3 ms·

Theres no need to plant a GPS tracker, the radio protocol almost all police/fire/EMS use is called P-25[0]. Even when both parties remember to enable encryption

by avs733 10y ago

Theres no need to plant a GPS tracker, the radio protocol almost all police/fire/EMS use is called P-25[0]. Even when both parties remember to enable encryption, the protocol still has a long list of security of security vulnerabilities including the ability to jam it (both broad range and single user jamming) with the radio embedded in a childrens' toy because of poor implementation [1,2]. The protocol is so bad in fact that it could easily be used as active location tracking silently. Here is a talk about the complete list of fail [3] [0]https://en.wikipedia.org/wiki/Project_25 https://en.wikipedia.org/wiki/Project_25 [1] https://hackaday.com/2010/10/09/pulling-data-from-the-im-me-spectrum-analyzer/ https://hackaday.com/2010/10/09/pulling-data-from-the-im-me-... [2] http://online.wsj.com/public/resources/documents/p25sec08102011.pdf http://online.wsj.com/public/resources/documents/p25sec08102... [3]https://www.youtube.com/watch?v=7or-_gT8TWU https://www.youtube.com/watch?v=7or-_gT8TWU

bigiain 10y ago
Subversive art project idea: A RaspberryPi(or similar) with a $12 TV tuner software defined radio, and a small database of the various frequencies and bands particular flavours of your local LEO and/or federal TLA use. I know our local highway patrol, for example, use at least: P25, police issued cell phones, iPads with cellular data, HF radio (at least on rural/country cars), and whatever they use for the data connection for their in-car computers. Most/all of that would be encrypted, but hey - metadata's a free-for-all according to them, right? I bet if you knew what to look for, you could quite reasonable detect the presence of a highway patrol car when you saw some digital P25, a cellular connection on the bands used by the contracted cellular provider, and I'd bet good money that patterns of encrypted data that things like ALPR systems send would be quite distinctive... That's all staying pretty solidly at the whitehat end of the wide grey space of "what's allowed". If you were much closer to the blackhat end of that spectrum, I'd also bet pretty good money that sophisticated criminals are already exploiting GSM and 3/4G weaknesses to individually identify cellular radios by cracking the encryption to see the IMSI data. And that'd all be passive and undetectable, if you were firmly in the blackhat camp, active attacks against their P25 radios can (as pointed out) be done for effectively zero dollars.
- cplease 10y ago
  Already exists: http://www.broadcastify.com/listen/ http://www.broadcastify.com/listen/
  - oasisbob 10y ago
    Not the same thing at all. Broadcastify requires self-censorship, their ToS prohibits broadcasting tactical, command, vice, narcotics, and other interesting channels. Also, metadata and retroactive analysis is much different than listening to a live audio stream.
slededit 10y ago
Or just go to your friendly local TV station's website: http://komonews.com/live/live-police--fire-scanner-11-20-2015 http://komonews.com/live/live-police--fire-scanner-11-20-201...
- avs733 10y ago
  thats audio, and only some of it...I want location
  - slededit 10y ago
    They are helpful enough to announce their locations to the dispatcher on every call. It would not be difficult to find a specific unit if you wanted to.

by avs733 10y ago

bigiain 10y ago

Subversive art project idea: A RaspberryPi(or similar) with a $12 TV tuner software defined radio, and a small database of the various frequencies and bands particular flavours of your local LEO and/or federal TLA use. I know our local highway patrol, for example, use at least: P25, police issued cell phones, iPads with cellular data, HF radio (at least on rural/country cars), and whatever they use for the data connection for their in-car computers. Most/all of that would be encrypted, but hey - metadata's a free-for-all according to them, right? I bet if you knew what to look for, you could quite reasonable detect the presence of a highway patrol car when you saw some digital P25, a cellular connection on the bands used by the contracted cellular provider, and I'd bet good money that patterns of encrypted data that things like ALPR systems send would be quite distinctive... That's all staying pretty solidly at the whitehat end of the wide grey space of "what's allowed". If you were much closer to the blackhat end of that spectrum, I'd also bet pretty good money that sophisticated criminals are already exploiting GSM and 3/4G weaknesses to individually identify cellular radios by cracking the encryption to see the IMSI data. And that'd all be passive and undetectable, if you were firmly in the blackhat camp, active attacks against their P25 radios can (as pointed out) be done for effectively zero dollars.

cplease 10y ago
Already exists: http://www.broadcastify.com/listen/ http://www.broadcastify.com/listen/
- oasisbob 10y ago
  Not the same thing at all. Broadcastify requires self-censorship, their ToS prohibits broadcasting tactical, command, vice, narcotics, and other interesting channels. Also, metadata and retroactive analysis is much different than listening to a live audio stream.

slededit 10y ago

Or just go to your friendly local TV station's website: http://komonews.com/live/live-police--fire-scanner-11-20-2015 http://komonews.com/live/live-police--fire-scanner-11-20-201...

avs733 10y ago
thats audio, and only some of it...I want location
- slededit 10y ago
  They are helpful enough to announce their locations to the dispatcher on every call. It would not be difficult to find a specific unit if you wanted to.