- baseband-devel - lists.osmocom.org

positioning
by Matzi Kratzi 25 Jul '11

25 Jul '11

(In a sort-of-answer to the triangulating mail a while ago:) > i wanted to know is it possible to triangulate any gsm cellphone with osmocombb?? Hi, It would be possible triangulate your own position using osmocombb. Assumption 1 (A1): The base stations of GSM are very stable and can keep running for months or years without interruption. Assumption 2 (A2): Osmocombb has a free running quarter bit counter that it never restarts when power is on. The timings of different cells are calculated relative to this free running counter. To be able to triangulate a phone, we need information about the cells in the area: The GSM TDMA system has a periodicity for broadcasted messages such as sync and SI1. The timing of these can be predetermined as an offset relative to the free running counter in A2. Note that the offset includes the propagation time for the signal from the base station to the mobile station. If the position of the mobile phone with osmocombb (MS) is known, one can get the offset for the first base station broadcasts (dt_BS1). If the MS is moved later to at least three other known positions and the same offsets are calculated, one can calculate the actual offset between the MS free running counter and the BS1 without the propagation time included. At the same time the actual position of the BS is calculated. [1] An MS should do measurements on neighbour cells as well, and can therefor do exactly the same calculations for several BS:s at the same time. An interesting aspect of this is that it is then possible to calculate the difference in timing for several BS:s. If the positions and relative timings for the BS:s in an area are known, it is possible to calculate the position of an MS. This time we do the same calculations, but now the relative timings for the BS:s and the position are known and the same for the MS is unknown. An interesting fact is that osmocombb could use the timings for BS:s from several operators to increase the accuracy of the calculations. Assumption 1 can be held for granted. Assumption 2 could be made true if it is not already true. The concept could probably otherwise be used anyway if that is not accepted. 1 http://en.wikipedia.org/wiki/Multilateration MS Mobile station (phone, modem) BS Base station dt_BSx timing offset from the free running timer to base station number x /Matzi

1 0

Some considerations about IMSI Detach DoS Attack
by Gloria Mazzi 22 Jul '11

22 Jul '11

Hi all, as stated on OsmocomSecurity: "A malicious attacker knowing the IMSI or TMSI of a victim can thus send hand-crafted IMSI DETACH messages to a cell, causing the network to assume the MS is no longer present in the network.This will effectively prevent the delivery of all mobile-terminated (MT) services, such as SMS, voice calls, CSD, ...". Following the theory i've better understood how it works [1]*, but still i have some questions for you: - what could happen if i will clone one SIM (Ki, IMSI) and use it to register on the same network, but on different BTS/LAC, two phones? Which will be rejected as first? Or both? - if i will send an IMSI detach with one of them... also the other (that is phisically in another BTS/LAC) will be disconnected? - what could happen if i will connect a C123 with ./mobile to the network using another SIM and then trying to forge IMSI_DET_IND with victim's IMSI/TMSI and send to the network where the victim is connected (that could mean the same network, but different BTS/LAC), this DoS will still be accomplished? What exactly i would like to know is, if someone already made some experiments on it (obviously on private networks, with a legal experimental license.) and eventually if there are any interesting results. Thank you for attention. Cheers Gloria *[1] - http://www.gsmfordummies.com/gsmevents/detach.shtml

4 5

Telecommunication and Wireless Hacking at CCC CAMP 2011
by Fabio Pietrosanti (naif) 22 Jul '11

22 Jul '11

Hi all, i just wanted to send a summary of all most cool talk that will be at CCC CAMP 2011 related to Telecommunications and Wireless Technologies hacking: Open-source 4G radio - It's time to start WiMAX and LTE hacking http://events.ccc.de/camp/2011/Fahrplan/events/4446.en.html Applied Research on security of TETRA radio - Digital radio technology beyond GSM http://events.ccc.de/camp/2011/Fahrplan/events/4496.en.html GPRS Intercept - Wardriving phone networks http://events.ccc.de/camp/2011/Fahrplan/events/4504.en.html Introduction to Satellite Communications - Installation and Operation of Satellite Systems http://events.ccc.de/camp/2011/Fahrplan/events/4442.en.html Transition Telecom - Telecommunications and networking during energy descent http://events.ccc.de/camp/2011/Fahrplan/events/4459.en.html Anyone missing to the list? -naif

1 1

AW: gpsd and as-needed patches
by Andreas.Eversberg 21 Jul '11

21 Jul '11

hi vlatko, thanx for your patches. i don't have knowledge about gpsd api. before i can apply them, i need to know about gps_waiting() function. the osmo_gpsd_cb() function in common/gps.c is called when there is data to be read from gpsd. this function (like any other function) may not delay or block. (except for the CPU processing time of the function.) if no data is available from gpsd, the function must continue with "goto gps_not_ready;" immidately. what will gps_waiting() do in case there is no (complete) information available? regards, andreas

2 1

gpsd and as-needed patches
by Vlatko Kosturjak 20 Jul '11

20 Jul '11

Hello! Hopefully this is right place to send patches since I don't have access to tracker. I'm sending two patches against latest git version. First one is updating gpsd support since new gpsd have few functions changed: I've #ifdefed each offending function, so you can check each function in configure process or just wrap everything inside same #ifdef, depending on your wish. I have #defined timeout, but it can be done as variable if you think 2000 miliseconds is not good for everybody. Other patch is just quick hack to support --as-needed linker flag, so osmocombb can compile fine on distros which enforce such flag. In order, to read more about flag, read here: http://www.gentoo.org/proj/en/qa/asneeded.xml (In short, order of flags do matter) Hope it helps, -- Vlatko Kosturjak - KoSt

1 0

Is it possible to triangulate cellphone with osmocombb
by Akib Sayyed 18 Jul '11

18 Jul '11

Guys i bit new to osmocombb i wanted to know is it possible to triangulate any gsm cellphone with osmocombb?? -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

Motorola C116 experiment
by Henk 18 Jul '11

18 Jul '11

Hi, I could not resist buying a C116 for 15 euro, so I compiled osmocombb and connected a 3.3V serial cable. Of course the C116 was not in the supported list, but I was hoping it would work as it seems that it is very similar to the C115. Here is my load attempt: (used -m c123 ) but there's no loading of the image. I am not using TX mode, also I don't have a SIM installed. Anything I can try to get it working? ./osmocon -p /dev/ttyS0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin got 1 bytes from modem, data looks like: 00 . got 2 bytes from modem, data looks like: 00 81 .. got 4 bytes from modem, data looks like: 1b f6 02 00 .... got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=16788, hdr_len=4, dnload_le n=16795 got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o Regards, Henk

6 7

AW: GSM 03.22 bug / unreachable code?
by Andreas.Eversberg 18 Jul '11

18 Jul '11

> while using Smatch on layer23, I discovered a potential problem in GSM > 03.22: There is a loop with an if-statement, and there might be missing > curly braces. hi harald, you are right. patch is committed. thanx, andreas

1 0

USB -FTDI 232RL- RS232 Converter
by iBruno 16 Jul '11

16 Jul '11

Hello I am having troubles, to find the decent cable/interface to get this working properly!! I bough converter USB -FTDI 232RLChip- RS232, Converter. IS giving me 6.60v Output.. and I needed 3.3v. Electronically, what can I do, to adjust for the correct Voltage? My phone didn't fry, besides I got connection! when I load the hello world or layer one, is not completing the task! I believe is because of the amount of power. If you know a cable that works decently, let me know :-) Big thanks to whole community.

2 1

GSM 03.22 bug / unreachable code?
by Harald Welte 16 Jul '11

16 Jul '11

Hi Andreas, while using Smatch on layer23, I discovered a potential problem in GSM 03.22: There is a loop with an if-statement, and there might be missing curly braces. Do you think this is the correct way to fix it? diff --git a/src/host/layer23/src/mobile/gsm322.c b/src/host/layer23/src/mobile/gsm322.c index 210215e..766ffbf 100644 --- a/src/host/layer23/src/mobile/gsm322.c +++ b/src/host/layer23/src/mobile/gsm322.c @@ -983,9 +983,10 @@ static int gsm322_a_user_resel(struct osmocom_ms *ms, struct msgb *msg) /* search current PLMN in list */ llist_for_each_entry(plmn_entry, &plmn->sorted_plmn, entry) { if (plmn_entry->mcc == plmn->mcc - && plmn_entry->mnc == plmn->mnc) + && plmn_entry->mnc == plmn->mnc) { plmn_found = plmn_entry; break; + } } /* abort if list is empty */ -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0