Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 34

Setting Up a Rogue Base Station with srsENB

Recommended resources

Introduction

Welcome to the first hands-on lesson of Module 7. In the previous module, we covered the theoretical foundations of several key 4G attacks, culminating in our discussion of Denial-of-Service attacks through spoofed NAS reject messages. You learned how attackers can exploit the un-integrity-protected nature of early communication to knock a device offline.

Today, we transition from theory to practice. This lesson is the first step in building our attack platform, and it directly addresses the learning outcome: Configure srsENB to act as a rogue base station by modifying its identity and security parameters.

A "rogue" base station is the cellular equivalent of a rogue Wi-Fi access point or a spoofed website used in a Man-in-the-Middle (MITM) attack. To perform attacks like IMSI catching or traffic sniffing, you first need to create a malicious cell tower that can trick phones into connecting. We will learn how to take the srsRAN software you installed in Module 4 and configure it to impersonate a legitimate network and weaken its security settings, paving the way for the attacks in the upcoming lessons.

1. What Makes a Base Station "Rogue"?

In our context, a rogue base station has two primary characteristics:

  1. Identity Impersonation: It broadcasts the identity of a real, commercial network. Every cellular network has a unique identifier called a Public Land Mobile Network ID (PLMN-ID), which is a combination of a Mobile Country Code (MCC) and a Mobile Network Code (MNC). To trick a phone, your rogue cell must broadcast a PLMN-ID that the phone is programmed to trust.
  2. Modified Security Posture: It deliberately weakens or disables security features. For many attacks, especially traffic interception, the goal is to disable encryption. We will configure our base station to allow a "null-ciphering" mode, where the traffic flows unencrypted.

Your background in web security provides a useful parallel. Configuring the PLMN-ID is analogous to creating a fake website with a domain name that looks legitimate (paypal-secure.com) or poisoning DNS to point paypal.com to your malicious server. Configuring the security posture is like performing a TLS-stripping attack, forcing a connection from HTTPS down to unencrypted HTTP.

4G LTE Network Architecture with srsRAN Components
This diagram shows the high-level architecture of a 4G network. Our focus is on the srsENB (the base station) and srsEPC (the core network), and how we configure their identities to appear legitimate to the UE (User Equipment).

2. The Rogue Identity: Impersonating a PLMN

The first and most important step is to make our base station broadcast a fake identity. Phones won't connect to a random, unknown network. They will, however, attempt to connect to their home network's PLMN-ID, or a known roaming partner's PLMN-ID.

To do this, we need to edit the configuration files for both the eNodeB (enb.conf) and the core network (epc.conf). These components work as a pair, and their identity settings must match for them to communicate with each other.

The following documentation from srsRAN provides a clear guide on where to find and how to edit these configuration files.

COTS UE — srsRAN 4G 23.11 documentation

Please study the following sections from the srsRAN documentation, 'COTS UE'. It details the exact configuration files and parameters needed to set the network's identity.

Please read the subsection titled 'Conf. Files'. Pay close attention to the snippets for 'EPC' (epc.conf) and 'eNB' (enb.conf), specifically noting the lines where mcc and mnc are set. You can find this subsection about halfway down the page.

As you've seen in the documentation, the key parameters are:

  • In enb.conf, within the [enb] section:
    • mcc: The Mobile Country Code
    • mnc: The Mobile Network Code
  • In epc.conf, within the [mme] section:
    • mcc: The Mobile Country Code (must match enb.conf)
    • mnc: The Mobile Network Code (must match enb.conf)

For example, to impersonate the common test network PLMN 001-01, you would set mcc = 001 and mnc = 01 in both files. If you wanted to impersonate a real US carrier, you would look up their MCC/MNC (e.g., T-Mobile uses MCC 310, MNC 260) and use those values. Note: Broadcasting a commercial PLMN-ID on public airwaves is illegal. In our controlled lab, this is for educational purposes only.

3. The Rogue Configuration: Disabling Security

Impersonating an identity is the first step. The second is to weaken the security to make attacks possible. In a normal LTE connection, after authentication, the data between the UE and the eNodeB is encrypted and integrity-protected. For an attacker wanting to sniff traffic, this is a major obstacle.

The solution is to configure our core network to tell the UE not to use encryption. This is achieved by setting the encryption algorithm to EEA0 (EPS Encryption Algorithm 0), which is the "null cipher." The connection proceeds, but the data is sent in the clear.

The same principle applies to integrity protection with algorithm EIA0 (EPS Integrity Algorithm 0).

Let's look at a practical example from another guide.

How to Build your Own Personal 4G Network

This blog post, 'How to Build your Own Personal 4G Network', provides another example of configuring the core network. It explicitly highlights the security parameters.

Please read the section that begins just after the 'Making it work' heading. The author shows the [mme] section of epc.conf and mentions changing mcc and mnc. Notice the line encryption_algo = EEA0. This is the critical parameter for disabling encryption.

The documentation snippet from LINK also showed encryption_algo = EEA0 in its example epc.conf. This shows how straightforward srsRAN makes it to set up a network with a weakened security posture. By controlling the core network, you control the security policy.

4. Assembling the Rogue Configuration

Let's summarize the exact changes needed to configure srsenb as a rogue base station that impersonates the test network PLMN 901-70 and disables all encryption and integrity protection.

Assuming your configuration files are in ~/.config/srsran/ (the user-level default), you would make the following edits:

1. Edit enb.conf:
Find the [enb] section and set the mcc and mnc.




# ~/.config/srsran/enb.conf

[enb]



# eNodeB identifier, must be unique within the PLMN
enb_id = 0x19B




# Public Land Mobile Network (PLMN) ID
# We set this to impersonate our target network
mcc = 901
mnc = 70




# MME address
mme_addr = 127.0.1.100




# Other parameters...
gtp_bind_addr = 127.0.1.1
s1c_bind_addr = 127.0.1.1
n_prb = 50

2. Edit epc.conf:
Find the [mme] section. Set the mcc and mnc to match the enb.conf file, and set the security algorithms.




# ~/.config/srsran/epc.conf

[mme]



# PLMN ID
# MUST match the enb.conf values
mcc = 901
mnc = 70




# Set encryption and integrity algorithms.
# EEA0 is the null-ciphering algorithm (no encryption).
# EIA0 is the null-integrity algorithm (no integrity protection).
encryption_algo = EEA0
integrity_algo = EIA0




# Other parameters...
mme_code = 0x1a
mme_group = 0x0001
tac = 0x0007
mme_bind_addr = 127.0.1.100
apn = srsapn
dns_addr = 8.8.8.8

With these settings, when you launch srsepc and srsenb, you will be broadcasting a cell for PLMN 901-70 that will not encrypt user traffic for any device that connects to it. You have successfully configured a rogue base station.

When you start the services, you can verify this in the srsepc log, which will show the eNodeB connecting with the configured identity:

Received S1 Setup Request.
S1 Setup Request - eNB Name: srsenb01, eNB id: 0x19b
S1 Setup Request - MCC: 901, MNC: 70
...
Sending S1 Setup Response

Conclusion

In this lesson, we made the crucial leap from theory to practice, laying the groundwork for all the hands-on attacks that follow. You learned how to reconfigure your srsRAN lab setup from a private network into a rogue base station.

Key Takeaways:

  • A rogue base station's primary functions are to impersonate a trusted network identity (PLMN-ID) and enforce a weakened security policy.
  • The PLMN-ID is set using the mcc and mnc parameters in both enb.conf and epc.conf, and these values must match.
  • Security policy is controlled in epc.conf. Setting encryption_algo = EEA0 and integrity_algo = EIA0 effectively disables encryption and integrity protection for the user plane.
  • These simple configuration changes turn your srsRAN instance into a powerful tool for cellular security analysis.

Preview of the Next Lesson:

We have now configured our lure. In the next lesson, "Induce a UE in the test lab to connect to the rogue base station," we will see if we can get a fish to bite. We will start our rogue cell and explore the factors—such as signal strength (tx_gain) and network selection logic—that determine whether a commercial phone will connect to our base station instead of a legitimate one.