A Rogue BTS can be beneficial, here I will show you how to install one and how to configure your network for security research.
First, let’s update our system, I will use a Debian Buster for RPI3 with 1G of RAM and a BladeRF xA9.
Table of Contents
- Step 1 – Requirements
- Step 2 – Configure Blade RF for Yate
- Step 3 – Install a Rogue BTS for fun and profit
- Step 4 – Configuring YateBTS
- Step 5 – Provisioning SIM Cards
![[Free] How to Install a Rogue BTS: What you need to know 14 Rogue BTS](https://www.offensive-wireless.com/wp-content/uploads/2022/06/Hacking-GSM-1024x256.png)
Step 1 – Requirements
Build your own rogue GSM
Pack List | Price | Link |
RPI3 – 1 GB RAM | 100 | |
RPI4 Case | 30 | |
BladeRF xA9 | 780 | |
BladeRF Case | 20 | |
BladeRF Antennas | 4 x 25 | |
Power Supply | 35 | |
SD Card 128GB | 20 | |
USB SIM Card Reader | 45 | |
Blank SIM Cards | 50 | |
GSM phone Unlocked | ||
Power Bank 28000 mAmp | 40 |
![[Free] How to Install a Rogue BTS: What you need to know 15 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-23.png)
[email protected]:~ $ sudo su
[email protected]:/root# apt-get -y update && apt-get -y upgrade
[email protected]:~ $ uname -a
Linux offensive-wireless 5.10.103-v7+ #1529 SMP Tue Mar 8 12:21:37 GMT 2022 armv7l GNU/Linux
Step 2 – Configure Blade RF for Yate
In order to install all necessary dependencies we need to add the bladerf repository in our system, as root run the following commands:
Now it’s time to install the necessary dependencies.
[email protected]:~ $ sudo apt-get install libusb-1.0-0-dev libusb-1.0-0 build-essential cmake libncurses5-dev libtecla1 libtecla-dev pkg-config git wget doxygen help2man pandoc python-setuptools python-dev swig libccid pcscd pcsc-tools python-pyscard libpcsclite1 unzip firefox-esr xserver-xorg lightdm xfce4 automake matchbox-keyboard iptables-persistent
[email protected]:~ $ sudo apt install libbladerf-dev
Clone the git hub bladerf repo into our system and go inside the respective folder.
[email protected]:~ $ git clone https://github.com/Nuand/bladeRF.git
[email protected]:~ $ cd bladeRF
Validate libusb and libusb-dev versions installed
Remember to validate this or you will have a lot of problems using BladeRF.
[email protected]:~/bladeRF $ dpkg -s libusb-1.0-0 libusb-1.0-0-dev
![[Free] How to Install a Rogue BTS: What you need to know 16 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-24.png)
[email protected]:~/bladeRF $ cd host/
[email protected]:~/bladeRF/host $ mkdir build
[email protected]:~/bladeRF/host/build $ cd build
[email protected]:~/bladeRF/host/build $ cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr/local -DINSTALL_UDEV_RULES=ON ../
[email protected]:~/bladeRF/host/build $ sudo addgroup bladerf
[email protected]:~/bladeRF/host/build $ sudo usermod -a -G bladerf rfs
[email protected]:~/bladeRF/host/build $ make && sudo make install && sudo ldconfig
[email protected]:~$ bladeRF-cli
![[Free] How to Install a Rogue BTS: What you need to know 17 bladeRF-cli](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-25.png)
![[Free] How to Install a Rogue BTS: What you need to know 18 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-26.png)
Connected the BladeRF device to raspberry and verify if is working:
[email protected]:~/bladeRF/host/build $ bladeRF-cli -p
Backend: libusb
Serial: f12ce1037830a1b27f3ceeba1f521413
USB Bus: 4
USB Address: 8
[email protected]:~/bladeRF/host/build $ bladeRF-cli -i
bladeRF> help
... (Help text shown here ) ...
bladeRF> info
Serial #: f12ce1037830a1b27f3ceeba1f521413
VCTCXO DAC calibration: 0x894e
FPGA size: 40 KLE
FPGA loaded: no
USB bus: 2
USB address: 3
USB speed: SuperSpeed
Backend: libusb
Instance: 0
bladeRF> version
bladeRF-cli version: 0.11.0-git-58c3ff4
libbladeRF version: 0.16.1-git-58c3ff4
Firmware version: 1.7.1-git-ca697ee
FPGA version: Unknown (FPGA not loaded)
Step 3 – Install a Rogue BTS for fun and profit
Before start installing the packages let’s create a group for Yate and add our user to that group.
[email protected]:~ $ sudo addgroup yate
[email protected]:~ $ sudo usermod -a -G yate rfs
Create a new folder to store all BTS data
[email protected]:~ $ mkdir YateBTS
[email protected]:~ $ cd YateBTS
Download the packages from Nuand repo dedicated to BladeRF, this step is critical using this package is easy to set up BladeRF with YateBTS.
[email protected]:~/YateBTS $ wget https://nuand.com/downloads/yate-rc-3.tar.gz
Decompress the file into our new folder:
[email protected]:~/YateBTS $ tar xvf yate-rc-3.tar.gz
How to Install Yate
[email protected]:~/YateBTS $ sudo mv yate /usr/src
[email protected]:~/YateBTS $ sudo mv yatebts /usr/src
[email protected]:~/YateBTS $ sudo mv *.rbf /usr/share/nuand/bladeRF
[email protected]:~/YateBTS $ cd /usr/src/yate
[email protected]:~/usr/src/yate $ ./autogen.sh
[email protected]:~/usr/src/yate $ ./configure --prefix=/usr/local
[email protected]:~/usr/src/yate $ make
[email protected]:~/usr/src/yate $ sudo make install
[email protected]:~/usr/src/yate $ sudo make install-noapi
[email protected]:~/usr/src/yate $ sudo ldconfig
[email protected]:~/usr/src/yate $ cd ..
Install Yate BTS
[email protected]:~/usr/src/$ cd yatebts
[email protected]:~/usr/src/yatebts$ ./autogen.sh
[email protected]:~/usr/src/yatebts$ ./configure --prefix=/usr/local
[email protected]:~/usr/src/yatebts$ make
[email protected]:~/usr/src/yatebts$ sudo make install
[email protected]:~/usr/src/yatebts$ sudo ldconfig
[email protected]:~/usr/src/yatebts$ cd ..
[email protected]:~/usr/src/$ sudo mkdir -p /usr/share/nuand/bladeRF
Step 4 – Configuring YateBTS
[email protected]:~/usr/src/$ sudo touch /usr/local/etc/yate/snmp_data.conf /usr/local/etc/yate/tmsidata.conf
[email protected]:~/usr/src/$ sudo chown rfs:yate /usr/local/etc/yate/*.conf
[email protected]:~/usr/src/$ sudo chmod g+w /usr/local/etc/yate/*.conf
[email protected]:~/Downloads/YateBTS/yatebts$ bladeRF-cli -l /usr/src/Nuand/bladeRF/hostedxA9.rbf
If everything works its time to start our BTS
[email protected]:~/Downloads/YateBTS/yatebts$ yate -v
[email protected]:~/Downloads/YateBTS/yatebts$ telnet localhost 5038
![[Free] How to Install a Rogue BTS: What you need to know 19 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-8.png)
Setup Network In a Box – NIB
[email protected]:~/ $ sudo apt-get install -y apache2 php libusb-1.0-0 libusb-1.0-0-d* libusb-1.0-0-dev libgsm1 libgsm1-dev
[email protected]:~/PySIM/pysim $ cd /var/www/html
[email protected]:/var/www/html $ sudo ln -s /usr/local/share/yate/nipc_web nipc
[email protected]:/var/www/html $ sudo chmod -R a+w /usr/local/share/yate
![[Free] How to Install a Rogue BTS: What you need to know 20 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-10-1024x217.png)
sudo vi /etc/systemd/system/yate.service
[Unit]
Description=RFS Yate BTS
After=network.target
StartLimitIntervalSec=0[Service]
[Service]
Type=simple
Restart=always
RestartSec=1
User=root
ExecStart=/usr/local/bin/yate -s
[Install]
WantedBy=multi-user.target
[email protected]:/usr/bin/pysim $ sudo systemctl start yate
rf[email protected]:/usr/bin/pysim $ sudo systemctl enable yate
Step 5 – Provisioning SIM Cards
In order to
How to Install PySIM
[email protected]:~/YateBTS $ sudo apt-get install libpcsclite-dev
![[Free] How to Install a Rogue BTS: What you need to know 21 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-9.png)
[email protected]:~ $ mkdir PySIM
[email protected]:~ $ cd PySIM/
[email protected]:~/PySIM $ git clone git://git.osmocom.org/pysim.git
[email protected]:~/PySIM $ sudo apt-get install python3-pyscard python3-serial python3-pip python3-yaml
[email protected]:~/PySIM/pysim $ pip3 install -r requirements.txt
How to Configure a Magic SIM
[email protected]:~/PySIM/pysim $ ./pySim-read.py -d /dev/ttyUSB0
![[Free] How to Install a Rogue BTS: What you need to know 22 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-28.png)
[email protected]:~/PySIM/pysim $ ./pySim-prog.py -d /dev/ttyUSB0 -n RFS -x 268 -y 07 -i 901990000000018 -s 8988211110000110000 -o 398198093111279FB1FC74BE07059FEF -k 1D8B2562B772549F20D0F42003EAA6FA
![[Free] How to Install a Rogue BTS: What you need to know 23 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-29.png)
[email protected]:~/PySIM $ sudo cp -R pysim/ /usr/src/
[email protected]:~/PySIM $ cd /usr/local/bin
[email protected]:/usr/local/bin $ sudo ln -s /usr/src/pysim/pySim-prog.py pySim-prog.py
[email protected]:/usr/local/bin $ sudo vi /usr/local/share/yate/nipc_web/config.php
<?php
$pysim_path = "/usr/bin/pysim";
?>
![[Free] How to Install a Rogue BTS: What you need to know 24 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-30.png)
![[Free] How to Install a Rogue BTS: What you need to know 25 [Free] How to Install a Rogue BTS: What you need to know](https://www.offensive-wireless.com/wp-content/uploads/2022/06/image-31-1024x284.png)
[email protected]:~/PySIM/pysim $ sudo systemctl daemon-reload
[email protected]:~/PySIM/pysim $ sudo systemctl restart yate
r[email protected]:~/PySIM/pysim $ sudo systemctl status yate
After all is done you can start capture GSM signals from our BTS using a RTL-SDR.
My next article will be about systems and methods for identifying rogue base stations, for now, you can check my other article about ZigBee Sniffing.