Resume

Tip

The quieter you become the most you are able to hear

🛰️ À la une — GSM de A à Z, sans matériel

Deux projets open-source qui, ensemble, montent un réseau GSM complet et émulent le baseband d'un vrai téléphone — puis un cours qui déroule chaque étape.

qemu-calypso — émule le baseband TI Calypso (Motorola C1xx / Compal E88) dans QEMU : un ARM exécute le firmware osmocom-bb non patché et un DSP TMS320C54x exécute la vraie mask-ROM TI, reliés par la mailbox 0xFFD00000.
osmo_egprs — un réseau GSM multi-opérateur interconnecté en SS7/IP, entièrement conteneurisé (« un DHCP pour SS7 »).

Danger

Point d’avancement (2026-08-24). En mode shunt_legit, la pile GSM tourne de bout en bout — camp, Location Update, auth COMP128v1, A5/1, SMS et appel voix avec audio. En mode native, le Frequency Burst est désormais acquis par le vrai DSP (437 transitions mesurées, sans injection) ; le mur suivant est le décodage du SCH.

👉 Cours associés : Lab GSM multi-opérateur · Émulation du baseband Calypso · GSM étape par étape · Casser A5/1

Profile information

name	Bastien Baranoff
tagline	Cybersecurity in Software Defined Radio
email	bastienbaranoff@gmail.com
timezone	Paris/France
website	https://bbaranoff.github.io/
linkedin	Bastien Baranoff
github	bbaranoff
twitter	‘@bastienbaranoff'

Languages:

Note

French: Native

English: Professional

Career Profile:

Warning

Physics -> Electronics -> Computer -> Embedded -> Software Defined Radio

Education:


degree	MSc in Electronics Computers
university	University of Perpignan via Domitia
time	2011 - 2013


degree	Licence In Computer Science
university	University of Perpignan via Domitia
time	2020-2021

Experience

CyberSecurity Research
- time: 2024
- company: Penthertz
Former
- time: 2024
- company: University of Perpignan via Domitia
Developper
- time: 2021
- company: PROMES-CNRS
- details: LoRa(WAN) connection testing
Developper
- time: 2020
- company: Tata Advanced System Limited
- details: Mobile Security Assesment
Former
- time: 2017
- company: Lycée Déodat de Séverac
Electrical Engenering
- time: 2013
- company: PROMES-CNRS
- details: Junior Research

Developer

Junior Researcher

CyberSecurity Analyst

Former

Former (Education Nationale)

Quoted :

Second Time :

First TIme :

Cited in Academic Research

Note

My open-source work on LTE redirection attacks is referenced in peer-reviewed academic research.

M. Gronau, A. Bysewski, K. Kobierzyński, A. Trzebiatowski, J. Filipiak, "Evaluation of 4G-LTE security and realization of a test stand for redirection attack", Gdańsk University of Technology (Politechnika Gdańska), Department of Radio Communication Systems and Networks, 2021.

The team built a 4G-LTE simulation test stand and used my published Docker image and tooling to carry out the LTE redirection attack, citing my GitHub as reference [29].

Project page — supervised by Dr. Eng. Piotr Rajchowski.

Community & Technical Write-ups

Osmocom Forum — Porting QEMU to Layer1 highram ELF in a no-RF Osmocom Network-in-the-Box environment — running the Calypso Layer 1 firmware under QEMU emulation, with no RF hardware, inside an Osmocom network-in-the-box. Related work: qemu-calypso.

Stuff

Projects:

Danger

Curious about A5/1 in the 2010s I searched around the internet and found a lot of interesting resources

Open-Source Contributions

Tip

A selection of my public repositories, grouped by field. Full list on github.com/bbaranoff.

📡 LTE / 5G — Downgrade & Redirection Attacks

Forcing a target UE from a modern network down to an insecure GSM/EDGE layer.

Project	★	Description
LTE-Redirection_Attack	33	Force a target victim onto an unsafe network (the tool cited in academic research above).
openlte	18	OpenLTE stack used as a base for redirection research.
srslte_to_gsm	11	Downgrade path from srsLTE-based LTE to GSM.
openLTE2GSM	8	LTE → GSM redirection workflow.
redir5Gted2Gsm	7	Redirect from 5G-NSA down to GSM.
redirect0r	4	Dockerized redirection attack LTE/5G-NSA → EDGE/GSM.
NSA_LTE_redirect_to_EDGE	4	The long-awaited full 5G-NSA → EDGE workflow.
LTE-Cell-ScannerBladeRF2	3	LTE cell scanner for BladeRF 2.0.

📶 2G / GSM — Osmocom, BTS & IMSI Catchers

Standing up rogue base stations and Calypso-based mobile stations.

Project	★	Description
telco_install_sh	19	One-shot install scripts for a full 2G network-in-the-box.
srsran_4G_RTE	11	IMSI catcher, reloaded.
osmo-GUI	9	Graphical front-end for Osmocom and `osmocon` scripting.
osmocombb-ansible	7	Ansible automation for OsmocomBB / CalypsoBTS.
HeArTbReAkEr	6	Exploration of subscriber impersonation with Osmocom.
calypsogprs	5	GPRS support files for CalypsoBTS.
osmo_egprs	5	EGPRS on Osmocom.
OpBTS-LimeMini	4	OpenBTS on a LimeSDR Mini.
qemu-calypso	4	QEMU emulation of the Calypso baseband ("Calypso Machine" test).

🔐 Cryptography & Cracking

Project	★	Description
A53	—	CUDA-accelerated A5/3 cracker.
a51_tools	—	Tooling around A5/1 rainbow tables.
dst80 / dst80_reversing	3	Reversing the DST80 automotive keyless cipher.
tea1-cracker	—	Experiments against the TETRA TEA1 cipher.

🐞 Vulnerability Research & Exploits

Project	★	Description
CVE-2022-0847	50	"Dirty Pipe" Linux local privilege escalation PoC.
CVE-2023-4863	6	libwebp heap buffer overflow PoC.
brute_ubuntu_lpe	—	Ubuntu local-privilege-escalation brute forcing.

☎️ Signaling & Fraud

Project	★	Description
callerid_spoofing	10	Methodology to spoof caller ID.
2RFA	1	Proof of concept for catching 2FA codes over RF.

🛰️ SDR, IoT & Misc

Project	★	Description
software-defined-radio	1	General SDR utilities.
ttn-gps	2	LoRaWAN / The Things Network GPS tracker.
llm-bridge	—	Bridge between telco tooling and a local LLM (Ollama).
telco_story	3	A written story of the telecommunications journey.