An answer to a recent question has given me an idea for a school project (security CS program).

Also, an active attacker (with a fake base station) can potentially force a mobile phone to use another variant [of encryption]...

This sounds very cool, and I want to implement this on an at-home basis.

This article talks about a 2010 presentation of just such an experiment. I've done some limited research, but I have two main questions:

What equipment would I need to buy and how much would it cost (this project is self-funded)? The article said $1,500, including the laptop (which I already have), but did not give any specific information on the antenna.

What sort of APIs/libraries/etc., if any, exist for the communications protocols? If none, I can probably try to implement the protocol myself, but this could take a lot of time.


Conclusion so far: While cell phones can operate in a HAM radio band in the United States, I'm concerned about potential legal implications of spoofing a cell phone tower. Specifically, I think I would need to identify myself as another carrier in order to perform a MITM attack, which may be a crime.

Some helpful links:

  • keep cell phone at home and relay calls threw it... do not use call forwarding because the carrier will see it as a incoming call but use perhaps Bluetooth to control that phone from a remote location all the carrier will see is incoming outgoing calls from ur home although you are in Hawaii at the beach sippin on coronas eating polky ;) please if you figure it out post up the results im not a electronic wizard or even a techy I got the idea from the blue tooth in my car witch is voice activated... to make my idea stupid easy to understand imagine this.... I leave my cell in my car at home wit – user31155 Sep 23 '13 at 20:04
  • Is this how the police use Stingray? See – Stone True Nov 25 '15 at 18:25
  • @user31155, Bluetooth is a short range technology, ~100 meters max. Probably the easiest solution would be remote control software to control your phone remotely.. Not sure how well it works though – kennycoc Jan 12 '17 at 15:57
  • The concept was demonstrated by white-hat hackers at DEFCON, as shown here:… – SDsolar Jun 25 '17 at 0:54
up vote 11 down vote accepted

Defcon has had a few presentations on this subject. An active attacker can turn off encryption altogether, never mind just changing it.

Also there is an open source program available just for this. I will edit this with the link when I find it.

A recent Blackhat- Europe talk entitled LTE and IMSI catcher myth [Paper], [presentation] was carried out using Yate BTS SatSite. The provided materials hints how to build one such fake base station.

A potentially cheaper option would be to get a femtocell device from an existing mobile provider (which often lend them or sell them cheaper than any SDR you'd need for OpenBTS) and root it.

Once you've got root you can look at what software drives the mobile network interface and modify it/make your own software that would spoof a provider's real BTS and logging the IMSIs.

protected by Community Jul 25 '14 at 11:49

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.