4 ms·

I listened to your great podcast and the remark along the lines of "unencrypted police comms let the robbers know when the police are getting close" made me won

I listened to your great podcast and the remark along the lines of "unencrypted police comms let the robbers know when the police are getting close" made me wonder if anyone has built a simple signal intensity detector for the encrypted radios. You don't need to hear the contents to know that the radios are closing in on you. I can't imagine police forces practice RF silence like special forces do. It really would be better to hide in the noise of 5G.

buildbot 1y ago
I’ve long wanted to do this with an SDR and maybe some simple ML, build a dataset by driving by cars/things with frequencies of interest. Now I wonder if you can fingerprint antennas…
- dumah 1y ago
  You can fingerprint transmitters. Antennas would be much more difficult and likely moot. https://arxiv.org/html/2402.06250v1 https://arxiv.org/html/2402.06250v1
  - mindcrime 1y ago
    Some transmitters have such a distinct sound that you can identify them with just your unassisted human hearing. Back in my firefighting days, I remember that certain trucks or stations had transmitters where you could identify them from the half second or so of "hum" between the time somebody keyed up the mic and the time they started talking. Using ML / signal processing stuff on a computer, yeah, you can probably get pretty fine grained at discriminating these things.
mystraline 1y ago
I have a BT scanner app for my phone. "BLE Radar". I have a detection on there for the MAC address "00:25:DF:*". That's the MAC OUI prefix for Taser International. I keep it on while driving, because the badgecams and hardware in cop cars spurts this out regularly. So even unmarked cars show themselves.
- Forbo 1y ago
  A.K.A. Axon Enterprises. Some OUI databases have the new name, some have the old.
jasonjayr 1y ago
https://www.krakenrf.com/ https://www.krakenrf.com/ For about $700, you can get some pre-made kit to use SDR to do Radio direction finding. IIRC this device uses the same chips as a RTL-SDR, but it uses 4-5 of them, all synchronized and has a signal emitter for calibration, and a nice web ui to report the data. (I have not used it, but I've been learning about all sorts of neat radio products as I'm dabling and learning about SDR)
- nullc 1y ago
  No current ability to track trunked radio units, though arguably thats 'just a software problem'. I have one and have found it to be quite easy to hunt down ham repeaters that you can get to transmit more or less non-stop... but relatively hard to use for intermittent transmitters. I need to see if I can figure out how to plub in my GNSS compass output because inferring orientation from motion requires an awful lot of moving around and is less reliable than I'd like.
  - genewitch 1y ago
    https://www.rtl-sdr.com/sdrtrunk-setup-and-use-tutorial/ https://www.rtl-sdr.com/sdrtrunk-setup-and-use-tutorial/ there's things to "hear" trunked radios. also the "kraken" may be $700, but there was kerberosdr/hydrasdr which was much cheaper. Furthermore, trunking is usually done within the bandwidth of a typical SDR so it doesn't really obfuscate it as much as one would think. Also i bought one; not to find repeaters, but to find trolls who were using repeaters. I'd monitor the input frequency to the repeater, apparently the same as mitnick would. there were trunking scanners in the late 90s / early 2000s, as well. my neighbor had one.
nullc 1y ago
> the remark along the lines of "unencrypted police comms let the robbers know when the police are getting close" Criminals sophisticated enough to do that are usually not going to get caught regardless, encryption or no and are generally savvy enough to not make themselves a serious threat to public comfort and order. I don't think its a long reach to say that the public may be better off with more ability to monitor police activity at a cost of being weaker against that kind of criminal.
- tptacek 1y ago
  I think that was truer 15 years ago, but every criminal now carries a police scanner with them (in the form a phone), and the residents in my area who most avidly follow police scanners are not the most technical people in the area. (Having said all that, our muni voted against encrypting radios; we lost 2-1 in a vote with the 2 other munis we share dispatch with). Unless you're talking about criminals doing traffic analytic RF attacks, in which case, I agree, who cares?

buildbot 1y ago

I’ve long wanted to do this with an SDR and maybe some simple ML, build a dataset by driving by cars/things with frequencies of interest. Now I wonder if you can fingerprint antennas…

dumah 1y ago
You can fingerprint transmitters. Antennas would be much more difficult and likely moot. https://arxiv.org/html/2402.06250v1 https://arxiv.org/html/2402.06250v1
- mindcrime 1y ago
  Some transmitters have such a distinct sound that you can identify them with just your unassisted human hearing. Back in my firefighting days, I remember that certain trucks or stations had transmitters where you could identify them from the half second or so of "hum" between the time somebody keyed up the mic and the time they started talking. Using ML / signal processing stuff on a computer, yeah, you can probably get pretty fine grained at discriminating these things.

mystraline 1y ago

I have a BT scanner app for my phone. "BLE Radar". I have a detection on there for the MAC address "00:25:DF:*". That's the MAC OUI prefix for Taser International. I keep it on while driving, because the badgecams and hardware in cop cars spurts this out regularly. So even unmarked cars show themselves.

Forbo 1y ago
A.K.A. Axon Enterprises. Some OUI databases have the new name, some have the old.

jasonjayr 1y ago

https://www.krakenrf.com/ https://www.krakenrf.com/ For about $700, you can get some pre-made kit to use SDR to do Radio direction finding. IIRC this device uses the same chips as a RTL-SDR, but it uses 4-5 of them, all synchronized and has a signal emitter for calibration, and a nice web ui to report the data. (I have not used it, but I've been learning about all sorts of neat radio products as I'm dabling and learning about SDR)

nullc 1y ago
No current ability to track trunked radio units, though arguably thats 'just a software problem'. I have one and have found it to be quite easy to hunt down ham repeaters that you can get to transmit more or less non-stop... but relatively hard to use for intermittent transmitters. I need to see if I can figure out how to plub in my GNSS compass output because inferring orientation from motion requires an awful lot of moving around and is less reliable than I'd like.
- genewitch 1y ago
  https://www.rtl-sdr.com/sdrtrunk-setup-and-use-tutorial/ https://www.rtl-sdr.com/sdrtrunk-setup-and-use-tutorial/ there's things to "hear" trunked radios. also the "kraken" may be $700, but there was kerberosdr/hydrasdr which was much cheaper. Furthermore, trunking is usually done within the bandwidth of a typical SDR so it doesn't really obfuscate it as much as one would think. Also i bought one; not to find repeaters, but to find trolls who were using repeaters. I'd monitor the input frequency to the repeater, apparently the same as mitnick would. there were trunking scanners in the late 90s / early 2000s, as well. my neighbor had one.

nullc 1y ago

> the remark along the lines of "unencrypted police comms let the robbers know when the police are getting close" Criminals sophisticated enough to do that are usually not going to get caught regardless, encryption or no and are generally savvy enough to not make themselves a serious threat to public comfort and order. I don't think its a long reach to say that the public may be better off with more ability to monitor police activity at a cost of being weaker against that kind of criminal.

tptacek 1y ago
I think that was truer 15 years ago, but every criminal now carries a police scanner with them (in the form a phone), and the residents in my area who most avidly follow police scanners are not the most technical people in the area. (Having said all that, our muni voted against encrypting radios; we lost 2-1 in a vote with the 2 other munis we share dispatch with). Unless you're talking about criminals doing traffic analytic RF attacks, in which case, I agree, who cares?