Radio Frequency Exploitation using GNU Radio + USRP2: Part 2

Hi folks.
Welcome to part two of this topic.  Picking up from where we left from, we have our USRP + Gnuradio glued together neatly and so where do we go from here?

Well, like I had stated before, the potential for this sort of 'hackery' is incredible and today ill demonstrate just that.

There is no plug and play radio interceptors though some folks have been kind enough to make work easier. Gnuradio is ideally an SDK in itself with loads of libraries which assist one to develop their own fancy tools to play with the radio interface. Also of interest is the GNU Radio Companion which provides an environment to develop your own Flow Graphs and also Flow graph source code. It's pretty neat and I would recommend this site http://gnuradio.org/redmine/projects/gnuradio/wiki/Tutorials for anyone who is starting off with SDR( Software Defined Radio).

GRC comes with examples of basic receivers and transmitters. These include a basic wide band FM receiver (wfm), tv receiver, narrow band FM receivers, etc. Again there are tonnes of material out there on how GNU Radio works coupled with the various sinks included. However, this guy  has some neat implementations which with a bit of tweaking makes signal process programming quite easy.
I borrowed some of his implementations and tweaked them to suite my environment especially for the WFM, NOAA and APT receivers. Please note ill just demo on reception since I dont possess a license to transmit. CCK will be hot on my heels so let's stick to what is publicly available.

This video will show you how with the right antennae and of course with allocated frequency bands well advertised on the CCK website I thought to myself why not? Besides, it simply goes to show that law enforcement communication isn't encrypted and it begs the question why it isn't. Besides, there exist HF encryption technologies to prevent such kind of interceptions like the Project 25(P25 or APCO-25) which is a standard that defines digital radio communication.

In a nutshell, the receiver used in the clip is an FM receiver coupled with the USRP communicating via UHD. Notice the FFT (Full Fourier Transform) and the peak hold indicating the top frequency range for the communication.

 These by the way are different police allotments; Traffic and General Police.

Have fun... see you in Part 3 where we shall look at Air Traffic interception.

-ty

Radio Frequency Exploitation using GNU Radio + USRP2: Part 1

Sorry for the delay. However, Let's dive right into today's subject.

Radio frequencies have been of interest to me ever since I can recall. My interest however died away in the confusion of whether to become a Pharmacist or a renowned hip hop artist but thankfully after growing up, I revisited the passion with renewed interest. This time Open Source had made significant steps towards bringing programmable radio interfaces closer to normal users.

So sometime late last year I dived into GNU radio for the sole purpose of exploring the airwaves. In addition, I also went further to research on how secure GSM networks are using open source implementations and a Motorola C123 phone. This is a topic for another day.
However today I want to present to you just how easy it is to intercept radio frequencies using a software defined radio; the USRP. For more on what the USRP is read on http://en.wikipedia.org/wiki/Universal_Software_Radio_Peripheral.

The USRP isnt a cheap piece of hardware and will set you back a few dollars. However, cost aside, the potential presented are limitless from creating your own FM/AM Transmitter/Receiver, listening in on Law enforcement communication, tracking planes taking off and landing, Satellite image decoding, TV reception.....the list goes on. However, outside these interesting hacks, it is a powerful device for signal analysis and simulations. Given your interests it comes with a plethora of additional daughter boards operating on different frequency ranges. By default it consists of an FPGA board and a DSP which integrates with the software (GNU radio in our instance).

My basic set up includes:

• Laptop with decent processing capability running on Ubuntu 11.0+
• Gigabit ethernet port (my USRP N200 connects via ethernet though other models, B100 connect via USB)
• GNU radio 3.5 and GNU radio companion.
• Lots and lots of caffeine :-)

Here is my overall set up.

Installing GNU radio is straightforward. If  you are on Ubuntu simply run sudo apt-get install gnuradio. On Fedora it should be equally as simple as running sudo yum install gnuradio. I prefer to compile it from the source for some reason so I can specify various parameters but it should install just fine either way. The next step is to grab the uhd driver from the makers of the USRP, Ettus Research. This is described in greater detail on their website 

http://code.ettus.com/redmine/ettus/projects/uhd/wiki/UHD_Linux

Once you have all the dependencies installed, there is the bit where you connect your USRP to your laptop. Again, my device connects via the UHD driver and therefore you need to install the right image for your hardware. Be careful not to brick your device though there is a way to recover. Instructions to do this are described here http://files.ettus.com/uhd_docs/manual/html/usrp2.html

Once all this is done, you should be in a position to connect to your device and get on with the interesting part which is hacking radio frequencies.

Ill detail how we achieve this in Part 2 of this tutorial.

Cheers and happy hacking.

-ty

Lo and Behold, the beast awakens

Well, I knew I would cave in after all this time. Had to share the knowledge with the rest of the world far as Information Security is concerned.

Here is the deal. What I post here is definitely a niche subject which could interest the 'experts', newbies, usual Internet pedestrians, ardent followers and ofcourse Google bots :-)

Nonetheless, I do welcome any feedback in whatever form. Flaming will not be tolerated, comments could go unanswered based on a diverse number of reasons but one thing is for sure, this wont be a perfect repository for Information Security posts. I need your help to make it one of the best.

My posts will definitely step on some toes, law enforcement perhaps but ill try my best not to irk anyone and if I do, sorry in advance. That's the last time an apology will come your way so make good use of it.

Conclusion, I have fun doing what I do. Anything InfoSec related will appear here ( Im talking of anything within the TCP/IP realm, Radio Frequency Spectrum hacks (anything that emits a radio frequency like your cell phone or radio call, some satellite communication equipment etc.)

As always, it is all intended for educational/knowledge purposes so if you are foolish enough to go trying this out and you are busted don't go pointing fingers at my blog. You have been put on notice.

That's it for now.

First post comes up tomorrow.