A list of telco security resources and projects.

• How to create an Evil LTE Twin/LTE Rogue BTS How to setup a 4G/LTE Evil Twin Base Station using srsLTE and a USRP SDR device.
• How To Build Your Own Rogue GSM BTS For Fun and Profit "In this blog post I’m going to explain how to create a portable GSM BTS which can be used either to create a private ( and vendor free! ) GSM network or for GSM active tapping/interception/hijacking … yes, with some (relatively) cheap electronic equipment you can basically build something very similar to what the governments are using from years to perform GSM interception."
• Practical attacks against GSM networks: Impersonation "Impersonating a cellular base station with SDR: With the flexibility, relative low cost of Software Defined Radio (SDR) and abundance of open source projects that emulate a cell tower, successfully impersonating a GSM Base Station (BTS) is not a difficult task these days."
• Building a Portable GSM BTS Using BladeRF/PI "I was always amazed when I read articles published by some hackers related to GSM technology. However, playing with GSM technologies was not cheap until the arrival of Software Defined Radios (SDRs), besides not being something easy to be implemented."
• rtl.sdr.com Tutorial-Analyzing GSM with-Airprobe and Wireshark "The RTL-SDR software defined radio can be used to analyze cellular phone GSM signals, using Linux based tools GR-GSM (or Airprobe) and Wireshark. This tutorial shows how to set up these tools for use with the RTL-SDR."
• Traffic Interception for Penetration Testing Engagements "Within the penetration testing domain quite often we have to deal with different technologies and devices. It’s important to cover all aspects of connectivity of a device being tested which is why we have built a GSM/GPRS interception capability. There are a number of different devices and systems that make use of GSM/GPRS, non-exhaustively we commonly see:"

• Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information
• QCSniper - A tool For capture 2g-4g air traffic using qualcomm phones
• [This is Your President Speaking: Spoofing Alerts in 4G LTE Networks](Link removed, will upload pdf)
• Hacking Public Warning System in LTE Mobile Networks
• RF Exploitation: IoT/OT Hacking with SDR
• Forcing a targeted LTE Cellphone Into an Eavesdropping Network
• Hacking Cellular Networks
• Bye-Bye-IMSI-Catchers
• New Privacy Threat on 3G, 4G, and Upcoming 5G AKA Protocols
• White-Stingray: Evaluating IMSI Catchers Detection Applications
• Breaking_LTE_on_Layer_Two
• LTE/LTE-A Jamming, Spoofing, and Sniffing: Threat Assessment and Mitigation
• Exploring LTE security and protocol exploits with open source software and low-cost software radio by Roger Jover
• LTE PROTOCOL EXPLOITS: IMSI CATCHERS,BLOCKING DEVICES AND LOCATION LEAKS
• Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems
• Using OpenBTS - "Experimental_Security_Assessment_of_BMW_Cars by KeenLab"
• 5G NR Jamming, Spoofing, and Sniffing
• LTE Security – How Good Is It?
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-187.pdf -Small Tweaks do Not Help: Differential Power Analysis of MILENAGE Implementations in 3G/4G USIM Cards
• #root via SMS: 4G access level security assessment
• Small Tweaks do Not Help: Differential Power Analysis of MILENAGE Implementations in 3G/4G USIM Cards
• LTE security and protocol exploits
• LTE Recon - (Defcon 23)
• LTE Pwnage: Hacking HLR/HSS and MME CoreNetwork Elements
• Synacktiv
• WiFi IMSI Catcher
• Analysis of the LTE Control Plane
• WiFi IMSI Catcher
• Demystifying the Mobile Network by Chuck McAuley
• (https://www.defcon.org/images/defcon-22/dc-22-presentations/Pierce-Loki/DEFCON-22-Pierce-Loki-NSA-PLAYSET-GSM.pdf)
• D1T2 - Bypassing GSMA Recommendations on SS7 Networks - Kirill Puzankov
• VoLTE Phreaking - Ralph Moonen
• [Baseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stack] (https://www.usenix.org/system/files/conference/woot12/woot12-final24.pdf)

• Rooting SIM-cards
• The Most Expensive Lesson Of My Life: Details of SIM port hack

• https://www.wired.com/story/dcs-stingray-dhs-surveillance/
• https://www.vice.com/en_us/article/gv5k3x/heres-how-much-a-stingray-cell-phone-surveillance-tool-costs
• https://www.nyclu.org/en/stingrays

• http://www.hackitoergosum.org/2010/HES2010-planglois-Attacking-SS7.pdf
• Getting in the SS7 kingdom: hard technology and disturbingly easy hacks= to get entry points in the walled garden

• https://github.com/Synacktiv-contrib/Modmobjam
• https://github.com/Synacktiv-contrib/Modmobmap

• https://github.com/Evrytania/LTE-Cell-Scanner
• https://harrisonsand.com/imsi-catcher/
• https://github.com/Oros42/IMSI-catcher
• https://github.com/CellularPrivacy/Android-IMSI-Catcher-Detector
• https://github.com/ptrkrysik/gr-gsm/wiki/Passive-IMSI-Catcher

• RTL-SDR
• MCC-MNC Codes for Base Stations
• RFSec-ToolKit
• FakeBTS
• https://rmusser.net/docs/Wireless.html#cn

• Touching the Untouchables: Dynamic Security
• https://www.eff.org/pages/cell-site-simulatorsimsi-catchers
• http://leetupload.com/blagosphere/2014/03/28/analyze-and-crack-gsm-downlink-with-a-usrp/
• AT&T Microcell FAIL - fail0verflow (Older blog article, but still a good read)