implementation of an active attack at the Um interface. The attack was carried out by taking
advantage of lack of two-way authentication. A rogue GSM base transceiver system was
established using Universal Software Radio Peripheral (USRP) B200 board and OpenBTS.
B200 allows relaxation of an external 10 MHz reference signal as opposed to widely used
USRP1 and N-series. After establishing rogue BTS, IMSI catch-attack and impersonation of …