The attack is a combination of multiple "vulnerabilities":<p>1. the data link layer is not protected, so an attacker can perform a relay attack (forward the encrypted radio packets between the phone and the actual cell tower).<p>2. from watching the encrypted traffic patterns, it is possible to guess which websites the user is surfing by comparing the traffic fingerprints.<p>3. the packets are not integrity-protected, so it's possible to change bits of data, if you can guess which packet you have and how it's constructed. This is used to manipulate DNS requests to redirect traffic.<p>I'm not sure about the significance of #1 and #2. A passive attacker <i>might</i> be able to obtain the same information simply by monitoring the physical layer traffic patterns emitted by the phone. Additionally, mobile operators are typically monitoring their frequencies for abuse, so an active attack might not stay under the radar for long.<p>Regarding #3, this is a complicated way to achieve what you can do with a fake WiFi hotspot, and gives you control over unencrypted communications, which hopefully is only a very small subset of todays traffic thanks to omnipresent HTTPS.