How to Build Your Own Rogue GSM BTS for Fun and Profit

Re:How to Build Your Own Rogue GSM BTS for Fun and Profit by iheartmemcache on Saturday April 02, 2016 @10:49PM (#11414676)

So, when you refer to 'restricted to nothing >928', I presume you mean side-band harmonic tone spill. To answer your question: I have no idea, but here's my educated guess based on the '08 auction[1] -- absolutely. I'm presuming that Verizon wouldn't pay billions of dollars for 2 6 mhz bands if they couldn't use it without violating FCC's "don't jump into my band, bro" stuff. Block A has 698–704 and 728–734 MHz. So, they're presumably using 6mhz here, another 6 mhz there (channel trunking) but they're definitely keeping within a 6mhz range. Granted you get a bit more of spectral content within a 700mhz band compared to the 900 to 928 range[edit: uh, per hertz obviously haha], that's still a massive band [edit: again, referring to the content you can fit per hertz; without actually running numbers, I'd gut-feeling-estimate that you're losing maybe ehh 30% capacity, so 900 to 928 is more than enough to operate a full 2G antenna].

RE: The dearth of information: Forcibly opening up? As in like, violating FCC rules? I mean, the knowledge is out there and readily available on the public internet if you know where to look. You can still find o-chem forums with PhD students talking about the manufacturing of research chemicals, but its masked in their own lexicon (an idiot can't just Google "how do i make {insert designer drug of choice}", but you'll find a lot re: "wacker oxidation of foo in bar" or "reductive amination in a Vigreux column").

Just like we've got specs and RFCs for all of our protocols, the mobile industry meets up and agrees on everything from MIPI standards (ever wondered how there are so many Chinese Android devices with so many different seemingly interchangable components like video cameras, GPS modules, etc? There's a spec everything). You could easily take over some of the 850mhz spectra for a day or two but a) what would you have to gain? I guess you could sell baseband equipment to private investigators for a huge premium, thats about it, b) even if you could monetize it, the FCC would storm in on you within a couple days, a week at most.

RE: devices hacked open - Shenzhen has everything.

[1] https://en.wikipedia.org/wiki/United_States_2008_wireless_sp...

[ Parent | on HN ]

Re:How to Build Your Own Rogue GSM BTS for Fun and Profit by mindslight on Saturday April 02, 2016 @11:43PM (#11414829)

I had forgotten how much the bands would be sliced up commercially, so yeah it makes sense that equipment can narrowly segregate. The two separate Verizon ranges are probably UL/DL, no? If you're messing with your own base station, then it seems like the phone would be the violator on the uplink frequencies, heh heh.

For opening up, fundamentally any device should be open to inspection and modification by its owner. But my specific desire would be to eliminate the fixed identifiers from the protocol, to restore some privacy of these tracking devices we expect to carry everywhere.

Homebrew hardware and a Free stack would be a massive undertaking and capital-intensive to distribute. So a better starting point would be some already-distributed piece of consumer hardware. I'd think there would be at least one device that got reverse engineered enough to create some community flash-it-yourself distribution. Perhaps I'm just not doing the right searches, but I just run across vague allusions from either people who are in the know and NDA, independents who dug in a bit but only published summaries of results, or commercial-oriented unlockers only interested in achieving their narrow result.

I guess I'm left wondering whether Qualcomm's hardware security really is that good to destroy the enthusiasm for such tinkering, or whether it's just their legal goons have so far successfully contained the knowledge to the secretive unlocking market.

[ Parent | on HN ]