From: Petter Reinholdtsen Date: Sun, 24 Sep 2017 06:23:56 +0000 (+0200) Subject: New post. X-Git-Url: https://pere.pagekite.me/gitweb/homepage.git/commitdiff_plain/ab55b01fc2c6a65e8e41e817fa70a4e2b27a58ba?hp=46c577f47d22c3bdc25969f8840217868225da5d New post. --- diff --git a/blog/data/2017-09-24-gsm-imsi-catcher.txt b/blog/data/2017-09-24-gsm-imsi-catcher.txt new file mode 100644 index 0000000000..a21fb63c13 --- /dev/null +++ b/blog/data/2017-09-24-gsm-imsi-catcher.txt @@ -0,0 +1,74 @@ +Title: Easier recipe to observe the cell phones around you +Tags: english, debian, personvern, surveillance +Date: 2017-09-24 08:30 + +

A little more than a month ago I wrote +how +to observe the SIM card ID (aka IMSI number) of mobile phones talking +to nearby mobile phone base stations using Debian GNU/Linux and a +cheap USB software defined radio, and thus being able to pinpoint +the location of people and equipment (like cars and trains) with an +accuracy of a few kilometer. Since then we have worked to make the +procedure even simpler, and it is now possible to do this without any +manual frequency tuning and without building your own packages.

+ +

The gr-gsm +package is now included in Debian testing and unstable, and the +IMSI-catcher code no longer require root access to fetch and decode +the GSM data collected using gr-gsm.

+ +

Here is an updated recipe, using packages built by Debian and a git +clone of two python scripts:

+ +
    + +
  1. Start with a Debian machine running the Buster version (aka + testing).
    2. + +
  2. Run 'apt install gr-gsm python-numpy python-scipy + python-scapy' as root to install required packages.
    3. + +
  3. Fetch the GSM package decoding code using 'git clone + github.com/Oros42/IMSI-catcher.git'.
    4. + +
  4. Insert USB software defined radio supported by GNU Radio.
    5. + +
  5. Enter the IMSI-catcher directory and run 'python + scan-and-livemon' to locate the frequency of nearby base + stations and start listening for GSM packages on one of them.
    6. + +
  6. Enter the IMSI-catcher directory and run 'python + simple_IMSI-catcher.py' to display the collected information.
    7. + +
+ +

Note, due to a bug somewhere the scan-and-livemon program (actually +its underlying +program grgsm_scanner) do not work with the HackRF radio. It do +work with RTL 8232 and other similar USB radio receivers you can get +very cheaply +(for example +from ebay), so for now the solution is to scan using the RTL radio +and only use HackRF for fetching GSM data.

+ +

As far as I can tell, a cell phone only show up on one of the +frequencies at the time, so if you are going to track and count every +cell phone around you, you need to listen to all the frequencies used. +To listen to several frequencies, use the --numrecv argument to +scan-and-livemon to use several receivers. Further, I am not sure if +phones using 3G or 4G will show as talking GSM to base stations, so +this approach might not see all phones around you. I typically see +0-400 IMSI numbers an hour when looking around where I live.

+ +

I've tried to run the scanner on a +Raspberry Pi 2 and 3 +running Debian Buster, but the grgsm_livemon_headless process seem +to be too CPU intensive to keep up. When GNU Radio print 'O' to +stdout, I am told there it is caused by a buffer overflow between the +radio and GNU Radio, caused by the program being unable to read the +GSM data fast enough. If you see a stream of 'O's from the terminal +where you started scan-and-livemon, you need a give the process more +CPU power. Perhaps someone are able to optimize the code to a point +where it become possible to set up RPi3 based GSM sniffers? I tried +using Raspbian instead of Debian, but there seem to be something wrong +with GNU Radio on raspbian, causing glibc to abort().