Sniffing GSM signals for everyone - Camp++ · PDF fileSniffing GSM signals for everyone with gr-gsm and Multi-RTL Piotr Krysik ... SDCCH, SACCH, FACCH) traffic channels (TCH/F) Piotr

gr-gsmMulti-RTL
Demos
Sniffing GSM signals for everyonewith gr-gsm and Multi-RTL
Piotr Krysik
Camp++19 August 2016
Piotr Krysik Sniffing GSM signals for everyone

gr-gsmMulti-RTL
Demos
About the speaker
whoami
author of the core part of gsm-receiver(most popular part of Airprobe)
main author of gr-gsm - a GSM reception and decodingtoolbox (successor of Airprobe)
author of Multi-RTL - a RTL-SDR based multichannel receiver
researcher at Warsaw University of Technology (Poland)
a Free Software fan

gr-gsmMulti-RTL
Demos
projects originsGSM basicsinternals
gr-gsm

gr-gsmMulti-RTL
Demos
gr-gsmWhat is it?
Out-of-tree GNU Radio module
set of tools for receiving, de-multiplexing, and decoding
together with Wireshark enables analysis of live GSMtransmission in the Um radio interface
projects page: https://github.com/ptrkrysik/gr-gsm

gr-gsmMulti-RTL
Demos
gr-gsmWhat is it?
BTSBTS
BTSBTS
MS
MSMS
Um
Um
Um

gr-gsmMulti-RTL
Demos
Motivations to make a GSM receiver
Why people wanted to receive GSM themselves? (2007)
more GSM terminals than nodes connected to the Internet
no access to GSM physical layer
knowledge of GSM - very rare, almost none in the FOSS world
GSM network security research far behind Internet securityresearch

gr-gsmMulti-RTL
Demos
GSM security
Tons of security weaknesses of GSM waiting for exploitation:
no BTS authentication (exploited by security apparatus to thisday)
comically weak algorithm securing main Ki key - comp128v1(replaces in early 2000s by comp128v2)
weak design of A5/1 cipher securing signaling data and voice(based on LFSRs, relatively easily modeled mathematically,vulnerable to time-memory tradeoff, ...)
availability of many offers of devices for breaking GSMsecurity for government buyers
GSM carriers living in denial of vast GSM insecurity
difficulty of creating of a receiver presented as real a securitymeasure

gr-gsmMulti-RTL
Demos
GSM security
Causes of GSM insecurity:
long tradition of collusion of telecommunication companieswith governments against the interests of end-users
dating back to times of national telecommunication monopoliescontinuing to this daypower of telecommunication companies highly dependent onpower of governments (and vice-versa)example: symbiotic relation of AT&T and NSA (confirmed in2015 after analysis of NSAs own documents that we havefrom Snowden)

gr-gsmMulti-RTL
Demos
GSM security
Causes of GSM insecurity (cont.):
committee that created GSM in 1980s concerned withpossibility of TOO high users security *
British wanted 48 bit key on behalf of GCHQ and NSAended up with 54 bit key - 64 bits with last 10 bits zeroedFrench didnt want encryption at all (A5/0 - French Mode)deliberately weakened A5/2 cipher for export to dislikedcountriesencryption could be turned off or switched to A5/2 mode,without the cell phone user knowing (by design)
security through obscurity
* sources: account by Ross Anderson 1994final confirmation: We were pressured to weaken the mobile security in the80s 2014

gr-gsmMulti-RTL
Demos
Predecessors of gr-gsm - THC gsm cracking project(2007-2009)
Created three sub-projects for receiving GSM:
GSSM by Joshua Lackey
GSMSPGSM tvoid by Tempest Void - the most advanced one
had automatic frequency offset correctionsimple equalization to fight inter-symbol-interferences (ISI)

gr-gsmMulti-RTL
Demos
Predecessors of gr-gsm - gsm-receiver(2009-2010)
at the beginning of 2009 THCs gsm project unexpectedlyends
works on GSM sniffer continued under Airprobe projectin the mid-2009 gsm-receiver was created by me and added toAirprobe
received GSM bursts the way it was intended (used trainingsequences and Viterbi equalization)included CCCH, TCH/F (voice) channels decoding anddecryption - all added as dirty hack that supposed to beremoved promptlypatched by Harald Welte and Sylvain Munaut to add PCAPoutput and SDCCH/FACCH/SACCH decodingthe most popular part of Airprobe

gr-gsmMulti-RTL
Demos
Drawbacks of gsm-receiver
never removed temporary hacks - gsm-receiver was meant forreceiving GSM bursts onlyunresolved problems:
unstable frequency correction loopnot working synchronization of bursts inside TDMA frame withuse of training sequences

gr-gsmMulti-RTL
Demos
Drawbacks of gsm-receiver

gr-gsmMulti-RTL
Demos
End of gsm-receiver
at some point I didnt have time to work on it
in 2011 osmocom-bb project released
osmocom-bb: implementation of gsm transceiver with use ofCalypso based GSM phone (not general purpose SDRhardware)
Calypso phones much cheaper than SDR hardware forgsm-receiver
motivation to develop gsm-receiver project evaporated(although I made some attempts to restart)

gr-gsmMulti-RTL
Demos
gr-gsm - second life of gsm-receiver
end of 2013
I discovered that people still find gsm-receiver usable
... and are happy with it - despite its flaws
... and using it with cheap RTL-SDR receivers
another attempt to correct synchronization in gsm-receiver -successful one :)
the problem with frequency correction loop instability initiallysolved through removal of it
Airprobe project unmaintained to the point its not possible toaccess the repository
April 2014 - gr-gsm project is born

gr-gsmMulti-RTL
Demos
gr-gsm currently
main part - block for receiving burstswithout decryption and decoding related bloatwith support for frequency hopping and uplink demodulation
modular designseparate blocks for logical channels de-multiplexingseparate blocks for decoding
makes use of new GNU Radio capabilities: message passing,stream tagsapplications for:
scanning for base stationslive analysis of a single C0 channeldecoding of a signal file stored to a disk
there are more capabilities in gr-gsm that are not covered byout of the box apps

gr-gsmMulti-RTL
Demos
GSM radio link basics: TDMA frame
TDMA multiplexing - signal divided into frames of 8 timeslotsTime-slot length = 156.25 symbolsTransmission rate = 270.83 kbits/s
GMSK modulationFrequency modulationConstant envelope
7 0
TDMA frame
10 1 32 4 65 7
Timeslot (577s)
Time

gr-gsmMulti-RTL
Demos
GSM radio link basics: TDMA frame
TDMA multiplexing - signal divided into frames of 8 timeslotsTime-slot length = 156.25 symbolsTransmission rate = 270.83 kbits/s
GMSK modulationFrequency modulationConstant envelope
7 00 1 32 4 65 7

gr-gsmMulti-RTL
Demos
GSM radio link basics: GSM bursts
8,25
8,25
8,25
8,25Data
58Data
58
Fixed bits (only zeroes)142
Data39
Data39
Synchronization sequence64
Fixed bits142
TB3
TB3
TB3
TB3
TB3
TB3
TB3
TB3
Guard period
NormalBurst
Frequency correction burst
Synchronizationburst
Dymmy burst
Training sequence26

gr-gsmMulti-RTL
Demos
GSM radio link basics: logical channels
Timeslot - a physical channel
Multiple logical channels in (few) predefined groups insidetimeslots

gr-gsmMulti-RTL
Demos
GSM radio link basics: logical channelsTraffic channel
T T T T T T T T T T T T S T T T T T T T T T T T T I T TT I
10 32 54 76 98 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Sniffing GSM signals for everyone - Camp++ · PDF fileSniffing GSM signals for everyone with gr-gsm and Multi-RTL Piotr Krysik ... SDCCH, SACCH, FACCH) traffic channels (TCH/F) Piotr

Text of Sniﬃng GSM signals for everyone - Camp++ · PDF fileSniﬃng GSM signals for everyone with...

Piotr Wlostowicz

Catching and Understanding GSM Signals[1]

Research Article Indoor Localisation Based on GSM Signals

Piotr Stachlewski

Piotr Kasztelowicz

GSM Wireless Module · GSM Wireless Module ... PCB layout, whole structure, ... without the capacitor in MIC signals, TDD noise could be heard at the far end

Transcom Profile 2018...Network Planning Transmitter Key Features • Support the output of GSM, TD-SCDMA, CDMA2000, WCDMA, LTE, NB-IoT and RoLa modulation signals and CW signals

signals and GSM-R in railway ppt

(Piotr Dittwald)

PIOTR ANDERSZEWSKI

Effects of mobile phone signals (GSM and UMTS) on the ... · Effects of mobile phone signals (GSM and UMTS) on the blood-brain barrier in vitro Dr. rer. nat. Helmut Franke Klinik

Recovery of Clustered Sparse Signals from Compressive Measurements Volkan Cevher [email protected] Richard BaraniukChinmay Hegde Piotr Indyk

GSM Control Unit - Vihepo A/S€¦ · 6 GSM Control Unit cOnfiguratiOn setting using the sMs’s cOnfigUrATiOn seTTing Using The sMs’s note: to ensure the SMS based signals are

TNO study on the effects of GSM and UMTS signals on well-being

Piotr Sztompka

Power Measurements on GSM/EDGE Signals with an NRT Power ... · Power measurements on GSM/EDGE signals mostly means measuring the average power in one or several bursts, or more exactly,

Piotr Bakowski

Piotr ROGUCKI

Basia & Piotr

Piotr Kropotkin.docx

TNO study on the effects of GSM and UMTS signals on well ... signals on well-being and cognition ... Physical Planning and the Environment and the ... answers these questions

Spectrum Survey in Vietnam: occupancy … - Vietnam...identify the spectrum of downlink GSM/E-GSM signals that are located in 950MHz and 1800MHz bands. The spectrum of downlink 3G/IMT2000

Piotr Piwowarski

PIOTR KULASIŃSKI

Catching and Understanding GSM Signals

ONITORING AND MEASUREMENT OF GSM MOBILE TELEPHONY … · 2006-02-28 · MONITORING AND MEASUREMENT OF GSM MOBILE TELEPHONY SIGNALS Chariton D. Melissaris Institute of Computer Science

Piotr Oski

Modulo GSM ABS-GSM - Dodic Elettronica · Modulo GSM ABS-GSM ABS-GSM GSM Modulo Módulo GSM ABS-GSM Módulo GSM ABS-GSM Module GSM ABS-GSM Manuale Installatore Installer Manual Manual

GSM/GPRS/GPS TRACKER MANUAL - Vehicle Tracking TRACKER 102.pdf · GSM/GPRS/GPS TRACKER MANUAL U ... GPS sensitivity -159dBm ... the unit will begin to work and acquire the GSM signals

PIOTR ZBIERSKI