Software Radio / OpenBTS - The Well Tempered Hacker Ep 4

[how367]

Base on theory, one could use this as A 911 service on their cell, the cell would connect to this then this could connect to emergency radio frequency that is in the area if the power goes out & this could be connected to A car battery or solar, and the also need to be connected to A packet note to send location

[Dusty696969]

can you use this to listen in on GSM broadcast. Like listening to cell phone conversations? Also is this legal to own in the U.S. I seen other similar software radios that can intercept GSM signals and can listen to GSM broadcast. If this is legal in the U.S. where can you buy these?

[anders94]

@Dusty696969 Yes, you can listen but no you can't understand it - GSM transmissions are encrypted. However, if you run your own BTS and handsets decide to camp to that, you obviously have access to calls that way. It is legal to buy these in the US, but it generally isn't legal to run them on public frequencies. As with any transmitter in licensed frequencies, you need to check with the FCC and make sure you comply with regulations. The URL where you can get these is in the description.

[Dusty696969]

@anders94 Thanks

[lazerusmfh]

@anders94. REALLY COOL VIDEO. Can i offer one small suggestion, please eliminate the words "um, ah and uhh" if at all possible. It will improve your speaking as a bonus. :) REALLY cool videos again, i must say.

[smashthestack]

Great video :) Thanks a bunch

[nitestick89]

Subscribed, great vid :D

[gauravpride1985]

Which programming language is used to program this device and what is specification of the development board.

[anders94]

@gauravpride1985 Using gnu radio, you build flowchart-like programs visually that get compiled and sent to the FPGA on the radio. The most common non-visual way to do the same thing is based in python, so I suppose this is the direct answer to your first question. The development daughterboards I use here are defined here: ettus.com/downloads/ettus_daug­hterboards.pdf

[anders94]

@syirrus depends on the radio board you use. I get about 2 blocks with mine but in theory you can go 35km.

[syirrus]

What is the transmit range of setting up a BTS?

[dxtbot]

o got some cool software made for ,,LOL testing ,, gsm card emulator ,, a real nice one , i almost fixed al sim routines , and also the USIM , , maybe you like 2 test it on your openBTS server ,,you can change everthing ,, IMSI Ki Kc HPLM PLM LAC , SMS everthing implemted ,, i Used it for Ki scanning ,, wrong aproach people ,, dont krack Ki codes , use imsi , 16 byte of

Ki code , random these 255 times 16 bytes , like a old turning lock , not 4 digits , but 16 bytes digit ,

[dxtbot]

@dxtbot and imsi number is a number , there are more phones and imsi numbers you test , i tested a lot of this shit years ago , this is old stuff , for me , dont to forget 2 change IMEI , every 5 atacks ,, LOL

[linagee]

Did you have to pay yourself $0.20 when you sent a text to yourself? LOL. :-)

[dxtbot]

@anders94 its a 3g cdma usb modem ,uses a sim in usb dongle , i wil try to get one ,an /dev/usb/ dump , and look wat i wil find , , hmms looks like a fake hacke , some guy with some money buying pre build stuff , hmms thats some easy ,shit , and for al the real hackers here , this kind of people do research ,and publish stuff , and help protecting , thats the reason why MagiqSim9in1not work lol and we can not clone SIM cards ,Comp128 V1 . yes and yes whe need Ki codes ,but they not share

[anders94]

Here's a parts list for the project demonstrated in this video. Keep in mind this is overkill for just what I am doing.

From Wherever:

1 x MacBook Pro $??? (using Linux here would definitely be easier)

2 x Nexus One phones $??? (you can use any GSM phone)

from ettus.com:

1 x UN210-KIT $1700

1 x WBX $450

2 x VERT900 $35/per

You can substitute the lower-cost UN200-KIT or even the UB100-KIT for $650. The E100 series includes an embedded Linux machine but will only drive 1 phone call at a time.

[dxtbot]

can't we use a Huwei usb stick for this shit ,???

[anders94]

@dxtbot I've never heard of it so I'd guess no.

[sexyjan4u21]

thank you for your hacking help, you are a good teacher

[digilk]

hii ,

I have installed gnuradio+uhd

but when i type the command uhd_find_devices..

it shows No devices found..

could you help me with that

[anders94]

@digilk Make sure you have a direct connection from your n210 to your computer - use a cross cable if your computer's ethernet port doesn't auto-cross - and put any static address (192.168.1.10 for example) on your linux machine so the interface is marked up.

[digilk]

@anders94  Right now I am using an ethernet cable to connect n210. I have changed eth0 to 192.168.10.1(though the default ip for n210 is 192.168.10.2). still same error..... did my compilation went any wrong..

If I make any success to make n210 run along with openbts(although you have done this :) ). I would like it to perform the same in a pandaboard a smaller processor.

awaiting your reply..

[digilk]

do this installation require a particular version of ubuntu???

[anders94]

@digilk No, but I'm sure the newer the better. I don't use Ubuntu for this so I don't know.

[digilk]

@anders94 thanks

[swedishvolvo]

So since these two phones are corrected to your base station they would not be able to make calls to other phones outside of your network right?

[anders94]

@swedishvolvo Right, unless I connected Asterisk to other phones or a VoIP provider.

[swedishvolvo]

@anders94 but once you route the calls through another phone the number will appear as if it's coming from your phone and not the main callers phone number correct?

[anders94]

@swedishvolvo No, you don't make calls to the public phone network through another phone. A VoIP provider presumably gives you phone numbers which you assign to handsets and then they make calls through the OpenBTS setup which connects to Asterisk on the host computer which connects to your VoIP provider.

I hadn't assumed "other phones" in your original post meant the public telephone network only.

[digilk]

hii Anders...

Nice work.. I have a n210 with me and i have a ubuntu platform. Could you please give me the installation steps to make n210 working..

[anders94]

@digilk A good place to start is gnuradio.org/redmine/projects/­gnuradio/wiki/OpenBTSUHD

[digilk]

@anders94 Thanks... I have installed openbts using the script which will install uhd as well. but still no scope... anyway I'll try my best..

[mrafiq26]

hi anders, can we configure usrp2 as BTS just as you did for N210?

[anders94]

@mrafiq26 Yes, the USRP2 will work as well.

[mrafiq26]

@anders94 I have usrp2 and WBX(Rev 2) boards and installed gnuradio 3.4.1 on fedora 15.

Is there a guide to follow and test openBTS working?

My major work is to implement selection algorithms using SDR,

hope above work I chose will help me know how to use usrp2 well for my purpose

Thanks very much!!

[anders94]

@mrafiq26 Google for a PDF called "OpenBTS for Dummies". That's probably the best non-uhd guide to start with.

[athosuk]

hello Anders, did you have to buy any extras to get a rig like this?

[anders94]

@athosuk Nope, just the radio, the antennas and the WBX boards that run in the cellular frequencies.

[athosuk]

@anders94 ahh, so the UN210-KIT for $1700 wont come with the cellular capabilities?

[anders94]

@athosuk Correct. The deal is you buy a N210 (essentially the FPGA) and you get a radio transmit / receive board and antennas that work within the bands you need. (for GSM, usually 850Mhz, 900Mhz, 1.8Ghz or 1.9Ghz) The radio board I got for my N210 was the WBX which gives you 50Mhz - 2.2Ghz at 100mw. I also have the RFX900 in my two E100s which only cover 800Mhz - 1Ghz but transmit at 200mw.

Obviously you will also need a computer to run OpenBTS!

[hazirafel]

thanks! cool!

[010675dario]

Hi Anders,

12 calls is not to much! Is it possible to have more concurrent calls with more ARFCN configured in openbts or have more usrp units working as a single cell/entity???

[anders94]

@010675dario You would have to use more USRPs to get more concurrent calls. Of course as soon as you have more than one USRP, clock differentials become a problem so you'll probably also want to use an external clock. Fortunately, Ettus hardware supports reference clock inputs as well as MIMO operation.

[010675dario]

Hello Anders!

Have you any idea on how many concurrent calls can handle the N210 with Asterisk with openbts configuref with one ARFCN?

Best regard,

Dario

[anders94]

@010675dario Up to 7 because that's how many calls you can get in the spectrum the radio tunes to. Its a limit of the GSM spec.

[awm129]

@anders94 With half rate traffic channels you could support 14. Anders mentions he could support 20 before CPU loading becomes an issue but he'd never get that high with only one usrp.

[010675dario]

So if i understand well, with this N210 USRP there is no need to disable the internal clock and use an external 52 MHz clock like the USRP1???

[anders94]

@010675dario That's correct. The only reason you should need an external clock is if you wanted to coordinate a number of devices or use the device you have in conjunction with a public network.

[010675dario]

Hello Anders, thank you very much for your quick reply. My main purpose to use usrp+gnuradio is with openbts. Months ago i purchased a usrp1 with+2wbx. I was unable to find in the local market the "infamous" 52MHz cristal clock. I purchased a lot from a provider in China but they did not work properly on my usrp, i was just able to scan the gsm bts antennas around me, but unable to register my unlocked handset to my openbts cell.

[010675dario]

Eventually i solved the problem using the clocktamer external clock purchased at the Fairwaves e-commerce website.

[zakinen]

@anders94 Is this applicable to USRP2?

[engahmed1990]

Thank you very much .........can i build usrp by my self or it will be difficult ???????

[anders94]

@engahmed1990 If you know Linux well, it is do-able. But this isn't a simple project unfortunately.

[davidstvz]

Is there a recommended place for tutorials on the USRP(1)? The pages I'm looking at are badly out of date (using build_fg instead of top_block and mc4020 FM tuner example doesn't work).

[anders94]

@davidstvz Google for the "OpenBTS for Dummies" PDF.

[gabrielflautista]

Thank you very much for posting this @anders94,

how did you make to use the OpenBTS with USRP2?

[anders94]

@gabrielflautista I'm not using a USRP2 here - the N210 is a UHD device. I compiled OpenBTS on a Mac and drive the N210 via Ethernet. I wouldn't suggest trying to use a Mac unless you really know what you are doing. Using a Linux machine would be better to start with.

[gabrielflautista]

@anders94 huuum... I see,

at college I'm working on a project that one of the main goals is to work OpneBTS with our USRP2,

and we're having some trouble on finding OpenBTS codes for USRP2, well... thanks anyway :)

[anders94]

@gabrielflautista OpenBTS works fine with the USRP / USRP2 radios - that is supported in the main codebase. Support for the UHD interface is less common and AFAIK only supported in Thomas Tsau's openbts-uhd git repo.

[gabrielflautista]

@anders94 but at the OpenBTS wiki page, says that the project only suports USRP and all other devices uses UHD (I thought that USRP2 was included)

[greatJeaorb]

Thanks for posting this....fantastic! I read that a license is not needed in this band because the transmit power is below a certain threshold. Is it true that this is kosher fcc-wise?

[anders94]

@greatJeaorb It depends. You need to check with the FCC to make sure you are compliant in your area. The power is low (and can be turned down even more with a software setting) so it is usually OK but you have to make sure. In the end, you are responsible for making sure you aren't breaking the law!

[smawis]

hi anders, thank you one more time for those interesting videos, please tell me if we can make calls between your openbts network and an external network like a provider ? how it works behind ? i mean the billing ? ... it's a good subject of research and internship at university i will talk about this with my teachers ! please have you a tutorial writen for this demonstration ?

[anders94]

@smawis Yes you can make calls to the standard telephone network. All you need is some VoIP connection to it. Think of OpenBTS as a GSM to SIP gateway so if you pair it with Asterisk that is already on the PSTN, you can just use GSM handsets instead of VoIP phones and make calls / receive calls. I have OpenBTS also going with FreeSWITCH which functions similarly.

I don't have docs but there are resources in the net that are reasonably good.

Best of luck on your research.

[smawis]

@anders94 Thank you very much Anders ^^

[whyteks]

Nice video Anders, you show it all working, as you say - if you set it up right.

Are you using the UHD version of OpenBTS there without gnuradio?

You mention some of the issues with the handsets internal clocks, but did you have any of these notorious clocking problems that happen with the USRP1 with it's default clock, or would you say the N210 + WBX board is a working solution out of the box?

[anders94]

@whyteks I'm using Thomas Tsou's OpenBTS-UHD repo on github so no GNURadio for the BTS stuff:

github.com/ttsou/openbts-uhd.g­it

Of course the FM radio and frequency sweep demos are GNURadio. (gnuradio-companion for that)

I'd say the clock that comes with the N210 and the E100 I also have here work perfectly right out of the box. An N210 + WBX + antenna should be all the gear you need with a Linux box (or Mac in my case) to have a great working setup.

[whyteks]

@anders94 Thanks Anders! I have read that there were issues using the USRP1 and one daughterboard - the RFX900 or 1800. The issues were to do with TX/RX channel isolation. so the recommended configuration with that box now is two daughterboards, one TX and one for RX. Do you know if the WBX would suffer the same problem?

[anders94]

@whyteks I'm sure separate boards would be better but the WBX is sufficiently isolated. I haven't had a problem yet.

[whyteks]

@anders94 Anders, Thanks so much for responding to me here, I'm sorry to bombard you with questions, but you're the only person I've found who actually has one of these things, and as I'm about to shell out nearly $2.5K, actually, about to recommend that someone else does, which is worse!.. I have another question. were you able to get your phones to camp to your openBTS and then go back to their home net and then camp to openBTS again without a cold restart?

[anders94]

@whyteks Yes, on the Nexus One it does. In fact I have a T-Mobile SIM in one of the phones. I can pick my test network, camp to it and then shut down the network and then just pick T-Mobile and it camps there without a restart. After you have done this once, the phone sees my test network as a preferred network and I don't even have to select it.

On other phones, things may not be so simple - camping is up to the phone, not the BTS.

[whyteks]

@anders94 Yes camping is up to the phone, and most if not all phones have an easy network selection process. but as you explain so well, if the USRP clock is well off, after a cold boot and camping to openBTS, the phone may not be able to find it's home network without a reset. It's interesting your Nexus see's your BTS as preferred, as that's NOT actually something that I would want. I think I will get the GPS Kit anyway.

[anders94]

@whyteks Yes, get the GPS kit if you can. I don't have skew enough in my clock to require cold boot but who's to say you won't too? GPS is the best way to be sure.

I wouldn't think the Nexus One would connect to a test network (yes, I'm running a test network in a test country) but I wouldn't have expected it to reconnect automatically when a "real" network was also available. Seems handsets tend to ignore the test flags and happily camp away! Almost can't count how many foreign IMSIs camp!

[whyteks]

@anders94 Wow - is this just with the WBX board and those VERT900 antennas in your lab? You must be getting a fairly decent signal out of it then.

[anders94]

@whyteks Yup, that's it. In fact to get it to work reliably, I typically put the transceiver in the next room because it is so strong.

[whyteks]

@anders94 Probably a good idea to stay away from it if you can.