Category: Mobile

RTL-SDR Cell Phone IMSI, TMSI and Key Sniffer

Over on YouTube user Kali Gsm has uploaded a video showing off a new software program he has written that allows an RTL-SDR to be used to gather IMSI, TMSI and Key information from a cell phone connected to a PC.

The IMSI (International Mobile Subscriber Identity) is a number that uniquely identifies a cell phone. Because IMSI’s are unique, they can be used to track a cell phone so they are rarely broadcast and instead a TMSI (Temporary Mobile Subscriber Identity) number is used to identify a cell phone instead. The TMSI is changed depending on geographic location or changed by the network randomly. The key is a number that is used to decrypt the GSM data sent to your phone.

Kali Gsm’s software is called rtl_tool_kit and is planned to be released soon on it’s GitHub page. It uses the gr-gsm software to sniff the GSM downlink with an RTL-SDR dongle and also interfaces to a connected mobile phone. The author writes that the following is possible with the software:

  1. You can get imsi tmsi and key of the device connected to your pc.
  2. You can send silent/flash sms
  3. You can connect/match tmsi to a mobile number if target is on the same BTS and in GSM900/2G mode.

Update 25/01/2015: All YouTube videos appear to have been removed – though the uploader reports in the comments that the videos will be back online soon.
Update 29/01/2015: Videos are back online.


RF Analyzer Android App for the HackRF

Earlier this month we posted about a new port of the HackRF software defined radio Linux library for Android. Now the author of the Android port has created a new app called RF Analyzer. The app is basically a real time spectrum viewer that includes a waterfall display. The app can be downloaded from Github at https://github.com/demantz/RFAnalyzer.

The app currently supports the following features.

  • Browse the spectrum by scrolling horizontally
  • Zoom in and out, both horizontally and vertically
  • Adjust the sample rate and center frequency to match the current view of the screen by double tapping
  • Auto scale the vertical axis
  • Jump directly to a frequency
  • Adjust the gain settings of the HackRF
  • Select a pre-recorded file as source instead of a real HackRF
  • Change the FFT size
  • Setting the frame rate either to a fixed value or to automatic control
  • Activate logging and showing the log file

In the future the author intends to support the RTL-SDR and implement demodulation for basic modes such as AM, FM and SSB.

To use the app you’ll need an USB OTG (on-the-go) cable to connect your Android device to the HackRF.

RF Analyzer Android App for the HackRF
RF Analyzer Android App for the HackRF
RF Analyzer demonstration - Showing a FFT plot by using an Android device and the HackRF

SDR Touch Updated to Version 2.0

SDR Touch, the popular Android based software defined radio software for the RTL-SDR has been updated to version 2.0. This new version is a complete rewrite with many optimizations listed below.

  • 100% rewritten from scratch
  • Improved reception sensitivity and quality
  • Optimized engine
  • GUI overhaul (Landscape mode, more flexible)
  • 16 bit audio
  • FIR filtering

The author also writes that the rewrite allows for new features coming out in the future such as adjustable bandwidth, FFT size, plugins and a separate GUI for in-car use. SDR Touch is available from the Android Play store.

SDR Touch Android GUI for RTL-SDR
SDR Touch Android GUI for RTL-SDR

New RTL-SDR Android App: SDRWeather

A new RTL-SDR Android app called SDRWeather has appeared on the Google Play Market. The new app allows you to listen to weather radio and decode EAS (Emergency Alert System) alerts. The app will only work in the US and Canada. More information about the app and its open source code can be found at http://sdrweather.thecongers.org.

This software along with a supported USB software defined radio turns your Android device to a portable weather radio.

Current Features:
* Listen to weather radio in the US/Canada.
* Decode EAS Alerts US/Canada
* Selectable Pre-defined Frequencies
* Alert Notifications
* Widget to display alerts
* Option to unmute audio when alert recieved
* FIPS and CLC Location Code Databases
* Event Code Database
* No internet connection required

Possible future features
* Switch to using rtl_tcp_andro
* Option to only show alerts if you are currently in the affected region
* Affected region map

Screenshot of the Android RTL-SDR App SDRWeather
Screenshot of the Android RTL-SDR App SDRWeather

Analyzing TD-LTE with the RTL-SDR

TD-LTE is a mobile phone standard acronym for Time Division Long Term Evolution. It is one of two variants of LTE technology, with the other being FD-LTE (Frequency Division LTE).

Over in China where TD-LTE is commonly used, Jiao Xianjun discovered that the current LTE-Cell-Scanner Linux program did not support TD-LTE, so he made a fork which does support TD-LTE. LTE-Cell-Scanner is a program which can decode LTE cell tower data which contains information like the cell ID, transmit frequency and transmit strength. With his modified LTE-Cell-Scanner, some MATLAB scripts he wrote and an RTL-SDR, Jiao was able to decode the cell information from 10 TD-LTE signals and 2 FD-LTE signals. He has uploaded a video showing this too.

TD-LTE, LTE FDD, scanning/demodulation results in Beijing, China

ADS-B Decoder for the RTL-SDR now available for Android

A (beta version) of an ADS-B decoder and display app for the RTL-SDR dongle for Android has been released. This app allows you to receive the ADS-B radio signals emitted by modern aircraft, which contain information such as flight number, latitude, longitude and altitude, essentially giving you a live portable aircraft radar.

To use the app, you will need an Android device that supports USB OTG, which most Android devices on Android 4.0+ should support. You will also need a USB OTG cable, and an RTL-SDR dongle. You may want to consider a USB OTG cable that has a second port for external charging capabilities, as the RTL-SDR can drain the battery quickly.

The app is cheaply priced at under $2, so give it a try!

ADS-B Decoding on Android
ADS-B Decoding on Android

SDRTouch Version 1.7 Released

The Android based SDR program SDRTouch has been officially updated to version 1.7. News comes via this forum post. This looks to be a major update which significantly improves audio quality and performance. The new features are listed below.

  • FM is now in STEREO
  • New audio recording feature for PRO users
  • Improved reception and audio quality. All filters were tested for quality and all bugs discovered were removed.
  • The multi-threading logic was completely rewritten. Now it’s faster than ever before.
  • Audio is now using NDK.
  • PPM correction, audio gain setting
  • A lot of bug fixes and UI enhancements
  • Experimental x86 support
sdtouch
SDR Touch Screenshot

Receiving, Decoding and Decrypting GSM with the RTL-SDR : YouTube Talk and Slides

A few days ago we posted about how Domi aka Domonkos Tomcsányi wrote on his blog about decoding and decrypting GSM signals from your own cell phones. Domi also did a talk at the CampZero conference which has now been uploaded to YouTube. His slides can be obtained from this link.

CampZer0 // Domonkos Tomcsányi: GSM - have we overslept the last wake-up call?