Is it possible to use a common phone to sniff the GSM traffic? Or something like a GNU-radio capable external device is absolutely required?

GSM and GSM security are interesting topics but really hard to touch with your hands because of the difficulty of reading what's passing over the air. The more hackers will have access to equipments, the more secure will be our conversations in the long run.