[lxgr]

Unfortunately, I think there's no way for a SIM card to indicate to the phone that it would like it to please never connect to any 2G (or any non-mutually-authenticated) network.

Absent that, maybe this happens via a carrier profile (or equivalent mechanism)?

[Scoundreller]

Ah, so the attack might depend on whether your phone is set to allow roaming or not. Maybe.

But I only have an option for data roaming on/off, not roaming entirely.

[lxgr]

I don't think that matters, since the phone has no way of knowing from the SIM card alone whether it should still connect to 2G networks or not.

It sounds like a good idea to at least restrict 2G connections to non-roaming scenarios, but then you have the next practical problem: How does your baseband know that you're abroad?

Sure, all solvable at the application layer (the phone could use location heuristics to figure out where it is etc.), but not trivial and full of edge cases that could easily result in your phone mysteriously not connecting while abroad or, worse, not being able to make an emergency call or similar.

[Scoundreller]

I also kinda figure there’s some magic running to “stick” to your home network where available/visible because of international border areas and people historically getting regularly upset about being roaming charges despite never leaving their home country.

[lxgr]

SIMs can define both their home network (both implicitly since the IMSI starts with MCC/MNC of the issuer/home network, and explicitly in the form of a list of "equivalent networks", which is useful for MVNOs with their own MNC that don't want the "roaming" icon to show up) and a ranked list of preferred roaming networks. The phone should usually define those.

Of course, in some situations you might only get signal from across the border, and then none of these mechanisms can help.

[Scoundreller]

I’d add in some high buildings in Toronto, if I did a network scan with a foreign SIM, I could see some US networks from over the lake, but with a Rogers SIM, they would not be visible in the scan.