Android：如何断开特定基站连接并强制切换至邻基站？

Great question—this is a critical topic for mobile security, especially with Stingray-like IMSI catchers targeting user communications. Let’s break down your questions clearly:

Short answer: No, not with standard Android APIs for third-party apps, and even system-level apps have extremely limited capabilities here. Here’s why:

• The core logic for cell tower selection, handovers, and connection management is controlled by your device’s baseband chip and the carrier’s core network, not the Android framework. Google intentionally restricts third-party apps from interfering with this process to prevent malicious actors from disrupting legitimate communication.
• While TelephonyManager lets you read active/neighboring CellInfo, there are no public APIs to trigger a disconnect from a specific tower or force a handover. The MODIFY_PHONE_STATE permission, which once allowed limited network tweaks, was locked down completely for third-party apps starting in Android 10.
• Even if you could access lower-level APIs, handovers require signaling between the device, current tower, and carrier core network—something an app can’t initiate on its own.

Since direct control over cell connections isn’t possible, focus on indirect mitigation and user alerts:

• Trigger a network re-registration: The closest you can get to forcing a tower switch is to prompt the user to toggle Airplane Mode on/off, or use Android 12+’s TelephonyManager.requestNetworkScan() API to scan for available networks. This encourages the device to re-evaluate nearby towers and may connect to a legitimate one automatically.
• Alert the user with actionable steps: Pop a high-priority notification warning them of the suspected fake tower. Advise them to:
  • Switch to a trusted Wi-Fi network immediately (if available)
  • Manually select their carrier’s official network in Settings → Mobile Network → Network Operators (avoid "Automatic" selection, which can prioritize fake towers with strong signals)
• Log and flag suspicious towers: Record the fake tower’s Cell ID, LAC (Location Area Code), and PLMN (Public Land Mobile Network) values. If your app detects the same tower again later, you can immediately alert the user to avoid it.
• Push for end-to-end encryption: The most effective long-term protection is to encourage users to use apps with end-to-end encryption for calls and messages. Even if a Stingray intercepts the connection, it can’t decrypt the actual content.

• Detection accuracy matters: Public Cell ID databases can be outdated or incomplete. To reduce false positives, cross-verify tower data with multiple signals (e.g., tower location vs. your device’s GPS, support for encrypted VoLTE/5G SA, unusual signal strength).
• Android version constraints: Many modern network-scanning APIs only work on Android 12 and above. Older devices will have fewer mitigation options available.
• Carrier-level restrictions: If a fake tower mimics a legitimate carrier’s PLMN perfectly, your device may still prioritize it. In these cases, app-level interventions are limited—users may need to rely on carrier-specific security features (if available).

内容的提问来源于stack exchange，提问作者Gabo Alvarez