huawei (oscilloscopes and frequency analysis)

All I meant was that the tools are relatively accessible to anyone
with the desire to look - An oscilloscope with the necessary freq.
range to study 4G communications can be bought or fabricated (all
that's really needed is a microcontroller with an ADC, some gain amps
and time), an appropriate SDR to intercept the signals shouldn't be
too hard to source, and that community has been blowing up for a few
years now. Hell, there are even a couple examples of LGA 4G receivers
floating around in the wild (gtm801, for example). Ignoring all of
that, there are commercial options like the YellowFin 4G analyzer. No
idea how much one of those costs, though.

Now, like Jay said, there are the issues of encryption and such, but
that's just another barrier to entry. A little Google-fu could
probably source a paper dealing with its implementation, at least.

I doubt it would be easy, but if the motivation exists, the required
test bed is easily assembled, and the information is available. Not
like we're talking about intercepted military GPS bands or something.
It's a consumer device that can sit on a workbench and be tested at
the leisure of the security researcher.

- J.

now THAT would be a cool project!

There's already code out there for the GNURadio project's software defined
radio infrastructure that supports some very basic LTE analysis.... using a
$20 or less USB DTV tuner stick!! Only a matter of time before some radio
devices with a lot more bandwidth become affordable and easily accessible.

now THAT would be a cool project!

(I missed the beginnig of this thread; sorry if this is a repeat.)

There was the fellow demonstrating a spoofed 2G GSM tower at DefCon

And the YouTube video was pretty cool to watch, for technical depth.

Part of his talk described how he could (up a point) block 3G, to
cause phones to fail over to 2G, where he could get them.

4G is a whole different thing, but the talk was educational, nonetheless...