Mobile Network Hacking: Recon on Local Mobile Networks

What it is

FALCON (Fast Analysis of LTE on Control Channels), a real-time LTE/LTE-A PDCCH decoder built by researchers at the University of Dortmund and maintained by falkenberg9, built on the srsLTE (now srsRAN) library. The tutorial runs it under DragonOS (a Lubuntu-based SDR distro by Aaron Noble / cemaxecutor) with a LimeSDR or Ettus USRP. The summary already has the concept and the three abuse cases; what follows is the setup detail it omits.

Preconditions

You must already know the target tower's transmit frequency and Cell ID (CID) — the tutorial points back to a prior "find local cell towers" post to obtain these. FALCON needs both to synchronize. Hardware: LimeSDR Mini or USRP over USB 3.0.

The developers' performance requirements (not in the summary):

• CPU with at least 4 physical cores, Hyper-Threading disabled
• Disable power-saving/DVFS; set CPU to performance mode
• Run nothing else with a GUI (no browser/email) during capture

What to do

Verify the SDR is seen:

lsusb
SoapySDRUtil --find="driver=lime"

In DragonOS, FALCON is pre-installed under the GUI's Hamradio section. Open it, enter the tower frequency and CID on the right, hit Start (upper left) to sync and decode the PDCCH. The UE Activity tab then lists connected devices by RNTI, with per-device Activity, Total Throughput, MCS Index, resource blocks/subframe, and an RNTI histogram.

Caveats

The decoder includes a multi-stage validation chain to reduce false detections under poor signal conditions, but the page gives no accuracy figures. It provides no defensive detection or mitigation content — framing is offensive/SIGINT training, and the concrete output is passive observation of who is on a cell and how loaded it is. No version numbers, CVEs, or benchmarks are stated.