he3556/sdr-detector

GSM Scanner, RTL-SDR, StingWatch, Meteor

This project is based on: Nodejs, npm and the Meteor platform. https://www.meteor.com/ Other components (like GNU Radio, Wireshark and GR-GSM) have to be installed in order to use SDR-Detector. It's also possible to expand the system with detectors for WiFi, Bluetooth, UMTS and LTE frequency bands. (using existing open source projects)

The software (stand alone detector) will be compatible to: Stingwatch (Cordova based Stingray (IMSI-Catcher) detection) Meteor ICC Meteor-imsi-catcher-catcher (Meteor package for client + server side IMSI-catcher detection.) API Client (more details soon)

---

![Image of SDR-Detector] (http://smartphone-attack-vector.de/wp-content/uploads/2016/05/SDR-Detector_GSM-Scanner.jpg)

###Usage

###Detections

###WiKi

//When all software tools and libraries are installed - 
download (or clone) the project to your harddisk 
and edit the settingsfile to your needs. 
Than generate a python script with: 
gnuradio-companion grcs/airprobe_rtlsdr.grc

// Now you can run the detector as `root` in order to capture data
sudo meteor --settings settings.json      
By default, Meteor runs the webserver on `http://localhost:3000`

sdr-detector's Issues

Support Scans and Detections as a plugins

A "Scan" (processes) is gathering data. With GNU Radio, tshark or other software components.
The data is saved in so called collections in a MongoDB.

A "Detection" is handling the data and giving out statuses and positive detections.

We have to keep everything compatible with StingWatch, Meteor-IMSI-catcher-catcher.
On a phone we get the information from the API. Scan = "API"
But also a external database would be possible. Scan = "OpenCellDB"
The detections (from 1. SDR/GNURadio or 2. the API) will use other parameters in some cases. Because not all information can be received from the API.

First Milestone is to establish compatibility between StingWatch and the SDR Detector.

https://github.com/He3556/SDR-Detector/milestones

Paging detection (your own IMSI)

(if somebody is paging you, they are tracking your position.)
This is done by sending your IMSI in a "Paging Request" message, as if there was a incoming call. Your phone will be sending a response and so it can be tracked. All Base Stations that belong to the same location (LAC) will be sending the same IMSIs (TMSIs) in "Paging Request". (possible detection if there is only 1 BTS sending the IMSI)

Right now all IMSIs (TMSIs) are counted.
Improvement would be if we can add another modus like "Monitor you own IMSI".
(Also for legal reasons this could be important in some countries.)

User needs to enter the IMSI(s) of his SIM card(s).
All variables should be added to the settings file https://github.com/He3556/SDR-Detector/blob/master/example_settings.json

Your IMSIs to monitor:  IMSI-1, IMSI-2, IMSI-3, IMSI-n
"Your IMSIs to monitor": "284011234567890", "285313247567277"

Variable ScanPeriod

Right now this value is constant for all scans.
See Settings: https://github.com/He3556/SDR-Detector/blob/master/example_settings.json#L13

'"deepScanPeriod": 10'

But different scans need more or less time.
P2: 5-10 seconds
P3: at least 20 seconds

Add a value for each scan into the settings file.
Something like this:

'"deepScanPeriod_p2": 5' 
'"deepScanPeriod_p3": 30' 

Status doesn't change

Positive detections are not shown on the frontend.
The Score is always 0 and color is green - even if there are detections.

Support for multiple SDRs

Reading from 2 or more SDR simultaneously.
Each SDR can run it's own (customized) scan.
For example if you want to monitor one certain CellID, permanently listening for paging requests.
While the other one is scanning all BTS (like p2)

https://github.com/He3556/SDR-Detector/milestones

Configuration menu

Slider Menue for settings

Add a button "configuration" to the frontend. Opens a slider when pressed.
If possible read the data from the settings file.
https://github.com/He3556/SDR-Detector/blob/master/example_settings.json
Show the data on the slider. Text can be edited and saved.

  "kalHackRFLocation": "/home/user/workspace/kalibrate-hackrf/src/kal(*)"
  "quickScanTolerance": 43(*)

(*) Field can be edited