

At IntSpired, we analyse signal environments like these to help identify emerging exposure risks before they become operational problems.

Research paper:
https://satcom.sysnet.ucsd.edu/docs/dontlookup_ccs25_fullpaper.pdf

INTSPIRED®
OFFENSIVE BY DESIGN. INTELLIGENT BY NATURE.

IntSpired® | Offensive Cyber & Wireless Security | UK

We test your defences the way adversaries would, under formal authorisation, to uncover what is actually exploitable.

intspired.co.uk

Bluetooth Exposure – Part 3

IntSpired® — Tue, 19 May 2026 05:53:20 +0000

The Silent Signals You Never Realise You’re Broadcasting

Long before digital navigation, reconnaissance teams relied on fieldcraft. Location was confirmed through resection: bearings plotted against known landmarks to determine position with precision.

Today, devices perform those bearings automatically.

Image 1: illustrates the shift from traditional navigation to Wi-Fi probing and finally to BLE mesh networks that quietly map presence and proximity through everyday devices.

Modern phones broadcast continuously. Wi-Fi probes and Bluetooth Low Energy (BLE) signals reveal device presence the moment a device wakes, often long before any connection is made.

BLE takes this further

Major technology ecosystems operate large-scale BLE mesh frameworks embedded into consumer devices. Phones, watches, earbuds, vehicles, trackers, and IoT products emit low-power beacons every few seconds. Nearby devices receive and relay them, extending the mesh.

The result is ambient visibility.

Image 2: shows two BLE detection interfaces side by side. Together, they demonstrate how BLE broadcasts can be observed externally and used to assess presence, proximity, and movement patterns.

No pairing.
No password.
No exploitation.

This is simply how BLE operates.

Over time, broadcast patterns can reveal behavioural rhythm: arrival times, devices that move together, and devices that separate. The exposure is not technical compromise, it is ambient metadata.

The same radio landscape that exposes also protects.

Understanding your own emissions helps identify anomalies, detect unknown trackers, and recognise unusual activity in your environment.

A simple starting point:
• Disable Bluetooth when not required
• Review device privacy settings
• Understand what your devices broadcast by default

In a shared spectrum world, awareness is no longer optional.

If you do not understand your own emissions, someone else eventually will.

@intspired® - Protecting your brand, your business, and your operations.

IntSpired® | Offensive Cyber & Wireless Security | UK

We test your defences the way adversaries would, under formal authorisation, to uncover what is actually exploitable.

intspired.co.uk

Bluetooth Exposure – Part 2

IntSpired® — Thu, 14 May 2026 07:11:07 +0000

Understanding BLE Through Simple Threat Modelling

Most people do not realise how much their devices broadcast. Constantly. Passively. Often in plaintext. BLE may be low power, but from an attacker’s perspective it is highly informative.

Last week we explored why Bluetooth remains an overlooked attack surface. This week we go deeper by applying simple threat modelling to show what an attacker actually sees and where the real exposures sit.

The Everyday BLE Ecosystem

This is the environment most people carry with them every day. A silent network of identifiers, telemetry and behavioural signals leaking into the air around you.

Image 1: BLE Device Ecosystem.

Smartwatch (Peripheral) Continuously advertises identifiers, sensor values, motion events and sync activity. This alone is enough to build behavioural profiles.

Bluetooth Earbuds (Peripheral) Many models broadcast even while inside the charging case. They reveal identifiers, battery levels and reconnection attempts. This exposes presence, movement and proximity.

Smart Lock (Peripheral) Reveals device type, activity timing, connection attempts and lock state patterns.

Smartphone (Central) Acts as the BLE hub. Constant scanning, pairing, reconnecting and exchanging data through OS services and installed apps.
Cloud Services Telemetry, identifiers and behavioural analytics flow upstream from associated apps. Once correlated, this becomes highly identifiable and highly valuable.

Why this ecosystem creates risk
Attackers do not need pairing. They do not need exploits. They only need to listen.

Image 2: shows the full 2.4 gigahertz environment: channel spikes, BLE bursts and hopping patterns, revealing activity density and where signals originate.

Image 3: illustrates live BLE MAC addresses, advertising data, service identifiers and device presence in real time. This allows attackers to map devices, movement patterns, proximity and relationships.

Image 4: password sent from phone, intercepted via BLE UART, captured by Nordic Sniffer, shown in plaintext in Wireshark.

This is BLE without encryption or authentication. And many consumer IoT devices still work exactly like this.

Plaintext BLE write operations may include: • passwords • PIN codes • actuator commands such as unlock or open • configuration values • sensor and status payloads

If it is unencrypted, anyone in range can intercept it.

Key Takeaway

If a BLE device does not enforce encryption and authenticated pairing, everything it transmits is visible and can be captured by anyone in range.

For red teams this is a powerful source of passive intelligence. For attackers it is trivial interception. For defenders it remains a major blind spot.

Next Week in Part 3

Part 1 explored why Bluetooth remains a high-value vector and how attackers use BLE at the reconnaissance stage.

Part 2 showed what an attacker can actually see, including live identifiers and plaintext BLE traffic.

Part 3 will move into the defensive and counter-surveillance side.

We will look at:

• Quick methods to reduce your BLE attack surface

• Surveillance and counter-surveillance considerations

• What attackers silently collect from BLE Radar-type tools • How to detect or disrupt unwanted BLE tracking

• How attackers use signal strength and directional antennas to track BLE devices in the real world

If you rely on BLE devices every day, Part 3 is the one you’ll want to read.

@intspired® - Protecting your brand, your business, and your operations.

IntSpired® | Offensive Cyber & Wireless Security | UK

We test your defences the way adversaries would, under formal authorisation, to uncover what is actually exploitable.

intspired.co.uk

Bluetooth Exposure – Part 1

IntSpired® — Sun, 10 May 2026 06:43:23 +0000

Real-World Weaknesses | Awareness Series: Part 1 of 3

Over the next few posts, I will explore the real cybersecurity risks behind Bluetooth and why individuals, homeowners and businesses routinely overlook this attack surface.

Bluetooth is often treated as harmless background technology. In reality, it can reveal device presence, proximity, movement patterns and, in some cases, weak implementation choices that increase exposure.

Classic Bluetooth vs BLE

Classic Bluetooth is typically used for audio devices and higher-bandwidth data transfer.

Bluetooth Low Energy, or BLE, is commonly used by beacons, trackers, wearables, IoT devices, smart locks and sensors.

Both operate in the crowded 2.4 GHz ISM band. Both can broadcast information into the surrounding environment. That means both can create exposure, often without the user realising.

Bluetooth Research Tools

Image 1: shows a selection of tools commonly used to explore Bluetooth and BLE weaknesses.

Highlighted is the Ubertooth One, a well-known device within the Bluetooth security research community. However, research and field experience show that it can be unreliable, and it is not usually the first tool I would reach for during practical assessments.

Bluetooth Exposure in the Real World

Image 2: demonstrates how easily freely available mobile apps can reveal Bluetooth devices nearby.

Many of these apps are designed for legitimate diagnostics and device management. However, they also show why individuals and organisations should take Bluetooth exposure seriously.

Even without specialist knowledge, it is possible to identify:

• Nearby devices currently broadcasting
• Devices left in discoverable or pairable modes
• Device names that unintentionally leak information
• Signal strength, or RSSI, which can indicate proximity
• Wearables, trackers, earbuds, speakers, locks and IoT equipment

Some devices may also accept a connection without being bonded or paired, allowing applications to read or write characteristics. This is not advanced exploitation. It is usually a sign of weak device security and poor implementation.

The same visibility that supports diagnostics can also allow environments to be passively mapped. Over time, this can reveal device presence, routines and behavioural patterns.

Despite this, Bluetooth exposure remains widely underestimated. In certain conditions, it can contribute to privacy compromise, tracking, surveillance, or become part of a broader attack chain.

Simple Defensive Step

Before going deeper into the series, one simple defensive step everyone should follow is:

Turn Bluetooth off when you are not using it.

This significantly reduces exposure and prevents your device from broadcasting unnecessarily.

What This Series Will Cover

This series will provide a high-level overview of:

• Why Bluetooth remains a valuable vector for threat actors
• How attackers use BLE during reconnaissance
• What nearby devices can reveal without pairing
• What your phone may broadcast without your knowledge
• Tools defenders should understand
• Quick ways to reduce Bluetooth exposure
• Surveillance and counter-surveillance considerations

Bluetooth may feel harmless, but it is not invisible. Most people have no idea how much they are broadcasting until it is demonstrated to them.

INTSPIRED® | Offensive by Design. Intelligent by Nature.

IntSpired® | Offensive Cyber & Wireless Security | UK

We test your defences the way adversaries would, under formal authorisation, to uncover what is actually exploitable.

intspired.co.uk

When a Radio Signal Stops a Train

IntSpired® — Thu, 07 May 2026 07:41:34 +0000

A Taiwan high-speed rail incident from earlier this week is a sharp reminder that RF security is not a niche issue. It is part of critical infrastructure resilience.

Image 1: Taiwan High Speed Rail — THSR 700T train on the Taipei–Kaohsiung line. Source: Wikimedia Commons

Reports confirm a university student used consumer-grade SDR equipment to intercept, decode and clone TETRA radio parameters, then triggered a General Alarm signal that brought four high-speed trains to an emergency stop for 48 minutes. A 23-year-old student has since been arrested and is currently out on bail.

The technical takeaway is clear. Parameters were cloned. Authentication was bypassed. And the equipment used was bought online.

Image 2: Seized equipment. Source: Taoyuan District Prosecutors Office via CNA/Newtalk, 2026. https://newtalk.tw/news/view/2026-04-30/1032591

What this incident tells us is not just that the system was vulnerable. It tells us that the vulnerability had likely existed for years, undetected and untested. A radio enthusiast with off-the-shelf equipment, no insider access, and no advanced technical background was able to clone operational parameters and trigger the highest-priority alert in a national rail network.

That is not a sophisticated attack. That is a gap that should have been identified in a security assessment long before it was exploited this way.

The questions every critical infrastructure operator should be asking right now are simple. When did you last rotate your radio parameters? Have you ever tested whether your authentication can be bypassed from outside the network? Do you have any detection capability for rogue transmissions? Do you know where a rogue signal is coming from and how fast you can locate it? And if someone triggered a false alarm today, would your response procedures hold up?

If any of those answers are uncertain, that is where to start.

What good RF security looks like in these environments is not complicated in principle, but it is rarely done well in practice. It means treating radio as an attack surface from day one. Regular parameter rotation. Strong authentication on every device. Encryption that is actually tested, not just assumed. Logging and alerting on anomalous transmissions. Direction-finding capability so you can locate a rogue signal when it appears. And response procedures that have actually been exercised, not just written down.

This is not about SDR being dangerous. SDR is a tool. The real issue is whether safety-critical communications have strong authentication, encryption, parameter rotation, logging, detection, direction-finding, and response processes around them.

For rail, ports, airports, utilities, emergency services and other critical environments, RF should be treated as an attack surface, not background noise.

Test it like it matters. Because it does.

Further insights - Taipei Times: https://www.taipeitimes.com/News/taiwan/archives/2026/05/05/2003856781
The Register: https://www.theregister.com/cyber-crime/2026/05/06/taiwan-student-pwns-rail-comms-halts-high-speed-trains/5230489
LinkedIn: https://www.linkedin.com/in/keith-intspired
IntSpired®: https://www.intspired.co.uk

Cover image: Handheld radios seized during the investigation. Source: CTWANT/Weekly King via PChome News. https://news.pchome.com.tw/society/crwant/20260501/index-77760091156668316002.html