How to create an EVIL LTE Twin

I had a problem — how do we hack the cell towerz? So I sought a solution. I curated sources of information, dug through forums and tested software and hardware myself. I made a blog to condense that information.

srsLTE Install

# sudo apt-get install cmake libfftw3-dev libmbedtls-dev libboost-program-options-dev libconfig++-dev libsctp-dev# sudo add-apt-repository ppa:bladerf/bladerf
# sudo apt-get update
# sudo apt-get install bladerf
#apt-get install libsctp-dev lksctp-tools# git clone
# cd srsLTE
# mkdir build
# cd build
#cmake ../
# make
# make test
git clone git://
cd gr-osmosdr/
mkdir build
cd build/
cmake ../
sudo make install
sudo ldconfig
apt-get install libuhd-dev libuhd003 uhd-host
* First probe for the UHD device, then run the UHD firmware software if you have any issues running srsenb/srsue *
A happy srsLTE configuration, ready to compile
  • Install all the correct dependencies
  • Ensure you’re using the right version of OpenLTE
  • If you get a lot of “LOLLLLLOOOL” errors when launching your software based enodeB, its due to to clock speed and the delicate timing nature of cellular communications
  • Ideally use bare metal, (Intel/AMD processors) if possible to avoid performance issues
  • Antennas do matter

LTE Evil Twin

When you launch srsue, this uses a “radio”. When you execute “srsenb” this uses a “radio”. You need two computers, and two radios to create a working LTE network that is fully functional. If you want a “Test” network, then you can use one USRP and one machine, though it’s not fully intended behavior by the software.

IMSI number from test device above



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Adam Toscher

Adam Toscher

Adam is a offensive security engineer and red team operator with over 20 years of experience in IT