6 ms·

Talk about over-reacting. Not only is there a legal power maximum for private use of regulated spectrum, but there are plenty of areas of the US where you won't

Talk about over-reacting. Not only is there a legal power maximum for private use of regulated spectrum, but there are plenty of areas of the US where you won't interrupt anyone else's service. If you're really concerned, get a Ham license. There are plenty of areas where you can play with this on low power without pissing off the feds or ILECs. The creators of OpenBTS did this to provide service where it doesn't exist - in the middle of a desert, providing service to 30,000 people over a 7 square kilometer area, for example. It should go without saying that broadcasting a pirate signal in a populated area is a bad idea.

blantonl 11y ago
This is not an over-reaction in even the slightest way. The barrier to entry for this implementation is a little over $600 USD. If someone brought this solution online in their apartment in midtown Manhattan NYC, they would potentially affect hundreds, if not thousands of devices. Someone who is deploying an OpenBTS in the middle of the desert probably already has a good understanding of their existing RF environment. I'm willing to bet that just about everyone participating here lives in an RF rich environment where if they brought solution online, it would impact someone.
- peterwwillis 11y ago
  People who buy football equipment are aware that you can injure people playing football and generally don't play football in a midtown Manhattan office, for example. People who buy BTS equipment are aware that they are creating a cell tower and it will affect people around them and the police and cell network providers will not be happy with them if that happens.
- CraigJPerry 11y ago
  > they would potentially affect hundreds Unlikely since the range of this device is about a single small / medium apartment building.
  - archimedespi 11y ago
    Exactly; without an RF amp you're not going to do any serious damage.
    - danellis 11y ago
      You'd think people would have gathered that from the fact that the entire RF device is USB bus powered.
      - xkcd-sucks 11y ago
        "hacker" news
iheartmemcache 11y ago
For those who want to mess around with BTS -- 900mhz (Eurospec GSM freq; US' complement is 850) is unlicensed ISM band even without a Ham license, and legally compatible with all the Siemens production gear you can get fairly cheap (everyones phasing out the BS20s and what not). There's a 1 watt/4 watt limit, but I'm really curious how easy it'd be to get full voice 2G (Euro spec standard) coverage for Manhattan. This is all on consumer-compatible Euro/Asia and/or quad-band units out of the box too. Capacity for each BTS was around 12 concurrent voice channels (IIRC) and when I ran numbers you'd get ~1.2 radial KM coverage[edit: indoors, not LOS (which is drastically further)] at the setup I spec'd out (it was a while ago, apologies, but I think it was Yagi style capable of +70dbm). [0]http://www.afar.net/tutorials/fcc-rules/ http://www.afar.net/tutorials/fcc-rules/
- mindslight 11y ago
  Below 928MHz doesn't exactly jive with https://en.wikipedia.org/wiki/GSM_frequency_bands https://en.wikipedia.org/wiki/GSM_frequency_bands. It looks like you'd be restricted to "Trunking GSM" and only part of the rest? Can the protocol/gear actually be restricted to only part of the band? Also, similar topic - why is there such a dearth of information on hacking / forcibly opening up mobile basebands? Is it that there isn't much tinkering to be done once inside (just a lot of opaque DSP code), or are they really locked down that well, or is it simply that the people who develop such knowhow earn a living through phone unlocking etc and thus don't publicize? I'd really like to see some device hacked open enough such that all the surveillance identifiers (IMEI etc) could be freely scrubbed. After that, psuedonymously obtain network access via a remote SIM card proxied over IP - bootstrap with an existing wifi, and then I'd hope any renegotiation could take place over the device's own connection.
  - deleted 11y ago
    [deleted]
  - iheartmemcache 11y ago
    So, when you refer to 'restricted to nothing >928', I presume you mean side-band harmonic tone spill. To answer your question: I have no idea, but here's my educated guess based on the '08 auction[1] -- absolutely. I'm presuming that Verizon wouldn't pay billions of dollars for 2 6 mhz bands if they couldn't use it without violating FCC's "don't jump into my band, bro" stuff. Block A has 698–704 and 728–734 MHz. So, they're presumably using 6mhz here, another 6 mhz there (channel trunking) but they're definitely keeping within a 6mhz range. Granted you get a bit more of spectral content within a 700mhz band compared to the 900 to 928 range[edit: uh, per hertz obviously haha], that's still a massive band [edit: again, referring to the content you can fit per hertz; without actually running numbers, I'd gut-feeling-estimate that you're losing maybe ehh 30% capacity, so 900 to 928 is more than enough to operate a full 2G antenna]. RE: The dearth of information: Forcibly opening up? As in like, violating FCC rules? I mean, the knowledge is out there and readily available on the public internet if you know where to look. You can still find o-chem forums with PhD students talking about the manufacturing of research chemicals, but its masked in their own lexicon (an idiot can't just Google "how do i make {insert designer drug of choice}", but you'll find a lot re: "wacker oxidation of foo in bar" or "reductive amination in a Vigreux column"). Just like we've got specs and RFCs for all of our protocols, the mobile industry meets up and agrees on everything from MIPI standards (ever wondered how there are so many Chinese Android devices with so many different seemingly interchangable components like video cameras, GPS modules, etc? There's a spec everything). You could easily take over some of the 850mhz spectra for a day or two but a) what would you have to gain? I guess you could sell baseband equipment to private investigators for a huge premium, thats about it, b) even if you could monetize it, the FCC would storm in on you within a couple days, a week at most. RE: devices hacked open - Shenzhen has everything. [1] https://en.wikipedia.org/wiki/United_States_2008_wireless_spectrum_auction#Prior_auctions https://en.wikipedia.org/wiki/United_States_2008_wireless_sp...

blantonl 11y ago

This is not an over-reaction in even the slightest way. The barrier to entry for this implementation is a little over $600 USD. If someone brought this solution online in their apartment in midtown Manhattan NYC, they would potentially affect hundreds, if not thousands of devices. Someone who is deploying an OpenBTS in the middle of the desert probably already has a good understanding of their existing RF environment. I'm willing to bet that just about everyone participating here lives in an RF rich environment where if they brought solution online, it would impact someone.

peterwwillis 11y ago
People who buy football equipment are aware that you can injure people playing football and generally don't play football in a midtown Manhattan office, for example. People who buy BTS equipment are aware that they are creating a cell tower and it will affect people around them and the police and cell network providers will not be happy with them if that happens.
CraigJPerry 11y ago
> they would potentially affect hundreds Unlikely since the range of this device is about a single small / medium apartment building.
- archimedespi 11y ago
  Exactly; without an RF amp you're not going to do any serious damage.
  - danellis 11y ago
    You'd think people would have gathered that from the fact that the entire RF device is USB bus powered.
    - xkcd-sucks 11y ago
      "hacker" news

iheartmemcache 11y ago

For those who want to mess around with BTS -- 900mhz (Eurospec GSM freq; US' complement is 850) is unlicensed ISM band even without a Ham license, and legally compatible with all the Siemens production gear you can get fairly cheap (everyones phasing out the BS20s and what not). There's a 1 watt/4 watt limit, but I'm really curious how easy it'd be to get full voice 2G (Euro spec standard) coverage for Manhattan. This is all on consumer-compatible Euro/Asia and/or quad-band units out of the box too. Capacity for each BTS was around 12 concurrent voice channels (IIRC) and when I ran numbers you'd get ~1.2 radial KM coverage[edit: indoors, not LOS (which is drastically further)] at the setup I spec'd out (it was a while ago, apologies, but I think it was Yagi style capable of +70dbm). [0]http://www.afar.net/tutorials/fcc-rules/ http://www.afar.net/tutorials/fcc-rules/

mindslight 11y ago
Below 928MHz doesn't exactly jive with https://en.wikipedia.org/wiki/GSM_frequency_bands https://en.wikipedia.org/wiki/GSM_frequency_bands. It looks like you'd be restricted to "Trunking GSM" and only part of the rest? Can the protocol/gear actually be restricted to only part of the band? Also, similar topic - why is there such a dearth of information on hacking / forcibly opening up mobile basebands? Is it that there isn't much tinkering to be done once inside (just a lot of opaque DSP code), or are they really locked down that well, or is it simply that the people who develop such knowhow earn a living through phone unlocking etc and thus don't publicize? I'd really like to see some device hacked open enough such that all the surveillance identifiers (IMEI etc) could be freely scrubbed. After that, psuedonymously obtain network access via a remote SIM card proxied over IP - bootstrap with an existing wifi, and then I'd hope any renegotiation could take place over the device's own connection.
- deleted 11y ago
  [deleted]
- iheartmemcache 11y ago
  So, when you refer to 'restricted to nothing >928', I presume you mean side-band harmonic tone spill. To answer your question: I have no idea, but here's my educated guess based on the '08 auction[1] -- absolutely. I'm presuming that Verizon wouldn't pay billions of dollars for 2 6 mhz bands if they couldn't use it without violating FCC's "don't jump into my band, bro" stuff. Block A has 698–704 and 728–734 MHz. So, they're presumably using 6mhz here, another 6 mhz there (channel trunking) but they're definitely keeping within a 6mhz range. Granted you get a bit more of spectral content within a 700mhz band compared to the 900 to 928 range[edit: uh, per hertz obviously haha], that's still a massive band [edit: again, referring to the content you can fit per hertz; without actually running numbers, I'd gut-feeling-estimate that you're losing maybe ehh 30% capacity, so 900 to 928 is more than enough to operate a full 2G antenna]. RE: The dearth of information: Forcibly opening up? As in like, violating FCC rules? I mean, the knowledge is out there and readily available on the public internet if you know where to look. You can still find o-chem forums with PhD students talking about the manufacturing of research chemicals, but its masked in their own lexicon (an idiot can't just Google "how do i make {insert designer drug of choice}", but you'll find a lot re: "wacker oxidation of foo in bar" or "reductive amination in a Vigreux column"). Just like we've got specs and RFCs for all of our protocols, the mobile industry meets up and agrees on everything from MIPI standards (ever wondered how there are so many Chinese Android devices with so many different seemingly interchangable components like video cameras, GPS modules, etc? There's a spec everything). You could easily take over some of the 850mhz spectra for a day or two but a) what would you have to gain? I guess you could sell baseband equipment to private investigators for a huge premium, thats about it, b) even if you could monetize it, the FCC would storm in on you within a couple days, a week at most. RE: devices hacked open - Shenzhen has everything. [1] https://en.wikipedia.org/wiki/United_States_2008_wireless_spectrum_auction#Prior_auctions https://en.wikipedia.org/wiki/United_States_2008_wireless_sp...