DragonOS FocalX Cellular Security Research w/ LTESniffer (srsRan, LimeSDR, B205mini) part 1

[@OpenSourcerers]

With an opening disclaimer like that you know it's about to be a fun ride.

[@cemaxecuter7783]

It just never fails, all previous videos I’ve did that’s anything close to this I end up getting strikes. I just figured maybe it was my deliver, so this time I tried to make it super clear lol..

[@kiniras]

Could LTESniffer work on a Raspberry Pi 4B? Would be really interesting to see that.

[@cemaxecuter7783]

Unlikely. It’s just too much for it if I recall

[@cemaxecuter7783]

Unlikely, it’s just too much for it if I recall.

[@yazidkeraichia2858]

😊😊😊 great work.... ❤❤❤ thanks

[@RTL_INTEGRAL]

Didn't get how you integrated the LIMESDR. The paper says "LTESniffer requires USRP X310 with 2 daughterboards"

[@cemaxecuter7783]

*required when doing downlink + uplink, not when doing just downlink mode. The LimeSDR was running in downlink mode, like how it describes the b210 can be used.. except LimeSDR has only 1 antenna, so somewhat limited functionality but works.

[@cemaxecuter7783]

github.com/SysSec-KAIST/LTESniffer#general-downlink-sniffing

[@RTL_INTEGRAL]

@@cemaxecuter7783 Wonder if the LTESniffer produces output without running SRSEpc or SRSenb?

[@cemaxecuter7783]

Yes, it does. I was just running it against a controlled network, but it works against a real network.

[@RobVK8FOES]

Hi Aaron, did you encounter this error at all? "LTESniffer: symbol lookup error: LTESniffer: undefined symbol: srsran_sequence_apply_bit" And if you did, how did you rectify it? I have tried compiling from source on DragonOS Focal 20.04, and also installing the .deb via the repo on an earlier (not current) version FocalX 22.04 and got that error. Thanks in advance for the reply. I really would like to avoid having to buy a third USB thumb drive for LTE decoding 🤣(it works perfectly on a FocalX r30.2 virtual machine, but I want bare-metal!)

[@cemaxecuter7783]

Well so funny story.. I built the deb package incorrectly. It should be fixed this morning and will work when installed on DragonOS FocalX (22.04).. sorry about that. On the 30.2 ISO I figured out what I was doing wrong (can’t strip it down to just the binary)..

[@cemaxecuter7783]

I built from source on the older 20.04 build, but quickly switched to the newer DragonOS FocalX as the developer helped me get it going on the newer setup.

[@cemaxecuter7783]

Now I’m waiting on daughterboards so I can do the full downlink an uplink at the same time. Side note, someone sent me your gsm video, great stuff! I’ve sorta steered clear as once I started talking about that I got like a million messages for more info on hacking etc 😳

[@RobVK8FOES]

@@cemaxecuter7783 Awesome! So that means if I try to reinstall from the repo on my FocalX 22.04 bootable USB, it should be fixed? Good stuff! 😁 And lol, story of my life mate! If you produce cellular hacking content on KZbin and have a public email address, prepare to be inundated! 🤣 I have a trusty old USRP1 here, it had an RFX1800 daughterboard in it initially. I recently upgraded it with a clone RFX900 board from eBay for dual band GSM receiving. Surprisingly, it works really well! I will definitely try to use LTESniffer with it at some stage. Thank you for your continued efforts on the amazing DragonOS, Aaron!

[@cemaxecuter7783]

You should be able to install that 1.3.6 seb package here github.com/alphafox02/focalx_ppa/blob/main/LTESniffer_1.3.6_amd64.deb And it “should” find the incorrect binary, install stuff in /usr/src and then make a correct synlink to the binary in /usr/src/LTESniffer/build/src But all you need to do at the command line is type in LTESniffer and make sure that error is gone. I’m also reminded I need to share your videos more, but then be prepared for maybe even more emails 🤣

[@JB-123]

Is it possible to run this with a pi? I tried to download the LTE sniffer and ran into CMake problems.

[@cemaxecuter7783]

Not going to have enough horsepower unfortunately, I should say most likely that is.

[@JB-123]

@@cemaxecuter7783 do you know if the IMSI still work? I can’t seem to pick anything up with the Pi and hackRf for some reason. I’m using an AT&T phone. When I run grgsm_livemon -f 959.8M you can kind of see a signal, but it’s too weak to the noise floor. I’ve tried to adjust the gain and nothing changes at all. I cannot seem to figure it out. Any advise?

[@cemaxecuter7783]

The only gsm left in the US is PCS1900, unless you’re talking outside the US.

[@vincei4252]

Hi cemaxecutor. I installed DragonOS in a VMWare virtual machine last year to play with. The last version you shared with me I cannot run in a VM for some reason. VMware workstation instance just restarts over and over again at the boot step. Are you aware of the regression ?

[@cemaxecuter7783]

I’m not exactly sure which version you’re referring to. Please try 30.1, or is that the one you’re using?

[@vincei4252]

@@cemaxecuter7783 Sorry, I should have provided the info. It is DragonOS_FocalX_R29.1.iso I'll try updating to the latest and see what happens. I'm running VMWare Workstation 17.02. FWIW.

[@cemaxecuter7783]

@@vincei4252 I’ll give VMware a try on my side asap. I’ve confirmed virtual box is okay.

[@vincei4252]

@@cemaxecuter7783 That's great to hear. Thank you! Btw, I spent this morning getting my PCIe LimeSDR working in a Zima board SBC. It works surprisingly well with Ubuntu 23.04 Lunar Lobster and Kernel v6.X. Working on building a case for it and all the antenna jacks.

[@cemaxecuter7783]

Oh dang. I need one to play with!!

[@robgrimes5873]

it detects bladerf, but not limesdr 2.0 on ubuntu

[@cemaxecuter7783]

On normal Ubuntu or DragonOS?

[@cemaxecuter7783]

I need to get ahold of a 2.0.

[@robgrimes5873]

@@cemaxecuter7783 it didn’t seem to work fullt on dragon os. I tried installing the newerr lime code

[@Alex-x6q5b]

🇺🇸🔥🇺🇸🔥

[@devstroi]

Hackrf one its compatible?

[@cemaxecuter7783]

I’ve not seen it really work, but I’ll check again when I get my hackrf back.

[@zigfly3018]

​@@cemaxecuter7783I never got my hackRF one to work with this. It kept crashing with too high PRB error.

[@innerfire369]

Noting interesting in these packets?

[@cemaxecuter7783]

It gets way more interesting when you’re doing downlink + uplink and using the API. I think you’ll find interesting stuff in the downlink only too. I just didn’t have the UE (PinePhone) fully connected doing things with internet enabled etc.

[@cemaxecuter7783]

There’s example pcap files on the project page that you can setup Wireshark like I show and explore with.

[@hamadmusabeh]

@@cemaxecuter7783 planning to get the pine phone for these projects ,,, will the pro version be needed , or do you recommend a specific model.

[@cemaxecuter7783]

I have this one pine64.com/product/pinephone-beta-edition-with-convergence-package/ I had it connect to srsRan before with this shop.sysmocom.de/sysmoISIM-SJA2-SIM-USIM-ISIM-Card-10-pack-with-ADM-keys/sysmoISIM-SJA2-10p-adm I think I just edited the srsRan user database file wrong for this video, but that’s okay as I just wanted to show some basic downlink decoding.

[@vincei4252]

Please delete the comments that are designed to compromise steal information from anyone that clicks on the links.

[@cemaxecuter7783]

I always do or at least try to. I’ll go see which ones you mean.

[@vincei4252]

@@cemaxecuter7783 Thanks. Either you or KZbin have deleted them. The scammers are a plague on this platform.