Who am I ?

Tip

The quieter you become, the more you are able to hear

Parcours, expérience et l'ensemble de mes contributions open-source. Le labo et les cours sont sur la page d'accueil.

Profile


Name	Bastien Baranoff
Focus	Cybersecurity in Software Defined Radio
Location	Paris, France
Email	bastienbaranoff@gmail.com
GitHub	bbaranoff
LinkedIn	Bastien Baranoff
Website	bbaranoff.github.io

Languages

French — native · English — professional.

Career

Physics → Electronics → Computer → Embedded → Software Defined Radio.

Education

Degree	Institution	Years
MSc, Electronics & Computers	University of Perpignan via Domitia	2011–2013
BSc, Computer Science	University of Perpignan via Domitia	2020–2021

Experience

Role	Organization	Year	Notes
Cybersecurity Research	Penthertz	2024
Lecturer	University of Perpignan via Domitia	2024
Developer	PROMES-CNRS	2021	LoRa(WAN) connection testing
Developer	Tata Advanced Systems	2020	Mobile security assessment
Teacher	Lycée Déodat de Séverac	2017	Éducation nationale
Electrical Engineering	PROMES-CNRS	2013	Junior research

Employers

Featured

MyriadRF — OTA OpenBSC setup, 80 Msps from a LimeSDR Mini, a satellite hunt & more (×2).
X / Twitter — a clip in action.

Cited in academic research

M. Gronau, A. Bysewski, K. Kobierzyński, A. Trzebiatowski, J. Filipiak, "Evaluation of 4G-LTE security and realization of a test stand for redirection attack", Gdańsk University of Technology, Dept. of Radio Communication Systems and Networks, 2021 — the team used my published Docker image and tooling for the LTE redirection attack, citing my GitHub as reference [29]. Project page.

Technical write-up — Osmocom Forum : Porting QEMU to Layer1 highram ELF in a no-RF Osmocom Network-in-the-Box.

Open-source contributions

A selection of my public repositories, grouped by field. Full list on github.com/bbaranoff — projects détaillés dans la section Projets.

📡 LTE / 5G — downgrade & redirection

Project	Description
LTE-Redirection_Attack	Force a target UE onto an unsafe network (cited in academic research above).
openlte	OpenLTE stack used as a base for redirection research.
srslte_to_gsm	Downgrade path from srsLTE-based LTE to GSM.
openLTE2GSM	LTE → GSM redirection workflow.
redir5Gted2Gsm	Redirect from 5G-NSA down to GSM.
redirect0r	Dockerized redirection LTE/5G-NSA → EDGE/GSM.
NSA_LTE_redirect_to_EDGE	Full 5G-NSA → EDGE workflow.
LTE-Cell-ScannerBladeRF2	LTE cell scanner for BladeRF 2.0.

📶 2G / GSM — Osmocom, BTS & baseband

Project	Description
qemu-calypso	QEMU emulation of the TI Calypso baseband (ARM + DSP).
osmo_egprs	Multi-operator GSM network over SS7/IP, containerized.
telco_install_sh	One-shot install scripts for a full 2G network-in-the-box.
srsran_4G_RTE	IMSI catcher, reloaded.
osmo-GUI	Web front-end for an Osmocom network-in-the-box.
osmocombb-ansible	Ansible automation for OsmocomBB / CalypsoBTS.
HeArTbReAkEr	Subscriber impersonation with Osmocom.
calypsogprs	GPRS support files for CalypsoBTS.
OpBTS-LimeMini	OpenBTS on a LimeSDR Mini.

🔐 Cryptanalysis

Project	Description
a51_tools	A5/1 known-plaintext attack + rainbow tables (Kraken/deka).
A53	CUDA-accelerated A5/3 (KASUMI) cracker.
tea1-cracker	OpenCL brute-force of the TETRA TEA1 cipher.
dst80_reversing	Reversing the DST80 automotive keyless cipher (ex-dst80).

🐞 Vulnerability research

Project	Description
CVE-2022-0847	"Dirty Pipe" Linux local privilege escalation PoC.
CVE-2023-4863	libwebp heap buffer overflow PoC.
brute_ubuntu_lpe	Ubuntu local privilege escalation brute forcing.

☎️ Signaling & fraud

Project	Description
callerid_spoofing	Methodology to spoof caller ID.
2RFA	Catching 2FA codes over RF (PoC).

🛰️ SDR, IoT & misc

Project	Description
software-defined-radio	Source of software-defined-radio.com.
ttn-gps	LoRaWAN / The Things Network GPS tracker.
llm-bridge	Bridge between telco tooling and a local LLM (Ollama).
telco_story	A written story of the telecommunications journey.