Analyze and Crack GSM Downlink with a USRP

A fairly-well documented article has already been written about this for RTL-SDRs. But what about the USRP folks out there? The article’s cited files to use are even RTL-SDR geared. The easy response to that would be to suck it up, and purchase an RTL-SDR dongle. Well, you would be mistaken. Not every location has GSM bands that fall under 1.7GHz (specifically 850MHz for AT&T and T-Mobile). In some locations, CDMA rides on these bands. This can be a bit frustrating. Well, look no further than here. Fire up your USRP (read: HackRF, BladeRF, USRP, etc.) and follow the directions for the RTL-SDR here and stop at the point where it asks you to load their cfile for testing.

From here on out, follow these directions.

  1. Find out where GSM is transmitting on a non-hopping frequency. For me, this is 1.9826GHz. Now, determine your gain necessary to receive GSM correctly. This depends on your antenna and device, so you may need to tweak this a bit before airprobe starts receiving data. 34 worked well for my setup. We will also record at a sample rate of 1,000,000 (1e6).
  2. Load wireshark in another tab and set it to listen on lo and use the filter gsmtap.
  3. cd airprobe/gsm-receiver/python/src/
  4. ./gsm_receive_rtl.py -f 1982600000 -s 1e6 -g 34
  5. A GNURadio FFT will appear. This will give us a good idea if the signal is strong and working with airprobe. Mess with the gain and click on the center of the peak each time you alter the gain. You should see a wave of hex absorb your terminal session when you hit the right spot, as well as in wireshark.
  6. To record this for cracking, execute the command below:
  7. uhd_rx_cfile –samp-rate=1.0e6 -f 1982600000 -g 34 /location/of/file/to/save/gsmRX.cfile
  8. Download and install pytacle; you will also need kraken and the kraken rainbow table for pytacle to work
  9. Pytacle should be pretty straight forward. Follow his YouTube video for more guidance, but all you need to do is point to the full directory and file location of each field found within the Properties section of the application. After that, you will have a cracked GSM session!

GSMEverythingGoing

Posted in Uncategorized | Leave a comment

GNU Radio Companion: Blind Replay Attack with a USRP

Replay attacks are probably the most rewarding tests to perform with a software defined radio — instant gratification (that is, if it works). No need to know the modulation, baud rate, deviation, frequency — well, you definitely need to know the frequency. You get the idea. From a post I submitted a while back with replaying a wireless outlet switch, it took a bit of work. But this is not always necessary, especially if your end-goal is simple replay, and not crafting of custom packets.

Given the aforementioned blog post, I was able to replay the signal for the wireless outlet switch and execute a simple “on” and “off” command (replaying the same command while the device is off, turns it on, and vice-versa). With the power of a USRP (if you can manage to buy one and make it stably work with GNU Radio, good for you), one is able to replay messages recorded by the USRP.

To record a message, one needs to know the frequency, bandwidth, and an educated guess at the appropriate gain (depends on your setup), are all necessary. Below is an example of a flow graph to be used for the recording piece. The source is the radio that is capable of RX, and the sink is the file we will write. We record and write in complex-float (aka complex). We do not need to demodulate, as it will replay as the file is.

radioTX

To replay this content, we simply point to the source file and direct this to our now sink, which is a radio capable of TX/RX. We keep all of the previously recorded variables the same, otherwise the radio will have a spasm and our results will not be desirable.

radioRX

Good luck and have fun!

Posted in Uncategorized | Leave a comment

X Gon’ Give it to Ya: Transmitting FM Radio Over the Air Waves

Who out there misses all of the dog barking, grunting, and terms of endearment toward women provided by our beloved DMX? Something tells me that he is missed on our radio waves. With this brief entry, I will quickly breeze through showing how you can broadcast DMX one more time in your neighborhood (if your country allows for this, of course — this experiment was done at low db…).

I’m still learning how to use GnuRadio Companion (GRC), but I thought it would be of use to share this with the community, those that wish to have a bit of instant gratification with their newly acquired [HackRF, BladeRF, Ettus, etc.] and freshly compiled GRC on their nix VM. Below is a screenshot of my GRC setup along with the GRC file thereafter. The file source (as you can see in the screenshot below) had to be down-sampled at a rate of 16bit in order for GRC to be able to broadcast the audio file. I have it on loop, and the signal to transmit this onto can be adjusted with a slider. This setup is for an Ettus B100. However, with some minor tweaking, this should work on the previously mentioned TX/RX devices.

To modify your audio file, install ‘sox’ along with any libraries needed for whatever file you are handling. If handling an MP3 file, search for libsoxmp3 (or something to that effect). For the file in question, I ran:

sox DMX\ -\ What\'s\ My\ Name.mp3 -b 16 dmx_whats_my_name.wav

That’s it! Now your neighborhood will thank you for rejuvenating a lost art and making it available to everyone, once again.

fm_tx_dmx

grc_fm_tx_screenshot

 

<?xml version='1.0' encoding='ASCII'?>
<flow_graph>
  <timestamp>Sat Mar  1 18:34:25 2014</timestamp>
  <block>
    <key>options</key>
    <param>
      <key>id</key>
      <value>top_block</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>title</key>
      <value></value>
    </param>
    <param>
      <key>author</key>
      <value></value>
    </param>
    <param>
      <key>description</key>
      <value></value>
    </param>
    <param>
      <key>window_size</key>
      <value>1280, 1024</value>
    </param>
    <param>
      <key>generate_options</key>
      <value>wx_gui</value>
    </param>
    <param>
      <key>category</key>
      <value>Custom</value>
    </param>
    <param>
      <key>run_options</key>
      <value>prompt</value>
    </param>
    <param>
      <key>run</key>
      <value>True</value>
    </param>
    <param>
      <key>max_nouts</key>
      <value>0</value>
    </param>
    <param>
      <key>realtime_scheduling</key>
      <value></value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(10, 10)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>notebook</key>
    <param>
      <key>id</key>
      <value>notebook</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>style</key>
      <value>wx.NB_TOP</value>
    </param>
    <param>
      <key>labels</key>
      <value>['tab0', 'tab1', 'tab2',]</value>
    </param>
    <param>
      <key>grid_pos</key>
      <value>0,0,1,1</value>
    </param>
    <param>
      <key>notebook</key>
      <value></value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(19, 565)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>wxgui_fftsink2</key>
    <param>
      <key>id</key>
      <value>wxgui_fftsink2_0</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>type</key>
      <value>complex</value>
    </param>
    <param>
      <key>title</key>
      <value>Signal after Low Pass Filter to USRP</value>
    </param>
    <param>
      <key>samp_rate</key>
      <value>250000</value>
    </param>
    <param>
      <key>baseband_freq</key>
      <value>0</value>
    </param>
    <param>
      <key>y_per_div</key>
      <value>10</value>
    </param>
    <param>
      <key>y_divs</key>
      <value>10</value>
    </param>
    <param>
      <key>ref_level</key>
      <value>50</value>
    </param>
    <param>
      <key>ref_scale</key>
      <value>2.0</value>
    </param>
    <param>
      <key>fft_size</key>
      <value>1024</value>
    </param>
    <param>
      <key>fft_rate</key>
      <value>30</value>
    </param>
    <param>
      <key>peak_hold</key>
      <value>False</value>
    </param>
    <param>
      <key>average</key>
      <value>False</value>
    </param>
    <param>
      <key>avg_alpha</key>
      <value>0</value>
    </param>
    <param>
      <key>win</key>
      <value>None</value>
    </param>
    <param>
      <key>win_size</key>
      <value></value>
    </param>
    <param>
      <key>grid_pos</key>
      <value>0,0,1,1</value>
    </param>
    <param>
      <key>notebook</key>
      <value>notebook,2</value>
    </param>
    <param>
      <key>freqvar</key>
      <value>None</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(859, 302)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>variable</key>
    <param>
      <key>id</key>
      <value>samp_rate</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>value</key>
      <value>44.1e3</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(29, 470)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>notebook</key>
    <param>
      <key>id</key>
      <value>notebook2</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>style</key>
      <value>wx.NB_TOP</value>
    </param>
    <param>
      <key>labels</key>
      <value>['tab1',]</value>
    </param>
    <param>
      <key>grid_pos</key>
      <value>1,0,1,1</value>
    </param>
    <param>
      <key>notebook</key>
      <value></value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(178, 565)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>variable_slider</key>
    <param>
      <key>id</key>
      <value>usrp_gain</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>label</key>
      <value></value>
    </param>
    <param>
      <key>value</key>
      <value>15</value>
    </param>
    <param>
      <key>min</key>
      <value>0</value>
    </param>
    <param>
      <key>max</key>
      <value>20</value>
    </param>
    <param>
      <key>num_steps</key>
      <value>100</value>
    </param>
    <param>
      <key>style</key>
      <value>wx.SL_HORIZONTAL</value>
    </param>
    <param>
      <key>converver</key>
      <value>float_converter</value>
    </param>
    <param>
      <key>grid_pos</key>
      <value></value>
    </param>
    <param>
      <key>notebook</key>
      <value>notebook2,0</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(887, 574)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>variable_slider</key>
    <param>
      <key>id</key>
      <value>input_level</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>label</key>
      <value>Signal Input Level</value>
    </param>
    <param>
      <key>value</key>
      <value>0.9</value>
    </param>
    <param>
      <key>min</key>
      <value>0</value>
    </param>
    <param>
      <key>max</key>
      <value>10</value>
    </param>
    <param>
      <key>num_steps</key>
      <value>1000</value>
    </param>
    <param>
      <key>style</key>
      <value>wx.SL_HORIZONTAL</value>
    </param>
    <param>
      <key>converver</key>
      <value>float_converter</value>
    </param>
    <param>
      <key>grid_pos</key>
      <value>0,0,1,37</value>
    </param>
    <param>
      <key>notebook</key>
      <value>notebook2,0</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(365, 559)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>audio_sink</key>
    <param>
      <key>id</key>
      <value>audio_sink_0_0</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>samp_rate</key>
      <value>44100</value>
    </param>
    <param>
      <key>device_name</key>
      <value></value>
    </param>
    <param>
      <key>ok_to_block</key>
      <value>True</value>
    </param>
    <param>
      <key>num_inputs</key>
      <value>1</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(798, 44)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>blks2_wfm_tx</key>
    <param>
      <key>id</key>
      <value>blks2_wfm_tx_0</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>audio_rate</key>
      <value>62500</value>
    </param>
    <param>
      <key>quad_rate</key>
      <value>250000</value>
    </param>
    <param>
      <key>tau</key>
      <value>75e-6</value>
    </param>
    <param>
      <key>max_dev</key>
      <value>75e3</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(384, 191)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>wxgui_fftsink2</key>
    <param>
      <key>id</key>
      <value>wxgui_fftsink2_1</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>type</key>
      <value>float</value>
    </param>
    <param>
      <key>title</key>
      <value>Signal before WBFM</value>
    </param>
    <param>
      <key>samp_rate</key>
      <value>62500</value>
    </param>
    <param>
      <key>baseband_freq</key>
      <value>0</value>
    </param>
    <param>
      <key>y_per_div</key>
      <value>10</value>
    </param>
    <param>
      <key>y_divs</key>
      <value>10</value>
    </param>
    <param>
      <key>ref_level</key>
      <value>50</value>
    </param>
    <param>
      <key>ref_scale</key>
      <value>2.0</value>
    </param>
    <param>
      <key>fft_size</key>
      <value>1024</value>
    </param>
    <param>
      <key>fft_rate</key>
      <value>30</value>
    </param>
    <param>
      <key>peak_hold</key>
      <value>False</value>
    </param>
    <param>
      <key>average</key>
      <value>False</value>
    </param>
    <param>
      <key>avg_alpha</key>
      <value>0</value>
    </param>
    <param>
      <key>win</key>
      <value>None</value>
    </param>
    <param>
      <key>win_size</key>
      <value></value>
    </param>
    <param>
      <key>grid_pos</key>
      <value>0,0,1,1</value>
    </param>
    <param>
      <key>notebook</key>
      <value>notebook,0</value>
    </param>
    <param>
      <key>freqvar</key>
      <value>None</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(199, 350)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>gr_multiply_const_vxx</key>
    <param>
      <key>id</key>
      <value>gr_multiply_const_vxx_0</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>type</key>
      <value>float</value>
    </param>
    <param>
      <key>const</key>
      <value>input_level</value>
    </param>
    <param>
      <key>vlen</key>
      <value>1</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(491, 74)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>blks2_rational_resampler_xxx</key>
    <param>
      <key>id</key>
      <value>blks2_rational_resampler_xxx_0</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>type</key>
      <value>fff</value>
    </param>
    <param>
      <key>decim</key>
      <value>441</value>
    </param>
    <param>
      <key>interp</key>
      <value>625</value>
    </param>
    <param>
      <key>taps</key>
      <value>[]</value>
    </param>
    <param>
      <key>fractional_bw</key>
      <value>0</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(80, 198)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>wxgui_fftsink2</key>
    <param>
      <key>id</key>
      <value>wxgui_fftsink2_1_0</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>type</key>
      <value>complex</value>
    </param>
    <param>
      <key>title</key>
      <value>Signal after WBFM</value>
    </param>
    <param>
      <key>samp_rate</key>
      <value>250000</value>
    </param>
    <param>
      <key>baseband_freq</key>
      <value>0</value>
    </param>
    <param>
      <key>y_per_div</key>
      <value>10</value>
    </param>
    <param>
      <key>y_divs</key>
      <value>10</value>
    </param>
    <param>
      <key>ref_level</key>
      <value>50</value>
    </param>
    <param>
      <key>ref_scale</key>
      <value>2.0</value>
    </param>
    <param>
      <key>fft_size</key>
      <value>1024</value>
    </param>
    <param>
      <key>fft_rate</key>
      <value>30</value>
    </param>
    <param>
      <key>peak_hold</key>
      <value>False</value>
    </param>
    <param>
      <key>average</key>
      <value>False</value>
    </param>
    <param>
      <key>avg_alpha</key>
      <value>0</value>
    </param>
    <param>
      <key>win</key>
      <value>None</value>
    </param>
    <param>
      <key>win_size</key>
      <value></value>
    </param>
    <param>
      <key>grid_pos</key>
      <value>0,0,1,1</value>
    </param>
    <param>
      <key>notebook</key>
      <value>notebook,1</value>
    </param>
    <param>
      <key>freqvar</key>
      <value>None</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(438, 303)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>low_pass_filter</key>
    <param>
      <key>id</key>
      <value>low_pass_filter_0</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>type</key>
      <value>fir_filter_ccf</value>
    </param>
    <param>
      <key>decim</key>
      <value>1</value>
    </param>
    <param>
      <key>interp</key>
      <value>1</value>
    </param>
    <param>
      <key>gain</key>
      <value>low_pass_gain</value>
    </param>
    <param>
      <key>samp_rate</key>
      <value>250000</value>
    </param>
    <param>
      <key>cutoff_freq</key>
      <value>100e3</value>
    </param>
    <param>
      <key>width</key>
      <value>10e3</value>
    </param>
    <param>
      <key>win</key>
      <value>firdes.WIN_HAMMING</value>
    </param>
    <param>
      <key>beta</key>
      <value>6.76</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(639, 220)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>variable_slider</key>
    <param>
      <key>id</key>
      <value>low_pass_gain</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>label</key>
      <value></value>
    </param>
    <param>
      <key>value</key>
      <value>0.9</value>
    </param>
    <param>
      <key>min</key>
      <value>0</value>
    </param>
    <param>
      <key>max</key>
      <value>1</value>
    </param>
    <param>
      <key>num_steps</key>
      <value>100</value>
    </param>
    <param>
      <key>style</key>
      <value>wx.SL_HORIZONTAL</value>
    </param>
    <param>
      <key>converver</key>
      <value>float_converter</value>
    </param>
    <param>
      <key>grid_pos</key>
      <value></value>
    </param>
    <param>
      <key>notebook</key>
      <value>notebook2,0</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(728, 568)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>gr_wavfile_source</key>
    <param>
      <key>id</key>
      <value>gr_wavfile_source_0</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>file</key>
      <value>/root/Desktop/dmx_whats_my_name.wav</value>
    </param>
    <param>
      <key>repeat</key>
      <value>True</value>
    </param>
    <param>
      <key>nchan</key>
      <value>1</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(28, 104)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>variable_slider</key>
    <param>
      <key>id</key>
      <value>freq_selection</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>label</key>
      <value>Frequency Selection to Transmmit</value>
    </param>
    <param>
      <key>value</key>
      <value>93e6</value>
    </param>
    <param>
      <key>min</key>
      <value>85e6</value>
    </param>
    <param>
      <key>max</key>
      <value>130e6</value>
    </param>
    <param>
      <key>num_steps</key>
      <value>100</value>
    </param>
    <param>
      <key>style</key>
      <value>wx.SL_HORIZONTAL</value>
    </param>
    <param>
      <key>converver</key>
      <value>float_converter</value>
    </param>
    <param>
      <key>grid_pos</key>
      <value>1,0,1,37</value>
    </param>
    <param>
      <key>notebook</key>
      <value>notebook2,0</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(541, 562)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <block>
    <key>uhd_usrp_sink</key>
    <param>
      <key>id</key>
      <value>uhd_usrp_sink_0</value>
    </param>
    <param>
      <key>_enabled</key>
      <value>True</value>
    </param>
    <param>
      <key>type</key>
      <value>fc32</value>
    </param>
    <param>
      <key>otw</key>
      <value></value>
    </param>
    <param>
      <key>stream_args</key>
      <value></value>
    </param>
    <param>
      <key>dev_addr</key>
      <value></value>
    </param>
    <param>
      <key>sync</key>
      <value></value>
    </param>
    <param>
      <key>clock_rate</key>
      <value>0.0</value>
    </param>
    <param>
      <key>num_mboards</key>
      <value>1</value>
    </param>
    <param>
      <key>clock_source0</key>
      <value></value>
    </param>
    <param>
      <key>time_source0</key>
      <value></value>
    </param>
    <param>
      <key>sd_spec0</key>
      <value></value>
    </param>
    <param>
      <key>clock_source1</key>
      <value></value>
    </param>
    <param>
      <key>time_source1</key>
      <value></value>
    </param>
    <param>
      <key>sd_spec1</key>
      <value></value>
    </param>
    <param>
      <key>clock_source2</key>
      <value></value>
    </param>
    <param>
      <key>time_source2</key>
      <value></value>
    </param>
    <param>
      <key>sd_spec2</key>
      <value></value>
    </param>
    <param>
      <key>clock_source3</key>
      <value></value>
    </param>
    <param>
      <key>time_source3</key>
      <value></value>
    </param>
    <param>
      <key>sd_spec3</key>
      <value></value>
    </param>
    <param>
      <key>clock_source4</key>
      <value></value>
    </param>
    <param>
      <key>time_source4</key>
      <value></value>
    </param>
    <param>
      <key>sd_spec4</key>
      <value></value>
    </param>
    <param>
      <key>clock_source5</key>
      <value></value>
    </param>
    <param>
      <key>time_source5</key>
      <value></value>
    </param>
    <param>
      <key>sd_spec5</key>
      <value></value>
    </param>
    <param>
      <key>clock_source6</key>
      <value></value>
    </param>
    <param>
      <key>time_source6</key>
      <value></value>
    </param>
    <param>
      <key>sd_spec6</key>
      <value></value>
    </param>
    <param>
      <key>clock_source7</key>
      <value></value>
    </param>
    <param>
      <key>time_source7</key>
      <value></value>
    </param>
    <param>
      <key>sd_spec7</key>
      <value></value>
    </param>
    <param>
      <key>nchan</key>
      <value>1</value>
    </param>
    <param>
      <key>samp_rate</key>
      <value>250000</value>
    </param>
    <param>
      <key>center_freq0</key>
      <value>1011e5</value>
    </param>
    <param>
      <key>gain0</key>
      <value>20</value>
    </param>
    <param>
      <key>ant0</key>
      <value></value>
    </param>
    <param>
      <key>bw0</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq1</key>
      <value>0</value>
    </param>
    <param>
      <key>gain1</key>
      <value>0</value>
    </param>
    <param>
      <key>ant1</key>
      <value></value>
    </param>
    <param>
      <key>bw1</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq2</key>
      <value>0</value>
    </param>
    <param>
      <key>gain2</key>
      <value>0</value>
    </param>
    <param>
      <key>ant2</key>
      <value></value>
    </param>
    <param>
      <key>bw2</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq3</key>
      <value>0</value>
    </param>
    <param>
      <key>gain3</key>
      <value>0</value>
    </param>
    <param>
      <key>ant3</key>
      <value></value>
    </param>
    <param>
      <key>bw3</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq4</key>
      <value>0</value>
    </param>
    <param>
      <key>gain4</key>
      <value>0</value>
    </param>
    <param>
      <key>ant4</key>
      <value></value>
    </param>
    <param>
      <key>bw4</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq5</key>
      <value>0</value>
    </param>
    <param>
      <key>gain5</key>
      <value>0</value>
    </param>
    <param>
      <key>ant5</key>
      <value></value>
    </param>
    <param>
      <key>bw5</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq6</key>
      <value>0</value>
    </param>
    <param>
      <key>gain6</key>
      <value>0</value>
    </param>
    <param>
      <key>ant6</key>
      <value></value>
    </param>
    <param>
      <key>bw6</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq7</key>
      <value>0</value>
    </param>
    <param>
      <key>gain7</key>
      <value>0</value>
    </param>
    <param>
      <key>ant7</key>
      <value></value>
    </param>
    <param>
      <key>bw7</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq8</key>
      <value>0</value>
    </param>
    <param>
      <key>gain8</key>
      <value>0</value>
    </param>
    <param>
      <key>ant8</key>
      <value></value>
    </param>
    <param>
      <key>bw8</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq9</key>
      <value>0</value>
    </param>
    <param>
      <key>gain9</key>
      <value>0</value>
    </param>
    <param>
      <key>ant9</key>
      <value></value>
    </param>
    <param>
      <key>bw9</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq10</key>
      <value>0</value>
    </param>
    <param>
      <key>gain10</key>
      <value>0</value>
    </param>
    <param>
      <key>ant10</key>
      <value></value>
    </param>
    <param>
      <key>bw10</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq11</key>
      <value>0</value>
    </param>
    <param>
      <key>gain11</key>
      <value>0</value>
    </param>
    <param>
      <key>ant11</key>
      <value></value>
    </param>
    <param>
      <key>bw11</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq12</key>
      <value>0</value>
    </param>
    <param>
      <key>gain12</key>
      <value>0</value>
    </param>
    <param>
      <key>ant12</key>
      <value></value>
    </param>
    <param>
      <key>bw12</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq13</key>
      <value>0</value>
    </param>
    <param>
      <key>gain13</key>
      <value>0</value>
    </param>
    <param>
      <key>ant13</key>
      <value></value>
    </param>
    <param>
      <key>bw13</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq14</key>
      <value>0</value>
    </param>
    <param>
      <key>gain14</key>
      <value>0</value>
    </param>
    <param>
      <key>ant14</key>
      <value></value>
    </param>
    <param>
      <key>bw14</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq15</key>
      <value>0</value>
    </param>
    <param>
      <key>gain15</key>
      <value>0</value>
    </param>
    <param>
      <key>ant15</key>
      <value></value>
    </param>
    <param>
      <key>bw15</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq16</key>
      <value>0</value>
    </param>
    <param>
      <key>gain16</key>
      <value>0</value>
    </param>
    <param>
      <key>ant16</key>
      <value></value>
    </param>
    <param>
      <key>bw16</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq17</key>
      <value>0</value>
    </param>
    <param>
      <key>gain17</key>
      <value>0</value>
    </param>
    <param>
      <key>ant17</key>
      <value></value>
    </param>
    <param>
      <key>bw17</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq18</key>
      <value>0</value>
    </param>
    <param>
      <key>gain18</key>
      <value>0</value>
    </param>
    <param>
      <key>ant18</key>
      <value></value>
    </param>
    <param>
      <key>bw18</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq19</key>
      <value>0</value>
    </param>
    <param>
      <key>gain19</key>
      <value>0</value>
    </param>
    <param>
      <key>ant19</key>
      <value></value>
    </param>
    <param>
      <key>bw19</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq20</key>
      <value>0</value>
    </param>
    <param>
      <key>gain20</key>
      <value>0</value>
    </param>
    <param>
      <key>ant20</key>
      <value></value>
    </param>
    <param>
      <key>bw20</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq21</key>
      <value>0</value>
    </param>
    <param>
      <key>gain21</key>
      <value>0</value>
    </param>
    <param>
      <key>ant21</key>
      <value></value>
    </param>
    <param>
      <key>bw21</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq22</key>
      <value>0</value>
    </param>
    <param>
      <key>gain22</key>
      <value>0</value>
    </param>
    <param>
      <key>ant22</key>
      <value></value>
    </param>
    <param>
      <key>bw22</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq23</key>
      <value>0</value>
    </param>
    <param>
      <key>gain23</key>
      <value>0</value>
    </param>
    <param>
      <key>ant23</key>
      <value></value>
    </param>
    <param>
      <key>bw23</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq24</key>
      <value>0</value>
    </param>
    <param>
      <key>gain24</key>
      <value>0</value>
    </param>
    <param>
      <key>ant24</key>
      <value></value>
    </param>
    <param>
      <key>bw24</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq25</key>
      <value>0</value>
    </param>
    <param>
      <key>gain25</key>
      <value>0</value>
    </param>
    <param>
      <key>ant25</key>
      <value></value>
    </param>
    <param>
      <key>bw25</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq26</key>
      <value>0</value>
    </param>
    <param>
      <key>gain26</key>
      <value>0</value>
    </param>
    <param>
      <key>ant26</key>
      <value></value>
    </param>
    <param>
      <key>bw26</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq27</key>
      <value>0</value>
    </param>
    <param>
      <key>gain27</key>
      <value>0</value>
    </param>
    <param>
      <key>ant27</key>
      <value></value>
    </param>
    <param>
      <key>bw27</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq28</key>
      <value>0</value>
    </param>
    <param>
      <key>gain28</key>
      <value>0</value>
    </param>
    <param>
      <key>ant28</key>
      <value></value>
    </param>
    <param>
      <key>bw28</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq29</key>
      <value>0</value>
    </param>
    <param>
      <key>gain29</key>
      <value>0</value>
    </param>
    <param>
      <key>ant29</key>
      <value></value>
    </param>
    <param>
      <key>bw29</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq30</key>
      <value>0</value>
    </param>
    <param>
      <key>gain30</key>
      <value>0</value>
    </param>
    <param>
      <key>ant30</key>
      <value></value>
    </param>
    <param>
      <key>bw30</key>
      <value>0</value>
    </param>
    <param>
      <key>center_freq31</key>
      <value>0</value>
    </param>
    <param>
      <key>gain31</key>
      <value>0</value>
    </param>
    <param>
      <key>ant31</key>
      <value></value>
    </param>
    <param>
      <key>bw31</key>
      <value>0</value>
    </param>
    <param>
      <key>_coordinate</key>
      <value>(884, 148)</value>
    </param>
    <param>
      <key>_rotation</key>
      <value>0</value>
    </param>
  </block>
  <connection>
    <source_block_id>low_pass_filter_0</source_block_id>
    <sink_block_id>uhd_usrp_sink_0</sink_block_id>
    <source_key>0</source_key>
    <sink_key>0</sink_key>
  </connection>
  <connection>
    <source_block_id>low_pass_filter_0</source_block_id>
    <sink_block_id>wxgui_fftsink2_0</sink_block_id>
    <source_key>0</source_key>
    <sink_key>0</sink_key>
  </connection>
  <connection>
    <source_block_id>blks2_wfm_tx_0</source_block_id>
    <sink_block_id>wxgui_fftsink2_1_0</sink_block_id>
    <source_key>0</source_key>
    <sink_key>0</sink_key>
  </connection>
  <connection>
    <source_block_id>blks2_wfm_tx_0</source_block_id>
    <sink_block_id>low_pass_filter_0</sink_block_id>
    <source_key>0</source_key>
    <sink_key>0</sink_key>
  </connection>
  <connection>
    <source_block_id>gr_multiply_const_vxx_0</source_block_id>
    <sink_block_id>blks2_rational_resampler_xxx_0</sink_block_id>
    <source_key>0</source_key>
    <sink_key>0</sink_key>
  </connection>
  <connection>
    <source_block_id>blks2_rational_resampler_xxx_0</source_block_id>
    <sink_block_id>blks2_wfm_tx_0</sink_block_id>
    <source_key>0</source_key>
    <sink_key>0</sink_key>
  </connection>
  <connection>
    <source_block_id>blks2_rational_resampler_xxx_0</source_block_id>
    <sink_block_id>wxgui_fftsink2_1</sink_block_id>
    <source_key>0</source_key>
    <sink_key>0</sink_key>
  </connection>
  <connection>
    <source_block_id>gr_multiply_const_vxx_0</source_block_id>
    <sink_block_id>audio_sink_0_0</sink_block_id>
    <source_key>0</source_key>
    <sink_key>0</sink_key>
  </connection>
  <connection>
    <source_block_id>gr_wavfile_source_0</source_block_id>
    <sink_block_id>gr_multiply_const_vxx_0</sink_block_id>
    <source_key>0</source_key>
    <sink_key>0</sink_key>
  </connection>
</flow_graph>
Posted in Uncategorized | Leave a comment

Replay Attack: Remote Control Outlets and RFCat

In my previous post, I discussed the possibility of controlling one of those handy remote controlled outlets. Well, I got a hold of one, and decided to put my previous post to the test. I’ve even included a video, along with the code that I used. What more could you ask for? In the video, I attach my monitor to the remote control outlet switch and use my RFCat device flashed in my previous previous post to send a custom packet of data via 433.925MHz to the device. As you can see, the same signal is sent each time, turning the device on and off via its relay.

To better understand what is going on in this code, refer to my previous post that I have mentioned numerous times already.

#!/usr/bin/env python

import sys
import time
from rflib import *
from struct import *
import argparse
import pprint
import bitstring


keyLen = 0
baudRate = (1 / 0.000158) # pulse width
frequency = 433945000
repeatNum = 5

def ConfigureD(d):
	d.setMdmModulation(MOD_ASK_OOK)
	d.setFreq(frequency)
	d.makePktFLEN(keyLen)
	d.setMdmDRate(baudRate)
	d.setMaxPower()
	d.setMdmSyncMode(0)
	
	print "[+] Radio Config:"
	print " [-] ---------------------------------"
	print " [-] MDMModulation: MOD_ASK_OOK"
	print " [-] Frequency: ",frequency
	print " [-] Packet Length:",keyLen
	print " [-] Baud Rate:",baudRate
	print "[-] ---------------------------------"


#raw what we are sending	  
bin_str_key =  "1111010101010101110000010"; # This is the RC Switch Outlet payload;

#make it longer so it looks right
long_bin_key = "";

for k in bin_str_key:
	x = "*"
	if(k == "1"):
		x = "11100" # <mossmann> A zero is encoded as a longer high pulse (high-high-low)
	if(k == "0"):
		x = "1000" #<mossmann> and a one is encoded as a shorter high pulse (high-low-low).
	long_bin_key = long_bin_key + x

print "[+] Binary (PWM) key:\n\t",long_bin_key,"\n"

# Elongate this by 7 iterations since this is what the remote outlet switch requires
long_bin_key_modified = long_bin_key*7;

key_packed = bitstring.BitArray(bin=long_bin_key_modified).tobytes()


keyLen = len(key_packed)

print "[+] Key len:\n\t",keyLen,"\n"
print "[+] Key:\n\t", key_packed.encode('hex'),"\n"
print ""

d = RfCat()
ConfigureD(d)

print "[%] Transmitting key: ",repeatNum," times\n"

d.makePktFLEN(keyLen)
for i in range(0,repeatNum):
	sys.stdout.write( "." )
	d.RFxmit(key_packed)

sys.stdout.write("Done.\n")
Posted in Uncategorized | 7 Comments

Non-Return-to-Zero ASK/OOK Signal Replay

Radios have been around for a long time. Security has not played a very long role within this realm. Consequently, precautions such as CRC, encryption, etc. are not always considered during the transmission of a radio signal. The below tutorial will highlight a replay of a modulated ASK/OOK signal that is non-return-to-zero (NRZ) encoded.

The 433.925MHz band is commonly used across many devices found all over our surroundings. From wireless doorbells to garage door openers, this band is fairly active in our daily lives. The demonstration of replay we will be covering will be wireless RC switches that are common in European households. These devices can be controlled wirelessly to turn on and off any electrical device connected. Naturally, this is an interesting device to investigate. Below is a picture of the device mentioned.

png;base64b874258e77870a44

In short, signals are sent as NRZ encoded in the signal as it is sent to the receiver, and subsequently decoded and the function is processed. NRZ line code is binary code where a ‘1’ is represented as a positive voltage and a ‘0’ is represented as a negative voltage. The longer the pulse width, the greater the amount of data. Below is an example of NRZ:

png;base64569decdf1b4785a1

So that we have a more controlled environment and since this is in the US, we will be using an Arduino Uno, an RF link set, and an Arduino ported RC Switch library. This will serve as our example remote controlled RC switch since they are not as common here as they are overseas.

Materials needed:

Let’s get started. First, we need to connect and configure our Arduino with the RF Link set and program our microcontroller as a transmitter with the rc-switch library. In the below image is my setup as an example. For my RF 433MHz transmitter (as both the transmitter and receiver tend to vary in pin count and voltage), I have 3 pins on my transmitter: GND, VCC, and DATA. On the breadboard, connect the transmitter directly and connect the appropriate pins — GND to the GND pin on the Arduino, VCC to 5v pin, and DATA to whatever digital pin you choose.

png;base64e8a809f4868df584

http://rc-switch.googlecode.com/svn/wiki_images/wiring_transmitter.png

With the Arduino physically configured correctly, fire it up and commit the following code (modifying to your pin setup where necessary).

/*
  Simple example for sending

http://code.google.com/p/rc-switch/

*/

#include <RCSwitch.h>

RCSwitch mySwitch = RCSwitch();

void setup() {
  mySwitch.enableTransmit(2);  // Using Pin #2
}

void loop() {
  mySwitch.send("1100101"); // Send the message 0x65, in ASCII, ‘a’
  delay(1000);  // 1 second delay per transmission; 1000ms
}

Now that the Arduino is setup, we need to find the signal by using RTL-SDR and SDR-Sharp on our Windows box (you can use gqrx or HDSDR if you are so inclined). Note that the signal generated from the RF link set is not the best. The frequency that it resides on varies at times. However, it should be right around 433 ~ 434MHz. Since this is an AM modulation, select “AM” when listening for the signal.

rtl-sdr-sdr-sharp-433

Once you find the signal, record it as a WAV file. Open the signal in Audacity and examine the transmission. As you can see below, it is a fairly straight-forward signal. Without looking at the source code, we can assume the following: it is NRZ encoded, it has been pulse width modulated (PWM), and it is ASK/OOK (Amplitude Shift Keying / On Off Keying — this essentially means with OOK that the carrier is switched on and off in order to convey the presence and absence of data [binary representation]). The last piece of information we need to gleen from the signal is the baud rate. To calculate the baud rate of a signal, follow the steps below:

  1. Set the tool at the bottom to length and change the measurement to samples

  2. Get the sample rate of the audio (in this case, it is 62,500Hz)

Formula for getting the baud rate:

1  / (samples / samplerate) → 1 / (22 / 62500) = ~2,840bps

arduino_433_00110101

Most of the time, this will work, be accurate enough, and serve as one of our variables in our recipe for RFCat.

Given that this signal has been PWM’d, we need to elongate each pulse width to the appropriate length. Unfortunately, most of this takes trial and error. Thankfully, AndrewMac put together the perfect script which addresses these concerns in conjunction with RFCat. With our RFCat dongle in hand, we will be able to transmit our hand-massaged signal which will hopefully be well-received by our Arduino receiver. When dealing with RFCat, we need to define different settings prior to transmitting our data. Given everything we learned earlier about the signal, we need to define the following as such:

d.setMdmModulation(MOD_ASK_OOK)
d.setFreq(frequency)
d.makePktFLEN(keyLen)
d.setMdmDRate(baudRate)
d.setMaxPower()
d.setMdmSyncMode(0)

We first set the modulation to ASK/OOK, set our target frequency to 434042000Hz (433.925MHz), essentially define how long our message is, set the baud rate to 2840bps, ensure that the transmission is set to full power, and to disable any preamble or syncwords, set Sync Mode to 0.

With the assumption that you have a somewhat solid understanding of RFCat (from previous articles) as well as python, the below script will help us execute the above with the necessary padding and PWM adjustment such that we receive a matching transmission.

/*
Script by AndrewMac of andrewmohawk.com
*/

#!/usr/bin/env python

import sys
import time
from rflib import *
from struct import *
import argparse
import pprint
import bitstring

keyLen = 0
baudRate = (1 / 0.000350) #because the pulse width is 350 in the code
frequency = 434042000
repeatNum = 30

def ConfigureD(d):
	d.setMdmModulation(MOD_ASK_OOK)
	d.setFreq(frequency)
	d.makePktFLEN(keyLen)
	d.setMdmDRate(baudRate)
	d.setMaxPower()
	d.setMdmSyncMode(0)

	print "[+] Radio Config:"
	print " [-] ---------------------------------"
	print " [-] MDMModulation: MOD_ASK_OOK"
	print " [-] Frequency: ",frequency
	print " [-] Packet Length:",keyLen
	print " [-] Baud Rate:",baudRate
	print "[-] ---------------------------------"

#raw what we are sending	  
bin_str_key = "1100101"; 

#adjust the key to make it longer so that the pulse width is correct
long_bin_key = "";

for k in bin_str_key:
	x = "*"
	if(k == "1"):
		x = "11100" # <mossmann> A zero is encoded as a longer high pulse (high-high-low)
	if(k == "0"):
		x = "1000" #<mossmann> and a one is encoded as a shorter high pulse (high-low-low).
	long_bin_key = long_bin_key + x

print "[+] Binary (PWM) key:\n\t",long_bin_key,"\n"

padAmount = len(long_bin_key) % 8
for x in range(0,8-padAmount):
	long_bin_key = "0" + long_bin_key

print "[+] Binary Padded (PWM) key:\n\t",long_bin_key,"\n"

key_packed = bitstring.BitArray(bin=long_bin_key).tobytes()

keyLen = len(key_packed)

print "[+] Key len:\n\t",keyLen,"\n"
print "[+] Key:\n\t", key_packed.encode('hex'),"\n"
print ""

d = RfCat()
ConfigureD(d)

print "[%] Transmitting key: ",repeatNum," times\n"

#startString = "11101";
startStringBin = "000000000000000" + "1000100010001000111001000"
startkey_packed = bitstring.BitArray(bin=startStringBin).tobytes()
d.RFxmit(startkey_packed)

d.makePktFLEN(keyLen)
for i in range(0,repeatNum):
	sys.stdout.write( "." )
	d.RFxmit(key_packed)

#endString = "011";
d.RFxmit('\xFF')
sys.stdout.write("Done.\n")

To briefly explain what the code is doing, we are taking our pre-defined settings such as modulation, baud rate, etc. and applying it to our RFCat configuration. We then take our key that we wish to send (already dissected from the Audacity screenshot taken above) and assign it to the variable bin_str_key. We then alter the key so that all ‘1’s are 11100 (high-high-low) and the ‘0’s are 1000 (high-low-low). Our original key (1100101) is now mutated into a new binary PWM key which now appears as 11100111001000100011100100011100. Our pulse width is now accurate. The next step is to pad the binary PWM key, convert it to bytes (so that the data is not sent out as ASCII), and then take the length of the now-in-byte format binary PWM padded key in order to set d.makePktFLEN(keyLen) so that RFCat has a fixed key length when sending the data. Now that the beef of our information has been created, we now need to create the start and end bits so that our Arduino program knows when our data transmission begins and when it ends. After all of this is defined, we then execute the following RFxmit() functions in order: d.RFxmit(startkey_packed), d.RFxmit(key_packed), and d.RFxmit(‘\xFF’). The end transmission appears as: 00000000000000010001000100010001110010001110011100100010001110010001110011111111

This message is then sent ~30 times given that our receiver is a bit finicky, and that it is a requirement for the signal to be sent 10 times to be considered a complete message (as per the rc-switch source code). However, to check and make sure that the signal was originally sent correctly, modify repeatNum to equal ‘1’, re-record the signal in SDR-Sharp, and line-up the result against the originally recorded Arduino frequency. It should look virtually the same.

Take your Arduino and use the following code to receive:

/*
  Simple example for receiving

http://code.google.com/p/rc-switch/

*/

#include <RCSwitch.h>

RCSwitch mySwitch = RCSwitch();

void setup() {
  Serial.begin(9600);
  mySwitch.enableReceive(0);  // Receiver on interrupt 0 => that is pin #2
}

void loop() {
  if (mySwitch.available()) {

    int value = mySwitch.getReceivedValue();

    if (value == 0) {
      Serial.print("Unknown encoding");
    } else {
      Serial.print("Received ");
      Serial.print( mySwitch.getReceivedValue() );
      Serial.print(" / ");
      Serial.print( mySwitch.getReceivedBitlength() );
      Serial.print("bit ");
      Serial.print("Protocol: ");
      Serial.println( mySwitch.getReceivedProtocol() );
    }

    mySwitch.resetAvailable();
  }
}

Thereafter, configure the receiver component you have and wire it identically as you already have on the Arduino, except rearrange the order of the wires. With my receiving component my pin order from right to left is: GND, DATA, DATA, VCC. In my setup, I only use the first data pin. The below diagram may be of use.
png;base64ab3110451faddc37

http://seeedstudio.com/wiki/images/0/0f/315433RF.jpg

Assuming that your signal matches up, go ahead and run the script with a higher repetition than 1 iteration, such as 30+. With any luck, your signal should have been successfully replayed!

Posted in Uncategorized | 4 Comments

You know how to send my signal — Setting up RFCat from scratch

What is RFCat?

RFCat is firmware/python-client combination written by “atlas”. This software takes the once-limited TI CC1111EMK and broadens its abilities. Taken from the GrrCon page (where you can buy it for $110 pre-flashed and ready for you to use out of the box) describes RFCat as:

@Signed, flashed RfCat USB Radio Dongle (based on Chipcon CC1111EMK-868-900), making the opacity of Proprietary protocols into transparency and capacity for attack

Capable of transmitting/receiving/snooping/SpectrumAnalysis on frequencies between 300-928MHz and more (officially 315, 433, 868, 915MHz ranges, but we’ve seen more than that) using modulations 2FSK, GFSK, MSK, ASK, and OOK and baud rates 0 – 250kbaud

http://grrcon.com/rfcat/

Why would I use this?

Good question. Well, if you are a Software Defined Radio enthusiast like me, this is an excellent tool for testing the robustness of radio protocols on various embedded devices. Since this piece of hardware transceiver with the modulation, etc. taken care of for you, this is the perfect device for helping with your every day exploration of radio signals.

Enough chit-chat. Below I have mapped-out how I “made” my un-flashed CC1111EMK into a fully-functional RFCat dongle. It cost me about $80 going this route; saving a little bit of cash, learning a lot through trial and error, and having the ability to re-flash my device again when a RFCat firmware comes out made this venture worth it.

What do I need?

  • CC1111EMK-868-900 dongle; order here
  • IMG_20140215_194039
  • SmartRF04EB or SmartRF05EB (I got mine from here)
  • IMG_20140215_194122
  • Mac Book Pro or a Linux box with Ubuntu natively installed (I did not have luck with a LiveUSB version of Kali)
  • RFCat
  • SmartRF Flash Programmer
  • Windows 7 box for the flashing of the bootloader and firmware
  1. Install the SmartRF Flash Programmer onto the Windows 7 box (the drivers should be automatically installed so the SmartRF works right as you plug it in)
  2. Hook the ribbon cable (the correct direction; it may be reversed!) to the “DEBUG” set of 10 pins found on the CC1111EMK
  3. Plug in the CC1111EMK into your Windows 7 box (a solid green light should appear)
  4. Plug the other end of the ribbon cable (again, in the correct direction or the chip won’t be recognized) onto the 10 prongs for the SmartRF
  5. Plug the SmartRF into another USB port on your Windows 7 box
  6. Download and extract the RFCat folder onto your desktop
  7. Start up the SmartRF Flash Programmer software you installed earlier
  8. The software may ask you to update the firmware for your SmartRF — go ahead and do this by clicking “OK”, selecting “Program Evaluation Board” from the top dropdown, and then clicking “Update EB Firmware”
  9. Click the “Program CCxxxx SoC or MSP430″ from the dropdown box at the top
  10. Make sure that the Chip Type appears as well as the EB type after loading up your flash programmer. At this point, we need to navigate to your root RFCat folder and point “Flash image” to the following file: rfcat_130515\firmware\bins\RfCatDonsCCBootloader-130515.hex and under “Actions”, select “Erase, program and verify”. Click “Perform actions”.
  11. 1
  12. Repeat the above with the second file after you hear Windows reconnecting your device. At this point, your dongle should still have a solid green light. Flash image: rfcat_130515\firmware\bins\RfCatDons-130515.hex but this time, be sure to select “Write protect boot block”. Click “Perform actions” once again.
  13. 2
  14. Remove the debug cable from the now flashed RFCat device (CC1111EMK) and remove it from the USB as well.
  15. On the Mac Book Pro (or native Linux install OS), download and extract RFCat
  16. Make sure you have python-usb and libusb installed on your box. You can perform this installation on OSX by running brew install package_name_here or apt-get install package_name_here for Debian-based distributions of Linux.
  17. Compile RFCat by running: sudo python setup.py install
  18. Create a new file located here: /etc/udev/rules.d/20-rfcat.rules with the following lines:
    SUBSYSTEMS=="usb" ATTRS{idVendor}=="1d50" ATTRS{idProduct}=="6049" SYMLINK+="RFCAT_BL_C"
    SUBSYSTEMS=="usb" ATTRS{idVendor}=="1d50" ATTRS{idProduct}=="604a" SYMLINK+="RFCAT_BL_D"
  19. Thereafter you can either reboot or run sudo udevadm control –reload-rules
  20. Plug in your newly flashed RFCat dongle
  21. Type rfcat -r You will be presented with options as displayed below to get you going:
  22. rfcat
  23. That’s it! You should be good to go!

If you would like further details on an example project while using RFCat, head over to Andrew’s blog — he has a great write-up using RFCat and harnessing Python’s power!

Also wanted to point out that I could not have done this without the help of user “poutine” and “AndrewMac” from the Freenode IRC in channel #rfcat. Thanks again!

Posted in Uncategorized | 3 Comments

BlackBerry Acknowledgement

I received an acknowledgement from BlackBerry for my finding from a few months back. Hooray!

BlackBerry Security Collaborations – US

BlackBerry Security Collaborations - US

Posted in Uncategorized | Leave a comment

Free Hakin9 Articles

Hakin9 was kind enough to share these articles with me for free, in order to share them with all of you for free! Enjoy!

Hacking for Beginners

Guide to Backtrack

Metasploit Tutorial

Guide to SAP Exploitation

Advanced Web Attacks

Programming

Software Exploitation Starter Kit

Posted in Uncategorized | Leave a comment

Google Vulnerability Hall of Fame

Hi all,

Today is a pretty exciting day for me as I have made it onto the Google Vulnerability Hall of Fame! http://www.google.com/about/appsecurity/hall-of-fame/reward/

google

Posted in Uncategorized | Leave a comment

Microsoft HotSpot in Forbes Magazine Firmware Lifting “Hack”

You may have heard about the free Wi-Fi hotspot that Microsoft pushed out in random Forbes magazines… This device comes with a T-Mobile GSM SIM card with the data service that lasts for only 15 days . I was curious as to what was making this tick, so I decided that it would be a fun experiment to lift the contents of this Linux OS off of the device.

The device has the following chips:

United-Tek H1602PR

Ralink RT5350F

Etron Tech EM63A165TS

These chips should be fairly obvious as to what purpose they serve, if not with a quick Google search.

The device has the following ports open with services started on by default: 80, 23, and 5820. That last one hosts a redirect site for a supposed login (or that’s what my phone seemed to think) in order to initiate the T-Mobile service? Maybe accessing that page triggers the “activation”. Please correct me either way.

Anyway, without further adieu, here are the steps I had to take in order to get the filesystem off of the device.

1. Plug device into computer via microusb and connect battery (this will keep the battery charged)
2. Wait for AP to startup, and connect to the SSID: Microsoft_Office365 with the password Office365
3. Visit 192.168.100.1:80 and login as admin/admin

portable_wifi_web
4. Do whatever you want on this web interface regarding the router’s settings
4a. The FTP setting in here does not actually work, we need to do this via telnet (23)
5. telnet 192.168.100.1
6. Login as username: admin password: admin
7. cd /bin
8. vi new.conf
9. Paste this in vi:

ServerName test
DefaultAddress 127.0.0.1
ServerType standalone
DefaultServer on
AuthUserFile /etc/passwd
Port 21
Umask 022
MaxInstances 10
User admin
Group admin
DefaultRoot /
UseReverseDNS off
IdentLookups off
RootLogin on
DelayEngine off

10. We are changing the DefaultRoot to be the root directory, instead of /media/
11. In the same directory, type: proftpd -c new.conf
12. This will take our new conf and run it with our FTPD

portable_wifi
13. Login as admin/admin on 192.168.100.1 via FTP, 21
14. Copy whatever you want off of the device. Enjoy!

portable_wifi_proftpd

Side note: I believe that you could simply copy off the device block and have it all neatly within a single file by performing the following, then copying it off via our FTP server:

cp /dev/mtdblock0 /tmp/rootfs

In case you don’t want to go through all of that, here are the files extracted: Ralink FileSystem

Cheers!

Posted in Uncategorized | 3 Comments