Sniffing GSM traffic with HackRF.

While my friend and colleague Simone was visiting our ZIMPERIUM – Enterprise Mobile Security TLV office, we got our hands on HackRF and hacked together the unguarded boarders of Radio Frequencies. Simone had the great patience to try and explain me the boring world of complex numbers and friends (more on that here), but my dyslexia won over again and left me to fill the gap by following Simone’s steps (and some mistakes, eh Simone? 🙂 ) and use my ‘trial & error’ approach until success. This tutorial is the result of our collaborate GSM hacking session, presented with the hope it will be useful for others.

Tools used:
Install Requirements:

First thing, you want to make sure you have all the required software installed, you can install most of them and their dependencies using your distribution package manager. Let’s start with the libraries and tools for the hackrf itself, on a Debian/Ubuntu distro you’ll install them like so:

sudo apt-get install hackrf libhackrf-dev libhackrf0

Once these libraries are installed, you can plug your hackrf into one of your USB ports and execute the hackrf_info command, at this point you should see something like the following:

# hackrf_info

Found HackRF board.
Board ID Number: 2 (HackRF One)
Firmware Version: 2014.08.1
Part ID Number: 0x00574746 0x00574746
Serial Number: 0x00000000 0x00000000 0x14d463dc 0x2f4339e1

You will now install gnuradio which is the software we’ll use to decode the RF signals, gqrx a tool to visualize signal power on certain frequencies and everything else that will be needed in the next steps:

sudo apt-get install gnuradio gnuradio-dev gr-osmosdr gr-osmosdr gqrx-sdr wireshark

Proceed with gr-gsm, the GnuRadio blocks that will decode GSM packets:

sudo apt-get install git cmake libboost-all-dev libcppunit-dev swig doxygen liblog4cpp5-dev python-scipy
git clone https://github.com/ptrkrysik/gr-gsm.git
cd gr-gsm
mkdir build
cd build
cmake ..
make
sudo make install
sudo ldconfig

Now create the file ~/.gnuradio/config.conf and paste the following contents into it:

[grc]
local_blocks_path=/usr/local/share/gnuradio/grc/blocks

Finally install kalibrate-hackrf, a tool that will hop among known GSM frequencies and will tell you which your country is using:

git clone https://github.com/scateu/kalibrate-hackrf.git
cd kalibrate-hackrf
./bootstrap
./configure
make
sudo make install
Finding GSM Frequencies:

Each operator in each country uses a different frequency in the GSM possible spectrum, which usually starts from 900Mhz. You can use hackrf_kalibrate to find the frequencies you want to sniff:

./kal -s GSM900 -g 40 -l 40

Note the two gain values, those are important in order to get some results. Leave kalibrate running and after a while you should see an output similar to this:

kalibrate

You will have to use the proper GSM parameter (‘-s’) to correspond to your local operator. Consult this list for verification.

Sometimes you might want to see the frequencies in order to ensure correct results from hackrf_kalibrate, or to save yourself from calculating the correct frequency given by hackrf_kalibrate (notice the +/- Khz sign of each result – this means the top peak with the corresponding power,not 100% correct frequency). Open gqrx and tune it to the first frequency you got from hackrf_kalibrate, for example 940.6Mhz, and you’ll see something like the following picture:

Waterfall

In the above screenshot you can visually see the activity is around 945Mhz.

Once you know the GSM channels frequencies, you can start gr-gsm by running the python script ./airprobe_rtlsdr.py or load the airprobe_rtlsdr.grc file using gnuradio-companion and set one of the channel frequencies you just found in the frequency field. Don’t forget to add ‘gain’ value again, move back to the frequency field and start pressing the UP/DOWN arrows on your keyboard to start scrolling the frequencies in 200Khz steps until you start seeing some data in your console window. The whole process should look something like this:

gr-gsm

Now you only need to launch wireshark from another terminal tab with the following command:

sudo wireshark -k -Y 'gsmtap && !icmp' -i lo

If gr-gsm did his job, you should be able to see decoded GSM traffic sniffed by your hackrf.
Wireshark

24 Comments

  1. But what exactly is innovative in getting the GSM broadcast channel? Too many done it before. All testing equipment and modem manufacturers does it better and 20 years back.

    Unless ofcourse your final goal is to exploit those poor Chinese modems.

  2. I did according to your instructions, and it works.
    However I can’t seem to get the Master Information Block, have any idea why?

  3. helo..
    How we can capore whole frequency..
    bts give 30kb for 1 user so 1000 users took 60mb per second..
    So how we can capore it.

    1. if u mean ‘capture’ – well, we can’t. we can’t capture a whole spectrum using HackRF and other SDRs – only a specific channel at a time. For more robust capturing you will need to use better hardware.

  4. oh 1 channel..ok..
    i have 500gb hdd..

    1. realy i want is how much data can be carried in a frequency..is there any formula to calculate it.
    2. how much memmory needs for 1 channel of gsm per second…
    3. How much users can be in 1 gsm channel.
    4.. How diffrent opersters can active in 1 location.is arfcn divided them.

    1. good questions, but I’m afraid I don’t have answers for you.
      My only advice is for you to test this for yourself – as I demonstrated, it ain’t difficult.

  5. Goodwork my friend. Hopefully we will all ensure that highlighted issues rae fixed by these operators 🙂
    Count me in your fan club also

  6. Dear

    I would like to do the same test using my RF Explorer device but I do not have the library like you have for the HackRF. I have been trying to get something since 3 days and I am lost. Could you help me please.

    Thank You

    1. Hey friend,

      Sorry I don’t have any experience with RF explorer. Since the HackRF is just the SDR I used here, and ensuring the RF Explorer supports GSM band, I think with some work this should/might be achievable.

      Best of luck.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s