Hacker News Reader

Comment by ipunchghosts | Hacker News Reader

Since OpenBTS launched 6 years ago they haven't been secret. All you need is a backpack with an Ettus USRP1, handful a D batteries, and a laptop. Walk into any starbucks, connect your laptop to the wifi and then SIP through Google and voila, you can snoop on everything and no one has any clue.

View on HN

maybe this sounds simple to you, but it probably goes over the heads of 99.99% of people (and i'd venture to say 90% of technical people).

I believe the majority of Hacker News readers could run OpenBTS on an Ettus as a weekend project, provided they had a little systems programming experience. I think the greater problem is expense: an Ettus USRP is into the 4 figures, although you could probably make something similar with the HackRF. [1]

[1] https://greatscottgadgets.com/hackrf/

HackRF is only half-duplex though, so I'm not sure you actually can.

Cellphones are only half duplex too, though.

Didn't know that! Do they switch between transmitting and receiving constantly to keep up a 2-way data stream?

I'm not danellis and I'm not skilled in signals processing, but assuming LTE is multiplexed with TDD, yes. The radio is switched throughout time between receiving and transmission. See https://en.wikipedia.org/wiki/Duplex_%28telecommunications%2... for how TDD works.

I've only worked with GSM, not anything newer, but the phone is assigned a timeslot in a repeating frame, and the uplink and downlink timeslots are offset so that the phone doesn't have to transmit and receive at the same time. As I understand it, that makes the antenna and amplifier design much simpler.

Although now that I've said that, I don't recall what happens when it's using multiple channels for packet data.

True for 2G, but for 3G and 4G most deployments are using full duplex (FDD) where reception and transmissions can happen concurrently and use different frequencies.

The only exception for 3G is China with its TD-SCDMA standard. Everywhere else, 3G is FDD.

For 4G, there is a TDD variant. It's mostly used in China and on some specific high bands (2.3/2.5 GHz around Wifi, 3.5 GHz). But in western countries when one use 4G it's FDD.

Cellphones are half duplex but the basestation is generally full-duplex. A half-duplex basestation could probably handle no more than one cellphone. OpenBTS and YateBTS, as well as most commercial basestations, have design patterns that require tight timing capabilites that in turn lend themselves to running on full-duplex basestations.

Ah, yes, you're right, of course. I don't know why I was thinking of the phone side. (You can use two HackRFs, though.)

OpenBTS and YateBTS need a full-duplex radio to function. So far only Ettus radios and bladeRFs [1] have those capabilities. The bladeRF is also the cheapest option, costing in the low 3 figures (with coupon code HKRNWS). Full-disclosure, I make the bladeRF.

[1] http://nuand.com/bladeRF

What does this mean? Please elaborate, I have a nagging sensation regarding the open digital airwaves.

TL;DR: Basically describing an off the shelf, Stringray

OpenBTS is basically an opensource cell phone tower software stack. You phone supports older protocols for backwards compatibility as you roam. You can instruct your tower to broadcast on an older protocol, like 2G. 2G has this hilarious design flaw that the tower tells the cellphone which tower has the strongest signal. So you claim that you have super amazing signal. 2G's cryptography is broken wide open, worse then DES. So this little cell tower running on a laptop and a digital radio system has just MITM'd your phone (and everyone else) who's network it is impersonating.

I expect/assume this is the general design (which hopefully significant refinement) of most Stringray devices.

> 2G has this hilarious design flaw that the tower tells the cellphone which tower has the strongest signal.

Can't go trusting those handsets now can we?

I'm not sure if this was your point or not, but we can't really trust any handset without an open baseband, of which all of the handsets we use today don't have. As long as we're stuck with proprietary blobs and their secrecy, we can't trust what's in them.

Given the technical skill shown in some of the Snowden leaks, it seems to be all but a given that these blobs are compromised from the factory by three-letter agencies. It's somewhat amusing watching the overt rhetoric of the FBI "crypto war" when the majority of even technical people make far less of a fuss over covert exploitation, which has the dual benefits of being pretty much ubiquitous and plausibly deniable. One NSL to Intel and Qualcomm, or better yet, one call to an executive with the loyalty of a few "patriotic" employees, the secret is safe, and everyone is pwned by default.

It is basically impossible to use a modern computing stack without trusting someone's proprietary blob, and the general population has little to no care about attacks at a level that they really don't understand. That's probably why all the press is on this crypto rhetoric to begin with.

>It's somewhat amusing watching the overt rhetoric of the FBI "crypto war" when the majority of even technical people make far less of a fuss over covert exploitation, which has the dual benefits of being pretty much ubiquitous and plausibly deniable.

Sounds like what John Young said today on cypherpunks mailing list[0] and something I don't see the public nor the all actors involved this "crypto c̶i̶r̶c̶u̶s̶ war" shedding light on soon:

"Kill metadata and other crypto-issue-overdone diversions.

Metadata and other crypto-workarounds resulted from the crypto wars of the 1990s which were bragged to be won rather than faked out.

The fake-out was orchestrated by some of the very same crypto warriors claiming to be against gov-controlled crypto.

A way to identify them is to note who rose to prominence and wealth in crypto com-edu-org. Still at it, ratcheting up the need for ever more crypto, acknowledging the workarounds but, but, but: Let's Encrypt, HTTPS-HTS everywhere, secure drops, freedom of the press and courage foundations, Snowden talks and tweets, FISC amicus curiea, POTUS and TLA advisories, industry lobbyists, dual hats riding the crypto gravy train and more likely, the subway out of sight.

The money and prestige to be gained by working all sides of the crypto phony war is, as Greenwald crows of Omidyar's $250M bribe, irresistable."

[0] https://cpunks.org/pipermail/cypherpunks/2015-December/01125...

I think jaquesm was making a tongue in cheek reference to the thought process of 2g's designers.

Huh? How are legitimate towers even supposed to know what the strongest signal is for a phone in an unknown location surrounded by unknown towers?

Also, do you even need to break any cryptography / MITM, or can you just be your own base station that happens to be called "AT&T"?

I don't have the details in mind but checkout https://en.m.wikipedia.org/wiki/Handoff#Implementations

Since digital, handsets validate the tower they are talking too, this info is stored on sim or device depending on model. So to intercept 2g, there is some work See https://youtu.be/DU8hg4FTm0g

Could this be mitigated w an Android patch that disables 2G entirely? There can be a switch in Settings to reenable (eg when travelling to a country w an old network) but by default your phone should not be so vulnerable.

Reply on news.ycombinator.com