Accidental Satellite Hijacks Can Rebroadcast Cell Towers

A lot of us will use satellite communications without thinking much about the satellite itself. It’s tempting to imagine that up there in orbit is a communications hub and distribution node of breathtaking complexity and ingenuity, but it might come as a surprise to some people that most communications satellites are simple transponders. They listen on one frequency band, and shift what they hear to another upon which they rebroadcast it.

This simplicity is not without weakness, for example the phenomenon of satellite hijacking has a history stretching back decades. In the 1980s for example there were stories abroad of illicit trans-atlantic serial links nestling as unobtrusive single carriers among the broad swathe of a broadcast satellite TX carrier.

Just sometimes, this phenomenon happens unintentionally. Our attention was drawn to a piece by [Harald Welte] on the unintended rebroadcast of GSM base station traffic over a satellite transponder, and of particular interest is the presentation from a conference in 2012 that it links to. The engineers show how they identified their interference as GSM by its timing frames, and then how they narrowed down its source to Nigeria. This didn’t give them the uplink in question though, for that they had to make a downconverter from an LNB, the output of which they coupled to an aged Nokia mobile phone with a wire antenna placed into an RF connector. The Nokia was able to decode the cell tower identification data, allowing them to home in on the culprit.

There was no fault on the part of the GSM operator, instead an unterminated port on the uplink equipment was enough to pick up the GSM signal and introduce it into the transponder as a parasitic signal for the whole of Europe and Africa to hear. Meanwhile the tale of how the engineers identified it contains enough detective work and outright hardware hacking that we’re sure the Hackaday readership will find it of interest.

If satellite hacks interest you, how about reading our thread of posts on the recapture of ISEE-3, or maybe you’d like to listen for a lost satellite from the 1960s.

Thanks [Kia] for the tip.

Emergency Cell Tower on a Budget

Cell phone towers are something we miss when we’re out of range, but imagine how we’d miss them if they had been destroyed by disastrous weather. In such emergencies it is more important than ever to call loved ones, and tell them we’re safe. [Matthew May] and [Brendan Harlow] aimed to make their own secure and open-source cellular network antenna for those occasions. It currently supports calling between connected phones, text messaging, and if the base station has a hard-wired internet connection, users can get online.

This was a senior project for a security class, and it seems that the bulk of their work was in following the best practices set by the Center for Internet Security. They adopted a model intended for the Debian 8 operating system which wasn’t a perfect fit. According to Motherboard their work scored an A+, and we agree with the professors on this one.

Last year, the same SDR board, the bladeRF, was featured in a GSM tower hack with a more sinister edge, and of course Hackaday is rife with SDR projects.

Thank you [Alfredo Garza] for the tip.

GPS Tracker Gets SMS Upgrade

In May of 2000, then-President Bill Clinton signed a directive that would improve the accuracy of GPS for anyone. Before this switch was flipped, this ability was only available to the military. What followed was an onslaught of GPS devices most noticeable in everyday navigation systems. The large amount of new devices on the market also drove the price down to the point where almost anyone can build their own GPS tracking device from scratch.

The GPS tracker that [Vadim] created makes use not just of GPS, but of the GSM network as well. He uses a Neoway M590 GSM module for access to the cellular network and a NEO-6 GPS module. The cell network is used to send SMS messages that detail the location of the unit itself. Everything is controlled with an ATmega328P, and a lithium-ion battery and some capacitors round out the fully integrated build.

[Vadim] goes into great detail about how all of the modules operate, and has step-by-step instructions on their use that go beyond what one would typically find in a mundane datasheet. The pairing of the GSM and GPS modules seems to go match up well together, much like we have seen GPS and APRS pair for a similar purpose: tracking weather balloons.

Detecting Mobile Phone Transmissions With a Sound Card

Anyone who had a cheap set of computer speakers in the early 2000s has heard it – the rhythmic dit-da-dit-dit of a GSM phone pinging a cell tower once an hour or so. [153armstrong] has a write up on how to capture this on your computer. 

It’s incredibly simple to do – simply plug in a set of headphone to the sound card’s microphone jack, leave a mobile phone nearby, hit record, and wait. The headphone wire acts as an antenna, and when the phone transmits, it induces a current in the wire, which is picked up by the soundcard.

[153armstrong] notes that their setup only seems to pick up signals from 2G phones, likely using GSM. It doesn’t seem to pick up anything from 3G or 4G phones. We’d wager this is due to the difference in the way different cellular technologies transmit – let us know what you think in the comments.

This system is useful as a way to detect a transmitting phone at close range, however due to the limited bandwidth of a computer soundcard, it is in no way capable of actually decoding the transmissions. As far as other experiments go, why not use your soundcard to detect lightning?

Hackaday Prize Entry: A Mobile Electric Gate

Electric gates can be an excellent labor-saving device, allowing one to remain in a vehicle while the gate opens and closes by remote activation. However, it can become somewhat of a hassle juggling the various remotes and keyfobs required, so [bredman] devised an alternative solution – controlling an electric gate over the mobile network.

20 years ago, this might have been achieved by wiring a series of relays up to the ringer of a carphone. These days, it’s a little more sophisticated – a GSM/GPRS module is connected to an Arduino Nano. When an incoming call is detected, the gate is opened. After a 3 minute wait, the gate is once again closed.

[bredman] suffered some setbacks during the project, due to the vagaries of working with serial on the Arduino Nano and the reset line on the A6 GSM module. However, overall, the gate was a simple device to interface with, as like many such appliances, it has well-labelled and documented pins for sending the gate open and close signals.

[bredman] was careful to design the system to avoid unwanted operation. The system is designed to always automatically close the gate, so no matter how many times the controller is called, the gate will always end up in a closed state. Special attention was also paid to making sure the controller could gracefully handle losing connection to the mobile network. It’s choices like these that can make a project much more satisfying to use – a gate system that constantly requires attention and rebooting will likely not last long with its users.

Overall, it’s a great project that shows how accessible such projects are – with some carefully chosen modules and mastery of serial communications, it’s a cinch to put together a project to connect almost anything to the Internet or mobile networks these days.  For a different take, check out this garage door opener that logs to Google Drive.

Hackaday Prize Entry: USB GSM GPS 9DOF SD TinyTracker Has All the Acronyms

[Paul] has put together an insanely small yet powerful tracker for monitoring all the things. The USB TinyTracker is a device that packages a 48MHz processor, 2G modem, GPS receiver, 9DOF motion sensor, barometer, microphone, and micro-SD slot for data storage. He managed to get it all to fit into a USB thumb drive enclosure, meaning that you can program it however you want in the Arduino IDE, then plug it into any USB port and let it run. This enables things like remote monitoring, asset tracking, and all kinds of spy-like activity.

One of the most unusual aspects of his project, though, is this line: “Everything came together very nicely and the height of parts and PCBs is exactly as I planned.” [Paul] had picked out an enclosure that was only supposed to fit a single PCB, but with some careful calculations, and picky component selection, he managed to fit everything onto two 2-layer boards that snap together with a connector and fit inside the enclosure.

We’ve followed [Paul’s] progress on this project with an earlier iteration of his GSM GPS Tracker, which used a Teensy and fit snugly into a handlebar, but this one is much more versatile.

A Simple, DIY GPS Tracker

Today, there are dozens of off-the-shelf solutions for a GPS tracking device. Most of them use GSM, some of them use satellites, and all of them are astonishingly inexpensive. If you want to track a car, dog, or your luggage, you’ve never had more options.

[Emilio] wanted to track his own car, and the original solution for this was a smartphone. This smartphone was also a good choice, as it’s a programmable GPS device connected to a cell network, but there had to be a simpler solution. It came in the form of an eight euro GPS module and a three euro GSM module (Google Translatrix right here). The rest of the hardware is an ATMega48V [Emilio] had sitting around and a 2500 mAh lithium cell. It’s a cellular tracker make out of eleven euro’s worth of hardware and some junk in a drawer.

There are only a few caveats to this hardware. First, the ATmega48V only has one UART. This is connected to the GPS module at 9600, 8N1. The connection to the GSM M-590 module is only 2400 bps, and slow enough for a bitbanged UART. This hardware is soldered to a piece of perfboard, thus ending the hardware part of this build.

The software is a little more complex, but not by very much. The GPS part of the firmware records the current latitude and longitude. If the GSM module receives a call, it replies with an SMS of the current GPS coordinates and a few GPS coordinates seen earlier. Of course, a pre-paid SIM is required for this build, but those are cheap enough.

Not even ten years ago, a simple, DIY GPS tracker would have cost a small fortune. Now that we have cheap GPS modules, GSM modules, and more magical electronics from the East, builds like this are easy and cheap. What a magical time to be alive.