Cracking GSM with RTL-SDR for Thirty Dollars

GSM

Theoretically, GSM has been broken since 2003, but the limitations of hardware at the time meant cell phone calls and texts were secure from the prying ears of digital eavesdroppers and all but the most secret government agencies. Since then, the costs of hardware have gone down, two terabytes of rainbow tables have been published, and all the techniques and knowledge required to listen in on cell phone calls have been available. The only thing missing was the hardware. Now, with a super low-cost USB TV tuner come software defined radio, [domi] has put together a tutorial for cracking GSM with thirty dollars in hardware.

Previous endeavours to listen in and decrypt GSM signals used fairly expensive software defined radios – USRP systems that cost a few thousand dollars a piece. Since the advent of RTL-SDR, the price of software defined radios has come down to about $30 on eBay, giving anyone with a Paypal account the ability to listen in on GSM calls and sniff text messages.

The process of cracking GSM first involves getting the TMSI – Temporary Mobile Subscriber Identifier – a unique ID for each phone in a certain cell. This is done by sending a silent SMS that will send back and acknowledgement an SMS has been received on the victim’s phone, but won’t give the victim any indication of   receiving a message.

From there, the attacker listens to the GSM signals in the cell, receiving bursts attached to a TMSI, and cracking the encrypted stream using 1.6 TB of rainbow tables.

[domi] put up a four-part tutorial series (part 1 above; part 2, part 3, and part 4) that goes over the theory and the actual procedure of cracking text messages and voice calls with a simple USB TV tuner. There are a few limitations; the attacker must be in the same cell as the victim, and it looks like real-time voice decoding isn’t yet possible. Cracking GSM for $30, though, that’s good enough for us.

Detecting galactic rotation with software defined radio

dish

Last summer in the heyday of software defined radio via USB TV tuners we asked hackaday readers a question: Is anyone using everyone’s favorite method of SDR for radio astronomy? It took nearly a year, but finally there’s an awesome project to turn a USB TV tuner into a radio telescope. It’s from the fruitful mind of [Marcus Leech] (PDF warning), and is good enough to detect the rotation of the galaxy with a three-foot satellite dish.

News of [Marcus]‘ work comes to us from [Carl] over at RTL-SDR.com who has been keeping tabs on the advances of building a radio telescope in a backyard. He’s been collecting a lot of interesting tidbits including this gif showing an arm of the galaxy entering and leaving [Marcus]‘ telescope’s field of view over the course of a few hours.

Not only can [Marcus]‘ telescope record continium measurements – basically, a single-pixel camera sensitive to only one frequency – it can also produce spectral plots of the sky. Combine the ability to measure multiple frequencies at the same time with the Doppler effect, and [Marcus] can measure the rotation of the galaxy with a USB TV tuner. That’s just awesome in our humble opinion.

If you already have an RTL-SDR TV tuner and a largish satellite dish, [Marcus]‘ project should be fairly inexpensive to replicate; the feed assembly is made out of a coffee can, the amplifiers are repurposed satellite television equipment, and all the software – [Marcus]‘ own simple_ra tool for GNU Radio – is open source. Of course with a 3 foot diameter dish, it will be impossible to replicate the data from huge radio telescopes. Still, it’s an impressive piece of work that leaves us searching craigslist for an old C-band dish.

Tracking ships using software-defined radio (SDR)

tracking-ships-using-sdr

When we first started hearing about software-defined radio hacks (which often use USB dongles that ring it at under $20) we didn’t fully grasp the scope of that flexibility. But now we’ve seen several real-life examples that drive the concept home. For instance, did you know that SDR can be used to track ships? Ships large and small are required by may countries to use an Automatic Identification System (AIS) transponder. The protocol was originally developed to prevent collisions on large ships, but when the cost of the hardware became affordable the system was also brought to smaller vessels.

[Carl] wrote in to share his project (which is linked above). Just like the police scanner project from April this makes use of RTL-SDR in the form of a TV tuner dongle. He uses the SDRSharp software along with a Yagi-UDA. The captured data is then decoded and plotted on a map using ShipPlotter.

Listening in on weather balloons with RTL SDR

sonde

Every day, twice a day, over 800 weather balloons are launched around the world at exactly the same time. The data transmitted from these radiosondes is received by government agencies and shared with climatologists and meteorologist to develop climate models and predect the weather. Near [Carl]‘s native Auckland, a weather balloon is launched twice a day, and since they transmit at 403 MHz, he decided to use a USB TV tuner to receive data directly from an atmospheric probe.

The hardware portion of this project consisted of building a high gain antenna designed for 162 MHz. Even though the radiosonde transmits at 403 MHz, [Carl] was easily able to receive on his out-of-band antenna.

For the software, [Carl] used SDRSharp and SondeMonitor, allowing him to convert the coded transmissions from a weather balloon into pressure, temperature, humidity, and GPS data.

Pictures from weather satellites with a USB TV tuner

europe

Several times a day, a NOAA weather satellite passes over your head, beaming down pictures of weather systems and cloud formations. These transmissions aren’t encrypted, and given the requisite hardware it’s possible for you to download these images from space as [Lovro] shows us in a tutorial video.

To get these near real-time satellite pictures, [Lovro] used one of those USB TV tuners we’ve grown so fond of. A somewhat specialized antenna is required to receive the right hand polarized transmissions from NOAA weather satellites, but with a few bits of wood and wire, [Lovro] made a helical antenna to listen in on the weather satellites transmitting around 137 MHz. After gathering a whole bunch of data from the satellites with SDRsharp, [Lovro] used an image decoder to turn an audio file into a picture taken from space just hours ago.

This isn’t the first time we’ve seen images from a NOAA weather satellite downloaded with a software defined radio; last year [hpux735] did just that with a somewhat inexpensive Softrock SDR. [Lovro]‘s use of a USB TV tuner to receive the transmission from NOAA satellites is a lot easier on the pocketbook, though, with the largest expense being an investment in time to build a helical antenna.

Building a better software defined radio (and transmitting as well)

By now most Hackaday readers should be familiar with this year’s latest advance in software defined radio. With a simple USB TV tuner dongle, it’s possible to receive FM broadcasts, GPS data from satellites, and even telemetry from aircraft flying overhead. There is one limitation to this setup, though: it’s receive only. Hacker extraordinaire [Michael Ossmann] is looking to make a better software defined radio called the HackRF.

The HackRF is an incredibly ambitious project – able to receive just about anything between 100 MHz and 6 GHz (this includes everything from the top of the FM radio band to cordless phones, cell phones, WiFi, and basically any radio technology that has been commercialized in the last 15 years), the HackRF is also able to transmit. Yes, with the HackRF it’s possible to build your own software-defined WiFi module, or just broadcast bogus GPS information.

Compared to the $20 TV tuner SDR dongles we’ve played around with, the HackRF isn’t exactly cheap. [Mossmann] figures he’ll be able to sell the device for about $300. A fair bit of change, but much, much less than professional, commercial SDR solutions.

A very cool advance in the state of SDR, but reason dictates we must suggest that everyone who wants a HackRF to start studying for their amateur radio exam now. Being a licensed radio operator won’t stop you from any sort of malicious intent, but with at least with licensing comes with the possibility of knowing what evil you’re doing.

You can check out the wiki for the HackRF over on the gits along with the current hardware design

Getting started with software defined radio

In the last few months, software defined radio has seen an explosion in popularity thanks to a small USB TV tuner dongle able to receive anything broadcast between 64 and 1700 MHz. It’s a very neat project that opens the door to a whole bunch of radio experimentations, but getting started in the SDR world can be a bit daunting. To help everyone out, [MS3FGX] is writing a getting started guide so everyone can get into the world of software defined radio.

After getting one of the TV tuners supported by the RTL-SDR project (by far the most commonly used is this one from Dealextreme), the next thing you’ll need is a decent antenna. [MS3FGX] has had some success with this Radio Shack antenna, but it’s very easy to make your own.

The most popular software package to use with the RTL TV dongle is GNU Radio, and [MS3FGX] goes over the ins and outs of setting this up along with a brief aside for the Gqrx receiver.

After your hardware and software is set up, the only thing left to do is tuning into a few of your favorite stations. The range of frequencies the RTL covers includes AM and FM radio, along with GSM and GPS signals. Of course there’s a whole lot more you can do with this project like listening in on your car’s keyless entry fob, pagers, and wireless weather stations.