Setting up a Private LTE/5G Environment

Getting hands-on experience in telecommunications security is notoriously difficult. Unlike web application hacking, where environments can be spun up in Docker with a single command, cellular protocols operate in licensed spectrum and require specialized hardware. The barrier to entry — regulatory compliance, expensive SDR hardware, and arcane protocol knowledge — has historically limited telecom security research to well-funded nation-state programs and a handful of academic groups.

That barrier is falling. Open-source 5G implementations, affordable software-defined radios, and containerized core networks have democratized access to cellular security research infrastructure. A functional 4G/5G test environment can now be built for under $2,000, enabling independent researchers to study everything from SS7 vulnerabilities interception to baseband exploitation in smartphones without touching a single production network.

This guide provides a comprehensive, step-by-step methodology for building a research-grade private LTE and 5G SA lab — from hardware procurement and RF shielding through core network deployment, SIM provisioning, and security research applications.

In this guide, we will walk through setting up a basic 5G Standalone (SA) and 4G LTE lab using accessible Software-Defined Radios (SDRs) and open-source core network implementations. For context on the protocols and network functions deployed here, refer to our 5G SBA vulnerabilities research and Diameter security analysis.

I. Hardware Requirements

Building a lab requires balancing cost against capability. The following sections detail the three critical hardware components: radio hardware, compute infrastructure, and user equipment.

1. The Software-Defined Radio (SDR)

The SDR acts as your Base Station (eNodeB for 4G, gNodeB for 5G). SDR selection is the single most consequential hardware decision — it determines which protocols you can run, signal stability, and maximum bandwidth.

Antennas: Match your antennas to your target frequencies. Common research bands:

• LTE Band 7 (2.6 GHz): Widely used in European deployments
• LTE Band 3 (1.8 GHz): Global mid-band coverage
• 5G n78 (3.5 GHz): Primary 5G NR mid-band globally
• 5G n77 (3.3-4.2 GHz): Extended C-band range

2. The Compute Node

You need a dedicated machine to run the Core Network and the RAN software simultaneously. Virtualization adds latency that disrupts real-time radio processing, so bare-metal is preferred for the RAN component.

Minimum Specifications

Critical: USB 3.0 is non-negotiable. USB 2.0 cannot sustain the data rates required by the USRP B210 (>30 MB/s continuous), causing sample drops that crash the RAN stack.

3. RF Shielding

Before any transmission, you must contain your signal. Options range from DIY to professional:

• Budget (~$200-500): A small Faraday tent or repurposed RF-shielded box (e.g., Ramsey STE-2300). Sufficient for single-cell labs with output power <0 dBm.
• Standard (~$1,000-3,000): Professional RF shielded enclosure with >80 dB attenuation. Suitable for multi-cell configurations and higher power research.
• Professional (~$10,000+): Walk-in anechoic chamber with >100 dB attenuation. Required for calibrated measurements and emissions testing.

Always validate your shielding effectiveness with a spectrum analyzer before transmitting. Even minor shield leakage at commercial cellular frequencies can trigger regulatory enforcement.

4. User Equipment (UE)

You need devices to connect to your private network and tools to provision them.

• Rooted Android Phones: A rooted Google Pixel or OnePlus device is ideal. Root access is required to lock the phone to specific bands, read baseband research (using tools like MobileInsight or SCAT), and change network APNs.
• Commercial 5G Modules: Quectel RM500Q or Sierra Wireless EM9191 provide industrial-grade 5G SA connectivity with AT command access for scripted testing.
• Programmable SIM Cards: Standard carrier SIMs are locked with secret keys. You must purchase programmable sysmoISIM-SJA5 cards (or similar blank SIMs) and a PC/SC-compliant smart card reader/writer.
• SIM Programming Tools: pySim-shell (from the Osmocom project) is the standard open-source tool for ISIM provisioning.

II. Software Stack Selection

The open-source telecom ecosystem is robust. The following table compares the major options:

Core Network Comparison

RAN Software Comparison

III. Step-by-Step Implementation

Step 1: Prepare the Host System

Configure your Ubuntu host for real-time radio processing:

Step 2: Program your SIM Cards

Before broadcasting, you need SIM cards provisioned with known cryptographic keys that match your core network configuration.

1. Insert the blank sysmoISIM-SJA5 into your PC/SC reader
2. Use pySim-shell from the Osmocom project
3. Program the following critical values:

# Install pySim
pip3 install pysim

  # Program a test SIM card
pySim-shell
> select MF
> select ADF.USIM

  # Write IMSI (test PLMN 00101 is the standard for research networks)
> update_binary EF.IMSI 001010123456789

  # Write Ki (128-bit authentication key — KEEP SECRET)
> update_binary EF.Ki 00112233445566778899aabbccddeeff

  # Write OPc (derived from operator's master OP key)
> update_binary EF.OPc aabbccddeeff00112233445566778899

  # Verify the programmed values
> read_binary EF.IMSI

Step 3: Deploy Open5GS

Open5GS can be easily installed via package managers on Ubuntu:

Configure the core:

1. Access the Web UI at http://localhost:9999
2. Add a new subscriber using the exact IMSI, Ki, and OPc values programmed onto the SIM
3. Configure the APN to internet with an IPv4 pool (e.g., 10.45.0.0/16)
4. For 5G SA: Configure the S-NSSAI (SST: 1, SD: optional) matching your slice configuration

Step 4: Configure and Run srsRAN

For 5G SA, use the srsRAN Project gNB:

Step 5: The Connection

Start the stack in the correct order:

Insert your programmed SIM into your Android device and search for networks. On the device, you may need to manually select the 00101 network or lock to Band n78 using engineering mode. Watch the srsRAN terminal output: you should see the UE send an RRC Setup Request, perform 5G-AKA mutual authentication with the AMF/AUSF, and establish a PDU session. Once active, the UE will receive an IP from your configured pool and have internet access through your lab.

IV. Security Research Applications

Once your lab is stable, the real work begins. You own the infrastructure end-to-end, allowing you to execute research scenarios that would be illegal or impossible on production networks.

1. Protocol Analysis and Traffic Capture

Run Wireshark on the compute node to capture and decrypt signaling traffic:

2. Core Network Fuzzing

Write Python scripts to modify authentication vectors or send malformed NAS packets directly into the Open5GS AMF to look for crashes. Key fuzzing targets:

• NAS Registration Messages: Malformed SUCI, invalid NSSAI, oversized PDU session requests
• NGAP Procedures: Invalid UE context IDs, malformed handover commands
• HTTP/2 SBA APIs: BOLA attacks, mass assignment against the NRF, UDM, and AUSF
• PFCP Session Management: Invalid TEID values, session modification overflows

3. RAN and Baseband Research

Intercept the downlink traffic from srsRAN and modify the ASN.1 encoded messages to trigger buffer overflows in the smartphone's baseband processor:

• RRC Fuzzing: Modify SystemInformationBlock messages to include deeply nested ASN.1 structures
• NAS Pre-Auth Fuzzing: Send malformed messages before mutual authentication completes — the baseband must process these without protection
• Paging Channel Analysis: Test IMSI catchers scenarios by broadcasting paging messages for specific IMSIs
• Downgrade Attacks: Force UEs to fall back from 5G to 4G/3G/2G by manipulating RRC release messages

4. Slice Security Testing

Configure multiple S-NSSAI entries in Open5GS and test 5G network slicing security:

• Register UEs to different slices and attempt cross-slice data access
• Test NSSAI spoofing by modifying the requested NSSAI in the NAS Registration Request
• Verify that QoS isolation holds under load (one slice should not impact another's throughput)

V. Troubleshooting Guide

VI. Dockerized Deployment (Alternative)

For faster iteration and reproducibility, the entire core network can be containerized:

This approach is ideal for 5G SBA security where you need to rapidly deploy, modify, and tear down core configurations.

VII. Authoritative References

VIII. Frequently Asked Questions

Conclusion & Next Steps

A private lab is an indispensable tool for serious telecommunications security research. By utilizing open-source cores and accessible SDRs, security teams can safely execute scenarios ranging from simple IMSI catching to complex zero-click baseband exploits, 5G SBA API attacks, and cross-slice isolation testing — all without leaving the confines of their test bench.

The recommended progression for lab-based research:

1. Start with software-only: Deploy Open5GS + srsRAN with ZMQ virtual radios
2. Add SDR hardware: USRP B210 for over-the-air testing in a shielded enclosure
3. Expand scope: Multi-cell configurations, Diameter interconnect testing, baseband fuzzing
4. Automate: CI/CD pipelines for regression testing of core network security patches

Don't have the time to build and maintain a physical lab? TelcoSec provides fully-virtualized, pre-configured 5G simulation environments directly via our Academy. Explore our TelcoSec protocol analysis tools for telecom-specific testing frameworks, or browse the TelcoSec research library for additional attack methodologies.