Vibe hacking LTE

The talk opens with the 2018 false missile alert in Hawaii, which a wrong menu selection caused, to argue that emergency alerts are trusted by default. The speaker maps the LTE public warning family, including US WEA/CMAS, Japan's ETWS and EU-Alert, and explains that the warnings sit in system information blocks. Any nearby phone decodes these in cleartext, with no keys, authentication or integrity checks. Commercial cell-site simulators sold for mass SMS messaging, and reported use in conflict zones, show how accessible this capability has become.

The middle of the talk covers the build. The open-source eNodeB stack lacked support for the warning blocks SIB10 through SIB12, so the speaker gave an LLM the 3GPP 36.331 specification and let it write the missing code. The model handled ASN.1 structures, scheduling plumbing and repetitive fixes through a compile-and-patch loop. The human still had to choose timing, segmentation, serial number behaviour and antenna settings. Transmission used a HackRF in transmit-only mode, bridged over ZeroMQ. A USRP was more reliable, and an external clock reduced drift.

The demos ran inside a Faraday cage with a stock Android phone, which displayed a full-screen alert with the standard tone. A second demo embedded a URL in an alert. The speaker warned that reused serial numbers can stop a phone from showing later alerts. The closing point is that range and transmit power are the main limits, not protocol knowledge, and that the design itself is the weakness. A 5G version is planned for later release.