Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

I Can LTE Even

Noble Trout

WirelessTalks19 minIntermediateOpen on YouTube ↗

Where

Talks
ShmooCon 2024

Duration

19 min

Walks through building a private LTE network on shared CBRS spectrum, from certification and hardware to a working packet core.

Summary

The speaker frames this as a build guide rather than a break-in story. Earlier research involved scanning the internet for carrier core equipment and finding many exposed devices, which led to looking into Citizens Broadband Radio Service, a shared slice of 3.55 GHz spectrum that lets private parties run their own mobile networks.

The middle of the talk lays out the steps. CBRS access is split into three tiers, and the lowest, opportunistic tier is the one most individuals will use. Installing equipment requires becoming a certified professional installer, which involves an online course and a credential issued as a cryptographic certificate. The build then needs a base station, a compatible test handset, SIM cards, a spectrum assignment service, and a hosted packet core that takes on the difficult backend work. The speaker also describes an open-source packet core as a self-hosted option for those who want to understand the layers, and suggests keeping experiments receive-only unless properly authorized.

The takeaway is that a working network can be assembled in a few hours for a modest budget, and that the main obstacles are administrative rather than technical. The speaker also raises community wireless, where one backhaul connection is shared among neighbors, while leaving open questions about carrier terms of service. Questions afterward covered alternative packet cores and antenna placement, with an attic-mounted unit reaching roughly several hundred feet.

Related talks