Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/464 Thanks!
Those two gentlemen would
love to present you now a
tad bit about broadcasting of pager
messages worldwide over
Iridium satellite.
This is of specific interest to me
because that
is a widely used on
oceans to communicate with drones
and autonomous vehicles.
So let's see what
I learned from this talk.
And I hope you learned something as well.
Have fun with Zech and Schnieder.
But thanks for coming out here and
we only have half an hour, so this will
be rapid fire off slides and
we will publish everything we have after
this talk. So don't be afraid
if you don't get everything right now.
So what is this talk about?
It's about Iridium, Pateros.
This is one example.
And yes, the talk is called
hacking iridium pagers.
And we actually did that.
We had a look at iridium pagers.
But and you also
found interesting stuff.
I mean, maybe some of you are familiar
with the CALIPSO chipset use and GSM
phones.
This seems to be predating that thing
and it's inside the Iridium pages.
But really we focused on.
Thank you.
Their interface to Iridium
satellites.
This is an Iridium satellite.
It flies across
the earth and it sends down lots of
interesting things.
Part of them are iridium pager messages.
And why would you look at the Iranian
Pedros now?
Well, the interesting thing about Iranian
pages is that they are completely
passive. The Iranian network does not
need to know where or a pager
is exactly the only need to know roughly
where it is. There are maybe eight zones
in the US and countries in
Europe and there are even larger
zones for message delivery,
for example, half of Europe or something
like that. You could travel around in
Europe and always receive early on Pedra
messages.
Why is this interesting now,
given the talk yesterday, you know that
basically anyone with access to S7
can track cell phones.
Do you want to be tracked?
I don't think so.
Do you want to be notified if something
happens and you get that message
basically instantly?
I guess so. Iridium pagers are
an option to do that.
Now, some basics about the Iridium
network.
It needs at least 66 active
satellites in low earth orbit.
They are constantly circling the Earth.
You can see a satellite for roughly eight
minutes at a time when it comes
up at the horizon and goes down at the
horizon again and
orbits go over the poles.
So you have absolute global coverage
of Iridium.
Iridium is located somewhere between
GPS and GSM.
You can see that the iridium frequency
span is quite narrow.
It's just about 10 megahertz
compared with GSM.
It's nothing.
It's it's not a lot.
So you can capture the whole iridium,
the frequency span with a single SDR with
no no trouble.
The band itself is partitioned
in a lot of suspense and
lots of them are used for transmitting
voice and data, communication,
all of that stuff. But there are also
some special channels
in the upper part, which are potentially
only downlink from the satellite to
Earth.
And we are focusing on the primary
messaging channel.
This is used for radio and Pedre
messages.
So one part of this talk
is also that, you know,
when we started working on this nine
months ago while driving to some
C.C.C.
event, we thought,
well, OK, we can try it and have a look
at it. But this stuff isn't that really
hard, really hard math.
And anyways, everything is encrypted
anyways.
But the thing is.
Why so, why even bother?
But the thing is, it's not
all of these systems, a lot of these
systems are unencrypted and SDR is not
really that hard.
I had some theoretical background from
university. I've never applied it.
It's years ago.
And now looking back, I
can say you should look at SDR.
You should look at satellite
communications and everything, all of
this stuff. It's not that hard.
You just need persistence a little bit of
time and you need to get used to
your tools. But the tools are so
available now.
For example, if the hacker RF you can
generate take notes, look at them, test
your circuits, look at your tools,
simulate stuff.
It's really, really amazing.
Now we thought, well, OK,
if I'm iridium on page, I can receive
Pedra messages indorse.
Well, we can do this decent
a piece of wire, go outdoors and sniff
something.
Well the thing is, that's not
the case really.
We have to learn the hard way.
We looked at lots of of
data and didn't see anything.
So luckily at the Munich C.C.C.,
we had some hardware available.
It had some GSM data boards.
And as you saw, GSM is kind
of in the region of Iridium.
And the data voice was were
capturing that frequency band.
And we also had some quite wide band
antenna, which was a good directive,
and we tried that.
Now, turns out that's also
not really the ideal setup.
You have to track these satellites.
And we learned about circular
polarization, which is not used by this
antenna. It gives you this less gain and
it's not optimal.
So we started throwing money at
the problem and bought some proper
iridium antenna. You can just buy them
there off the shelf.
They cost around 50 euros if you buy
them at malls or something like that.
We also bought some blocks from mini
circuits to block the GSM
and GPS signals and then
an amplifier to boost the signal
above the noise floor of our
of our receiver.
We didn't really know what we're doing,
really. I just bought some blocks
and well, we went to
the roof of this stuff.
This is the roof of the
CCC. And we have the nice option
to just go up there and do anything and
sell antennas in the middle of the night
and we'll work up there.
And behold, we actually found something.
Now you can see two peaks
here and this is frequency
versus power.
You can see there are two distinctive
peaks. And when you look these
up from the frequency perspective,
you see, OK, one of them is does ring
alert, which is used to telephones
that there is a call for them.
And the other one is the primary
messaging channel. And you can see the
primary message channel is a little bit
stronger than the ring a lot because the
satellite Senate with more power so
the pagers can receive the pager messages
indoors.
You can also see that the peaks are
they are wired.
The reason is that there's a lot of
Doppler chef and these satellites come up
at the horizon and go down again.
They changed their
speed
relative to you a lot.
And that means that there's huge Doppler
shifts and changes in frequency.
Also, we didn't know at that time really
know how to cope with that.
But that's a signal.
All right.
And we looked at it
in borderline and you can now see time
versus frequency and the colorist
power. Can you spot the signals?
Can you spot a signal?
Maybe.
So so there's a lot in there.
And if you zoom in, oh, there's at least
three.
So we zoom in more
and we see this.
This is actually a signal from Iridium.
It's already impact.
And if you dissect this packet and you
look at it and you search a
few patterns and you realize, OK, there's
a preamble and there's a unique word
which uniquely identifies iridium packets
there you can look for this specific,
unique word which is encoded in this part
of the signal and say, yes, we found on
radium packet.
Then comes the data section and something
which we, after some time figure out must
be some kind of lead.
It's always the same thing at the end of
smaller packets. We don't know what it
is, but it's always there.
Now, if you massage the
signal a little bit and you
preprocessor post-process it,
you get to this kind of
visualization of the packet and you can
see that there's the preamble.
There's nothing going on.
There's a unique word which is somehow
boringly encoded.
There's some entropy
in there. But if you really look at the
data section, you see that the signal
starts to get very weird.
And that's because they use two different
kinds of modulation, basically,
and these packets.
Now, how much do we have to
invest to sniff Iridium
and get this kind of stuff?
Well, you can go all out.
You just bring us up to 100.
That's the cheapest one from ETAs, 700
euros. You get just an antenna,
50 euros and you end up at the 800
euro range. Maybe you want to.
By an amplifier and then you got
really good signals or you can go the
cheap way.
Actually, some of the ideas can
go up into the frequency range at one
point, six gigahertz hit an amplifier,
self build antenna.
I have some of these here, and I'm not
sure if you can switch over to the GoPro,
but.
You can buy these parts
here just
from mouther. They are five dollars or
something like that, eSolar on an
connecter, no problem.
This thing is as good as a commercial
radio antenna.
You can also build your own amplifiers.
This thing has a material price of around
maybe five euros, also
that not much money, and
we still have to calibrate
ourself a little bit for the year, but
you can really work with them now.
We have to take notes from space.
What do we do with them?
We have to decode them.
And SEC is going to talk to you about
how to look at these packets, how to
make sense of them and see what we
can actually do with Iridium.
So we have these signals and
then you start searching the Internet
for information about them and you find
stuff like this, this is a slide of
Iridium confidential flight deck, which
is on the Internet.
And it says the
sniffing is probably
beyond the reach of all but most
determined adversaries, which is like,
oh, I like to do that.
Just we we started to look at the signal.
This is the frequency of
the received packets where we have signal
over time.
And there you can see the Doppler shift.
We have to to turn off the ring
alert and the messaging channel.
And as the satellite flies over you,
the frequency you see
the packets that changes and
then you can go and pick one of the
frequencies
and use a
simple toolkit to plot what you expect
to be where they're expecting.
And it's a good match, at least
if you use like a
five percent lower light speed
for the calculations.
But it matches.
We are we have some tools written.
Uh, this is a short overview.
That's one tool called Runner, which just
basically captures the data from the user
and writes it into a big file.
Then there's which Schneider wrote that
that detector, which goes over the file
and looks where the signal is high
enough. So we receive something
and cut it into small little pieces.
And then there's the cutting down mix,
which, uh, conditions the
signal does some
signal magic
and outputs the signal mixed down
to the basement.
Uh, and the demodulator
just does the kupinski
modulation. The Iridium signal is
Kupinski modulated.
Most of the time there's a part which is
PBSC modulated, but if you
just stuff it through Kupinski,
even the letter, it's the box.
You just get a little bit extra bits.
So then you get bits after running these
tools and you can stare at them.
I replaced all the zeros and of course,
because then you can see the difference
between zeros and ones better.
If you sort them by length, you
can see a little bit of structure
and then you can the better bits.
They look like this.
And as I said, we send packets
with big piece and
now you can look at them and try
to see if you see them replace the zeros
for and of course, maybe you can see them
now.
Yes, here they are.
And if you look at the signal like
this
is them, you see
there's some bits in between.
So there's probably still some error
correction.
The most probable thing, Solomon, or if
you go to the Wikipedia page and read all
the stuff because you have never heard
about it and you
realize that there has to be a generator
polynomial.
Yeah.
And
the math to get to to to
build one for a specific case is
tiresome and not really easily
understandable.
But if you look at it really hard, you
realize it's just an indigent binary
number one day longer than the checksum
is. And we had
12 bits possible for the checksums.
So brute forcing 12 bits
is, what, two seconds?
Just try it on your packets and you
notice. Yeah, the number 1897
matches for most of our packets.
So we found to be checksum,
which is this polynomial.
And it turns out one of the bits is
not actually part of the text, but this
is a parity bit.
I don't know why they use that.
It called and then
I heard a bit, but they do.
And if you know what it is, then
you can search on the Internet and find
one document that says, yay.
So the layout is.
The loudest like this is
a discrediting block is 64 bits
long, and it contains two part, two
times the same part after each other.
It's the payload, the checksum and the
parapet.
The first bit is separate because it is.
Part of the checksum is normal, but
most of the package structures we found
do not actually use the spit.
As you can see the piece do not
use this, that the message part does
not use this, but I don't know why.
But it is.
That's it.
And then
we take a look at the decoded message.
So we have to bitstream now
and removed all the checksums
and we have just bits.
And then you try to find out what
the format is. And this is an example
packet. That's a pager message packet.
So you have some fields,
the block, the frame and the group number
which tell us where inside
the bigger iridium protocol
the packet is that
if you want to read the message, it's not
really important. It's important for the
pager, which only wakes
up every 20 seconds and tries to
know when it has to wake up next.
There's a length information in there.
There is.
There's some fields that are always zero.
There's a field that we still do not know
actually in the last few days.
It is a checksum,
but I have not really realized how
it's calculated.
But you can kind of see that
Flip's mirrored in there
and you have other stuff like
the message Anex, a pager
message that is longer than about 60
characters gets up, split up in
multiple packets.
This is the most convoluted way
to specify how many
packets there are in the message
that I've ever seen.
So this message is
part two of two packets.
So they start with one bit to
tell you, yes, it is more than
one message.
Then you use four bits to specify
how many bits you need
to encode, how many packets
there will be.
So it needs one bit.
Then we have two times.
One bit, which says it is the second
message of two.
In this case, if you just
write the numbers directly in the stream,
it would be shorter.
But if they want to do it,
they can do it.
Then we have checked some
over the complete message and
sequence number, which is used by a pager
to know if it missed a message
or if it's the same message again,
so it can tell you how
you received the message.
But you have missed one in between
because the pager has no back channel.
And if it misses the message, it's gone.
So the rest of the
package is not very interesting, it
contains the message and
the if the message is complete,
but the package, as long as it filled up
with ASCII three, which is
end of text and
the descrambler block is forty six point
sixty four bits long, and it's filled up
with one bits if it's not used.
So this is the new overview of the tools
after the demodulator, there's a script
called Iridium Parser which
tries to pass the message into the
Snice class diagram
and has basically
messages that contain
Pedro messages or just meta
information and also
a first attempt at parsing the regular
channel messages that is not yet
completely complete.
About the timeline we started, as
Schneider said, nine months ago,
we were driving to the
east, I was driving to the east with a
friend who had one of those pagers,
and we were thinking, well, this is
old and maybe not encoded
and interesting.
And as you do, you just
sit around and talk about it.
And a little bit later,
the second person said, Oh, that's
interesting. Which was Schneider.
And we started really doing stuff
and went out and bought the antenna.
And about a month later, we
finally got our first signal.
That was a real boost.
Then we try to
do something with the signal we did in
radio, a radio companion.
The unfortunately, it turns out it's the
radio companion is really well suited
for continuous signals.
But as you saw, the Iridium packets are
really short and
well.
We had no prior knowledge and we didn't
get anywhere with new radio.
We just dumped the signal out in a file
and started writing our own tools to work
with it.
Then we spent three and a half months
staring at bits until we realized,
no, there is no K
equals seven error correction code.
And like three days after we realized
that we had the first bits and
now we're at Congress and
we can read the
Pedre messages and read some
of the regulation.
We have some statistics.
We have one receiver at our hackerspace
which captures whatever comes down.
Since we started, we've seen
a hundred and nineteen unique recipients.
The number one recipient receives 16
percent of the messages in the
first five for it's
about half of the traffic.
What you see is most of
the traffic is encrypted,
some base64 strings are
similar.
We have no idea what that actually is.
We've made some attempts to
look at the encoded message, but it's
just binary garbage then.
And we have about 60 percent of
person we want to here,
about 12 percent
messages containing the word test or one,
two or three or something like that,
about three percent.
Call me call me back urgently,
four percent.
That kind of military nature
is like call Sergeant Andrews
back immediately or
sitrep at 800
or something like that or
raise your antenna higher.
We can't read you.
Oh, yes.
If you want to know more about those,
come back later.
And, uh,
about six percent regular messages
like, oh, the weather is fine.
Or I got my internship yesterday.
So there's still lots of stuff
to do. Uh, we still
haven't decoded the whole protocol yet.
There's also voice communication.
There's a few gotchas like
the algorithm that there is
supposedly some security there.
What we found in the documentation is
they use a three four authentication
security.
They say also taxation, security, that
makes me think, OK, the voice
is probably not secure, but
we don't know and they use a voice
codec, which is a proprietary
and be familiar voice codec.
We don't know anything about it.
But the ultimate GMAR
people are quite knowledgeable.
So we have contacted them and we might
try to look at this further.
There's also a part called
Childbirths Data, which transmits
data over the Iridium signal and
channel.
Uh, there are more modern
hajra like things which can talk
back to the satellites, which
which do not use the pager
channel to transmit the messages.
But this Shortbus data channel,
we have not not really an idea
where it actually is, but we haven't
looked at it. But that should be
interesting, too.
It's also used for aircraft
communication,
stuff like also like Inmarsat,
if you remember the stuff about the
missing plane and they said, oh, there
was this last ping.
Iridium does something similar to but
there's not much documentation out there.
And then there circuit search data of
over Iridium.
But we have to look at that.
And we're already coming to an
end of the talk, we will be
having an official workshop for
loops for
people who have no idea what they are and
we want to show it's really not that hard
to get started.
It would be in 30 minutes and all 13,
bring your laptop if you have radio
installed. It's good, but you don't need
it. We have a virtual box
installation.
If you're interested about SDR anymore,
there is an SDR con on your COSWELL,
which is, I think, Meyerhold.
We also have some equipment at our
assembly, like an USCAP
be 200 and a network analyzer, a
portable one.
The code is on top.
That's actually a lie. It's not yet.
Don't get up. But I will push it after
the talk.
Uh.
And this is a call out to
all of you.
There is a document called Iridium System
Specification or the Iridium Radio
Link protocol specification, if
anyone happens to have it
lying around somewhere.
We would really be interested in
acquiring this.
That would make our life quite a bit
easier.
Uh.
There is our there email addresses and
our fingerprints, we are we
will ask no questions of any of those
documents are in our inbox.
Also, any other documentation that you
might stumble across that
it's not as public as
the rest.
And I think that's the end of our talk
like.
I think we have two minutes left.
Yeah, we have even three or four minutes
left. So questions queue
up fast behind the microphones.
And while you do that, is that a question
from the Internet?
One awesome.
Please let us hear the question
from the Internet.
OK, after just.
Question for the speakers, anything about
the legal side of making the dream
available over the Internet?
But the data
is sent down from the satellite.
Unencrypted everywhere, you
don't have to send something to a
satellite, you just have to listen.
So I don't think actually listening
to it is illegal.
I don't know if rebroadcasting
it would be a problem.
I don't think we're going to do that yet.
The tools we don't plan that the tools
are out there. You can listen to it.
We're not planning on publishing
this data.
We receive any further.
But if you capture your own, you can work
with.
So we have to station in Munich
and it captures basically everything for
Germany. You set up another station
somewhere in Germany, you get the same
thing.
It's your decision if you want to
broadcast anything.
So microphone number three, please
ask a short question, just
a remark or a foreign intelligence agency
says stuff to intercept
from the settlers is actually intercept
in space for German law doesn't apply.
Oh, thank you.
Yeah. I mean, you could argue,
well, these things are out there in
space.
And is it are they owned
by someone maybe,
I don't know,
on microphone to
say hello.
OK, how do you actually send
those messages, because this is
just a pager so you can send them through
the Internet or. That's a very good
question.
And the interesting thing is that if you
have a number of pages that numbers,
it's associated to that contract.
You go to a website of Iridium,
the company, you type in that number,
you type in your message, you hit send
so that basically it's free for you to
send messages.
As long as you have a valid number,
you can send messages.
And if it's not a valid number, the phone
will tell you.
And there are seven digits long
and.
Please remember, all of this stuff is
going through a US uplinks,
and please also remember anyone can
read it.
So it's completely unencrypted.
So are there any more questions from the
signal angel?
No, no, no further questions.
Thirty something.
Oh, yeah. Microphone five ringing
So nice maybe to go ahead.
Maybe I missed it in the protocol,
but it's possible to see
what and number was actually paged
in the message.
Uh, the the, uh,
the air interface uses a radio identifier
called we we can't
map the radio identifier code to a number
back that's done by the
company somewhere.
Well, not yet.
Who knows what's happening on these other
channels.
Yeah. As far as we know.
So you can identify.
OK, it's a message to the same person
again, but you don't know the number
unless you sent him something
like a one time token.
And see this number is this
radio identifier code or you
just if you have a pager, there's a
manual for you can read the radio,
identify it if you want to.
OK, last question.
Microphone five,
OK?
Only one shot.
OK, now it works.
Only one shot question.
Did you try creating packages
to pitch the Patra
you have?
We did not yet try that.
It the creating a correct packet
is not difficult.
The thing that maybe a little bit
problematic is, as I said, the pager to
save power only wakes up every 21
seconds to listen to the
satellite, which tells
him that there will be a message and he
has to listen at another point to
actually get the message out.
And you probably have to get that packet
correct to get the message
to the pager.
But that should be probably
be doable in like two days of trial
and error on coding.
Yes, and it's no question of signal
strength. You will easily overpower the
satellite.
OK, thank you.
Thank you for this awesome talk on Q&A.
I would like you to clear the roads
now because the next talk is coming up
shortly and.