Osmocom Suite — GSM/UMTS Infrastructure Security Stack

The Osmocom (Open Source Mobile Communications) project provides a complete, production-grade implementation of 2G GSM and 3G UMTS cellular network infrastructure. Within TelcoChisel, the full Osmocom suite (OsmoBTS, OsmoBSC, OsmoMSC, OsmoHLR, OsmoSGSN, OsmoSTP) is pre-installed and configured for security research including rogue BTS deployment, A5/1 cipher downgrade testing, and SS7/SIGTRAN stack auditing.

Key Capabilities & Security Vectors

• Rogue BTS Deployment: Deploy a complete 2G base station using OsmoBTS + OsmoTRX to test UE camping, IMSI collection, and voice interception.
• A5 Cipher Downgrade Attacks: Force cipher mode negotiation to A5/0 (no encryption) or A5/1 (known-broken) to intercept GSM voice and SMS traffic.
• HLR/VLR Subscriber Manipulation: Inject, modify, and delete subscriber records in OsmoHLR to test authentication triplet handling and subscriber identity spoofing.
• SIGTRAN/SS7 Stack Testing: Use OsmoSTP (Signaling Transfer Point) for M2UA/M3UA/SCCP protocol security analysis.

TelcoChisel Execution Cheatsheet

1. Launch Minimal GSM Network

# Start the complete GSM core (HLR → MSC → BSC → BTS chain)
sudo systemctl start osmo-hlr osmo-msc osmo-bsc osmo-bts-trx osmo-trx-uhd

2. Provision Test SIM Subscriber

# Add subscriber via OsmoHLR VTY interface
telnet 127.0.0.1 4258
# > enable
# > subscriber imsi 001010000000001 create
# > subscriber imsi 001010000000001 update msisdn 555000001

3. Monitor GSM Air Interface

# Capture Um interface signaling with Gr-GSM
grgsm_livemon -f 935.2e6 | wireshark -k -i -

Practice in TelcoSec Academy

👉 Launch GSM Infrastructure Lab on App.TelcoSec.Net