Connecting to a Rogue Base Station

1. How a Phone Chooses a Cell

A User Equipment (UE), like your smartphone, doesn't connect to a cell tower randomly. It follows a specific decision-making process defined in the 3GPP standards. For our purposes, this complex process can be simplified to two primary criteria:

1. Network Identity (PLMN-ID): The UE will only consider connecting to cells that broadcast a PLMN-ID it trusts. This includes its home network and any roaming partners specified on the SIM card. Since we already configured our rogue cell with a specific mcc and mnc in the last lesson, we have this covered.
2. Radio Link Quality: Among all the valid cells it can see, the UE will generally try to connect to the one providing the best signal. The goal is to ensure a stable, high-quality connection. This is our primary lever for attack.

The following paper discusses the theoretical basis for this.

By broadcasting a signal that is stronger at the UE's location than the signal from any legitimate cell towers, we can trick the UE into reselecting to our rogue cell. In srsRAN, we control this signal strength using a parameter called tx_gain.

2. Configuring the Lure

In the previous lesson, we edited enb.conf and epc.conf to set the identity and disable security. Now, we will revisit enb.conf to adjust the radio parameters that will make our cell attractive.

Key Radio Parameters in enb.conf

Two parameters are critical for this task:

1. dl_earfcn (Downlink E-UTRA Absolute Radio-Frequency Channel Number): This number specifies the exact frequency band your base station will broadcast on. You need to choose a channel that your SDR and the target UE both support. For lab work, it's best to use a band that is not licensed for commercial use in your region to avoid interference.
2. tx_gain: This integer value controls the transmission power of your SDR. A higher value means a stronger signal.

Let's watch a video where these parameters are configured in a real-world example.

Putting it together: In your enb.conf file, you'll need to locate these parameters and set them. For example:

# ~/.config/srsran/enb.conf

[rf]



# Set the frequency channel. This value depends on the band you choose.
# For example, 2100 corresponds to Band 4.
dl_earfcn = 2100




# Set the transmission gain. Start low and increase if needed.
# This value is specific to your SDR. For a USRP, 70 is a moderate value.
tx_gain = 70
rx_gain = 40

A CRITICAL WARNING ON TRANSMITTING: Broadcasting on cellular frequencies is highly regulated. Transmitting with high power (tx_gain) can interfere with commercial networks, which is illegal and can have serious consequences. For this exercise, you must either:
a) Use a Faraday cage or bag to contain the radio signals.
b) Keep the tx_gain very low and place the UE's antenna physically close (a few inches) to the SDR's transmitting antenna.
Always operate responsibly and within a controlled lab environment.

3. Springing the Trap and Verifying the Connection

With your rogue enb.conf and epc.conf files ready, it's time to launch the network and see if the UE takes the bait.

Step 1: Launch the Core Network and Base Station

Open two separate terminal windows.

In Terminal 1, start the Evolved Packet Core (EPC):

# Make sure to point to the rogue epc.conf from the last lesson
sudo srsepc --epc.conf ~/.config/srsran/epc_rogue.conf

You should see the MME service starting up and waiting for a connection.

In Terminal 2, start the eNodeB:

# Point to the rogue enb.conf you just edited
sudo srsenb --enb.conf ~/.config/srsran/enb_rogue.conf

The eNB will start, synchronize with your SDR, and then connect to the EPC. You will see log messages in both terminals confirming the S1 setup is complete. The eNB is now broadcasting.

Step 2: Induce and Verify the Connection

Bring your test UE (a smartphone with a test SIM card) near the SDR's antenna.

How to check for a connection:

1. On the UE: The most straightforward way is to go to your phone's network settings and perform a manual network scan. You should see your rogue PLMN appear in the list. If your tx_gain is high enough, the phone may automatically disconnect from the commercial network and connect to yours. The network status icon will likely show "Emergency Calls Only" or "No Service" but will be attached at a radio level.

2. In the srsenb Terminal: This is the definitive proof. When the UE attempts to connect, the srsenb log will burst with activity. It will show the establishment of the RRC connection and the initial NAS (Non-Access Stratum) messages from the UE.

The following video demonstrates exactly what this looks like.

If the UE does not connect, the most likely reason is that your tx_gain is too low. Stop srsenb (Ctrl+C), increase the tx_gain value in enb.conf by 5-10, and restart it. Repeat this process until you achieve a connection.

Conclusion

In this lesson, you took your configured rogue base station and made it operational. You learned how to manipulate the radio environment to successfully lure a User Equipment into connecting to your malicious cell.

Key Takeaways:

• UE cell selection is primarily based on PLMN-ID match and signal strength.
• We can force a UE to connect to our rogue cell by making its signal stronger than nearby legitimate cells using the tx_gain parameter in enb.conf.
• The dl_earfcn parameter must be set to a frequency channel supported by both the SDR and the UE.
• A successful connection is confirmed by observing the RRC and NAS signaling messages in the srsenb log file when the UE attaches.
• Safety is paramount. Transmitting on licensed spectrum must be done with extreme care, using shielding or very low power in a controlled environment.

Preview of the Next Lesson:

In the video, you saw a crucial piece of information flash across the screen the moment the UE connected: the IMSI. This wasn't a coincidence. The initial attach procedure in LTE has a privacy weakness that allows this to happen. In our next lesson, "Perform an IMSI catch by capturing and analyzing the UE's initial attach signaling," we will formalize this into a proper attack, capture these messages, and analyze them in Wireshark to extract the subscriber's permanent identity.