Building a GSM BTS Using the BladeRF, RPi and YateBTS

had to google that before I got to your comment. Thanks, though.

I can't emphasize this enough if you're in the States. This is something that the FCC takes very seriously. There are hundreds of billions of dollars corporations have thrown at just to get rights to little chunks of spectrum (and as one would imagine, I'm sure their lobbyists have Tom Wheeler on speed-dial). This information has been out there for ages but this is the first time I've seen a single source with all of the information in aggregate. (I've toyed with putting up a similar page myself, but opted not to just to avoid the unwanted federal attention). If you do this on the nominal 850 for any significant amount of time, you're going to be at best convicted of a federal crime with a long duration of probation after spending an egregious amount of money on defense counsel fees. You could realistically serve jail-time (it wouldn't be hard to convince a jury to convict someone by claiming your transmission compromised emergency-comms, and if little Tiffany from Connecticut was abducted, how could her Amber alert propagate through the networks?!)

There's a lot of amazing stuff which is incredibly accessible for such a low amount of money (spectrum analyzers with amazing VBW for 1/20th the price you'd pay 10 years ago, hell, the whole SDR scene), but there's really no Tor you can hide behind. Our civil servants might not be the brightest of the bunch, but they can triangulate a transceiver I'd imagine. If you choose to do this, broadcast in the ISM band around 912, and you should be safe..ish if you keep your broadcast under a watt. I love playing with gear but there are safer ways to get your jollies. As someone who did his share of foolhardy things in my youth, I could see myself as a precocious teenager doing something dumb like this - if you're that 15 year old reading this - don't. There are tons of fun things to do out there with a way, way lower risk factor. (If you really want to play with things you shouldn't, the modern power grid is filled with a mesh network, broadcasting your power consumption to the peers in your network. It's on RF, and as such they have to legally disclose the nature of the broadcasts to the government, and those databases are public. Have fun ;))

Everyone always gets so excited over this. "Holy cow guys, be careful! The FCC will pwn you forever if you even think about running this code!"

A cell tower is elevated, outdoors, transmits +10 W, and runs 24/7.

Your BladeRF is likely to be indoors at ground level, has an output power of about 10 mW. You aren't going to get very far with that. You'll likely have problems detecting the signal over 100 meters, much less connecting and using it.

It may be illegal, but if you aren't causing interference you'll have a hard time getting caught. That being said, yes. Check your local laws. If you do cause a problem and it's tracked down to you, expect to have some serious legal issues.

One use case is the GSM network ran on Chaos Communication Congress hacker conference in Hamburg. They created an internal network for the attendees to - among other reasons - communicate for free:

https://events.ccc.de/congress/2015/wiki/Static%3AGSM

The main use case would be getting into trouble with the authorities.

However, there are a few sub-cases (most of which will still in part fall under the first one)

a) Educational - you can learn a lot about how telecom networks actually work by playing around with your own BTS. However, it would be advisable to do so in a place where your emissions don't interfere with other, legit operators - say, in a mine or something. (I am not being flippant here).

b) Nefarious, non-state: it is trivial to trick any compatible cell phone into connecting to your rogue BTS instead of one belonging to the victim's carrier. This could be done transparently to the victim - ie. you forward his call data to the network at large, MitM-ing him and monitoring his conversations.

c) Nefarious, state actor: Much the same purpose as b), though presumably a (legit) state actor would be able to just serve the telco with a warrant to get at the same data - the exception being, of course, if you were operating on someone else's turf - say, you are some intelligence service operating abroad, eavesdropping on another state's principal actors, for instance.

d) Fun (closely related to a) above) - say, in particular if you operated in an area with no effective RF licencing regime (failed states and offshore springing to mind), you could effectively become your own cell phone carrier, for instance while hosting a conference on a vessel in international waters, allowing participants to use their handsets to get in touch with each other. This option could be utilized either with or without a gateway to the global phone network.

I would say mainly for learning, as long as you first have enough knowledge to set it up to not be detectable outside your property.

But as it develops, it could be useful for building networks in developing countries, or for deploying emergency networks as it will be far lower cost than commercial equipment.

Interestingly, I was able to save the article to Pocket. I guess the Pocket bot doesn't respect robots.txt [0]. :)

Also, did anyone else notice that the title-text for paragraphs (specifically, each <span> element) is in Portuguese? i.e. If you hover over a sentence in the article, the title-text displays its Portuguese translation.

[0] https://blog.strcpy.info/robots.txt

I saved it at Instagram just fine.

Archive.is works perfectly fine: https://archive.is/rFOLB

(This is because it's an archiving machine designed for people; it will x-forwarded-for your IP address to the target site as if it were a proxy)

The phones have SIM cards (subscriber identification modules). However, they are not authenticated by this network to see if they are paying customers or whatever because this is an experiment.

You need a GSM Core Network[1]. For more details, you can take a look at HLR and AuC components which are responsible for authentication.

[1] https://en.wikipedia.org/wiki/Network_switching_subsystem#Au...

The network could blindly accept any phone, and distinguish by IMEI (phone identification) instead of IMSI (subscriber identification), I think. But as the former doesn't have any cryptographical authentication, it's trivially easy to spoof a different identity.

To have "proper" user authentication, you could just buy blank SIM cards which you can provision with keys and identification as you see fit.

http://www.aliexpress.com/item/SIM-USIM-Card-4G-LTE-Blank-Mi...

Basically if the phone cannot find a BTS for its normal carrier, it will ask the other BTS that it can find if it can connect. There normally isn't any authentication done to see if the BTS is legit.

This is also what the police stingray devices take advantage of.

Basically (as has been pointed out below), authentication is more of an issue in the opposite direction - when the GSM spec was hammered out, carriers were concerned with rogue handsets, not that someone, somewhere would set up a rogue network (as the package in the article pretty much is, at least from the perspective of the established carriers.)

In NMT networks, for instance, ghost handsets were a major issue - you could register onto the network and place calls and the operator would have nowhere to send the bill.

Not such a good idea for ordering pizza, but great for lengthy international calls.

Here in Norway I seem to recall that our national telco simply blocked calls from the NMT cellular network to a number of countries on the assumption that any call placed would be fraudulent, anyway.

There are several kits (like the Canokit) that come with them.