X-Git-Url: http://pere.pagekite.me/gitweb/homepage.git/blobdiff_plain/5db3924833a1f13a69fbc3c63ceeb06211bac17d..2cba027b86a4c0e449905be1d62c86d618ba558b:/blog/archive/2017/09/09.rss diff --git a/blog/archive/2017/09/09.rss b/blog/archive/2017/09/09.rss index 7baa3bf688..72b333b157 100644 --- a/blog/archive/2017/09/09.rss +++ b/blog/archive/2017/09/09.rss @@ -6,6 +6,143 @@ http://people.skolelinux.org/pere/blog/ + + Visualizing GSM radio chatter using gr-gsm and Hopglass + http://people.skolelinux.org/pere/blog/Visualizing_GSM_radio_chatter_using_gr_gsm_and_Hopglass.html + http://people.skolelinux.org/pere/blog/Visualizing_GSM_radio_chatter_using_gr_gsm_and_Hopglass.html + Fri, 29 Sep 2017 10:30:00 +0200 + <p>Every mobile phone announce its existence over radio to the nearby +mobile cell towers. And this radio chatter is available for anyone +with a radio receiver capable of receiving them. Details about the +mobile phones with very good accuracy is of course collected by the +phone companies, but this is not the topic of this blog post. The +mobile phone radio chatter make it possible to figure out when a cell +phone is nearby, as it include the SIM card ID (IMSI). By paying +attention over time, one can see when a phone arrive and when it leave +an area. I believe it would be nice to make this information more +available to the general public, to make more people aware of how +their phones are announcing their whereabouts to anyone that care to +listen.</p> + +<p>I am very happy to report that we managed to get something +visualizing this information up and running for +<a href="http://norwaymakers.org/osf17">Oslo Skaperfestival 2017</a> +(Oslo Makers Festival) taking place today and tomorrow at Deichmanske +library. The solution is based on the +<a href="http://people.skolelinux.org/pere/blog/Easier_recipe_to_observe_the_cell_phones_around_you.html">simple +recipe for listening to GSM chatter</a> I posted a few days ago, and +will show up at the stand of <a href="http://sonen.ifi.uio.no/">Åpen +Sone from the Computer Science department of the University of +Oslo</a>. The presentation will show the nearby mobile phones (aka +IMSIs) as dots in a web browser graph, with lines to the dot +representing mobile base station it is talking to. It was working in +the lab yesterday, and was moved into place this morning.</p> + +<p>We set up a fairly powerful desktop machine using Debian +Buster/Testing with several (five, I believe) RTL2838 DVB-T receivers +connected and visualize the visible cell phone towers using an +<a href="https://github.com/marlow925/hopglass">English version of +Hopglass</a>. A fairly powerfull machine is needed as the +grgsm_livemon_headless processes from +<a href="https://tracker.debian.org/pkg/gr-gsm">gr-gsm</a> converting +the radio signal to data packages is quite CPU intensive.</p> + +<p>The frequencies to listen to, are identified using a slightly +patched scan-and-livemon (to set the --args values for each receiver), +and the Hopglass data is generated using the +<a href="https://github.com/petterreinholdtsen/IMSI-catcher/tree/meshviewer-output">patches +in my meshviewer-output branch</a>. For some reason we could not get +more than four SDRs working. There is also a geographical map trying +to show the location of the base stations, but I believe their +coordinates are hardcoded to some random location in Germany, I +believe. The code should be replaced with code to look up location in +a text file, a sqlite database or one of the online databases +mentioned in +<a href="https://github.com/Oros42/IMSI-catcher/issues/14">the github +issue for the topic</a>. + +<p>If this sound interesting, visit the stand at the festival!</p> + + + + + Easier recipe to observe the cell phones around you + http://people.skolelinux.org/pere/blog/Easier_recipe_to_observe_the_cell_phones_around_you.html + http://people.skolelinux.org/pere/blog/Easier_recipe_to_observe_the_cell_phones_around_you.html + Sun, 24 Sep 2017 08:30:00 +0200 + <p>A little more than a month ago I wrote +<a href="http://people.skolelinux.org/pere/blog/Simpler_recipe_on_how_to_make_a_simple__7_IMSI_Catcher_using_Debian.html">how +to observe the SIM card ID (aka IMSI number) of mobile phones talking +to nearby mobile phone base stations using Debian GNU/Linux and a +cheap USB software defined radio</a>, and thus being able to pinpoint +the location of people and equipment (like cars and trains) with an +accuracy of a few kilometer. Since then we have worked to make the +procedure even simpler, and it is now possible to do this without any +manual frequency tuning and without building your own packages.</p> + +<p>The <a href="https://tracker.debian.org/pkg/gr-gsm">gr-gsm</a> +package is now included in Debian testing and unstable, and the +IMSI-catcher code no longer require root access to fetch and decode +the GSM data collected using gr-gsm.</p> + +<p>Here is an updated recipe, using packages built by Debian and a git +clone of two python scripts:</p> + +<ol> + +<li>Start with a Debian machine running the Buster version (aka + testing).</li> + +<li>Run '<tt>apt install gr-gsm python-numpy python-scipy + python-scapy</tt>' as root to install required packages.</li> + +<li>Fetch the code decoding GSM packages using '<tt>git clone + github.com/Oros42/IMSI-catcher.git</tt>'.</li> + +<li>Insert USB software defined radio supported by GNU Radio.</li> + +<li>Enter the IMSI-catcher directory and run '<tt>python + scan-and-livemon</tt>' to locate the frequency of nearby base + stations and start listening for GSM packages on one of them.</li> + +<li>Enter the IMSI-catcher directory and run '<tt>python + simple_IMSI-catcher.py</tt>' to display the collected information.</li> + +</ol> + +<p>Note, due to a bug somewhere the scan-and-livemon program (actually +<a href="https://github.com/ptrkrysik/gr-gsm/issues/336">its underlying +program grgsm_scanner</a>) do not work with the HackRF radio. It does +work with RTL 8232 and other similar USB radio receivers you can get +very cheaply +(<a href="https://www.ebay.com/sch/items/?_nkw=rtl+2832">for example +from ebay</a>), so for now the solution is to scan using the RTL radio +and only use HackRF for fetching GSM data.</p> + +<p>As far as I can tell, a cell phone only show up on one of the +frequencies at the time, so if you are going to track and count every +cell phone around you, you need to listen to all the frequencies used. +To listen to several frequencies, use the --numrecv argument to +scan-and-livemon to use several receivers. Further, I am not sure if +phones using 3G or 4G will show as talking GSM to base stations, so +this approach might not see all phones around you. I typically see +0-400 IMSI numbers an hour when looking around where I live.</p> + +<p>I've tried to run the scanner on a +<a href="https://wiki.debian.org/RaspberryPi">Raspberry Pi 2 and 3 +running Debian Buster</a>, but the grgsm_livemon_headless process seem +to be too CPU intensive to keep up. When GNU Radio print 'O' to +stdout, I am told there it is caused by a buffer overflow between the +radio and GNU Radio, caused by the program being unable to read the +GSM data fast enough. If you see a stream of 'O's from the terminal +where you started scan-and-livemon, you need a give the process more +CPU power. Perhaps someone are able to optimize the code to a point +where it become possible to set up RPi3 based GSM sniffers? I tried +using Raspbian instead of Debian, but there seem to be something wrong +with GNU Radio on raspbian, causing glibc to abort().</p> + + + Datalagringsdirektivet kaster skygger over Høyre og Arbeiderpartiet http://people.skolelinux.org/pere/blog/Datalagringsdirektivet_kaster_skygger_over_H_yre_og_Arbeiderpartiet.html