INITIALIZING_ACCESS_PROTOCOL...
← Back to Tools Console
[ SYSTEM_NOTICE :: TOP_RESEARCH_NODE ]
System Node · Research Ready · OSMOCOMBB
OsmocomBB — GSM Baseband Security & Um Interface Analysis
Research Overview
TL;DR — OsmocomBB replaces proprietary firmware on Calypso-based GSM handsets (Motorola C118, C123) with open-source software exposing the full GSM Um interface from Layer-1 burst processing through Layer-3 MM/CC/SMS protocols (3GPP TS 24.008, TS 44.018). Unlike passive SDR tools, OsmocomBB operates as an active MS enabling two-way protocol interaction with live GSM networks. Researchers use it for active ciphering enforcement testing (A5/0/1/3), IMSI catcher detection heuristic development, silent SMS behaviour analysis, and supplementary service (USSD/SS) attack surface research. GSMTAP output integrates with Wireshark and gr-gsm captures for full cross-layer Um interface reconstruction.
OsmocomBB replaces the proprietary Layer-1 firmware on Calypso-based handsets (Motorola C118, C123, C139; Pirelli DP-L10) with open-source software, exposing the full GSM Um interface from Layer-1 burst processing and frequency hopping through Layer-3 Mobility Management, Call Control, and SMS protocols defined in 3GPP TS 24.008 and TS 44.018. Unlike passive SDR-based tools such as GR-GSM, OsmocomBB operates as an active MS, enabling two-way protocol interaction with live GSM base stations and precise control over channel assignment, ciphering negotiation, and mobility management procedures. The Layer-1 interface runs over a serial/USB connection to the host where the osmocon and mobile applications manage protocol stack execution.
For security research, OsmocomBB's trxcon component and the Osmocom-specific L1CTL protocol allow scripted control of BCCH/CCCH scanning (TS 45.002), RACH access, and Immediate Assignment procedures, enabling systematic testing of BTS ciphering enforcement across deployed GSM networks. The mobile application exposes a VTY (Virtual TeleTYpe) interface for runtime configuration of IMSI, classmarks, and ciphering algorithm preferences (A5/0, A5/1, A5/3) — critical for confirming whether serving cells enforce minimum cipher requirements or permit A5/0 null-cipher negotiation in violation of GSMA FS.11 guidelines.
OsmocomBB is the reference platform for IMSI catcher detection research from the UE side: by logging all received MM messages and monitoring for unsolicited Identity Requests, abrupt LAU rejections, or anomalous Ciphering Mode Commands, researchers build UE-side heuristics for false BTS detection. Integration with Wireshark via GSMTAP dissectors and temporal correlation with SDR captures from GR-GSM or GNU Radio enables full cross-layer GSM Um interface reconstruction for protocol conformance and security analysis.
Key Research Applications
- >Conduct active GSM protocol testing from the MS side using Calypso hardware: test BTS ciphering enforcement (A5/0 vs A5/1 vs A5/3), authentication procedures, and LAU rejection behaviour per 3GPP TS 44.018
- >Research IMSI catcher detection heuristics by logging Identity Request patterns, unsolicited LAU commands, and anomalous Ciphering Mode Commands from controlled and live GSM cells via OsmocomBB VTY
- >Analyse GSM silent SMS (Type 0) acknowledgment behaviour and MS-side USSD/SS call forwarding attack surface for surveillance and toll fraud vulnerability assessments
- >Cross-layer GSM protocol analysis combining OsmocomBB Layer-1 through Layer-3 traces with passive SDR captures from GR-GSM or GNU Radio via GSMTAP over UDP for full Um interface reconstruction
Technical Specifications
Operational Mode
Level 1 certification required. Targeting RAN infrastructure layers.
Compatibility
SDR hardware (USRP/BladeRF) required.
Secure Audit Threat Vectors
GSM's fundamental authentication asymmetry — the network authenticates the MS but the MS cannot authenticate the network — is directly exploitable with OsmocomBB. A rogue BTS can camp a target MS by broadcasting a stronger BCCH signal, then issue an Authentication Request using a replayed or null RAND value; OsmocomBB confirms that the MS responds regardless of network authenticity. Ciphering Mode negotiation per TS 44.018 Section 3.4.7 can then be manipulated to force A5/0 by a rogue BTS claiming no higher cipher support, exposing all subsequent Um traffic to passive decryption with pre-computed A5/1 rainbow tables (Kraken, Berlin).
OsmocomBB enables MS-side silent SMS (Type 0 SMS, TS 23.040 Section 9.2.3.9) behavioural testing, verifying whether handsets acknowledge delivery without user notification — a technique used in law enforcement location tracking and commercial surveillance services. Supplementary Services call forwarding manipulation via USSD and MAP (TS 24.080, TS 29.002) can be tested from the MS side to confirm whether MO-originated SS requests are accepted without additional authentication, enabling toll fraud and call interception setup. These vulnerabilities persist into 3G and 4G networks wherever CS Fallback to GSM remains active in the serving PLMN.
Frequently Asked Questions
What is OsmocomBB — GSM Baseband Security?
OsmocomBB — GSM Baseband Security is an open-source telecom security utility in the RAN category. OsmocomBB replaces proprietary firmware on Calypso-based GSM handsets (Motorola C118, C123) with open-source software exposing the full GSM Um interface from Layer-1 burst processing through Layer-3 MM/CC/SMS protocols (3GPP TS 24.008, TS 44.018). Unlike passive SDR tools, OsmocomBB operates as an active MS enabling two-way protocol interaction with live GSM networks. Researchers use it for active ciphering enforcement testing (A5/0/1/3), IMSI catcher detection heuristic development, silent SMS behaviour analysis, and supplementary service (USSD/SS) attack surface research. GSMTAP output integrates with Wireshark and gr-gsm captures for full cross-layer Um interface reconstruction.
Which category does OsmocomBB — GSM Baseband Security belong to?
OsmocomBB — GSM Baseband Security is categorized under RAN in the TelcoSec Tools console. This category covers tools used for auditing Radio Access Network air interfaces, base station broadcasts, and SDR-based signal capture.
What hardware is required to run OsmocomBB?
OsmocomBB requires a Calypso-based GSM handset — most commonly the Motorola C118 or C123, which contain the Texas Instruments Calypso baseband chipset targeted by OsmocomBB's Layer-1 firmware. These phones communicate with the host PC via a serial cable using an FTDI-based USB-to-serial adapter. The hardware is increasingly scarce; Motorola C118 units are the standard choice, with the Pirelli DP-L10 as an alternative. OsmocomBB operates in the 900 MHz GSM band by default; 850/1800/1900 MHz support depends on the RF front-end in each specific handset model.
Can OsmocomBB be used to intercept or decrypt GSM calls?
OsmocomBB can receive and decode GSM downlink bursts within a cell's ARFCN, but decrypting A5/1-ciphered traffic requires the session key Kc — either derived from a known Ki via the SIM, or recovered via pre-computed Kraken or Berlin tables targeting A5/1's 64-bit key space. A5/0 (null cipher) traffic is immediately decodable in the clear. For passive downlink capture and decoding workflows, GR-GSM is better suited; OsmocomBB's strength is active MS-side protocol interaction and two-way GSM Um testing.
ADVANCED_TRAININGRAN Security PathRecommended for: OsmocomBB — GSM Baseband Security
Master OsmocomBB — GSM Baseband Security Security at the Academy
Upgrade your skill set from running automated modules to manual exploit engineering. Learn deep protocol auditing, signaling vulnerabilities, and baseband hardware analysis inside our virtual environments.
•Hands-On Virtual Labs
•SDR & RF Sandbox Kits
•Industry-Recognized Certs
Research Credentials
Tool Feedback
Found a bug, have a feature request, or a technical question about OsmocomBB — GSM Baseband Security? Send it directly to the research team.