[novas0x2a]

It's not the same scope as a claimed 4G attack, but you can already intercept voice and some data on every US GSM network with openbts/gnu-radio; it's pretty trivial to set up an IMSI-catcher with them. This[1] is from Defcon 18 in 2010; I've recently watched someone set up a rogue tower in a lab environment.

(This probably goes without saying, but I'll say it anyway; if you do this in the wild and you don't take precautions for handling emergency calls, you're probably a bad person.)

GSM implementation insecurity hasn't affected iphone or blackberry enterprise deployment, not sure why it would affect android.

1) http://www.tombom.co.uk/blog/?p=244