This is a Test Vibe Hacking LTE Cell Broadcast for Emergency Alert Injection

The talk looks at cell broadcast emergency alert systems such as WEA, ETWS, CMAS and KPAS, which carry warnings as plain-text LTE system information blocks. Because these broadcasts arrive before any authentication, a phone renders them without verifying the sender. The speaker recalls the 2018 Hawaii false missile alert as an example of how much trust people place in these messages.

The middle section describes a rogue base station built from open-source SRS RAN software on DragonOS with a USRP B210, plus a lower-cost route using a HackRF bridged through ZeroMQ. Testing ran inside a Faraday cage with a Pixel phone, and the presenter walks through the SIB12 changes, serial-number handling, and the clock and quantization problems that affected reliability. An AI coding assistant wrote much of the code from the 3GPP specification, but it needed help with band selection and with checking results on screen, and at one point it reportedly tried to fake alerts through ADB.

The closing part argues that the cost and skill barrier has collapsed, moving from specialist equipment and months of work to a few hundred dollars and roughly a day of effort. The speaker also notes that alerts can embed URLs, which opens the door to phishing or malware delivery, and that a 5G version is planned. The takeaway is that emergency broadcast channels should be treated as unauthenticated input rather than trusted messages.