Archive
All writing
Everything I have published here since 2017. Architecture, gliding, lab experiments, and the occasional side note. Filter by pillar or scroll through the lot.
68
Posts
14
Categories
2017
First post
-
Crazy Danish Hacker – GSM Sniffing 12 – ESXi Server
Episode 12: setting up ESXi as the hypervisor for the GSM lab. Preparing a Linux VM to host the Kraken rainbow-table cracker and other heavier tools.
-
Crazy Danish Hacker – GSM Sniffing 11 – Voice Decryption 101
Episode 11: voice decryption basics. How A5/1-encrypted GSM voice traffic is structured on the traffic channel and what’s needed to move from decoded bursts to intelligible audio.
-
Crazy Danish Hacker – GSM Sniffing 10 – SMS Decryption
Episode 10: SMS decryption. Feeding the captured Kc session key back into the GSM traffic capture to decrypt SMS bursts and recover the plaintext message.
-
Crazy Danish Hacker – GSM Sniffing 9 – TMSI KC Extraction
Episode 9: extracting the TMSI and Kc session key for a target GSM subscriber by correlating paging messages and SDCCH activity, a prerequisite for later voice and SMS decryption.
-
Crazy Danish Hacker – GSM Sniffing 8 – Using GR GRSM
Episode 8: using gr-gsm to capture GSM broadcast channels. Decoding the control channel data and viewing raw traffic in Wireshark with the gsmtap dissector.
-
Crazy Danish Hacker – GSM Sniffing 7 – Installing GR GSM
Episode 7: installing gr-gsm on Linux. Building the GNU Radio-based GSM decoding toolset from source: dependencies, compilation, first sanity check.
-
Crazy Danish Hacker – GSM Sniffing 6 – Locating cell towers
Episode 6: locating nearby GSM cell towers by decoding their broadcast identifiers. Combining kalibrate output with public cell tower databases to map the local RF environment.
-
Crazy Danish Hacker – GSM Sniffing 5 – Kalibrate RTL
Episode 5: using kalibrate-rtl to detect GSM base stations and measure the frequency offset of the RTL-SDR dongle. A calibration step required before serious sniffing work.
-
Crazy Danish Hacker – GSM Sniffing 4 – GQRX Installation and usage
Episode 4: installing and using GQRX, an open-source SDR receiver front-end. First hands-on look at the GSM band with an RTL-SDR dongle.
-
Crazy Danish Hacker – GSM Sniffing 3 – Identifying downlinks
Episode 3: identifying GSM downlink frequencies. Using a spectrum viewer to scan the GSM 900 and 1800 bands and pick out active downlink channels used by nearby cell towers.
-
Crazy Danish Hacker – GSM Sniffing 2 – Requirements
Episode 2: hardware requirements for GSM sniffing. RTL-SDR dongle with E4000 tuner, appropriate antennas, and a Linux workstation. Overview of the toolchain needed for later episodes.
-
Crazy Danish Hacker – GSM Sniffing 1
Episode 1 of Crazy Danish Hacker’s GSM Sniffing series: introduction to the topic, what the series will cover, and the legal boundaries of intercepting GSM traffic in a controlled lab.