Schneier on Security

Iain Moffat • February 27, 2014 2:28 PM

I used to do (amateur) radio direction finding for fun when I was young enough for the running about so this is quite familiar and I would have given arms and legs for it back then. This is at least partly a radio direction finding system – the key words in the TAO catalogue being “line of bearing”.

Direction finding requires a multi channel receiver and multiple antennas, or a steerable antenna. Normal direction finding requires either simultaneous bearings from multiple locations (the transmitter being where the lines cross on the map) or taking the direction finding equipment from one location to the next and hoping the transmitter hasn’t moved in the meantime. I do wonder if the TDM aspects of the GSM protocol make it possible to get range and bearing from one location by transmitting the appropriate query to a target phone – I am not an expert in GSM.

In the radio world there are really four separate passive security threats – detection (the enemy knowing a signal is being transmitted), interception (recording and decryption of the transmitted data), position finding (the enemy discovering where you are when you transmit) and traffic analysis (the enemy logging who and when you communicate with even if they can’d decrypt the content). Encryption at best protects you from decryption and some forms of traffic analysis. I am ignoring the active threats of impersonation (equivalent to MITM) and Jamming (equivalent to DOS or DDOS) for this post before Clive corrects me!.

The mere fact that you transmit exposes you to detection and the risk of position finding. Traditionally the risk of being detected and found increases if you transmit for longer and on the same frequency. Now that A to D converters fast enough to digitise the entire RF spectrum from DC to UHF are commercially available (just look at digital storage scope specs and prices) it may no longer require much time for a professional adversary to find any kind of radio so that is no longer a safe bet.

The best counter to detection and traffic analysis is either to transmit an encrypted stream constantly as a broadcast station (like naval fleet broadcasts) or to hide below the noise floor with some form of spread spectrum or multicarrier system that is easy to correlate if you know what to look for but doesn’t show as a ‘spike’ on anyone’s FFT or spectrum analyser display. If you can be detected you are vulnerable to position finding. There are some countermeasures such as the use of multiple radios on the same frequency but they are technically challenging to set up and operate on a small scale.

Modern military radios use frequency hopping or spread spectrum (an extreme form of CDMA) to try and hide from interception and mesh like networking to complicate position finding but the COTS technology used by most of the “bad guys” (be that pmr 446/ FRS, VHF-FM in Ham/PMR forms or cellular) is much less frequency agile – and in the case of cellular can be made to transmit on demand by a real or fake base station (is this Nebula?)

@Figureitout: It is important to realise that encryption (however good) will not prevent an adversary from locating the source of a radio signal even if the content of that signal is unknown. A good description of one method (Pseudo Doppler) is given at: http://www.pi4wag.nl/index.php/pseudo-doppler-radio-direction-finder . There are other methods (Interferometry for example, as used in the Plessey Vampire DF stations of the British Army until the 1990s).

@ Alex: I think it is more a case that something that can do direction finding of GSM (which probably involves following the GSM signalling to track the channel and timeslot in use by the wanted mobile) can also do single channel FM with the greatest of ease. You are right that the capabilities in this unit are now to be found in a USB stick for less than $20; I imagine if this unit was to be available in 2009 it was designed years earlier. Certainly $70K for 10MHz-4GHz application protocol aware DF would seem like a bargain to the UK Ministry of Defence which spent tens of millions on Vampire in the 1980s to cover 30-120MHz against fixed frequency FM radios only, and blew many more millions on Vixen (a failed successor around the turn of the century). This doesnt need an extra large landrover either !

@Benni: I think “finishing” in this context may just be the final stages of locating a transmitter beyond the accuracy that can be achieved by use of data from cell sites. From practical experience the last hundred metres can be challenging because of issues like reflections and shielding by metal objects, especially in a built up area.