As part of their senior project Matthew May & Brendan Harlow of Champlain College worked on a project that involved creating their own software defined radio based portable cell phone network. If you're interested their setup is nicely documented on their project page. Basically it consists of a bladeRF software defined radio and Raspberry Pi running the YateBTS base station software. This is nothing new in terms of work done before, but the clear documentation makes it a good starting point for anyone looking at building their own SDR based cell basestation.
A custom cell basestation may be useful for those in remote areas without commercial cell phone reception, during disasters or even just to create a type of secondary network in your home.
Last month we posted about Aerial TV, a new Android based DVB-T decoder that works with RTL-SDR dongles. Back then the app was still in beta testing and had a few operational bugs. Now the Aerial TV app has been officially released.
UPDATE: Due to Google policies Aerial TV has been removed from the Google Play Store. It is claimed that Aerial TV could be used for copyright violation. It is now available on the Amazon store. Official information will always be available on the new official website at aerialtv.eu.
The app is based on the new Android DVB-T driver for RTL2832U devices which is written by Martin Marinov who is also the programmer of Aerial TV. The DVB-T driver is open source, and currently supports RTL2832U devices with the R820T, E4000, R828D, FC0012 and FC0013 tuner chips. Of note is that the R828D also has DVB-T2 support.
Aerial TV is free to download and test, but requires a $7.99 licence to use for more than 30 minutes. To use it you will need an OTG (On-the-go) cable adapter and an RTL-SDR dongle with antenna.
Just watch TV – no data plan or wifi connection required. Aerial TV works by picking up digital TV channels off the air with a regular TV antenna.
You will need a low cost USB TV tuner. You can grab one online for less than €10. Make sure to get an RTL2832 tuner. When it arrives, just connect the provided antenna and start watching. You may need a USB OTG cable to plug the tuner in your Android device. USB OTG cables are inexpensive and easy to find.
Note that your Android device must support USB OTG. If unsure, do a quick search online or consult your Android device manual. Also check that there is DVB-T/DVB-T2 service in your local area by doing a quick search online. Signal needs to be strong enough for Aerial TV to pick it up. For best results use an outdoor aerial.
You get free unlimited access to radio forever. You also get to watch all TV channels and experience all features of Aerial TV during the trial period for free. After the trial period ends you can make a one-off purchase and watch as much TV as you want. Remember: you can keep listening to radio even if the trial has ended!
Q: How do I find a supported dongle? A: All major RTL2832 (rtl-sdr) dongles are supported. These dongles can be easily purchased online. Just type in “RTL2832” or “RTL2832U” in the search box of your favourite online store.
Q: What tuner do I need to watch DVB-T2? A: If your country has DVB-T2 broadcasts (such as Freeview HD in UK) you will need a DVB-T2 compatible receiver dongle such as R828D in order to watch DVB-T2 with Aerial TV.
Test a android program "Aerial TV (Unreleased)" ver. 1.1 with usb dongle with R820T2 chip
The new software requires a different DVB-T driver app to be installed first, which is also provided by Martin. This is because the RTL-SDR needs to be operated in a mode different to the way that the SDR drivers use it in. Martin has also open sourced his Android DVB-T driver and it is available on GitHub.
Aerial TV is currently free on the Google Play store, but looks like it may eventually have some in-app purchases. Also, it is currently marked as ‘Unreleased’ on Google Play, which is essentially a beta version, so you might expect there to be some bugs.
One nice feature of modern Motorola smartphones is that some models can accept ‘mods’, which are essentially phone cases that snap onto the back of the phone and interface via some exposed data pins. Some examples include a snap on speaker, projector, battery pack and zoom lens. Currently Moto Mods and Indiegogo are running a promotional campaign that gives developers a chance to pitch new Moto Mod ideas to Motorola, and if successful be partnered with Motorola and receive funding to complete and sell the hardware.
Vaclav Bouse is one developer who has been working on an RTL-SDR based Moto Mod. The idea is to integrate RTL-SDR hardware into the Moto Mod phone case form factor and possibly even add transceiver capabilities via an AX5043 transceiver chip. The hardware is still in the very early concept and design phases, and Vaclav is seeking donations on Indiegogo to help fund the development of a prototype (note that donating will not get you the final product). As it will be an RTL-SDR, it should be compatible with all Android RTL-SDR software, such as SDR Touch.
Over on YouTube the channel Budapest Hackerspace has recently uploaded a talk by Piotr Krysik which was given during the August 2016 Camp++ 0x7e0 information security conference. The talk is titled: “GSM signal sniffing for everyone with gr-gsm and Multi-RTL by Piotr Krysik” and talks about using the gr-gsm software and RTL-SDR dongles to sniff the GSM mobile phone network. Also, a tool developed by Piotr called multi-rtl which allows the proper synchronization of multiple RTL-SDR dongles in order to cover the large gap between the GSM uplink and downlink frequencies is discussed.
The talk explains a bit about how GSM works, and then goes on to talk about the gr-gsm and multi-rtl software. The talk blurb reads:
Gr-gsm is a set of tools for receiving GSM transmissions, which works with any software radio hardware capable of receiving GSM signal. Together with widely available RTL2832 based TV dongles, that are popularly used as low cost software radio receivers (known as RTL-SDR), it enables everyone to receive and study protocols used in GSM’s mobile radio interface.
Ability to receive signals spread over wide frequency range exceeding single RTL-SDR receiver’s bandwidth (~2.4MHz) was available exclusively for the owners of more capable and more expensive SDR devices. With introduction of Multi-RTL project by the author of the talk, this limit was overcome through synchronization of multiple RTL-SDR receivers in time domain, that doesn’t require complicated hardware modifications. With Muli-RTL it is possible to receive for example uplink and downlink of GSM900 transmissions, that are separated by 45MHz.
Speaker will present origins of both of the projects, together with description of their inner workings, examples of applications and plans for the future.
Over on YouTube user Crazy Danish Hacker has been working on uploading an entire series on GSM Sniffing with an RTL-SDR. His series is explained in a slow and clear presenting style, and it starts at the very beginning from installing the RTL-SDR. The tutorial series is not yet complete, however he is uploading a new video almost daily. Presumably the series will end with showing you how to receive text messages and voice calls originating from your own cellphone.
So far he has shown how to install the RTL-SDR, identify GSM downlinks, install and use GQRX and kalibrate, locate nearby cell towers, install and use GR-GSM and how to extract the TMSI & KC keys from your cell phone. To obtain the TMSI & KC keys he shows us how to use an Android tool called usbswitcher which forces the phone to use its USB modem interface, from which the keys can be obtained.
The video below shows his teaser video on the series. Check out his GSM playlist to view the full series.
GSM Sniffing Teaser – Software Defined Radio Series!
A few months ago the popular SDRTouch software for Android added support for the SDRplay RSP. The RSP is a $149 USD software defined radio with a tuning range of 100 kHz to 2 GHz and a 12 bit ADC.
Over on YouTube user Mile Kokotov has uploaded a video showing the SDRplay RSP running in SDRTouch. He uses it to listen to the 14 MHz ham band in SSB mode and finds that reception is clear and that it is fairly easy to tune around.
In order to use the RSP with an Android device you will need a fairly modern phone and a USB OTG cable. Ideally try to get a USB OTG cable with an external power port as the battery can drain quite fast when using the SDR. SDRTouch also supports the RTL-SDR.
Over on YouTube user Osama SH has uploaded a video briefly showing the steps needed to use an RTL-SDR dongle to sniff some SMS text messages and voice calls made from his own phone. This can be done if some encryption data is known about the phone sending the messages, so it cannot be used to listen in on any phone – just ones you have access to. In the video he uses Airprobe and Wireshark to initially sniff the data, and find the information needed to decode the text message. Once through the process he is able to recover the SMS message and some voice audio files.