Getting a stranger’s phone kicked off the cellular network costs a few dollars

Researchers found six weaknesses across device firmware, carrier reporting portals, and cross-carrier block-list sharing that let an attacker — using inexpensive prepaid accounts or leaked/early-assigned IMEIs — remotely block phones and cellular IoT devices (including home alarm gateways) without physical access. Demonstrations against three major U.S. carriers showed blocks costing $2.50–$4 each and taking seconds to minutes, with additional attack variants using rogue base stations to capture IMEIs from vulnerable chipsets; the paper proposes stronger identity checks, device certification, improved ownership signals, and richer metadata when carriers share blocks.