Use hackrf to sniff gsm traffic

Use hackrf to sniff gsm traffic

When my colleague and friend Simon were visiting our zimperium tlv office, we started to learn HackRF and use radio frequencies to sniff unprotected GSM communication traffic. Simon patiently explained to me the meaning of complex plural numbers and explained the interesting places (related reading). Because of reading barrier, I had to follow his steps step by step, after many experiments and error correction, I finally succeeded! This tutorial is based on a period of GSM hacking experiment. I hope it will help you.

Tools used:

Hackrf_kalibrate

Gnuradio-companion

Gr-gsm

Gqrx

Wireshark

Installation requirements:

First, you must ensure that all the software to be installed is installed. you can install most of the software by using the dependency distribution Package Manager, let's start with installing the libraries and tools on which HackRF depends. On the Debian/Ubuntu release, install the tool in the following ways:

sudo apt-get install hackrf libhackrf-dev libhackrf0

After installing these libraries. We can insert HackRF into the USB interface and execute the hackrf_info command. Then we can see:

# hackrf_infoFound HackRF board.Board ID Number: 2 (HackRF One)Firmware Version: 2014.08.1Part ID Number: 0x00574746 0x00574746Serial Number: 0x00000000 0x00000000 0x14d463dc 0x2f4339e1

The next step is to install gnuradio that can decode radio frequency signals and gqrx, a tool that can visually generate radio frequencies. Run the following command:

sudo  apt-get  install  gnuradio gnuradio-dev gr-osmosdr gr-osmosdr gqrx-sdr wireshark

Then execute gr-gsm, And the GnuRadio module will decode the GSM data packets.

sudo apt-get install git cmake libboost-all-dev libcppunit-dev swig doxygen liblog4cpp5-dev python-scipygit clone https://github.com/ptrkrysik/gr-gsm.gitcd gr-gsmmkdir buildcd buildcmake ..makesudo make installsudo ldconfig

Then open the configuration file of gnuradio (~ /. Gnuradio/config. conf), and paste the following:

[grc]local_blocks_path=/usr/local/share/gnuradio/grc/blocks

Finally, install kalibrate-hackrf, which is a tool that can identify GSM Signal Carriers:

git clone https://github.com/scateu/kalibrate-hackrf.gitcd kalibrate-hackrf./bootstrap./configuremakesudo make install

Search for GSM frequency:

In each country, each carrier uses different GSM frequency segments, usually starting from MHz. You can also use hackrf_kalibrate to sniff the frequency you want.

  . /kal  -s GSM900 -g 40 -l 40

The following parameter values are also very important in obtaining some results. When you run kalibrate for a while, you will see output similar to the following:

Now you need to adjust the ('-S') in the GSM parameter to match the local carrier. You can verify the consistency through the list.

Sometimes you want to see the frequency corresponding to the result from hackrf_kalibrate, or use hackrf_kalibrate to calculate the correct frequency (+/-Khz indicates the error mark of each result-these indicate the frequency error range, the frequency is not correct ). Open gqrx and adjust it to the first frequency obtained from hackrf_kalibrate, for example, 940.6 Mhz, and you will see the following picture:

In the above section, we can see that the frequency is floating in the range of 945Mhz.

As long as we know the GSM channel frequency, we can start to execute the python script. /airprobe_rtlsdr.py or load the airprobe_rtlsdr.grc file to gnuradio and set it to the channel frequency you just saw. Do not forget to add the 'gain' parameter value and return to the frequency segment, press the up/down key on the device to adjust the frequency. Each time you press the button, the frequency changes to 200 Khz until you can see the data in the console window. The thumbnail of the process is as follows:

 

Now you only need to execute the following command on another terminal to run wireshark:

sudo wireshark -k -Y 'gsmtap && !icmp' -i lo

If gr-gsm does run successfully, you should be able to see the GSM communication traffic data after sniffing and decoding through HackRF.