[00:02.630 --> 00:03.910]  So, thank you very much.
[00:04.990 --> 00:13.750]  This talk will give you a background on what we did in the last two years, roughly, in Iridium satellite hacking.
[00:14.450 --> 00:21.210]  And you might know us, as mentioned, from the radio badge or the rocket badge from four years old.
[00:21.550 --> 00:23.070]  Sorry, five years and one year ago.
[00:23.550 --> 00:24.890]  And we're both from Munich.
[00:25.030 --> 00:26.290]  We're part of the CCC there.
[00:26.290 --> 00:32.450]  And we have been working on Iridium stuff for now around two years.
[00:32.810 --> 00:40.870]  And not only us, too, but also lots of help from the Osmocom, open-source mobile communication community, because they have quite some insight.
[00:41.190 --> 00:45.330]  And without them, probably, we wouldn't have been so far by now.
[00:45.950 --> 00:48.290]  So, quick introduction to Iridium.
[00:49.650 --> 00:52.010]  Iridium was built by Motorola in the 90s.
[00:52.410 --> 00:57.310]  And it's consisting of 66, let's say, logical satellites.
[00:57.570 --> 01:01.690]  Because at some point, some of these satellites failed, and they had spares in orbit.
[01:02.310 --> 01:05.210]  And some satellites failed in interesting ways.
[01:05.410 --> 01:13.970]  So, sometimes they have two satellites at one spot acting as one satellite, because something is broken on one satellite that is not broken on the other satellite, and vice versa.
[01:14.350 --> 01:16.150]  So, quite interesting stuff going on there.
[01:16.570 --> 01:23.330]  And Iridium is, really, the only satellite system, which has what they call truly global coverage, It works everywhere.
[01:23.610 --> 01:27.110]  Even at the poles, where the geostationary satellites cannot work anymore.
[01:27.670 --> 01:31.890]  And also across the ocean, where, for example, Globalstar can't work anymore.
[01:32.730 --> 01:34.810]  It has many different services.
[01:35.050 --> 01:39.630]  For example, one-way paging, where you have pagers which can just receive stuff.
[01:39.890 --> 01:43.750]  But it also has voice, SMS, data.
[01:43.970 --> 01:49.690]  At some point, they've added data, although it wasn't, I think, meant to be to do that in the beginning.
[01:49.690 --> 01:54.630]  And then also something interesting is that's new, time and location.
[01:55.030 --> 01:57.930]  They've introduced that, I think, in the last one or two years.
[01:58.450 --> 02:01.950]  I cannot see it everywhere, but it's somehow aiding GPS.
[02:02.230 --> 02:03.990]  And that's also somehow interesting.
[02:04.670 --> 02:06.810]  So what is Iridium used for?
[02:07.050 --> 02:10.370]  I mean, sure, they have lots of services, but there's also applications.
[02:10.710 --> 02:11.810]  Lots of tracking.
[02:12.030 --> 02:14.710]  So you see shipping containers being tracked.
[02:14.970 --> 02:17.410]  You see lorries being tracked.
[02:18.190 --> 02:21.130]  Of course, it's voice and data.
[02:22.350 --> 02:24.610]  And emergency services.
[02:25.010 --> 02:38.590]  So they have something, for example, like Iridium push-to-talk, which is basically for emergency services which want to quickly reach lots of people across some geography where they don't have necessarily lots of infrastructure.
[02:38.590 --> 02:40.110]  Aircrafts use the stuff.
[02:40.290 --> 02:47.050]  You can see it on sea gliders or buoyants, which measure stuff in the ocean.
[02:47.570 --> 02:50.450]  And also, which is maybe very interesting, covert operations.
[02:50.710 --> 02:56.530]  So they have some high penetration paging service, which reaches into buildings.
[02:57.070 --> 03:07.630]  And they also have this Iridium burst service, which is meant to be a one-way burst across potentially the whole globe where you can't really say who is the recipient.
[03:07.990 --> 03:10.790]  And it reaches deep into even buildings.
[03:11.710 --> 03:14.550]  And that was also our start.
[03:14.550 --> 03:21.930]  So roughly two years ago, Zach had the idea to look at Iridium pages.
[03:22.710 --> 03:24.790]  And he got me on board.
[03:24.790 --> 03:26.150]  And we started looking at the stuff.
[03:26.290 --> 03:30.490]  And we realized there's almost no public information available about Iridium.
[03:30.610 --> 03:45.170]  There's the decode systems page, which has some basic information about the channels, the used modulation, and some pointers regarding some FCC documents, but no detailed information about how the system actually works.
[03:46.530 --> 03:54.430]  What's also interesting, though, is that due to the fact that it has such a high signal strength, the barrier of entry is very low.
[03:54.670 --> 04:00.130]  Even the cheapest RTL SDR is able to receive Iridium, at least in theory.
[04:01.030 --> 04:09.750]  And then, yes, as I mentioned, paging services, one-way paging services are quite interesting because you're not giving up your location when you receive something.
[04:10.490 --> 04:19.690]  So people told us that at some point, WikiLeaks was using lots of Iridium pages because you can't really tell where the recipient is located.
[04:22.370 --> 04:42.450]  When you look at Iridium and you start thinking, oh, well, it's data and voice and whatnot, and they probably have lots of security in there, and you'll spend lots of time looking at it and probably not being able to crack it because, I mean, even moderate encryption is probably good enough.
[04:43.570 --> 05:00.490]  But when you look at the slides that Iridium has online or that are floating around, you realize when they talk about security, they mainly talk about, hey, this is so complex, no one is able to do this, maybe a state or something like that.
[05:01.010 --> 05:05.870]  And so they say, oh, probably beyond the reach of all but the most determined attackers.
[05:06.570 --> 05:09.410]  And we thought, well, okay, I mean, we are determined.
[05:09.650 --> 05:09.910]  Yes.
[05:10.350 --> 05:11.210]  Thank you very much.
[05:14.490 --> 05:16.070]  And determined we were.
[05:16.810 --> 05:26.050]  So from the first idea, which took us around roughly two years until now, we have basically decoded most of the system.
[05:26.270 --> 05:31.610]  And with a small gap in 2015, we've worked all the time on Iridium.
[05:32.070 --> 05:40.650]  And in 2015, before camp, yeah, there was this small secret project, the radio batch, and it is a formidable Iridium receiver.
[05:40.650 --> 05:45.190]  So even with the onboard antenna, you're able to receive Iridium pager messages.
[05:46.710 --> 05:54.790]  And after the camp, we went back to Iridium, and we started looking at not only the pager services, but also the data services.
[05:55.450 --> 06:00.630]  So short burst data, IP, voice, GSM signaling inside there.
[06:00.770 --> 06:06.110]  We've improved the tool chain to be able to decode the whole Iridium band in real time and all of these things.
[06:06.510 --> 06:15.590]  So what we'll now go through with you is first the basics of Iridium, stuff that you might not find like this online.
[06:15.990 --> 06:19.530]  Then how can you get into decoding and receiving Iridium?
[06:19.670 --> 06:23.490]  And what kind of frames and data types are on the network?
[06:23.730 --> 06:26.750]  And by the way, all we do is online.
[06:26.750 --> 06:33.430]  So we publish everything, all the code, and all the documentation on GitHub or on our Wiki of the local hackerspace.
[06:33.750 --> 06:36.310]  And it's all for you to work with.
[06:38.150 --> 06:39.650]  So Iridium coverage.
[06:40.970 --> 06:45.530]  Iridium says, we don't have a coverage map because we have coverage everywhere.
[06:45.770 --> 06:46.730]  And that's correct.
[06:46.970 --> 06:51.730]  So what you see here is the satellites moving across the earth.
[06:51.730 --> 06:56.630]  And the small circles are the coverage that each satellite provides.
[06:56.890 --> 06:58.410]  They have small overlaps.
[06:58.590 --> 07:01.790]  So when one satellite comes in reach, the other satellite can take over.
[07:02.170 --> 07:05.490]  Oh, one comes in reach and the other one goes out of reach.
[07:05.730 --> 07:08.090]  The new satellite can take over and you can have a handoff.
[07:08.710 --> 07:14.150]  And obviously these large circles are spanning multiple countries potentially.
[07:14.150 --> 07:16.570]  And they're divided up in smaller spot beams.
[07:16.950 --> 07:22.310]  So one larger beam is 4,500 kilometers in diameter, roughly.
[07:22.690 --> 07:26.030]  One spot beam has roughly 400 kilometers in diameter.
[07:26.750 --> 07:31.870]  And that satellite drags this fixed spot beam pattern across the earth.
[07:32.070 --> 07:40.350]  So if you're on a fixed point on the earth, what you see is these highlighted spot beams moving over you.
[07:40.350 --> 07:45.250]  So you first see maybe spot beam 20, spot beam 21, and then it moves forward.
[07:45.430 --> 07:48.290]  So in this case, the satellite is moving north.
[07:48.550 --> 07:53.130]  And the receiver sees the different spot beams lighting up after each other.
[07:53.290 --> 07:57.630]  If you have a sensitive setup, you can see more than one spot beam at a time.
[07:57.830 --> 08:01.730]  And what you can also see is a little bit of the beam pattern of the antenna of the satellite.
[08:01.730 --> 08:14.030]  Then when you move roughly directly under the satellite, you can see also spot beams which are far away from you at the end of the whole beam that the satellite provides.
[08:15.290 --> 08:17.790]  Regarding frequency usage...
[08:17.790 --> 08:19.370]  Oh, great.
[08:19.990 --> 08:20.930]  Wait a second.
[08:21.930 --> 08:22.330]  Oh, better.
[08:22.330 --> 08:22.350]  There.
[08:22.490 --> 08:31.950]  So you have on the lower part of the spectrum, which begins at 1.616 gigahertz, what they call traffic channels.
[08:32.190 --> 08:35.630]  These are 240 channels, 41 kilohertz apart.
[08:35.870 --> 08:38.330]  They hold basic data.
[08:38.470 --> 08:45.530]  So you see voice, IP traffic, short burst data, and some basic management traffic on there.
[08:45.670 --> 08:51.130]  But they also have the upper frequency band, which is above 1.626 gigahertz.
[08:51.130 --> 08:53.490]  And there's the time and date stuff.
[08:53.810 --> 09:02.630]  There's what we call the ring alert, where they have a higher presentation signal, which tells phones to start ringing and paging them.
[09:02.770 --> 09:06.490]  And then an even higher signal, which is called a pager channel.
[09:06.670 --> 09:09.090]  There's actually multiple of them, but only one is really active.
[09:09.930 --> 09:13.930]  And it contains the one-way pager messages going to Iridium pagers.
[09:14.410 --> 09:19.490]  On the bottom of the screen, you can see how these channels are active.
[09:20.470 --> 09:22.710]  And Iridium is packet-based.
[09:22.950 --> 09:24.090]  It's very bursty.
[09:24.210 --> 09:31.150]  So you cannot simply tune to one channel and start decoding a constant stream of data.
[09:31.330 --> 09:36.590]  You have to detect these packets and then demodulate them each by itself.
[09:37.370 --> 09:40.470]  Regarding modulation, you have a preamble.
[09:40.570 --> 09:42.270]  It's different between uplink and downlink.
[09:42.770 --> 09:46.650]  You have a unique word, which identifies this as an Iridium frame.
[09:46.850 --> 09:47.290]  They also...
[09:47.290 --> 09:50.250]  There's this binary PSK.
[09:50.450 --> 09:53.030]  They have different preambles for the uplink and the downlink.
[09:53.170 --> 09:56.570]  And then differential QPSK for the data.
[09:56.730 --> 09:58.830]  We're not going into details of the modulation.
[09:59.110 --> 10:02.290]  You can have a look at our talks at Congress or maybe the toolchain.
[10:02.990 --> 10:05.330]  It's pretty basic in terms of modulation.
[10:05.570 --> 10:07.130]  It's 25,000 symbols per second.
[10:07.310 --> 10:08.230]  Not very fast.
[10:09.390 --> 10:15.750]  And no special knowledge about how they do it necessary.
[10:17.010 --> 10:22.270]  Now, to support all of these different services, Iridium has quite a few frame types.
[10:22.970 --> 10:27.530]  We have given them names, three-letter names.
[10:27.870 --> 10:34.350]  And I'm going to go with you quickly through the different frame types so you can have an idea of what they did there.
[10:34.890 --> 10:36.550]  So, first, what we call raw frames.
[10:36.750 --> 10:39.330]  These are just detected bursts from our toolchain.
[10:39.530 --> 10:46.350]  If they have the Iridium unique word, we call them IRI, which marks them as actually being from an Iridium satellite.
[10:46.350 --> 10:53.570]  Then you have to differentiate between the uplink and the downlink... sorry, the simplex band and the duplex band.
[10:53.690 --> 10:57.610]  So, the lower part of the spectrum is the duplex band and the upper part is the simplex band.
[10:57.770 --> 11:02.010]  The simplex band is only going from the satellite to the receivers.
[11:03.010 --> 11:04.810]  There you have the time and location.
[11:04.910 --> 11:06.750]  That's what we call ITL.
[11:06.950 --> 11:09.690]  You have the ring alert, what we call IRA.
[11:10.430 --> 11:13.810]  And the ring alert is protected by a certain type of checksum.
[11:13.810 --> 11:18.230]  And just by looking at the checksum and if it matches, we can say, okay, this is a ring alert frame.
[11:19.450 --> 11:25.030]  Then also pager messages have another kind of checksum and also another kind of unique word.
[11:25.470 --> 11:29.170]  Some of these then contain messages, which we call then MSG.
[11:30.650 --> 11:32.950]  The broadcast frames are a little bit special.
[11:33.070 --> 11:38.590]  They're in the duplex band, but they're also actually only coming from the satellite to the receivers.
[11:38.590 --> 11:45.070]  They contain basic system information about what the system is doing and also acquisition information, where to go.
[11:45.210 --> 11:48.590]  It tells the receivers to which channel they are associated.
[11:49.590 --> 11:50.210]  Oops.
[11:51.150 --> 11:53.910]  Then there's something called the Iridium link control word.
[11:54.390 --> 11:57.830]  Frames which contain the link control word are traffic frames.
[11:58.170 --> 12:04.970]  And the link control word contains some smaller management information and also it defines what is inside this frame now.
[12:05.870 --> 12:06.350]  Oops.
[12:07.450 --> 12:09.470]  First one is link control word seven.
[12:09.650 --> 12:10.810]  That's a synchronization frame.
[12:10.970 --> 12:15.410]  Just some basic filler frame, which just contains the link control word.
[12:15.670 --> 12:18.710]  Then we have link control word number three, which we don't know what it is.
[12:18.830 --> 12:21.370]  It has some specific Reed-Solomon checksum.
[12:21.930 --> 12:24.450]  Link control word number two, data frames.
[12:24.650 --> 12:27.850]  They contain GSM data frames or short burst data.
[12:28.370 --> 12:31.170]  They also have a specific BCH checksum.
[12:31.170 --> 12:33.970]  Then packets.
[12:34.630 --> 12:39.130]  Now, this is data, but it's packet-based data.
[12:39.370 --> 12:45.310]  You have IP data, PPP data, some other specialized services from Iridium in there.
[12:45.530 --> 12:48.890]  They're protected by other specific frame checksums.
[12:50.450 --> 12:55.630]  And there's now, from the packet one, three subtypes already.
[12:55.970 --> 12:58.490]  And some of them we know what they do.
[12:58.490 --> 12:59.830]  Some of them we don't know yet.
[13:01.270 --> 13:02.190]  Then voice.
[13:02.490 --> 13:04.970]  There's different types of voice also.
[13:05.170 --> 13:06.610]  There's standard voice.
[13:06.830 --> 13:08.130]  That's an MB codec.
[13:08.510 --> 13:13.930]  And then there's specially encoded voice.
[13:14.110 --> 13:16.490]  And also voice frames, which contain data.
[13:16.890 --> 13:20.950]  What you can see here is that Iridium evolved.
[13:20.950 --> 13:27.270]  And probably in the beginning they had voice frames and synchronization frames and maybe the data frames.
[13:27.430 --> 13:31.150]  And after some time they've integrated lots of stuff in there.
[13:31.270 --> 13:32.970]  And you can see how it progressed.
[13:33.310 --> 13:41.590]  So, the data frames in the voice channel at some point moved over to this new link control word number one, where it's now packet data.
[13:44.390 --> 13:44.910]  Statistics.
[13:45.290 --> 13:51.230]  Now that we all know these different frame types, here's data from some location.
[13:51.910 --> 13:58.470]  And you can see frequency bottom to top and time from left to right.
[13:58.710 --> 14:00.710]  As you can see, Iridium is quite bursty.
[14:00.790 --> 14:06.730]  You can have times where there's lots of traffic and then there's times where there's not so much going on.
[14:06.730 --> 14:09.270]  And in this example, you see lots of voice data.
[14:09.450 --> 14:10.950]  That's the gray marks.
[14:11.810 --> 14:20.770]  Then at location B, you can see lots of some kind of packet data and maybe SBD and GSM information in there.
[14:20.990 --> 14:24.330]  If we zoom in a little bit, you can see, okay, it's still quite bursty.
[14:24.510 --> 14:27.110]  But you can see a little bit more what belongs to what.
[14:27.290 --> 14:30.530]  And if we zoom in even more, you can see, okay, there's these channels.
[14:30.770 --> 14:35.930]  And each channel contains like a conversation or some kind of ongoing transaction.
[14:35.930 --> 14:39.230]  What you can see here also is that these lines are not straight.
[14:39.670 --> 14:43.070]  They're a little bit bent down over time.
[14:43.270 --> 14:44.570]  And that comes from the Doppler shift.
[14:44.790 --> 14:48.090]  So the satellites are moving across the globe quite quickly.
[14:48.310 --> 14:52.730]  And when they appear on the horizon, they come towards you.
[14:52.810 --> 14:57.510]  And when they disappear on the other side of the horizon, they move away from you.
[14:57.650 --> 15:01.470]  And the Doppler shift then creates this shift in frequency.
[15:02.090 --> 15:06.690]  That also means that one channel on Iridium is not one fixed frequency.
[15:06.870 --> 15:10.810]  You can't just tune your receiver to this frequency and say, okay, I'm just going to be here.
[15:10.930 --> 15:14.510]  I have all my channels set up and I know exactly which one goes where.
[15:15.590 --> 15:21.070]  Given the frequency, you can't even say if it's channel one or two because these overlap slightly.
[15:22.230 --> 15:25.130]  Which brings me to how do you capture Iridium?
[15:25.130 --> 15:31.010]  As the satellites move over the globe, you cannot have an antenna which has a high gain.
[15:31.230 --> 15:35.190]  Because a high gain antenna means that you are only looking at a small portion of the sky.
[15:35.570 --> 15:38.910]  And as soon as the satellite moves out of that portion, you don't see it anymore.
[15:39.130 --> 15:43.230]  So what you want is an antenna with low gain.
[15:43.390 --> 15:50.550]  Or if you have a high gain antenna, you either have to track the satellites or you have to have multiple high gain antennas looking at different parts of the sky.
[15:52.450 --> 15:54.730]  Passive antennas are the cheapest option.
[15:55.530 --> 15:56.770]  They are easily to get.
[15:56.930 --> 15:58.930]  They are available on DigiKey and Mauser.
[15:59.270 --> 16:01.670]  You can even build them yourself if you want to.
[16:02.270 --> 16:10.650]  So, Jared Boone, aka SharedBrain, did some very basic setup using some FR-4 PCB and a patch antenna on his port-a-pack.
[16:10.830 --> 16:13.930]  And he was able to receive Iridium very clearly.
[16:14.210 --> 16:19.110]  Even the HackRF with an Ant 500 is good enough to receive Iridium.
[16:19.110 --> 16:25.330]  So, you take your HackRF, you put basically any kind of antenna on there, you go outside, you'll see Iridium frames.
[16:26.250 --> 16:30.610]  Probably pager frames and a few data frames, it's not the best setup yet, but you will receive something.
[16:30.970 --> 16:36.890]  Even the radio battery, if it's PCB antenna on here, is able to receive Iridium frames inside a tent.
[16:37.250 --> 16:40.070]  That's something we did a year ago at Chaos Camp.
[16:41.150 --> 16:44.350]  If you want to go further, you should use an active antenna, though.
[16:44.350 --> 16:51.770]  But active antennas for Iridium are tough to get because most antennas are meant to also send.
[16:52.750 --> 16:57.970]  And for an active antenna, that means it has to somehow switch between sending and receiving.
[16:57.970 --> 17:02.570]  And that's then, again, tied to the specific equipment for that they are built.
[17:03.850 --> 17:06.730]  That means buying them off the shelf is tough.
[17:06.730 --> 17:12.570]  But they're super useful because they have an amplifier right inside the antenna which offsets cable losses.
[17:12.930 --> 17:20.450]  And also the first receiver in this chain basically defines how well your noise flow will be.
[17:20.990 --> 17:22.270]  So you should use some.
[17:22.430 --> 17:24.570]  But what to do if you can't buy them?
[17:24.830 --> 17:26.190]  Well, you build them.
[17:26.190 --> 17:37.430]  The easiest way is modifying GPS antennas because GPS has a similar frequency range and similar polarization than the Iridium frame, the Iridium signal.
[17:37.650 --> 17:41.310]  So what you do is you basically open up a GPS antenna, remove the filter.
[17:41.530 --> 17:43.590]  You have your first basic Iridium antenna.
[17:43.750 --> 17:50.570]  If you want to go a little bit further, you remove the patch antenna of the GPS antenna and replace it with an Iridium antenna.
[17:50.570 --> 17:55.030]  And even better, remove the filter and replace it with another filter.
[17:55.170 --> 17:59.250]  So there's ready-made Iridium filters available on Digikey and Mauser.
[17:59.550 --> 18:00.130]  Quite cheap.
[18:00.650 --> 18:06.190]  We've got some instructions on our wiki how to do that.
[18:06.710 --> 18:10.010]  The most important thing is get an antenna which you can open up with screws.
[18:10.930 --> 18:13.510]  There's also special built antennas for Iridium.
[18:13.690 --> 18:17.910]  So our work on Iridium has sparked some interest in the community.
[18:17.910 --> 18:22.010]  There's at least two projects we know of, of specialized Iridium antennas.
[18:22.150 --> 18:23.210]  So there's TNT's antenna.
[18:23.410 --> 18:27.770]  It's an active L-band antenna, but it can also switch in an Iridium filter.
[18:28.230 --> 18:31.690]  So you can have very good reception of that.
[18:31.810 --> 18:35.490]  We have that thing in Munich and it's the best we have so far.
[18:35.950 --> 18:38.670]  Also, Jared Boone has an active antenna.
[18:38.930 --> 18:41.530]  We haven't tested that one yet, but it should work.
[18:41.990 --> 18:43.490]  Both of them are on OSH Park.
[18:43.490 --> 18:49.390]  So if you want to order some PCBs, just go on OSH park, type in Iridium, and you will find the project.
[18:51.370 --> 18:54.950]  Regarding SDRs, as mentioned, Iridium frames are pretty strong.
[18:55.070 --> 18:58.970]  So even an RTL SDR is good enough to receive Iridium.
[18:59.150 --> 19:04.150]  The only problem is that it doesn't have enough bandwidth to capture the whole band.
[19:04.150 --> 19:09.330]  With two to three megahertz, you get a third of the Iridium frequency band.
[19:09.730 --> 19:11.390]  But that's still quite a lot.
[19:11.530 --> 19:15.090]  So you get all the pager channel, ring alert, and some data frames.
[19:15.590 --> 19:16.510]  Not too bad.
[19:17.010 --> 19:22.630]  What you have to do, though, is add a bias T to supply your active antenna.
[19:22.950 --> 19:26.370]  We also have some information about that on our wiki.
[19:27.010 --> 19:32.690]  Next thing, the radio or the HackRF, they are pretty good for Iridium.
[19:32.950 --> 19:34.950]  So you can capture the whole band.
[19:35.750 --> 19:39.590]  The HackRF even has the advantage that the bias T is already included.
[19:39.630 --> 19:41.050]  So you don't have to do any modification.
[19:41.050 --> 19:42.590]  You just activate it in software.
[19:42.810 --> 19:46.250]  It will supply your active antenna, and you get very good reception.
[19:46.510 --> 19:57.390]  For the radio, you have to add at least one component, the SMA connector, to attach the external antenna, and also an inductor if you want to use the integrated bias T.
[19:57.650 --> 20:05.850]  For the HackRF, I would recommend you use some shielding, because the intermediate frequency it's using when tuned to Iridium is close to Wi-Fi.
[20:06.090 --> 20:09.890]  And if you have your PC next to it, it will just radiate into the HackRF.
[20:10.470 --> 20:15.690]  Next thing, USRP, Blade RF, LimeSDR, way to go.
[20:16.110 --> 20:17.470]  They capture everything.
[20:17.710 --> 20:20.630]  Their LimeSDR isn't that expensive anyways.
[20:20.630 --> 20:23.790]  It's roughly where the HackRF is, 250 U.S. dollars.
[20:24.830 --> 20:38.350]  Something to be aware of, though, is if you're using USB 3, make sure you use good cables or have the antenna far away from your USB 3 cables we had, the cables radiating into the antenna.
[20:39.770 --> 20:41.730]  And it also needs an external bias T.
[20:41.850 --> 20:44.050]  It doesn't have any provision for an internal bias T.
[20:44.750 --> 20:46.290]  Now to software.
[20:47.510 --> 20:51.270]  GR Iridium is an out-of-three module for GNU Radio.
[20:51.570 --> 21:03.890]  And it is built to capture the complete Iridium band with, that's saying, core I5, quad-core, is good enough to do the whole band in real time.
[21:04.330 --> 21:05.950]  It's really that simple to use.
[21:05.950 --> 21:07.730]  You compile GNU Radio.
[21:07.890 --> 21:11.030]  Maybe you have to build GNU Radio script or with PI bombs.
[21:11.210 --> 21:13.170]  Then you install GR Iridium.
[21:13.250 --> 21:14.390]  You call the command line.
[21:14.530 --> 21:16.730]  It will automatically detect your SDR.
[21:17.010 --> 21:18.950]  It will configure the gains.
[21:19.130 --> 21:21.050]  And it will spit out bits.
[21:21.310 --> 21:23.050]  Raw bits from the satellite.
[21:23.290 --> 21:26.250]  Not decoded, but hey, you can get...
[21:26.250 --> 21:30.810]  At good locations, you get over 1,500 bursts per second of data.
[21:31.610 --> 21:35.350]  And each burst then has maybe 400 bits of data in there.
[21:35.750 --> 21:36.750]  So quite a lot.
[21:39.010 --> 21:43.710]  The whole thing is built around two major components.
[21:43.890 --> 21:45.530]  First, we have a burst tagger.
[21:45.730 --> 21:49.270]  It looks at the whole spectrum and it figures out, okay, where's activity?
[21:49.270 --> 21:52.770]  And it captures a small piece of that activity.
[21:52.870 --> 22:00.130]  It feeds it through a channelizer, which then just looks at, okay, where roughly in the frequency band is that?
[22:00.130 --> 22:10.750]  It takes a chunk of that frequency band, and it moves it into multiple demodulators and decoders, which then basically spit out bits.
[22:10.990 --> 22:20.190]  We did it this way to reduce the memory bandwidth requirements on your PC, because if you have lots of bursts, and Iridium is, as I said, quite burst here.
[22:20.270 --> 22:36.250]  If you have 1,000 bursts, 2,000 bursts a second, your PC gets quite quickly to some saturation in terms of memory bandwidth if you try to capture, like, 10 mega samples of bandwidth 1,000 times per second for eight milliseconds.
[22:37.150 --> 22:40.530]  That's not going to work out, so we had to introduce this stuff.
[22:40.650 --> 22:41.670]  It's working quite well.
[22:42.830 --> 22:45.250]  The output of this stuff is first frame type.
[22:45.310 --> 22:48.090]  It's raw because it hasn't processed anything further.
[22:48.250 --> 22:50.670]  It has the seconds when the capture started.
[22:50.670 --> 22:52.490]  It has the milliseconds inside that capture.
[22:52.910 --> 22:58.290]  It tells you which exact frequency the frame was on, if the unique word was okay or not.
[22:58.670 --> 23:00.610]  It has a unique frame ID in there.
[23:01.050 --> 23:02.410]  Confidence is quite interesting.
[23:02.710 --> 23:10.690]  So while decoding the frame, it looks at the different bits, and it realizes, okay, how well was this decoded or not?
[23:10.810 --> 23:15.590]  And if the confidence goes lower and lower and lower, you can expect more bit errors.
[23:16.570 --> 23:24.590]  That's useful if you want to reverse engineer packets from Iridium because you don't want to have any bit errors.
[23:24.730 --> 23:29.450]  You want frames which have no error at all, even if you don't know the error correction.
[23:29.710 --> 23:34.590]  So if you have a confidence of 100%, most likely there will not be any bit error in there.
[23:34.770 --> 23:38.610]  It helped us a great deal when reverse engineering all the frame types.
[23:38.830 --> 23:52.510]  It has a signal strength, which gives you a correlation of how close was the satellite, was it far away or was it rather close to us, length in symbols, and the data in bits.
[23:54.330 --> 23:59.050]  And now Sek will talk to you a little bit about what to do with these bits.
[23:59.810 --> 24:00.150]  Thank
[24:03.430 --> 24:03.610]  you.
[24:04.790 --> 24:05.130]  Okay.
[24:05.470 --> 24:20.750]  So after you run the GR Iridium thing and got all the bits, you get a text file which contains all the bits, and then you just pipe it through the next tool, which is the Iridium toolkit, Python script.
[24:21.450 --> 24:28.150]  It has a command line option, dash dash perfect, which you most of the time will want to use.
[24:28.290 --> 24:31.630]  That just shows away all the packets that have decoding errors.
[24:32.890 --> 24:37.910]  Everything that it knows about the frames, and if it says, okay, this frame is somehow broken, then it throws it away.
[24:38.910 --> 24:43.670]  Sometimes you want to look at broken frames, but most of the time you just want to see the good stuff.
[24:44.330 --> 24:50.210]  And then you write it into another file so you can look at it later, because the Iridium toolkit takes quite some time.
[24:50.490 --> 25:00.470]  I mean, it's way faster than real time, but if you capture, I don't know, capture Iridium for two days and then run it through, you will have to wait about an hour or so until it's done.
[25:02.230 --> 25:10.290]  You can get some speed ups there if you install PyPy, and it makes it faster, but the result will be the same.
[25:10.930 --> 25:16.490]  There's also quite a few other command line options in there, but use at your own risk.
[25:16.670 --> 25:17.990]  They have not been maintained.
[25:20.770 --> 25:26.210]  Now I will go through all the different stuff we see and have some examples for you.
[25:27.690 --> 25:33.410]  The first type of packets, schneider mentioned that already, is the messaging frame.
[25:33.650 --> 25:38.350]  Those are the frames that have the highest signal strength when sent from Iridium.
[25:38.530 --> 25:40.430]  So even with a bad setup, you should see those.
[25:40.850 --> 25:51.050]  They contain a cycle, which is timing information, the time slot inside the cycle, and which spot beam of the satellite sent this.
[25:51.350 --> 25:56.350]  This packet does not contain information which satellite it was, but which spot beam you can see.
[25:57.410 --> 26:00.470]  The time slot is either A or 0 to 3.
[26:01.990 --> 26:10.830]  The packets in the A, which is the acquisition time slot, this is sent always because the pagers need to find the channel.
[26:12.090 --> 26:19.130]  The actual pager messages will usually be sent in the other time slots, but will also sometimes be sent in the equation time slot.
[26:19.290 --> 26:22.870]  Those packets then will decode as MSG frames.
[26:24.210 --> 26:28.490]  This is basically the same packet, but has a pager message appended at the end.
[26:29.210 --> 26:37.430]  That can be up to three packets, because pager messages can be 160 characters long, but there's not enough space in one packet for this.
[26:37.430 --> 26:40.090]  They also contain a format specifier.
[26:40.350 --> 26:51.790]  That is, one type is for ASCII, and we've only ever seen one other type, I think three times, and it looks like that might be BCD, but I have no real idea.
[26:52.110 --> 27:05.230]  They also have another checksum in there, and a radio identifier code, which is basically the internal number of your pager, so your pager can tell which messages to show to you, because otherwise it would show all the messages.
[27:06.390 --> 27:10.130]  What you see as pager messages is stuff...
[27:10.130 --> 27:11.650]  People use it for monitoring.
[27:13.190 --> 27:18.130]  Some machines that have problems send pager messages.
[27:18.550 --> 27:33.190]  As the pager does not send back its location, the areas for the pager messages are quite large, so you can see at least your continent, if not larger area of messages on the pager channel.
[27:33.490 --> 27:43.850]  You also see not only monitoring messages, but messages that seem to be military type messages.
[27:44.310 --> 27:46.390]  We blanked out a little bit.
[27:46.590 --> 27:49.310]  But I mean, you are going eight kilometers the wrong way.
[27:52.390 --> 27:55.310]  Or the last one looks quite dangerous.
[27:55.550 --> 27:57.410]  I'm not sure why they sent it in clear text.
[28:03.470 --> 28:07.110]  And then there's also messages where I can only say WTF.
[28:08.010 --> 28:13.450]  This is a conversation that was occurring over probably one or two days.
[28:14.210 --> 28:24.850]  And I have no idea what the red scorpion is, and why the bartender needs to talk to them before they can make the payment.
[28:26.070 --> 28:29.350]  And whoever is white...
[28:30.150 --> 28:31.030]  No idea.
[28:35.890 --> 28:41.550]  So, now that we went through the messages, we have the ring alert packages.
[28:42.570 --> 28:47.470]  Those are generally used to alert phones that they should be ringing.
[28:47.470 --> 28:50.770]  They have a slightly higher signal strength.
[28:51.190 --> 28:55.050]  So, your phone, even with its antenna retracted, will still ring.
[28:55.490 --> 29:00.710]  But the actual conversation then will be with antenna extended.
[29:00.810 --> 29:03.650]  So, that can be a little weaker.
[29:03.990 --> 29:06.890]  That contains the satellite number and the beam number.
[29:07.090 --> 29:08.790]  And it contains a position.
[29:08.790 --> 29:13.790]  That position, as you can see below, will be decoded.
[29:14.350 --> 29:16.310]  And it also has an altitude.
[29:16.710 --> 29:28.850]  Because the position they send out alternates between the position of the satellite, which has a higher altitude, and the position where the satellite thinks that its spot beam hits the ground.
[29:30.130 --> 29:37.510]  So, the satellite, since it's the same location for all spot beams for itself, but every spot beam has a different down position.
[29:38.450 --> 29:46.490]  And then there will be a page, will be the temporary IMC for the phone that should ring.
[29:46.690 --> 29:52.070]  If you plot those coordinates for one receiver, you get something like this.
[29:53.030 --> 29:57.110]  Those are the satellite locations from which signals we have seen.
[29:57.110 --> 29:58.950]  You can see that's quite a large area.
[29:59.930 --> 30:05.350]  And you can somehow see the color is the signal strength we see.
[30:05.730 --> 30:11.830]  That's either an artifact of the antenna or an artifact of the spot beams of the satellite.
[30:12.130 --> 30:15.210]  I'm not quite sure which of those it is.
[30:15.430 --> 30:18.450]  You can also plot the down positions.
[30:18.450 --> 30:20.930]  So, where the satellite thinks the beam hits the ground.
[30:21.570 --> 30:23.570]  This is a way smaller area.
[30:23.570 --> 30:30.030]  So, that means we are most of the time receive messages that are meant for the general area we are in.
[30:30.150 --> 30:31.110]  It's still quite large.
[30:32.290 --> 30:37.430]  And the tool also plots the amount of packets it sees in a height.
[30:37.690 --> 30:45.430]  So, if you switch to the next picture, you can see that indeed most of the packets you see are meant for you.
[30:45.430 --> 30:48.910]  And you will by chance also see packets that are farther away.
[30:50.470 --> 30:53.850]  The next packet type is the Iridium time and location.
[30:54.550 --> 30:57.130]  Which is something that we found quite recently.
[30:57.270 --> 31:00.250]  And it's still not enabled on the whole planet.
[31:00.490 --> 31:02.250]  But we see it here in the U.S.
[31:04.290 --> 31:08.570]  It basically sends a very long header of zero bits.
[31:09.290 --> 31:17.170]  That is meant so you can use correlation on it to receive it in very, very bad signal strength locations.
[31:17.350 --> 31:19.030]  Like inside the shipping container also.
[31:19.730 --> 31:25.010]  And then it sends two 256 bit words containing of a pseudorandom sequence.
[31:25.470 --> 31:30.570]  Which is then used with correlation to find out the current time.
[31:30.570 --> 31:33.450]  We don't have much information about it.
[31:33.510 --> 31:36.070]  We found one or two patterns about it.
[31:36.570 --> 31:42.270]  But those are not very elaborating much on the information.
[31:42.750 --> 31:45.610]  So currently we just output the words.
[31:45.930 --> 31:49.370]  We cannot do any location from that, unfortunately.
[31:50.230 --> 31:56.510]  The next frames we are going into the duplex channel are the broadcast frames.
[31:56.510 --> 32:00.050]  Those also contain satellite and beam ID.
[32:00.370 --> 32:03.150]  They also contain acquisition info.
[32:03.910 --> 32:08.510]  And rotating between the packets additional info about transmission strength.
[32:08.830 --> 32:11.490]  About TIMSS that should expire.
[32:11.850 --> 32:13.150]  And actually a time.
[32:13.730 --> 32:16.290]  We have some... I have some example frames here.
[32:17.810 --> 32:23.770]  The most interesting part about the time is that this is a time field that is...
[32:23.770 --> 32:28.550]  I forgot how many bits it is, but it has less resolution than the UNIX timestamp.
[32:29.290 --> 32:31.490]  So the Iridium has its own epoch.
[32:31.930 --> 32:35.250]  And a few years ago they had a rollover.
[32:37.050 --> 32:40.010]  So they sent memos to all their customers.
[32:40.410 --> 32:42.130]  Yeah, yeah, the time has changed.
[32:42.390 --> 32:48.530]  Please type into your phone this 30-digit string to update your phone to the new epoch.
[32:48.530 --> 32:54.090]  And they basically tell the phone what zero means in real time to translate the time.
[32:57.520 --> 33:00.840]  Yeah, the rest of the frames that we see contain the link control word.
[33:01.100 --> 33:03.100]  Schneider also told you about that already.
[33:03.340 --> 33:06.060]  It has a 3-bit frame type ID.
[33:06.460 --> 33:11.660]  Of which we only have seen the values 0, 1, 2, 3 and 7.
[33:11.920 --> 33:13.160]  So the others are not used.
[33:13.160 --> 33:21.340]  Most of the info that we have about the link control word was reverse engineered from an SBD modem, the 9601.
[33:21.560 --> 33:27.760]  Which has a very nice debug output that gave us some of the strings.
[33:27.980 --> 33:34.200]  You see that it has the time of arrival and frequency of arrival adjustments.
[33:34.200 --> 33:44.000]  So the sender can... the satellite tells you if your signal arrived a little bit too early, a little bit too late or to the left or to the right on the frequency.
[33:44.000 --> 33:47.000]  So you can adjust it and send it on the proper channel.
[33:47.480 --> 33:50.380]  It also contains information about handoff.
[33:50.600 --> 33:54.840]  If your satellite says, hey, I'm getting... I'm soon going to be gone.
[33:54.840 --> 33:56.800]  Please go to another satellite.
[33:57.100 --> 33:59.480]  Then you need to also need to go on a different channel.
[34:01.000 --> 34:05.120]  Inside the link control we have the... Oh, yeah, that is a picture of the modem.
[34:08.340 --> 34:11.700]  Inside the link control we have the synchronization packets.
[34:13.220 --> 34:15.280]  This is... I don't know if you can see it.
[34:15.540 --> 34:27.020]  It's basically a single tone that's slightly off center of the frequency because it's just a 1, 0, 1, 0, 1, 0 bit pattern which in QPSK is a single tone.
[34:27.020 --> 34:37.680]  You see that periodically and it is most of the time probably sent just to have a link control word where you can put in that information there and you need to fill the frame somehow.
[34:38.720 --> 34:43.180]  Then we have the, as of yet, unknown link control word type 3.
[34:44.380 --> 34:50.780]  We have been getting very, very good at spotting checksums in random data.
[34:51.980 --> 34:57.500]  So I can tell you that there is a read Solomon checksum which is based on 6-bit words.
[34:58.100 --> 35:01.540]  And we can successfully verify that it is valid.
[35:01.580 --> 35:03.640]  But I still have no idea what the data means.
[35:03.800 --> 35:07.800]  And I have no idea why they would send it in 6-bit packets.
[35:10.280 --> 35:15.740]  But if we find a device that uses it, we can probably tell you more about it.
[35:15.740 --> 35:19.200]  But currently we just output the bytes that we see.
[35:20.540 --> 35:26.360]  Then we go to link control word type 2 which is the data packet which is...
[35:27.360 --> 35:33.700]  We had a relevation sometime this year that this is very similar to GSM layer 2.
[35:33.700 --> 35:41.620]  And if you pack those in a correct framing, you can just load them into Wireshark.
[35:42.280 --> 35:49.220]  And that contains all the call setup and call teardown, the SMS and the SPD.
[35:49.880 --> 36:05.900]  And the stuff that Wireshark can decode is like the authentication request which contains the challenge value.
[36:07.040 --> 36:08.820]  One thing that's interesting is...
[36:09.840 --> 36:12.860]  At the beginning we thought there should be some encryption somewhere.
[36:13.680 --> 36:16.220]  So far we have found no encryption anywhere.
[36:17.780 --> 36:19.920]  The only thing is for...
[36:19.920 --> 36:22.480]  We found some reference to authentication security.
[36:22.680 --> 36:31.380]  So when the phone connects to the network, there is supposedly some crypto going on to identify the phone as the correct phone.
[36:32.300 --> 36:35.620]  As we haven't looked too deeply into this, I cannot verify.
[36:35.820 --> 36:42.060]  But seeing that there's a challenge value going around, it looks like it is.
[36:42.660 --> 36:45.980]  You can also see then stuff like a call setup.
[36:47.340 --> 36:49.460]  Just the number that is being called.
[36:49.560 --> 36:51.020]  This is the number of our hackerspace.
[36:51.020 --> 36:54.080]  So don't all call at the same time, please.
[36:56.360 --> 36:57.280]  But that works.
[36:57.440 --> 37:00.340]  I mean, there's also like the frames that contain SPD data.
[37:00.580 --> 37:02.520]  Wireshark will not decode them.
[37:02.600 --> 37:03.660]  You will get error messages.
[37:04.620 --> 37:07.920]  There's some work to be done to get Wireshark to decode them.
[37:08.020 --> 37:08.860]  But we didn't have time.
[37:10.760 --> 37:24.720]  But once you have this PCAP file, you can put that into T-Shark, the text console version of Wireshark, to extract information from it, like SMS messages, if you want to see them.
[37:25.440 --> 37:33.240]  And in theory, if you had such a recording and would look at it, then you could maybe see messages like those.
[37:34.560 --> 37:37.500]  I fear for the well-being of those chickens.
[37:39.180 --> 37:42.340]  Or maybe there could be messages like this one.
[37:51.570 --> 37:54.690]  I'm still not quite sure why you need to send that over Iridium.
[37:59.230 --> 38:03.310]  So for the SPD messages, as I said, Wireshark cannot decode this.
[38:03.310 --> 38:10.870]  There is a special mode in Iridium parser to decode them that is actually deprecated, but there's nothing, no other way to do it yet.
[38:10.870 --> 38:13.910]  But it should be... I will tell you about it later.
[38:15.030 --> 38:19.270]  You can see messages over there like this.
[38:19.630 --> 38:20.770]  It's here in the U.S.
[38:21.050 --> 38:23.590]  Someone is sending that thing, I think, every hour.
[38:24.010 --> 38:25.390]  I have no idea why.
[38:27.290 --> 38:28.410]  Or XML.
[38:28.410 --> 38:33.770]  Why would you send XML over a channel that is so low bandwidth that...
[38:33.770 --> 38:34.790]  Well, I don't know.
[38:38.680 --> 38:43.000]  You also see some stuff from SeaGliders.
[38:43.240 --> 38:43.680]  Oh.
[38:45.900 --> 38:58.180]  From SeaGliders, USA SATCOM posted a few tweets about that, that you can see call signs of airplanes in there.
[38:58.820 --> 39:02.040]  There's a lot of stuff in there, but most of it is...
[39:02.040 --> 39:07.040]  If you don't know the application that's using it, you will have to guess what the information means in there.
[39:09.120 --> 39:15.600]  Then we come to the next frame type, which is the IP, what I call IP frames, which is data frames.
[39:16.560 --> 39:22.640]  They contain either PPP or what Iridium calls Rudix, which is just a packet-based connection.
[39:22.640 --> 39:26.660]  Those packets contain a counter, a length, and another checksum.
[39:26.820 --> 39:28.200]  This time a CRC.
[39:29.380 --> 39:32.700]  There's no automated decoding stuff in our tutorial yet.
[39:33.200 --> 39:37.320]  All the exams that you see have been hand-assembled from the raw data.
[39:38.980 --> 39:41.520]  The Rudix stuff starts with this.
[39:42.740 --> 39:51.400]  You can basically see they implemented via Cisco router, or telnetting somewhere wherever you tell Iridium in advance where you want to go.
[39:51.780 --> 39:52.860]  That's then fixed.
[39:53.320 --> 40:00.980]  You also see IP data, like people automatically uploading stuff via FTP.
[40:02.660 --> 40:04.240]  I have no idea.
[40:04.800 --> 40:06.060]  With really long banners.
[40:06.200 --> 40:06.900]  You can't see it.
[40:06.900 --> 40:10.960]  This banner at the top is like five times the size with disclaimers and stuff.
[40:13.820 --> 40:27.620]  Yeah, and if you spend some time and realign the packets correctly, you can even open the IP traffic in Wireshark and decode like HTTP requests that we did just to check if it works.
[40:28.540 --> 40:33.040]  But there definitely needs to be some automatism here, but it's still not working.
[40:33.420 --> 40:41.040]  One of the problems is that if you do PPP with Windows machines, you will have what I call the PPP problem.
[40:42.380 --> 40:51.780]  Microsoft uses a Microsoft point-to-point compression protocol when using PPP, which is documented in RFC, but Wireshark cannot decode it.
[40:52.260 --> 40:55.820]  It's not really difficult, but nobody has done it so far.
[40:56.120 --> 41:00.060]  That means even if you reassemble the IP frames, you will still not be able to see the traffic.
[41:00.600 --> 41:02.980]  Someone needs to write the decoder.
[41:03.220 --> 41:06.500]  If someone else wants to do it, I would be grateful.
[41:07.520 --> 41:17.880]  Inside the same link control, but we also have other data, which we call IAQ, IAR and IAU for unknown, which is there's somewhat...
[41:17.880 --> 41:21.500]  We can tell that there are somewhat checksums that we can validate.
[41:21.820 --> 41:24.480]  The IAQ frames have a Reed-Solomon checksum.
[41:24.680 --> 41:32.940]  The IAR frames have the same Reed-Solomon checksum and an additional 16-bit sum, really addition of all the octets.
[41:33.440 --> 41:36.840]  And the IAU is everything yet we do not know.
[41:37.160 --> 41:40.920]  We have... I have two example frames, but I cannot tell you what they contain.
[41:41.060 --> 41:42.100]  There's no ASCII in there.
[41:44.100 --> 41:46.380]  Last but not least, we get to the voice frames.
[41:47.100 --> 41:52.400]  They have 312 bits per frame, which is a MB codec.
[41:52.400 --> 41:57.420]  Oh, let's see if we can get the audio too back.
[42:03.500 --> 42:06.980]  This is a propriety codec.
[42:08.240 --> 42:19.800]  Fortunately, we got some outside help from the OSMOCOM guys, especially TNT, who had some knowledge with that codec from other satellite systems.
[42:19.800 --> 42:24.050]  And we have now two different decoders for that data.
[42:24.620 --> 42:34.660]  One is a re-implementation in C, and the other is some emulation based on the original firmware from the phone, which just emulates it and decodes it.
[42:35.040 --> 42:37.320]  And we have two examples here.
[42:40.090 --> 42:41.230]  Can we hear something?
[42:43.110 --> 42:44.270]  Audio, please.
[42:51.500 --> 42:53.100]  This is our world now.
[42:53.520 --> 42:56.580]  The world of the electron and the switch, the beauty of the board.
[42:56.880 --> 43:05.320]  We make use of a service already existing without paying for what could be dirt cheap if it wasn't run by profiteering gluttons and you call us criminals.
[43:05.680 --> 43:07.980]  We explore and you call us criminals.
[43:08.340 --> 43:10.860]  We seek of the knowledge and you cause criminals.
[43:11.040 --> 43:15.740]  We exist as our skin color and nationality without good buyers and you call us criminals.
[43:16.400 --> 43:22.960]  You build atomic bombs, you wage wars, you murder, cheat and lie to us and try to make us believe it's for our own good.
[43:23.440 --> 43:23.880]  Yet we...
[43:23.880 --> 43:24.840]  Yet it's criminal.
[43:25.240 --> 43:26.620]  My crime is that of curiosity.
[43:27.280 --> 43:31.180]  My crime is that of judging people by what they say and think and not what they look like.
[43:31.400 --> 43:33.340]  My crime is that of outsmarting you.
[43:33.560 --> 43:35.700]  Something that you will never forgive me for.
[43:36.000 --> 43:37.940]  I am a hacker and this is my manifesto.
[43:38.620 --> 43:41.300]  You may stop this individual, but you can stop it all.
[43:41.420 --> 43:42.480]  After all, we won't lie.
[43:42.700 --> 43:43.080]  Okay.
[43:49.520 --> 43:59.900]  Yeah, so this was a test call at our local hackerspace that was roughly ideal recording conditions and you can still hear that that voice codec is not very good.
[44:00.480 --> 44:03.940]  I mean, okay, it has to work with 2k4.
[44:04.580 --> 44:05.900]  That's not very much bandwidth.
[44:06.340 --> 44:09.920]  And we have one other sample that I found very interesting.
[44:09.920 --> 44:14.060]  You have reached the 310th Airlift Squadron C-37 aircraft.
[44:14.380 --> 44:16.100]  Call number 0028.
[44:16.440 --> 44:18.540]  To call the CSO, press 1.
[44:18.840 --> 44:21.820]  To call secure telephone number 1, press 2.
[44:22.060 --> 44:24.960]  To call secure telephone number 2, press...
[44:24.960 --> 44:27.360]  SATCOM direct Inmarsat connection in process.
[44:27.720 --> 44:29.780]  Please hold while we attempt to connect your call.
[44:29.980 --> 44:32.580]  The approximate global connect time is 20...
[44:35.740 --> 44:39.860]  Okay, you can find the 310th Airlift Squadron on Wikipedia.
[44:40.800 --> 44:43.580]  And they have indeed a C-37 aircraft.
[44:44.320 --> 44:45.920]  I have no idea.
[44:46.260 --> 44:48.400]  Remember, we are listening to Iridium.
[44:49.200 --> 44:53.100]  That thing is then connecting through Inmarsat somewhere else.
[44:53.100 --> 44:54.960]  What is going on?
[44:58.740 --> 45:00.080]  Yeah, well, so...
[45:00.080 --> 45:07.240]  We also have, as schneider mentioned, the other voice frames, which we call VOD for digital.
[45:07.620 --> 45:09.600]  Because there's an additional checksum in there.
[45:10.000 --> 45:15.480]  And that additional checksum means that the frame is not big enough for the data.
[45:15.660 --> 45:18.260]  So the voice data needs to be split over two frames.
[45:18.580 --> 45:24.160]  So you use twice the bandwidth for the same information with a little bit of additional checksum.
[45:24.460 --> 45:26.400]  We don't see that everywhere on the globe.
[45:27.480 --> 45:28.720]  But in some locations.
[45:29.000 --> 45:30.720]  To me, it seems like a bandwidth waste.
[45:31.580 --> 45:34.360]  One guess is that we...
[45:34.360 --> 45:35.080]  That this...
[45:35.080 --> 45:39.660]  The Iridium codec has quality problems with different languages than English or so.
[45:40.560 --> 45:44.420]  Because some of the stuff we see in there sounds like Russian.
[45:45.660 --> 45:48.100]  But I'm still not clear why they wouldn't just use...
[45:48.100 --> 45:52.180]  There is a full-rate version of the same codec, which uses exactly twice the bandwidth.
[45:52.500 --> 45:54.960]  So that would be ideal for this scenario, in my opinion.
[45:55.160 --> 45:56.360]  But they do it this way.
[45:56.620 --> 46:00.280]  And we don't have a voice sample of this, because I don't think anyone here speaks Russian.
[46:06.730 --> 46:08.830]  Yeah, and then there's the voice data packets.
[46:09.290 --> 46:10.970]  Those are inside...
[46:10.970 --> 46:14.290]  Like, have the link control word of voice packets, but they contain data.
[46:14.870 --> 46:17.490]  Sometimes we see stuff like PPP.
[46:17.490 --> 46:20.470]  So we are not quite sure which device creates that...
[46:20.470 --> 46:24.830]  That data flow with a tag as a voice frame.
[46:25.010 --> 46:25.810]  But we see it.
[46:26.230 --> 46:28.430]  And one example is this.
[46:30.430 --> 46:31.670]  But, I mean...
[46:32.790 --> 46:34.070]  Mandrake 9.2?
[46:34.650 --> 46:35.210]  Seriously?
[46:35.430 --> 46:36.530]  Update this shit!
[46:41.150 --> 46:45.170]  Yeah, so that concludes all the frames that so far we know of.
[46:45.170 --> 46:50.410]  There's two open questions that I would like to propose to the audience, in case anyone has some knowledge.
[46:51.890 --> 46:56.250]  We still want to know more about some data that we have not understood yet.
[46:56.770 --> 47:08.270]  And there we see one type of data which has a framing, where each frame starts with hex BD, A-F-F-E, which is in German monkey, and ends with BD.
[47:08.270 --> 47:12.010]  If anyone says that it's familiar to them, please tell me.
[47:12.110 --> 47:19.490]  And the other one is where the frames at the end are filled with 7E, have a checksum, and 00FF before that, and the data is in front.
[47:19.910 --> 47:22.390]  If anyone recognizes this, please tell us.
[47:24.310 --> 47:30.750]  The devices we used for all this reverse engineering were basically an Iridium phone, for voice, SMS, and PPP.
[47:31.730 --> 47:35.410]  They are quite expensive to rent, but you can rent them.
[47:35.410 --> 47:37.010]  We have the SBD modem.
[47:37.210 --> 47:41.170]  We had an Iridium pager lent from someone.
[47:41.430 --> 47:45.830]  And the Iridium Go, which is basically an Iridium to Wi-Fi adapter.
[47:46.250 --> 47:51.070]  You can't do Internet over it, but I mean with 2K4, it's really, really slow.
[47:54.090 --> 48:06.870]  So to get all that examples that I showed you, most of the work is done with the reassembler script, which uses the parse data and reproduces, like, higher-level information.
[48:07.170 --> 48:09.130]  For the pager messages, there's an example.
[48:09.430 --> 48:13.170]  For the PCAP files, the code I wrote is slightly broken.
[48:13.310 --> 48:16.690]  I need to fix it, but it should be in the Git repository, like, tomorrow or so.
[48:17.870 --> 48:21.410]  And there should be more stuff coming when we have time.
[48:22.930 --> 48:25.530]  We wanted to also say something over the Iridium next.
[48:26.230 --> 48:29.630]  So Iridium is aware that its stuff is old and falling apart.
[48:30.390 --> 48:36.450]  And they are launching new satellites with the SpaceX Falcon 9 full trust.
[48:37.730 --> 48:39.430]  Supposed to be launching in September.
[48:39.690 --> 48:40.350]  I mean, they had...
[48:40.350 --> 48:45.870]  They've been saying they were launched as satellites for a few years now and they moved it to the future and to the future.
[48:45.990 --> 48:47.970]  But hopefully, it looks like they will be launched.
[48:47.970 --> 48:49.630]  They will be backwards compatible.
[48:50.030 --> 48:51.970]  So you will still see all the old stuff.
[48:52.150 --> 48:55.350]  But there should be new services that might be interesting.
[48:55.550 --> 48:58.430]  And there will be no more Iridium's flares with the new satellites.
[48:58.730 --> 49:00.330]  So if you want to see them, do it now.
[49:02.310 --> 49:07.190]  Stuff that still needs to be done to understand the ready resource layer.
[49:07.630 --> 49:14.910]  How they handle which frequencies they choose and how they authenticate to the network.
[49:14.910 --> 49:20.450]  We still have a few blobs of firmware to reverse engineer to find more, maybe, debug information.
[49:22.150 --> 49:26.210]  If anyone has interesting Iridium devices, we always want to look at those.
[49:27.490 --> 49:31.790]  The Wireshark, mentioned already, needs to be enhanced.
[49:32.130 --> 49:34.070]  And more unknown frames.
[49:35.150 --> 49:39.110]  Even in SPD we see data that we do not understand.
[49:40.510 --> 49:45.650]  And last but not least, as we already mentioned, all the code is on GitHub.
[49:45.990 --> 49:46.950]  These are the links.
[49:47.150 --> 49:51.850]  There is an IRC channel where we will be hanging around if you have questions.
[49:53.030 --> 49:58.270]  If you have any Iridium devices and want to lend them to us, please.
[49:59.550 --> 50:05.950]  And thanks to all the people that helped us, especially TNT, Dieter Spahr, Ayman and Steve M.
[50:06.490 --> 50:13.610]  And if you want to send us some information you have, maybe encrypted, those are our PGP keys.
[50:14.310 --> 50:16.770]  Well, I cannot really read the second one, I'm sorry.
[50:18.230 --> 50:19.670]  And our Twitter handles.
[50:20.830 --> 50:22.070]  And that's it.
[50:23.150 --> 50:23.810]  Thank you.
[50:36.680 --> 50:38.060]  Does anyone have questions?
[50:40.380 --> 50:40.520]  No?
[50:42.620 --> 50:43.260]  Yes, maybe?
[50:44.160 --> 50:45.060]  I cannot.
[50:46.080 --> 50:48.000]  Ich wollte es auf den Beemer machen, aber es geht nicht.
[50:48.820 --> 50:48.940]  Sorry.
[50:49.660 --> 50:49.800]  Yes?
[50:50.300 --> 50:58.760]  So, you can reliably receive pager messages with any one of the several SDR kits that you displayed at the beginning?
[50:59.000 --> 50:59.340]  Yes.
[50:59.340 --> 51:06.280]  And it's relatively easy to programmatically send pager messages through Iridium's website or API?
[51:07.900 --> 51:14.980]  There is an Iridium website where you can, if you know and receive a number, you can free of charge send Iridium pager messages.
[51:15.300 --> 51:21.400]  So, between those two things, you could send and receive pager messages from anywhere to anywhere?
[51:22.000 --> 51:23.460]  You need a valid contract.
[51:23.780 --> 51:30.620]  I mean, the receiver pays for the messages, so you need a valid contract, a phone number, but then you can send and receive, yes?
[51:32.220 --> 51:37.140]  Well, you need to know a contract number that is real.
[51:37.800 --> 51:37.900]  Yeah.
[51:39.420 --> 51:43.660]  The satellites send down the radio identifier code, which is not the phone number.
[51:43.840 --> 51:46.640]  So, you need some other way to find the phone number, but then you can, yes.
[51:47.660 --> 51:48.240]  Thank you.
[51:48.460 --> 51:52.100]  And the owner of the pager sets the receive areas.
[51:52.500 --> 51:54.720]  Iridium lets you select where it gets down.
[51:55.060 --> 51:56.480]  You have, like, three areas.
[51:56.680 --> 51:59.420]  That's, like, nearly whole of Europe, if you want it.
[51:59.540 --> 52:02.660]  But if your receiver is in the wrong country, you will not see the message.
[52:03.620 --> 52:09.860]  So, the receiver number would have to be compatible with the areas that the receiver had selected.
[52:10.380 --> 52:10.900]  Yes.
[52:10.900 --> 52:11.140]  Thank you.
[52:12.480 --> 52:19.280]  So, you did this really cool thing where you captured somebody calling a plane that was probably, like, you know, government plane or whatever.
[52:19.280 --> 52:23.460]  And they were, I can talk closer into it now.
[52:23.580 --> 52:23.920]  There we go.
[52:24.280 --> 52:30.960]  So, you did this cool thing where you called the C-37 plane or whatever, and they were, like, for secure line two, press whatever.
[52:31.480 --> 52:31.620]  Yes.
[52:32.140 --> 52:40.100]  Could you, like, replay those packets and call the same line and, like, push the button and get the secure line yourself?
[52:41.020 --> 52:46.500]  In theory, we should have seen the call setup message.
[52:47.180 --> 52:49.820]  And then we maybe have the phone number.
[52:50.700 --> 52:51.980]  But I didn't check.
[52:52.780 --> 52:53.420]  Thank you.
[52:55.400 --> 52:58.380]  I just wanted to say, I picked up a couple of those antennas.
[52:58.580 --> 53:06.040]  The Tau Glass Iridium antennas and some GPS antennas with the intent of hacking them in and hooking them up to my HackRF.
[53:06.140 --> 53:07.380]  Didn't get around to it yet.
[53:07.560 --> 53:08.960]  They're with me today.
[53:09.460 --> 53:13.400]  So, if anyone wants to play with this, I would love to hand you some hardware and get you a jumpstart.
[53:14.020 --> 53:16.340]  I'll be in the hardware hacking area right after this talk.
[53:16.840 --> 53:17.160]  Great.
[53:17.440 --> 53:18.020]  Thank you very much.
[53:20.800 --> 53:21.200]  Hi.
[53:24.340 --> 53:28.360]  I've gotten into arguments with people about how many bits are in a byte, right?
[53:28.620 --> 53:34.440]  So, maybe this is really obvious, but the number of bits in a byte isn't eight, right?
[53:34.440 --> 53:40.720]  It's dependent upon the number of bits that it takes to describe your character set, right?
[53:41.080 --> 53:50.520]  So, have you considered that that six-bit unknown value is actually not, it's six bits for the language?
[53:51.040 --> 53:59.720]  Yes, but, I mean, all the rest of Iridium has eight-bit bytes, so I was wondering, I'm wondering why suddenly in this position they use six bits.
[53:59.900 --> 54:04.060]  Yeah, well, I mean, it's possible that you have some sort of legacy IBM system.
[54:04.420 --> 54:05.520]  That's a part of the match.
[54:05.520 --> 54:06.460]  That could be, yes.
[54:06.760 --> 54:07.060]  Yeah.
[54:07.080 --> 54:07.220]  Okay.
[54:07.800 --> 54:08.320]  Thanks.
[54:10.120 --> 54:13.380]  A question for the bi-directional data.
[54:14.480 --> 54:18.840]  Do you see both sides of the conversation, or do you only see one side?
[54:19.080 --> 54:29.820]  So, if the initiator of the communication or the uplink generating device is near to you, like a kilometer or two, you can still see it with your SDR.
[54:29.820 --> 54:30.280]  Yes.
[54:30.500 --> 54:30.920]  Okay.
[54:31.140 --> 54:36.680]  But if the center is, like, outside of where you are, you only see the one side of the conversation then?
[54:36.820 --> 54:37.200]  Exactly.
[54:37.480 --> 54:37.520]  Yeah.
[54:37.760 --> 54:37.860]  Okay.
[54:38.420 --> 54:39.000]  Thank you.
[54:41.100 --> 54:43.600]  How do firmware upgrades on the satellites work?
[54:43.700 --> 54:47.680]  Do they upgrade the firmware to add new features, or do they always just have to launch new satellites?
[54:48.000 --> 54:50.420]  No, they do upgrade features on the satellites.
[54:50.640 --> 54:55.640]  So, for example, the short-burst data service is an upgrade of the firmware on the satellite.
[54:55.640 --> 55:03.700]  They pride themselves that the new Iridium-next satellites have been extensively tested and won't need as many firmware upgrades anymore.
[55:03.980 --> 55:07.120]  I guess that's due to that they're so late.
[55:09.480 --> 55:10.100]  Okay.
[55:10.280 --> 55:11.520]  One more, and then we have to finish.
[55:13.360 --> 55:20.480]  Which reverse engineering insights did you find easier to gain from reversing firmware versus looking at packet captures?
[55:22.200 --> 55:27.080]  And which approach did you find easier for what?
[55:27.380 --> 55:36.160]  So, I personally spent most of my time just looking at the packet dumps, but there's stuff like the voice codec, which we could not have done from the packet dumps.
[55:36.160 --> 55:38.100]  So, we did both, basically.
[55:38.520 --> 55:39.020]  Yes.
[55:39.280 --> 55:40.700]  Very much depends on what you have.
[55:41.060 --> 55:47.220]  It's always easier if you have the device itself to generate data and then just look at how it changes.
[55:47.780 --> 55:55.000]  But if you can't do that, then you might want to look at the firmware-enabled debug output.
[55:55.100 --> 55:56.620]  That's very helpful, usually.
[55:57.540 --> 56:00.340]  And we've gotten really good at finding checksums.
[56:03.420 --> 56:04.560]  Thank you.
[56:04.560 --> 56:04.620]  Thank you.