• Home
  • Rogue BTS: How to easily install a GSM BTS
Rogue BTS

Rogue BTS: How to easily install a GSM BTS

A Rogue BTS can be very useful, here I will show you how to install one and how to configure your our network for security research.

  • Buy Hardware
  • Configure Hardware
  • Install Yate BTS
  • Configure Yate BTS
  • Provisioning SIM Cards
  • Configure Subscribers on Yate BTS

First let’s update our system, I will be using a Debian 10 machine with 8G of RAM and Dual Core CPU.

Rogue BTS
Rogue BTS
[email protected]:~/Downloads/$ sudo apt update
[email protected]:~/Downloads/$ sudo apt upgrade

How to setup BladeRF for Yate BTS

In order to install all necessary dependencies we need to add the bladerf repository in our system, as root run the following command:

[email protected]:~/Downloads/$ sudo add-apt-repository ppa:nuandllc/bladerf

With the new repository added it’s time update our system again and install the necessary dependencies.

[email protected]:~/Downloads/$ sudo apt update
[email protected]:~/Downloads/$ sudo apt install libbladerf-dev

Clone the git hub bladerf repo into our system and go inside the respective folder.

[email protected]:~/Downloads/$ git clone https://github.com/Nuand/bladeRF.git
[email protected]:~/Downloads/$ cd bladeRF
Rogue BTS: How to easily install a GSM BTS

cd host/
mkdir build
cd build
cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr/local -DINSTALL_UDEV_RULES=ON ../
[email protected]:~/Downloads/$ addgroup bladerf
[email protected]:~/Downloads/$ usermod -a -G bladerf rfs
make && sudo make install && sudo ldconfig
[email protected]:~$ bladeRF-cli
Rogue BTS: How to easily install a GSM BTS
[email protected]:~/Downloads/$ bladeRF-cli -p
    Backend:        libusb
    Serial:         f12ce1037830a1b27f3ceeba1f521413
    USB Bus:        4
    USB Address:    8
[email protected]:~/Downloads/$ bladeRF-cli -i

bladeRF> help

... (Help text shown here ) ...

bladeRF> info

  Serial #:                 f12ce1037830a1b27f3ceeba1f521413                          
  VCTCXO DAC calibration:   0x894e
  FPGA size:                40 KLE
  FPGA loaded:              no
  USB bus:                  2
  USB address:              3
  USB speed:                SuperSpeed
  Backend:                  libusb
  Instance:                 0

bladeRF> version
  bladeRF-cli version:        0.11.0-git-58c3ff4
  libbladeRF version:         0.16.1-git-58c3ff4

  Firmware version:           1.7.1-git-ca697ee
  FPGA version:               Unknown (FPGA not loaded)

How to Install Yate BTS 3

sudo addgroup yate
sudo usermod -a -G yate rfs
sudo apt install libusb-1.0-0-dev
mkdir ~/Downloads/YateBTS
cd ~/Downloads/YateBTS
wget https://nuand.com/downloads/yate-rc-3.tar.gz
tar xvf yate-rc-3.tar.gz
Rogue BTS: How to easily install a GSM BTS

Install Yate

[email protected]:~/Downloads/YateBTS/$ cd yate
[email protected]:~/Downloads/YateBTS/yate$ ./autogen.sh
[email protected]:~/Downloads/YateBTS/yate$ ./configure --prefix=/usr/local
Rogue BTS: How to easily install a GSM BTS
[email protected]:~/Downloads/YateBTS/$ make
Rogue BTS: How to easily install a GSM BTS
[email protected]:~/Downloads/YateBTS/$ sudo make install
[email protected]:~/Downloads/YateBTS/$ sudo ldconfig

Install YateBTS

[email protected]:~/Downloads/YateBTS/$ cd yatebts
[email protected]:~/Downloads/YateBTS/yatebts$ ./autogen.sh
[email protected]:~/Downloads/YateBTS/yatebts$ ./configure --prefix=/usr/local
Rogue BTS: How to easily install a GSM BTS
[email protected]:~/Downloads/YateBTS/$mv yate /usr/src
[email protected]:~/Downloads/YateBTS/$mv yatebts /usr/src
[email protected]:~/Downloads/YateBTS/$mv *.rbf /usr/share/nuand/bladeRF
[email protected]:~/Downloads/YateBTS/$ apt install autoconf gcc g++ make

Rogue BTS: Configuring Yate & YateBTS

sudo touch /usr/local/etc/yate/snmp_data.conf /usr/local/etc/yate/tmsidata.conf
sudo chown rfs:yate /usr/local/etc/yate/*.conf
sudo chmod g+w /usr/local/etc/yate/*.conf
Rogue BTS: How to easily install a GSM BTS
[email protected]:~/Downloads/YateBTS/yatebts$ bladeRF-cli -l /usr/src/Nuand/bladeRF/hostedxA9.rbf
[email protected]:~/Downloads/YateBTS/yatebts$ yate -v
[email protected]:~/Downloads/YateBTS/yatebts$ telenet localhost 5038
Rogue BTS: How to easily install a GSM BTS
Rogue BTS: How to easily install a GSM BTS
Rogue BTS: How to easily install a GSM BTS 15

Provisioning SIM Cards

How to Install PySIM

 sudo apt-get install pcscd pcsc-tools libccid libpcsclite-dev python-pyscard
Rogue BTS: How to easily install a GSM BTS
git clone git://git.osmocom.org/pysim.git
sudo apt-get install python3-pyscard python3-serial python3-pip python3-yaml
pip3 install -r requirements.txt
Rogue BTS: How to easily install a GSM BTS
[email protected]:~/Downloads/pysim$ ./pySim-read.py -d /dev/ttyUSB0

How to Configure a Magic SIM

[email protected]:~/Downloads/pysim$ ./pySim-read.py -d /dev/ttyUSB0
./pySim-prog.py -d /dev/ttyUSB0 -n OffSec -x 268 -y 07 -i 901990000000018 -s 8988211000000110000 -o 398153093661279FB1FC74BE07059FEF -k 1D8B2562B992549F20D0F42113EAA6FA
Rogue BTS: How to easily install a GSM BTS

bladeRF 2.0 micro xA9

After all done you can start capture GSM signals from our BTS using a RTL-SDR