7 ms·

Sniffing GSM Traffic with HackRF

95 points by evilsocket 11y ago

callesgg 11y ago
Interesting. Now make a guide about decrypting it as-well :)
- icehawk 11y ago
  Like this? http://domonkos.tomcsanyi.net/?p=418 http://domonkos.tomcsanyi.net/?p=418
- z4ziggy 11y ago
  soon
CraigJPerry 11y ago
Heh and I thought I was cool using my hackrf to ring my doorbell! Started attending an amateur radio club after I completed Mike Ossmans video lectures (which are great). Those guys just had no interest in SDR though. They thought being able to waterfall plot the entire UHF band was nifty but that was about it :-( I need some new friends!
- madez 11y ago
  The following post is off-topic. I need some new friends! I feel like that since two years. Depending on where you live and what your interests are it can be surprisingly difficult to find someone who shares your excitement. Does someone of you have an idea how to find others who also like, for example, SDRs? Are there some generic guides?
  - dmix 11y ago
    Just find people on twitter who talk about the same things and invite them out for a beer/coffee. Or find some local person who blogged about a project they built.
  - imrehg 11y ago
    Hey, if you have a hackerspace near you, just drop in and pretty sure you'll find some like-minded people for almost any kind of interest (from cooking to electronics, from programming to board games...) Other than that, there are IRC channels for many different topics in tech, that can be quite busy and social. Depends on luck and topic, but could check it out. For SDR specifically, could start with a project, learn from that, then build further. In my experience plane tracking (aka. ADS-B receivers) is a sort of easy-going and fun starter. There are a lot of guides and different approaches to it. Try that, and see which part interests you more, and follow that. I'm sure you'll find communities along the way.
- vt240 11y ago
  Yes, I had a similar experience here with my local Ham club. I used to go to meetings in my home town when I was a kid. I must have watched too many YouTube videos, but I had visions of guys swapping stories of their latest eBay spectrum analyzer repairs, home brew microwave transmitters, RF pcb designs, and RF DSP. Nope: It was the same club I had been to 20 years ago. I'm sure it differs by area, but most of the interest seems to be in Ham culture. QSL cards, bunny hunt. I still like to go, there is a ton of experience in one room; guys that have been in the industry for their whole life.
deutronium 11y ago
It's also possible to do it with a cheap USB tv tuner - http://domonkos.tomcsanyi.net/?p=422 http://domonkos.tomcsanyi.net/?p=422
w8rbt 11y ago
I would not do this. Intercepting cell phone signals is illegal in the US. If you do this and are caught (brag on Facebook, Twitter), the penalties may be harsh. https://www.law.cornell.edu/uscode/text/18/2511
- deleted 11y ago
  [deleted]
  - yareally 11y ago
    What makes you think Standard US Cellular Network (AT&T, T-Mobile, etc) GSM traffic isn't encrypted? It is encrypted, just that that at least some of the older ciphers used have been broken. Gr-GSM (which is mentioned used in the link) has some basic implementation to decrypt traffic built into it. I've only skimmed it over, so I'm no expert on the project, but I wouldn't go around sniffing a cellular network's traffic without some careful consideration of what the tools you are using are doing. http://en.wikipedia.org/wiki/A5/1 http://en.wikipedia.org/wiki/A5/1 https://github.com/ptrkrysik/gr-gsm/blob/a33f3d82ed565719645286ff4fd805d2a0e9cfc7/lib/decryption/decryption_impl.cc https://github.com/ptrkrysik/gr-gsm/blob/a33f3d82ed565719645...
redwards510 11y ago
This guide was not complete. I am running KUbuntu 15, very stock, and several needed packages were not mentioned, and the git clone commands did not work (Permission denied (public key). So here's some help. git clone https://github.com/scateu/kalibrate-hackrf.git https://github.com/scateu/kalibrate-hackrf.git ./bootstrap fails until you run this: sudo apt-get install autoconf automake fftw3-dev but then i get this: checking for LIBHACKRF... no configure: error: Package requirements (libhackrf) were not met: No package 'libhackrf' found Which doesn't make sense, because I do have libhackrf0 and libhackrf-dev installed! Any help?
- redwards510 11y ago
  I used PyBombs[1] to install gnuradio (instead of packages) and was able to build kalibrate successfully. [1] http://pybombs.info/ http://pybombs.info/
- nikseeth 11y ago
  I put up a detailed guide going from zero to scanning a Control Channel a while back with pertinent commands, etc: http://blog.nikseetharaman.com/gsm-network-characterization-using-software-defined-radio/ http://blog.nikseetharaman.com/gsm-network-characterization-...
curiously 11y ago
so what can you make up from the decoded gsm traffic? All I see are non meaningful "paging" or some technical terms.
methou 11y ago
Why people repeatedly trying to sniff GSM with varies devices? from a RTL-SDR to real SDRs, point has been proven for many many times, GSM encryption is broken since a long time ago.
- maguirre 11y ago
  This is specifically my point of view, but I'd be willing to bet people keep doing this because they are curious, to see if they can or just because they want to expand their technical abilities.
  - iNate2000 11y ago
    Right, "it's been done" is different from "I did that" Also, repeatability is important
xtrumanx 11y ago
I wonder if you can capture USSD traffic with this. USSD is the tech the brings you the little menu or message that pop up on your cell phone's screen usually after dialing a short code like *122#. They're usually used to check your prepaid account's current balance but in Kenya and Somalia, USSD is what powers the mobile banking applications. If you can capture that traffic, what I would like to know is if its encrypted. If it ain't, someone could do a lot of damage with this thing.
bronz 11y ago
I bought a Realtek SDR a while ago. It didn't come with an antenna, so what little signal it receives is overshadowed by all the noise my computer makes. I really need to get that thing working. Incredibly cool stuff.

95 points by evilsocket 11y ago

callesgg 11y ago

Interesting. Now make a guide about decrypting it as-well :)

icehawk 11y ago
Like this? http://domonkos.tomcsanyi.net/?p=418 http://domonkos.tomcsanyi.net/?p=418
z4ziggy 11y ago
soon

CraigJPerry 11y ago

Heh and I thought I was cool using my hackrf to ring my doorbell! Started attending an amateur radio club after I completed Mike Ossmans video lectures (which are great). Those guys just had no interest in SDR though. They thought being able to waterfall plot the entire UHF band was nifty but that was about it :-( I need some new friends!

madez 11y ago
The following post is off-topic. I need some new friends! I feel like that since two years. Depending on where you live and what your interests are it can be surprisingly difficult to find someone who shares your excitement. Does someone of you have an idea how to find others who also like, for example, SDRs? Are there some generic guides?
- dmix 11y ago
  Just find people on twitter who talk about the same things and invite them out for a beer/coffee. Or find some local person who blogged about a project they built.
- imrehg 11y ago
  Hey, if you have a hackerspace near you, just drop in and pretty sure you'll find some like-minded people for almost any kind of interest (from cooking to electronics, from programming to board games...) Other than that, there are IRC channels for many different topics in tech, that can be quite busy and social. Depends on luck and topic, but could check it out. For SDR specifically, could start with a project, learn from that, then build further. In my experience plane tracking (aka. ADS-B receivers) is a sort of easy-going and fun starter. There are a lot of guides and different approaches to it. Try that, and see which part interests you more, and follow that. I'm sure you'll find communities along the way.
vt240 11y ago
Yes, I had a similar experience here with my local Ham club. I used to go to meetings in my home town when I was a kid. I must have watched too many YouTube videos, but I had visions of guys swapping stories of their latest eBay spectrum analyzer repairs, home brew microwave transmitters, RF pcb designs, and RF DSP. Nope: It was the same club I had been to 20 years ago. I'm sure it differs by area, but most of the interest seems to be in Ham culture. QSL cards, bunny hunt. I still like to go, there is a ton of experience in one room; guys that have been in the industry for their whole life.

deutronium 11y ago

It's also possible to do it with a cheap USB tv tuner - http://domonkos.tomcsanyi.net/?p=422 http://domonkos.tomcsanyi.net/?p=422

w8rbt 11y ago

I would not do this. Intercepting cell phone signals is illegal in the US. If you do this and are caught (brag on Facebook, Twitter), the penalties may be harsh. https://www.law.cornell.edu/uscode/text/18/2511

deleted 11y ago
[deleted]
- yareally 11y ago
  What makes you think Standard US Cellular Network (AT&T, T-Mobile, etc) GSM traffic isn't encrypted? It is encrypted, just that that at least some of the older ciphers used have been broken. Gr-GSM (which is mentioned used in the link) has some basic implementation to decrypt traffic built into it. I've only skimmed it over, so I'm no expert on the project, but I wouldn't go around sniffing a cellular network's traffic without some careful consideration of what the tools you are using are doing. http://en.wikipedia.org/wiki/A5/1 http://en.wikipedia.org/wiki/A5/1 https://github.com/ptrkrysik/gr-gsm/blob/a33f3d82ed565719645286ff4fd805d2a0e9cfc7/lib/decryption/decryption_impl.cc https://github.com/ptrkrysik/gr-gsm/blob/a33f3d82ed565719645...

redwards510 11y ago

This guide was not complete. I am running KUbuntu 15, very stock, and several needed packages were not mentioned, and the git clone commands did not work (Permission denied (public key). So here's some help. git clone https://github.com/scateu/kalibrate-hackrf.git https://github.com/scateu/kalibrate-hackrf.git ./bootstrap fails until you run this: sudo apt-get install autoconf automake fftw3-dev but then i get this: checking for LIBHACKRF... no configure: error: Package requirements (libhackrf) were not met: No package 'libhackrf' found Which doesn't make sense, because I do have libhackrf0 and libhackrf-dev installed! Any help?

redwards510 11y ago
I used PyBombs[1] to install gnuradio (instead of packages) and was able to build kalibrate successfully. [1] http://pybombs.info/ http://pybombs.info/
nikseeth 11y ago
I put up a detailed guide going from zero to scanning a Control Channel a while back with pertinent commands, etc: http://blog.nikseetharaman.com/gsm-network-characterization-using-software-defined-radio/ http://blog.nikseetharaman.com/gsm-network-characterization-...

curiously 11y ago

so what can you make up from the decoded gsm traffic? All I see are non meaningful "paging" or some technical terms.

methou 11y ago

Why people repeatedly trying to sniff GSM with varies devices? from a RTL-SDR to real SDRs, point has been proven for many many times, GSM encryption is broken since a long time ago.

maguirre 11y ago
This is specifically my point of view, but I'd be willing to bet people keep doing this because they are curious, to see if they can or just because they want to expand their technical abilities.
- iNate2000 11y ago
  Right, "it's been done" is different from "I did that" Also, repeatability is important

xtrumanx 11y ago

I wonder if you can capture USSD traffic with this. USSD is the tech the brings you the little menu or message that pop up on your cell phone's screen usually after dialing a short code like *122#. They're usually used to check your prepaid account's current balance but in Kenya and Somalia, USSD is what powers the mobile banking applications. If you can capture that traffic, what I would like to know is if its encrypted. If it ain't, someone could do a lot of damage with this thing.

bronz 11y ago

I bought a Realtek SDR a while ago. It didn't come with an antenna, so what little signal it receives is overshadowed by all the noise my computer makes. I really need to get that thing working. Incredibly cool stuff.