For "basestation" read "the network". The partitioning of responsibility within a GSM network is relevant to this attack only in regards to which component main

For "basestation" read "the network". The partitioning of responsibility within a GSM network is relevant to this attack only in regards to which component maintains the "signals-pending table". There are a number of different locations this could be stored, depending on how the network is setup. They are doubtless using osmocom-bb, which is an open source baseband implementation for a number of older phones using an old baseband board. The implementation of the attack is not relevant to the attack itself. You could implement it with an SDR, or with osmocom-bb compatible boards, or whatever. It is still a race condition that they've figured out how to win. The solution is simple. The network needs to maintain to "signals-pending table" entry for a mobile until it successfully authenticates, or the entry times out. If they are flushing the entry after an unsuccessful authentication attempt then it enables a DoS, such as this one. I still have a hard time believing this is how it actually works because it seems like the network is behaving incorrectly.