Based on this paper, it says that one technique for tricking phones using LTE to connecting to a CSS is to exploit the "absolute priority based cell reselection" feature. Basically we'll need to parse SIB 4,5,6, and 7 messages to figure out these frequencies and then scan to see if there's anything on them.
Based on this paper, it says that one technique for tricking phones using LTE to connecting to a CSS is to exploit the "absolute priority based cell reselection" feature. Basically we'll need to parse SIB 4,5,6, and 7 messages to figure out these frequencies and then scan to see if there's anything on them.