Most active commenters
  • wkat4242(8)
  • seba_dos1(3)

←back to thread

LTESniffer: An Open-Source LTE Downlink/Uplink Eavesdropper

(github.com)
256 points transpute | 28 comments | 22 Oct 24 00:42 UTC | HN request time: 0.612s | source | bottom
1. wkat4242 ◴[22 Oct 24 03:00 UTC] No.41910794[source]▶
Too bad the hardware for this is eyewateringly expensive :'(
replies(6): >>41910955 #>>41911076 #>>41911108 #>>41911306 #>>41911470 #>>41911593 #
2. teruakohatu ◴[22 Oct 24 03:33 UTC] No.41910955[source]▶
Seems like if you had a PC already, you could get away with a bladeRF 2.0 micro xA5 for $670, but this can sniff downlink only.
replies(2): >>41912123 #>>41912640 #
3. RachelF ◴[22 Oct 24 04:01 UTC] No.41911076[source]▶
Yes, there is cheaper hardware like the Adalm Pluto with enough bandwidth and dynamic range, but it is not supported by the looks of things.
4. superkuh ◴[22 Oct 24 04:10 UTC] No.41911108[source]▶
For those interested in a more accessible LTE meta-data decoder check out https://github.com/JiaoXianjun/LTE-Cell-Scanner which can work with even cheap rtl-sdr dongles (for some things). It is a fork of an older https://github.com/Evrytania/LTE-Cell-Scanner
replies(1): >>41912117 #
5. binary_marbl ◴[22 Oct 24 04:53 UTC] No.41911306[source]▶
What does it require?
6. tinix ◴[22 Oct 24 05:32 UTC] No.41911470[source]▶
It uses srsRAN which supports SoapySDR which is vendor agnostic.

this should work with limesdr as well.

for something cheaper, try antsdr or adalm-pluto: https://github.com/srsran/zynq_timestamping

lots of good notes here: https://www.quantulum.co.uk/blog/private-lte-with-analog-ada...

replies(1): >>41912111 #
7. HeatrayEnjoyer ◴[22 Oct 24 06:01 UTC] No.41911593[source]▶
True? How are phone modems inexpensive?
replies(4): >>41912014 #>>41912121 #>>41914230 #>>41914861 #
8. paweladamczuk ◴[22 Oct 24 07:28 UTC] No.41912014[source]▶
I'm wondering the same thing.

Can someone outline the architectural limitations of using a smartphone modem for such network debugging/sniffing tasks?

replies(1): >>41913046 #
9. wkat4242 ◴[22 Oct 24 07:46 UTC] No.41912111[source]▶
I thought it needs 2xUSRP if you want to receive both sides? And it's a lot less useful without that.
replies(1): >>41916360 #
10. wkat4242 ◴[22 Oct 24 07:46 UTC] No.41912117[source]▶
Huh how can that work? It's only got 2Mhz bandwidth. An LTE cell is much wider.
replies(1): >>41912216 #
11. wkat4242 ◴[22 Oct 24 07:47 UTC] No.41912121[source]▶
Simple: Mass production, dedicated hardware for that single purpose (but not able to do full monitoring like this).
12. wkat4242 ◴[22 Oct 24 07:47 UTC] No.41912123[source]▶
Yeah for me that is already eye-wateringly expensive :) (Being in Spain where purchasing power is low).
13. dezgeg ◴[22 Oct 24 08:05 UTC] No.41912216{3}[source]▶
Possibly it's decoding MIB only, which is only 1.080 MHz wide.
14. fhsm ◴[22 Oct 24 09:32 UTC] No.41912640[source]▶
> xA5 for $670

No longer for sale (out of stock with no plan to restock https://www.nuand.com/product/bladerf-xa5/ )

15. wkat4242 ◴[22 Oct 24 10:53 UTC] No.41913046{3}[source]▶
Smartphone modems (baseband) are super optimised for battery life. They don't send any traffic that isn't meant for the device itself on to the CPU. That would only cause unnecessary load.

They could perhaps be modified to do that but the baseband firmware is usually very closed source.

There is only one example I know, there was one particular dumbphone from the 2G era for which the baseband sourcecode was available due to a hack. You could use several (one for uplink and one for downlink) of these with modified firmware to sniff 2G traffic. I forget which model it was exactly but obviously the price ballooned on eBay :)

Haven't heard of this happening with later models. Baseband sourcecode firmware is really rare.

replies(3): >>41913546 #>>41914178 #>>41914398 #
16. motrm ◴[22 Oct 24 12:25 UTC] No.41913546{4}[source]▶
Certainly Qualcomm modems can have their diagnostic mode enabled when you have access to /dev/diag - usually on rooted devices but occasionally on stock.

You can ask the processor to send higher layer information via diag, including the messages the base stations send. There’s also commands to lock on to a specific base station so you’re not constantly moving from cell to cell.

There’s plenty of commercial devices that use this functionality to provide network monitoring and management capabilities for mobile network operators checking out base station functionality in the field. TEMS comes to mind for that but they’re certainly not the only ones.

It’s a deep rabbit hole :-)

replies(2): >>41913996 #>>41915475 #
17. ◴[22 Oct 24 13:23 UTC] No.41913996{5}[source]▶
18. throwawayC123 ◴[22 Oct 24 13:42 UTC] No.41914178{4}[source]▶
You may be thinking about the Motorola C123. Back in the days, you could use it to dump TMSI and IMSI using OsmoconBB : https://osmocom.org/projects/baseband/wiki/MotorolaC123
replies(1): >>41915510 #
19. mytailorisrich ◴[22 Oct 24 13:48 UTC] No.41914230[source]▶
Phone modems (software + hardware) are very expensive to develop and only inexpensive to purchase because of the staggeringly high volumes and the fact that they are highly integrated.

This is the main reason why the number of suppliers as massively dwindled: Large upfront investments are needed and only recouped if you manage to sell 10s if not 100s millions of units.

20. beeboobaa3 ◴[22 Oct 24 14:03 UTC] No.41914398{4}[source]▶
> Haven't heard of this happening with later models. Baseband sourcecode firmware is really rare.

You know what they say. "If you have nothing to hide, you have nothing to fear"

So I wonder what they're trying to hide from all of us. Probably all the backdoors and glaring security issues.

replies(1): >>41915032 #
21. ajsnigrutin ◴[22 Oct 24 14:48 UTC] No.41914861[source]▶
Because they have to do only one thing, and literally billions are produced every year, so if qualcomm spends 1 billion for R&D, the modem price will only need to be $1 "higher" to cover the r&d cost... if SDR development costs $1 mio (and that's basically zero for hardware design), and 10k units are sold, that's $100 per device in R&D cost.

(numbers simplified and rounded to make an example)

22. transpute ◴[22 Oct 24 15:07 UTC] No.41915032{5}[source]▶
https://hackaday.com/2022/07/12/open-firmware-for-pinephone-...

> With the PinePhone modem.. It was quickly found that the Quectel modem ran a stripped down version of Android on its ARM core, with adb shell available over the modem’s USB interface. When a few adventurous hackers started probing it and got shell access, they found tools like ffmpeg, vim, gdb and sendmail compiled in – certainly not something you’d need on a cellular modem, but hey.

replies(1): >>41916007 #
23. wkat4242 ◴[22 Oct 24 15:45 UTC] No.41915475{5}[source]▶
The diagnostic mode just lists the cells and their parameters afaik. It doesn't capture IMSIs or traffic to/from other devices like this does. It's like the network diagnostics menu built into Samsung and Apple phones.
replies(1): >>41916123 #
24. wkat4242 ◴[22 Oct 24 15:48 UTC] No.41915510{5}[source]▶
Yes, that was the one! Thanks!
replies(1): >>41915964 #
25. seba_dos1 ◴[22 Oct 24 16:28 UTC] No.41915964{6}[source]▶
FWIW, the same chipset was used as a modem in the Openmoko phones.
26. seba_dos1 ◴[22 Oct 24 16:31 UTC] No.41916007{6}[source]▶
EG25 is an IoT modem and those tend to expose some extra functionality such as HTTP clients or TTS synthesis over AT commands. Some even document how to compile and run software on them - though of course it's only about the application CPU and not the actual modemy stuff that runs on separate DSPs with proprietary signed Qualcomm firmware.

Most (all?) standalone modems are basically screenless smartphones/SBCs with integrated modem these days.

27. seba_dos1 ◴[22 Oct 24 16:44 UTC] No.41916123{6}[source]▶
It isn't even able to list some crucial parameters needed to identify neighboring cells. It's simply dumping data that's already used by the modem for its regular operation.

It does, however, more than just "listing cells" though. You can sniff all the comms, but only between your device and the base station. It won't listen to anything else, you need SDRs for that.

28. AnarchismIsCool ◴[22 Oct 24 17:08 UTC] No.41916360{3}[source]▶
Pluto and USRP are almost exactly the same thing at this point, just USB2 vs USB3 so you're limited on data rates outside of the device an technically a different chip but they're an old node and binned, so they're the same in practice. You can still install an external clock into the UFL connector on the Pluto though so you can sync a few if you want or use a GPSDO for frequency accuracy. You can also install the extra Tx/Rx pair onto the UFL connectors they added recently-ish.