Re: [A51] Karsten Nohl on national German televison
Very nicely done Karsten. Congrats :) Ty Christian for letting us know. Is it on youtube yet? Cal On Tue, Aug 16, 2011 at 11:04 AM, Christian Buchner christian.buch...@gmail.com wrote: Hi, yesterday I watched German national television (ZDF station, publicly funded) and Karsten Nohl had a successful appearance on a live television show intercepting SMS text messages from two members of the audience. Interestingly all he needed to do this was a Macbook Air and an older mobile phone model as a receiver. Unfortunately the show was a bit light on the technical details, but it clearly demonstrated the need for cell carriers to upgrade their infrastructure. Congratulations for taking this important topic into the mainstream! Christian ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] [airprobe-main] Reminder - order Camp Tickets _now_
I so wish I could attend this :( On Sun, Jul 10, 2011 at 5:03 PM, Perfektionist perfektion...@go4more.dewrote: Alexander Chemeris wrote: Frank, The CCC-Camp website mentions that there will be enough tickets for everyone. Does it mean that this statement is no longer valid? At least until Tuesday... ;-) On Sun, Jul 10, 2011 at 18:20, Frank Rieger fr...@ccc.de wrote: Just a brief reminder: if you plan to attend the CCC-Camp, order your tickets _now_ at https://presale.events.ccc.de, before we ramp up the propaganda on tuesday, which will probably lead to a relatively quick sellout of the remaining tickets. Please also tell your friends whom you suspect to be interested. Thanks Greetings, Frank -- () The ASCII Ribbon Campaign /\ Help Cure HTML Email ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] GPU Performance
Curious, would be interesting to see if anyone can shed some light?? On 27/05/2011 11:15, Abid Rauf wrote: Hi All, ATI STREAM SDK 2.4 is compatiable with my Ati hd 6850. I ran the test burst with the GPU. I have following queries if you can answer please: 1- The test burst (i.e. a single burst) is taking more time on GPU i.e. 2 minutes as compared to CPU 1.5 minutes. Why is that? I am using two hard drives of one tera each. And my CPU specs is Quad Core 2.66 GHZ 2- For the test run (i.e. a single burst) i found two hits in tables on CPU and only a single hit when running on GPU. Why is that so? Is it anything alarming? Any one can comment on it please? Best Regards ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Traffic dump
Well.. assuming the drives and controller are the bottleneck.. 4x 512GB SSD drives with NCQ are like £160+vat each. A decent-ish RAID card would be around £500.. The chassis + motherboard + RAM + cpu would be at most £350-400 (only low spec would be needed right?) So, we're talking less than £2000.. And, if you had this done on a Dell contract, you could pay monthly too. However, the only thing you'd have to take into consideration is the legality of offering a service which allowed people to decrypt GSM traffic.. I'm not sure if a simple checkbox which says Confirm you are authorized to decrypt this traffic would be sufficient. On Tue, Apr 26, 2011 at 2:32 AM, Gerard gyoutu...@yahoo.com.br wrote: I really don't know whether a server like this could be deployed on the cloud. In my case, and beginners like me, maybe don't need a powerfull server like the one Sylvain described (but other configuration could be thought for advanced guy like him ;-) ). How much to pay and for how much time i don't know, but the idea is to to make easier the entrance of people in the community, in that sense one simple machine could help and the money would pay to let the machine online. TIA ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Traffic dump
The dell site has a power consumption calculator, where you can build a machine on their interface, and it'll give you all the heat / power / efficiency values. Can't remember the link off my head, but if you google you should find it :) On Tue, Apr 26, 2011 at 11:26 AM, Georgy Zhukov zhu...@gawab.com wrote: Learning purposes? Speaking for myself, in my university some not-so-clear things are teached, all assuming a safe environment, aka legal... Also speaking for myself, this project is incredibly interesting for me just for the fun of doing new things... As someone stated earlier, 2.4ghz is no longer fun :D Anyone knows the power consumption of a machine for this scenario? Average monthly consumption, that is... Best regards! On Tue, Apr 26, 2011 at 10:47 AM, Cal Leeming [Simplicity Media Ltd] cal.leem...@simplicitymedialtd.co.uk wrote: Well.. assuming the drives and controller are the bottleneck.. 4x 512GB SSD drives with NCQ are like £160+vat each. A decent-ish RAID card would be around £500.. The chassis + motherboard + RAM + cpu would be at most £350-400 (only low spec would be needed right?) So, we're talking less than £2000.. And, if you had this done on a Dell contract, you could pay monthly too. However, the only thing you'd have to take into consideration is the legality of offering a service which allowed people to decrypt GSM traffic.. I'm not sure if a simple checkbox which says Confirm you are authorized to decrypt this traffic would be sufficient. On Tue, Apr 26, 2011 at 2:32 AM, Gerard gyoutu...@yahoo.com.br wrote: I really don't know whether a server like this could be deployed on the cloud. In my case, and beginners like me, maybe don't need a powerfull server like the one Sylvain described (but other configuration could be thought for advanced guy like him ;-) ). How much to pay and for how much time i don't know, but the idea is to to make easier the entrance of people in the community, in that sense one simple machine could help and the money would pay to let the machine online. TIA ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Traffic dump
Hmm, I just checked scan.co.uk again, and I can't seem to find this price.. They're all coming up as like £600 - £1500 now.. I guess there was either a pricing error, or it picked up 512GB as 512MB, and I misread the results or something.. I was wondering to myself why SSD prices had dropped so much lmao. http://www.scan.co.uk/shop/computer-hardware/all/hard-drives-ssd/all Sorry for the mistake! Cal On Tue, Apr 26, 2011 at 11:52 AM, Sylvain Munaut 246...@gmail.com wrote: Hi 4x 512GB SSD drives with NCQ are like £160+vat each. Can you give me a source for those ? I'd like to buy a few ... Cheers, Sylvain ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
[A51] Question about using PS3 hardware
Hey, Apologies if this subject has already been covered, but has anyone attempted to do table generations using PS3 hardware? On a side note, have all the tables now been generated, or are there still some outstanding? Cheers Cal ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Question about using PS3 hardware
On 25/04/2011 21:18, Sylvain Munaut wrote: Hi, Apologies if this subject has already been covered, but has anyone attempted to do table generations using PS3 hardware? I did a few back-of-the-enveloppe calculation and it ended up being in the same order of magnitude as the ATI GPU cards ... but less convenient (need to re-implement / re-test / re-rebug and not really faster), so I didn't pursue. Did it work out cheaper to use PS3 hardware, in terms of physical cost? On a side note, have all the tables now been generated, or are there still some outstanding? all the tables ? AFAIK It's a statistical attack, it's never complete, each new table helps converge towards 100% success without ever reaching it (and with a diminishing return for each new table). This might be a silly question but, what is the recommended minimum and maximum total tables? Or, can you give an X number of tables will give you X percentage chance of success answer? Cheers, Sylvain ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Traffic dump
Am I correct in assuming, that the performance bottleneck is always going to be the disk IO? I.e. the most expensive component of the server is going to be the drives and the controller? Cal On 25/04/2011 21:35, Sylvain Munaut wrote: Hi, I am new on the Mailing List, but why don't you host on EC2? There it would be scaleable and I guess with 15$ per run you could even cover a High-CPU Instance There is even GPU instance ... but doesn't help. But have you looked up the price it would cost to first upload then maintain and access 2To of data on the cloud ? Also, the latency for theses storage is horrible. On the server I'm describing, I'm talking 4*512Go of SSD each capable of 30k random access per second. You're not gonna even approach that on EC2. Cheers, Sylvain ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] get TMSI
Sorry, can you clarify this question? What do you mean by mobile platforms? You mean the firmware running on the phone? On Sun, Dec 5, 2010 at 11:17 PM, Jesse Wang je...@jeswang.com wrote: Hi Do all the mobile platforms provide APIs to easily get TMSI from SIM card programmably? Regards, Jesse Wang ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk *IM: *AIM / ICQ / MSN / Skype (available upon request) Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] get TMSI
Yeah, I have to say I've never heard of any sort of specific API call to retrieve such information, at least not documented anyway :S On Mon, Dec 6, 2010 at 9:33 AM, Sylvain Munaut 246...@gmail.com wrote: Which do and which don't? Is there a work around if they don't? I'm not sure _any_ has such a feature as standard/universal ... You can sometime get the info through undocumented phone-specific API (i.e. it may work on one android phone but not the next, or it may break depending on fw version ...). Basically just search for a network monitor application for the specific phone you're interested in, check it has the TMSI and decompile it. Cheers, Sylvain -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk *IM: *AIM / ICQ / MSN / Skype (available upon request) Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Error on Airprobe
Looks like you got the wrong libraries installed, or there is some sort of
weird incompatibility.
Can you please post the following:
- What OS you are running (cat /etc/issue)
- What python version you are running (python -v)
Also, try running the following command:
find /home/strazytski/Research/GSM_Cracking/Code/airprobe/ -iname '*.pyc'
-exec rm -fv '{}' \;
I use that to remove all pre-compiled python sources, as I sometimes get
symbol errors after installing a new package, or migrating between
environments etc, and this sometimes resolves the problem.
On Wed, Aug 4, 2010 at 5:55 AM, Ninja ni...@infosec-id.com wrote:
Hello,
I tried to follow the instruction for airprobe from
http://srlabs.de/uncategorized/airprobe-how-to, but following error
occurred.
$ ./go_usrp2.sh vf_call6_a725_d174_g5_Kc1EF00BAB3BAC7002.cfile 174 0B
vf_call6
Traceback (most recent call last):
File ./gsm_receive100.py, line 12, in module
import gsm
File ../lib/gsm.py, line 24, in module
_gsm = swig_import_helper()
File ../lib/gsm.py, line 16, in swig_import_helper
import _gsm
ImportError:
/home/strazytski/Research/GSM_Cracking/Code/airprobe/gsm-receiver/src/lib/.libs/libgsmdemod.so.0:
undefined symbol:
_ZN15gr_msg_accepter4postEN5boost13intrusive_ptrIN3pmt8pmt_baseEEE
anyone experience with the error?
Rgds
___
A51 mailing list
A51@lists.reflextor.com
http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
--
Cal Leeming
Operational Security Support Team
*Out of Hours: *+44 (07534) 971120 | *Support Tickets: *
supp...@simplicitymedialtd.co.uk
*Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk
Simplicity Media Ltd. All rights reserved.
Registered company number 7143564
___
A51 mailing list
A51@lists.reflextor.com
http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Research Server
That could work.. Either that, or a shared 'screen' session. But, multiple people working on the USRP server at the same time might get messy... On Fri, Jul 30, 2010 at 10:47 AM, FlUxIuS flux...@gmail.com wrote: You're right Cal because only a user can have access to the usrp. But I'll be working in a solution to perform a group work. Maybe the best way will be to virtualise a session and the member will have access to a same session with the same display X. Any suggestion ? On 29 July 2010 21:52, Cal Leeming [Simplicity Media Ltd] cal.leem...@simplicitymedialtd.co.uk wrote: Could I also make a suggestion.. You could possibly implement a 'time share' system, where anyone can book a segment of time on the server?? On Thu, Jul 29, 2010 at 8:31 PM, Dinos Pastos dino...@gmail.com wrote: I have decided to setup a machine with a USRP2 + WBX or DBSRX board and open accounts for some people here that want to be able to develop/test/improve/etc. The machine will include: - Ubuntu 10.04LTS - USRP2 (with the 2 above boards) but most likely the DBSRX will be used as I dont want people transmitting. - GNUradio (custom requests for build parameters accepted) - AirProbe (currently the setup segfauls so anyone who wants to get it working is more than welcome to) - and any other tools on request can be installed. I wont give root access for obvious reasons. Any root actions will be performed manually by me. Only a few users will be accepted, as I dont want to have a crowded setup. Any suggestions or comments, please post to the list. Regards dinopio ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Research Server
Could I also make a suggestion.. You could possibly implement a 'time share' system, where anyone can book a segment of time on the server?? On Thu, Jul 29, 2010 at 8:31 PM, Dinos Pastos dino...@gmail.com wrote: I have decided to setup a machine with a USRP2 + WBX or DBSRX board and open accounts for some people here that want to be able to develop/test/improve/etc. The machine will include: - Ubuntu 10.04LTS - USRP2 (with the 2 above boards) but most likely the DBSRX will be used as I dont want people transmitting. - GNUradio (custom requests for build parameters accepted) - AirProbe (currently the setup segfauls so anyone who wants to get it working is more than welcome to) - and any other tools on request can be installed. I wont give root access for obvious reasons. Any root actions will be performed manually by me. Only a few users will be accepted, as I dont want to have a crowded setup. Any suggestions or comments, please post to the list. Regards dinopio ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Response from Ettus (monitoring the GSM spectrum)
Does this mean that the 64 ARFCN channels are spread across the entire spectrum (at which point channel hopping become more effective?), or just within a small allocation? On Wed, Jul 28, 2010 at 8:22 AM, Harald Welte lafo...@gnumonks.org wrote: On Tue, Jul 27, 2010 at 09:33:07PM +0200, Sylvain Munaut wrote: I don't really know if full spectrum monitoring it's required to do the cracking/interception job No, it's not, unless you want to listen to _all_ the communication taking part simultaneously in the zone ... Most likely the local cell isn't gonna hop between all the ARFCN in the band ... The two config I've seen here locally : - A few ARFCN relatively close together ( 60 MHz and even often 25 MHz ) Yes, (I know Sylvain, you know this, but maybe not all others in this thread) this by the way is the result of how the spectrum is allocated to a single operator by the regulatory authority in the respective country. - The BCCH ARCFN + A large contiguous range of hopping ARFCN somewhere else. This is the result of common network planning methods where you have one rarely reused allocation of ARFCN for BCCHs, and faster frequency reuse scheme for the hopping and power-controlled traffic chnannels. Also, you generally are interested in the traffic of one cell. And for that cell, you can obtain the Cell Channel Allocation list from its BCCH. After that you have a limited set of ARFCNs that you will have to monitor. The specification limits the number of ARFCN of one given cell to 64. -- - Harald Welte lafo...@gnumonks.org http://laforge.gnumonks.org/ Privacy in residential applications is a desirable marketing option. (ETSI EN 300 175-7 Ch. A6) ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Kraken, now in server mode
Hi Frank, If you need any help with anything Python/Stackless Python related, just give me a shout. Cheers Cal On Wed, Jul 28, 2010 at 3:57 PM, Frank A. Stevenson fr...@hvitehus.nowrote: Rather than fighting with torrent creation tools, I spent my time writing a TCP/IP server core and bolted it on to Kraken. This means that you can specify a port when starting Kraken, and the program will the go into server mode, and accept incoming connections on the port. I have set an initial limit of 25 clients but more can be added if needed. Currently crack is the only supported command, but I am thinking to add some table selection logic. The next step is to write a front end that takes bitvectors and framecounts and feeds those to 1 or more servers. The front end should also perform the find_kc check on the results. With this setup it should be easy to set up a distributed Kraken network, reducing cracking times dramatically, without resorting to expensive SSD media. Enjoy! Frank ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
[A51] Response from Ettus
Hi guys, I don't know if this information is of any use to anyone, but here is what they said: Cal, Theoretically you can monitor a 60MHz chunk of spectrum, but there are a few limitations to consider: The standard software for USRP1/USRP2 sends samples as 16bit, complex (I/Q) values. For practical purposes, this means the USRP1 can pass 8Msps over USB2 and the USRP2 can pass 25Msps over gigabit ethernet. Those figures translate directly into 8MHz and 25MHz of instantaneous spectrum access respectively. If you want to monitor a wider bandwidth, you would need to use fewer bits per sample. I believe there may be community implementations of 8bits or less per sample, and we are working on our own, but no eta. You are of course free to take the software/fpga code and do this yourself. We do not currently spec frequency switching time (LO lock time) of our daughterboards. It is likely to be substantial fractions of seconds if you need to change the LO on the daughterboard. If you are wanting to do frequency hopping, my suggestion would be to stick within a 60MHz window and then use the DDC to select smaller chunks of the 60MHz to send over the bus from USRP to Host PC. Even better would be to hop within the 8MHz or 25MHz of instantaneous bandwidth on your host pc using the analysis filter bank. Then you could have very fast switching. Jason - Hide quoted text - On Fri, Jul 23, 2010 at 12:57:06PM +0100, Cal Leeming [Simplicity Media Ltd] wrote: Hey, I have been monitoring the progress of the USRP for almost 2 years now, and have finally convinced myself to spend some money on investing in some radio fun! I just wanted to confirm the following points (please excuse me if I have used the wrong terminology!): - In the DBSRX specifications, it states that the software can monitor a channel as wide as 60mhz. Does this mean the accuracy of data or the error probability goes higher, when you increase the channel width? And also, does the resolution suffer greatly by monitoring a wider band? (i.e. if I was to monitor a single 1mhz channel, and then switched to a wide 60mhz channel, would the data be less precise?) - let me know if this question doesn't make any sense! - How quickly is the USRP able to switch frequencies? (From the moment I send a python query, to the point of the daughter board physically switching over) Cheers! -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk © 2010 Simplicity Media Ltd. All rights reserved. Registered company number 7143564 -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
[A51] NVIDIA Tesla C1060 GPGPU
http://www.siliconmechanics.com/i20995 Anyone seen this? Looks quite beefy.. -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
[A51] Reporting in..
Hey all, Just came across this board yesterday... Pretty amazing stuff tbh. I've always taken a really active interest in anything cellular related, however things went a bit stale about a year ago, and I found myself with less and less time available. But now I really want to get back into it again, and therefore volunteering for any duties which would (or could) involved the following: - *anything* python / stackless python related (5+ years experience) - *anything* gsm stack related (might need some time on this one, as it's been a while and my memory is fuzzy!) - *anything* linux/kernel/firmware related (done several kernel/firmware modifications in the past for embedded routers etc) - providing any bandwidth required (around 10-30tb/month) - arranging meet ups in the east/west midlands area of the UK - various other bits.. just ask! :) You'll have to forgive my somewhat limited knowledge of the project so far, but I've put some time aside this weekend to do as much reading as possible on everything you guys have released, and also on the work over at osmocom.org. -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] trasceiver Vs receiver only
The DBSRX does say it can handle a 60mhz wide band, but I don't know how accurate it would be.. And yeah, the amount of data coming back would be insane.. Talking hypothetically here... there's no way you could decode every single one of those data streams on the fly, at least, not without investing some serious cash. Surely it would be better (and probably more fun) to get around the channel hopping problem, rather than just throwing resources at something which is probably overkill for what you're trying to do? I think THC came close, but had some teething issues.. On Fri, Jul 23, 2010 at 1:44 PM, 246...@gmail.com wrote: a WBX 50 MHz to 2.2 GHz Transceiver is sufficient enough for an USRP2 to read the full GSM spectrum ? You can read anywhere _in_ the GSM spectrum. But get it all at once : No way ! To dump the full GSM spectrum, you'd need to bring back : GSM900: 2 * 35 MHz [ 880.0–915 925.0–960 ] (or 1 * 80 MHz) GSM1800: 2 * 75 MHz [ 1710–1785 1805–1880 ] (or 1 * 170 MHz) That's at the minimum 230 MHz of bandwidth split in 4 bands ... The USRP2 is generally accepted as capable of getting 25 MHz of RF bandwidth at once, so you're gonna need something like 10 of them if you want all GSM at once ... (And you're gonna need a hell of a PC as well ... with like 10 gigabits ports and a bunch of cores to decode all that) Sylvain ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51 -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk © 2010 Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Reporting in..
Hey, Probably most of you already seen this, but, for anyone who doesn't already know about this: https://svn.berlin.ccc.de/projects/airprobe/wiki/DeCryption https://svn.berlin.ccc.de/projects/airprobe/wiki/DeCryptionThere's some rather interesting stuff on that page.. Quite detailed too! On Fri, Jul 23, 2010 at 12:33 PM, Cal Leeming [Simplicity Media Ltd] cal.leem...@simplicitymedialtd.co.uk wrote: Hey all, Just came across this board yesterday... Pretty amazing stuff tbh. I've always taken a really active interest in anything cellular related, however things went a bit stale about a year ago, and I found myself with less and less time available. But now I really want to get back into it again, and therefore volunteering for any duties which would (or could) involved the following: - *anything* python / stackless python related (5+ years experience) - *anything* gsm stack related (might need some time on this one, as it's been a while and my memory is fuzzy!) - *anything* linux/kernel/firmware related (done several kernel/firmware modifications in the past for embedded routers etc) - providing any bandwidth required (around 10-30tb/month) - arranging meet ups in the east/west midlands area of the UK - various other bits.. just ask! :) You'll have to forgive my somewhat limited knowledge of the project so far, but I've put some time aside this weekend to do as much reading as possible on everything you guys have released, and also on the work over at osmocom.org. -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. Registered company number 7143564 -- Cal Leeming Operational Security Support Team *Out of Hours: *+44 (07534) 971120 | *Support Tickets: * supp...@simplicitymedialtd.co.uk *Fax: *+44 (02476) 578987 | *Email: *cal.leem...@simplicitymedialtd.co.uk Simplicity Media Ltd. All rights reserved. Registered company number 7143564 ___ A51 mailing list A51@lists.reflextor.com http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Re: [A51] Reporting in..
I've actually been thinking of ways this could be done... Here's some random ideas: - Try and arrange a deal with Ettus Research, in which we could purchase the hardware at a cheaper price for academic based research. - Go to 2600 meetings, and suggest starting up a ccc.de style work shop in your local district, and for everyone to donate towards the hardware. I know this is quite a big thing in Germany, and there is at least one group in the UK which is trying to do the same (see www.fizzpop.org.uk) - Figure out how to build our own boards on the cheap, or build instructions on how to take apart other equipment to provide us with the necessary parts to build a transceiver on all gsm/cdma/utms bands etc. - Apply for a research grant, or an academic grant. (i wouldnt know much about this, but i know fizzpop have done something similar, so might be worth asking them) - Save up! :/ Besides, you gotta remember, that the USRP is a very expensive piece of kit, and just having one might not be enough depending on what you need it for. See Sylvain's earlier post reply for a good explaination about this. Personally, I think it would be a really cool idea to start up work shops which would look primarily at extracting the transceivers out of cheap/unwanted handsets, and putting them to a good use. It would certainly be a lot more fun than just paying for the hardware :) On Sat, Jul 24, 2010 at 1:11 AM, Abdalaleem Andy James Potter ajpot...@youdinar.com wrote: Cal, Can you find any creative way of raising funding for hackers to afford the USRP hardware and boards...? There must be a smart way of doing this... One idea is to have a completely open source GSM phone using the USRP and just free software. Begin forwarded message: *From: *Abdalaleem Andy James Potter ajpot...@youdinar.com *Date: *24 July 2010 01:08:55 BST *To: *discuss-gnura...@gnu.org, openbts-disc...@lists.sourceforge.net *Cc: *Joshua Lackey j...@thre.at *Subject: **Re: [Openbts-discuss] [Discuss-gnuradio] Software mobile phone * Fantastic stuff! On 23 Jul 2010, at 22:26, Joshua Lackey wrote: And leveraging the work from the osmocombb project (http://bb.osmocom.org/trac/) will get you a far ways towards the goal. Quoting John Gilmore (g...@toad.com): Dear All, Do we think it is possible to create a software mobile phone using the USRP, with the OpenBTS code or something else? I mean everything would be in software, plus the USRP? It is absolutely possible. So far I don't know anyone who has tried to do it. The OpenBTS code would give you a big head start. I also think it would be interesting to port the resulting code into a mobile phone. Generally the GSM protocols in a phone are run in a baseband processor separate from the user interface processor. Every phone I know of uses secret, proprietary code running in the baseband processor, even when the user interface is largely free software. Once you had working code running in GNU Radio on a Linux machine, the challenge would be finding a well-documented baseband chip (in which the manufacturer tells you where to find the radio I/O gear on the chip, and how it works, etc). Porting clean GSM code to run in that chip in realtime would require some adaptation to exploit unusual on-chip DSP hardware, mastering an embedded debugging environment, and perhaps shrinking the memory consumption of the GNU Radio-based code. I think it's not only doable, but well worth doing. It should be worth a couple of PhDs at least. You would certainly know the GSM protocols inside and out by the time you were done! John -- This SF.net email is sponsored by Sprint What will you do first with EVO, the first 4G phone? Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first ___ Openbts-discuss mailing list openbts-disc...@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openbts-discuss On 23 Jul 2010, at 12:33, Cal Leeming [Simplicity Media Ltd] wrote: Hey all, Just came across this board yesterday... Pretty amazing stuff tbh. I've always taken a really active interest in anything cellular related, however things went a bit stale about a year ago, and I found myself with less and less time available. But now I really want to get back into it again, and therefore volunteering for any duties which would (or could) involved the following: - *anything* python / stackless python related (5+ years experience) - *anything* gsm stack related (might need some time on this one, as it's been a while and my memory is fuzzy!) - *anything* linux/kernel/firmware related (done several kernel/firmware modifications in the past for embedded routers etc) - providing any bandwidth required (around 10-30tb
