- <div class="title"><a href="http://people.skolelinux.org/pere/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html">syslog-trusted-timestamp - chain of trusted timestamps for your syslog</a></div>
- <div class="date"> 1st April 2016</div>
- <div class="body"><p>Two years ago, I had
-<a href="http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html">a
-look at trusted timestamping options available</a>, and among
-other things noted a still open
-<a href="https://bugs.debian.org/742553">bug in the tsget script</a>
-included in openssl that made it harder than necessary to use openssl
-as a trusted timestamping client. A few days ago I was told
-<a href="https::/www.difi.no/">the Norwegian government office DIFI</a> is
-close to releasing their own trusted timestamp service, and in the
-process I was happy to learn about a replacement for the tsget script
-using only curl:</p>
-
-<p><pre>
-openssl ts -query -data "/etc/shells" -cert -sha256 -no_nonce \
- | curl -s -H "Content-Type: application/timestamp-query" \
- --data-binary "@-" http://zeitstempel.dfn.de > etc-shells.tsr
-openssl ts -reply -text -in etc-shells.tsr
-</pre></p>
-
-<p>This produces a binary timestamp file (etc-shells.tsr) which can be
-used to verify that the content of the file /etc/shell with the
-calculated sha256 hash existed at the point in time when the request
-was made. The last command extract the content of the etc-shells.tsr
-in human readable form. The idea behind such timestamp is to be able
-to prove using cryptography that the content of a file have not
-changed since the file was stamped.</p>
-
-<p>To verify that the file on disk match the public key signature in
-the timestamp file, run the following commands. It make sure you have
-the required certificate for the trusted timestamp service available
-and use it to compare the file content with the timestamp. In
-production, one should of course use a better method to verify the
-service certificate.</p>
-
-<p><pre>
-wget -O ca-cert.txt https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt
-openssl ts -verify -data /etc/shells -in etc-shells.tsr -CAfile ca-cert.txt -text
-</pre></p>
-
-<p>Wikipedia have a lot more information about
-<a href="https://en.wikipedia.org/wiki/Trusted_timestamping">trusted
-Timestamping</a> and
-<a href="https://en.wikipedia.org/wiki/Linked_timestamping">linked
-timestamping</a>, and there are several trusted timestamping services
-around, both as commercial services and as free and public services.
-Among the latter is
-<a href="https://www.pki.dfn.de/zeitstempeldienst/">the
-zeitstempel.dfn.de service</a> mentioned above and
-<a href="https://freetsa.org/">freetsa.org service</a> linked to from the
-wikipedia web site. I believe the DIFI service should show up on
-https://tsa.difi.no, but it is not available to the public at the
-moment. I hope this will change when it is into production. The
-<a href="https://tools.ietf.org/html/rfc3161">RFC 3161</a> trusted
-timestamping protocol standard is even implemented in LibreOffice,
-Microsoft Office and Adobe Acrobat, making it possible to verify when
-a document was created.</p>
-
-<p>I would find it useful to be able to use such trusted timestamp
-service to make it possible to verify that my stored syslog files have
-not been tampered with. This is not a new idea. I found one example
-implemented on the Endian network appliances where
-<a href="http://help.endian.com/entries/21518508-Enabling-Timestamping-on-log-files-">the
-configuration of such feature was described in 2012</a>.</p>
-
-<p>But I could not find any free implementation of such feature when I
-searched, so I decided to try to
-<a href="https://github.com/petterreinholdtsen/syslog-trusted-timestamp">build
-a prototype named syslog-trusted-timestamp</a>. My idea is to
-generate a timestamp of the old log files after they are rotated, and
-store the timestamp in the new log file just after rotation. This
-will form a chain that would make it possible to see if any old log
-files are tampered with. But syslog is bad at handling kilobytes of
-binary data, so I decided to base64 encode the timestamp and add an ID
-and line sequence numbers to the base64 data to make it possible to
-reassemble the timestamp file again. To use it, simply run it like
-this:
-
-<p><pre>
-syslog-trusted-timestamp /path/to/list-of-log-files
-</pre></p>
-
-<p>This will send a timestamp from one or more timestamp services (not
-yet decided nor implemented) for each listed file to the syslog using
-logger(1). To verify the timestamp, the same program is used with the
---verify option:</p>
-
-<p><pre>
-syslog-trusted-timestamp --verify /path/to/log-file /path/to/log-with-timestamp
-</pre></p>
-
-<p>The verification step is not yet well designed. The current
-implementation depend on the file path being unique and unchanging,
-and this is not a solid assumption. It also uses process number as
-timestamp ID, and this is bound to create ID collisions. I hope to
-have time to come up with a better way to handle timestamp IDs and
-verification later.</p>
-
-<p>Please check out
-<a href="https://github.com/petterreinholdtsen/syslog-trusted-timestamp">the
-prototype for syslog-trusted-timestamp on github</a> and send
-suggestions and improvement, or let me know if there already exist a
-similar system for timestamping logs already to allow me to join
-forces with others with the same interest.</p>
-
-<p>As usual, if you use Bitcoin and want to show your support of my
-activities, please send Bitcoin donations to my address
-<b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
+ <div class="title"><a href="http://people.skolelinux.org/pere/blog/Simpler_recipe_on_how_to_make_a_simple__7_IMSI_Catcher_using_Debian.html">Simpler recipe on how to make a simple $7 IMSI Catcher using Debian</a></div>
+ <div class="date"> 9th August 2017</div>
+ <div class="body"><p>On friday, I came across an interesting article in the Norwegian
+web based ICT news magazine digi.no on
+<a href="https://www.digi.no/artikler/sikkerhetsforsker-lagde-enkel-imsi-catcher-for-60-kroner-na-kan-mobiler-kartlegges-av-alle/398588">how
+to collect the IMSI numbers of nearby cell phones</a> using the cheap
+DVB-T software defined radios. The article refered to instructions
+and <a href="https://www.youtube.com/watch?v=UjwgNd_as30">a recipe by
+Keld Norman on Youtube on how to make a simple $7 IMSI Catcher</a>, and I decided to test them out.</p>
+
+<p>The instructions said to use Ubuntu, install pip using apt (to
+bypass apt), use pip to install pybombs (to bypass both apt and pip),
+and the ask pybombs to fetch and build everything you need from
+scratch. I wanted to see if I could do the same on the most recent
+Debian packages, but this did not work because pybombs tried to build
+stuff that no longer build with the most recent openssl library or
+some other version skew problem. While trying to get this recipe
+working, I learned that the apt->pip->pybombs route was a long detour,
+and the only piece of software dependency missing in Debian was the
+gr-gsm package. I also found out that the lead upstream developer of
+gr-gsm (the name stand for GNU Radio GSM) project already had a set of
+Debian packages provided in an Ubuntu PPA repository. All I needed to
+do was to dget the Debian source package and built it.</p>
+
+<p>The IMSI collector is a python script listening for packages on the
+loopback network device and printing to the terminal some specific GSM
+packages with IMSI numbers in them. The code is fairly short and easy
+to understand. The reason this work is because gr-gsm include a tool
+to read GSM data from a software defined radio like a DVB-T USB stick
+and other software defined radios, decode them and inject them into a
+network device on your Linux machine (using the loopback device by
+default). This proved to work just fine, and I've been testing the
+collector for a few days now.</p>
+
+<p>The updated and simpler recipe is thus to</p>
+
+<ol>
+
+<li>start with a Debian machine running Stretch or newer,</li>
+
+<li>build and install the gr-gsm package available from
+<a href="http://ppa.launchpad.net/ptrkrysik/gr-gsm/ubuntu/pool/main/g/gr-gsm/">http://ppa.launchpad.net/ptrkrysik/gr-gsm/ubuntu/pool/main/g/gr-gsm/</a>,</li>
+
+<li>clone the git repostory from <a href="https://github.com/Oros42/IMSI-catcher">https://github.com/Oros42/IMSI-catcher</a>,</li>
+
+<li>run grgsm_livemon and adjust the frequency until the terminal
+where it was started is filled with a stream of text (meaning you
+found a GSM station).</li>
+
+<li>go into the IMSI-catcher directory and run 'sudo python simple_IMSI-catcher.py' to extract the IMSI numbers.</li>
+
+</ol>
+
+<p>To make it even easier in the future to get this sniffer up and
+running, I decided to package
+<a href="https://github.com/ptrkrysik/gr-gsm/">the gr-gsm project</a>
+for Debian (<a href="https://bugs.debian.org/871055">WNPP
+#871055</a>), and the package was uploaded into the NEW queue today.
+Luckily the gnuradio maintainer has promised to help me, as I do not
+know much about gnuradio stuff yet.</p>
+
+<p>I doubt this "IMSI cacher" is anywhere near as powerfull as
+commercial tools like
+<a href="https://www.thespyphone.com/portable-imsi-imei-catcher/">The
+Spy Phone Portable IMSI / IMEI Catcher</a> or the
+<a href="https://en.wikipedia.org/wiki/Stingray_phone_tracker">Harris
+Stingray</a>, but I hope the existance of cheap alternatives can make
+more people realise how their whereabouts when carrying a cell phone
+is easily tracked. Seeing the data flow on the screen, realizing that
+I live close to a police station and knowing that the police is also
+wearing cell phones, I wonder how hard it would be for criminals to
+track the position of the police officers to discover when there are
+police near by, or for foreign military forces to track the location
+of the Norwegian military forces, or for anyone to track the location
+of government officials...</p>
+
+<p>It is worth noting that the data reported by the IMSI-catcher
+script mentioned above is only a fraction of the data broadcasted on
+the GSM network. It will only collect one frequency at the time,
+while a typical phone will be using several frequencies, and not all
+phones will be using the frequencies tracked by the grgsm_livemod
+program. Also, there is a lot of radio chatter being ignored by the
+simple_IMSI-catcher script, which would be collected by extending the
+parser code. I wonder if gr-gsm can be set up to listen to more than
+one frequency?</p>
projects / homepage.git / blobdiff