Cracking GSM with RTL-SDR for Thirty Dollars

GSM

Theoretically, GSM has been broken since 2003, but the limitations of hardware at the time meant cell phone calls and texts were secure from the prying ears of digital eavesdroppers and all but the most secret government agencies. Since then, the costs of hardware have gone down, two terabytes of rainbow tables have been published, and all the techniques and knowledge required to listen in on cell phone calls have been available. The only thing missing was the hardware. Now, with a super low-cost USB TV tuner come software defined radio, [domi] has put together a tutorial for cracking GSM with thirty dollars in hardware.

Previous endeavours to listen in and decrypt GSM signals used fairly expensive software defined radios – USRP systems that cost a few thousand dollars a piece. Since the advent of RTL-SDR, the price of software defined radios has come down to about $30 on eBay, giving anyone with a Paypal account the ability to listen in on GSM calls and sniff text messages.

The process of cracking GSM first involves getting the TMSI – Temporary Mobile Subscriber Identifier – a unique ID for each phone in a certain cell. This is done by sending a silent SMS that will send back and acknowledgement an SMS has been received on the victim’s phone, but won’t give the victim any indication of   receiving a message.

From there, the attacker listens to the GSM signals in the cell, receiving bursts attached to a TMSI, and cracking the encrypted stream using 1.6 TB of rainbow tables.

[domi] put up a four-part tutorial series (part 1 above; part 2, part 3, and part 4) that goes over the theory and the actual procedure of cracking text messages and voice calls with a simple USB TV tuner. There are a few limitations; the attacker must be in the same cell as the victim, and it looks like real-time voice decoding isn’t yet possible. Cracking GSM for $30, though, that’s good enough for us.

HackRF, or playing from 30 MHz to 6 GHz

hackrf

Up on Kickstarter, [Michael Ossmann] is launching the HackRF, an inordinately cheap, exceedingly capable software defined radio tool that’s small enough to lose in your laptop bag.

The HackRF was the subject of a lot of interest last time it was on Hackaday – the ability to receive up to 6GHz allows the HackRF to do a lot of very interesting things, including listening in on Bluetooth, WiFi, and 4G networks. Also, the ability to transmit on these frequencies means a lot of very interesting, and quite possibly slightly evil applications are open to anyone with a HackRF. Like the RTL-SDR dongles, the HackRF works with GNU Radio out of the box, meaning all those cool SDR hacks we’ve seen so far will work with this new, more powerful board.

Compared to the USB TV tuner cards that were so popular a year ago, the HackRF has 10 times the bandwidth, is able to receive up to 6GHz, and is also able to transmit. It’s only half-duplex, so to receive and transmit simultaneously you’ll need two HackRFs, or maybe wait for a hardware revision that will hopefully come sooner rather than later.

Below you can check out [Michael]‘s presentation at Toorcon where the HackRF was unleashed to the world.

[Read more...]

Building a better software defined radio (and transmitting as well)

By now most Hackaday readers should be familiar with this year’s latest advance in software defined radio. With a simple USB TV tuner dongle, it’s possible to receive FM broadcasts, GPS data from satellites, and even telemetry from aircraft flying overhead. There is one limitation to this setup, though: it’s receive only. Hacker extraordinaire [Michael Ossmann] is looking to make a better software defined radio called the HackRF.

The HackRF is an incredibly ambitious project – able to receive just about anything between 100 MHz and 6 GHz (this includes everything from the top of the FM radio band to cordless phones, cell phones, WiFi, and basically any radio technology that has been commercialized in the last 15 years), the HackRF is also able to transmit. Yes, with the HackRF it’s possible to build your own software-defined WiFi module, or just broadcast bogus GPS information.

Compared to the $20 TV tuner SDR dongles we’ve played around with, the HackRF isn’t exactly cheap. [Mossmann] figures he’ll be able to sell the device for about $300. A fair bit of change, but much, much less than professional, commercial SDR solutions.

A very cool advance in the state of SDR, but reason dictates we must suggest that everyone who wants a HackRF to start studying for their amateur radio exam now. Being a licensed radio operator won’t stop you from any sort of malicious intent, but with at least with licensing comes with the possibility of knowing what evil you’re doing.

You can check out the wiki for the HackRF over on the gits along with the current hardware design

Follow

Get every new post delivered to your Inbox.

Join 96,695 other followers