Schneier on Security

Clive Robinson • September 6, 2016 4:42 PM

@ Leonardo Herrera,

Some pretty cool toys there 🙂

Not that cool, I see nothing there that I’ve not seen befor for well healed corporate clients, and on some cases I’ve made befor and sold to intermediary organisations. Kroll Asoc is one a number of corporate assistance organisation that used to “buy in” stuff like this, as middle men.

If you look at somr of the cameras you will find the same from other suppliers. As for some of the larger cameras there are a couple of South African companies make almost identical stuff. If you don’t have “Tax Dollar deep pockets” you will find slightly lower spec but a lot lot cheaper systems from the likes of Swann. There are also quite a number of Chinese firms making “IP video cameras” which can easily be hooked together with WiFi routers etc. It actually takes not much effort to take a current WiFi router and make a block up or down converter so that the kit runs not at 2.5 or 5GHz but at 1.3 or even X-Band.

Thus I see little there that you could not make yourself from off the shelf components and information you will find in the better Ham / Amateur Radio info sources. In fact I would make a small wager that some of the stuff is just items from the likes of Mini-Circuits just bolted together in a custom case with a very high price tag (I’ve done it myself in the past as have a number of others I know).

Take for instance their GSM modems, the likes of Motorola sell modules that have the bulk of it in there including a USB 2 interface. You can spend around $50 and get a GSM Shield for the likes of a Raspberry Pi, the bolt some FOSS in with a few changes and the jobs done…

The real hard stuff would be reading and understanding the Mobile Phone Specs so the “faux cells” don’t become obvious to users that have been tricked. But again the Software Defined Radio and similar groups have already developed big chunks of GSM radio software and the hardware to make your own cell site is fairly findable with a modicum of “Google Fu”.

The problem is getting into the game, after all you don’t get Cobham advertising much, as much of their work used to be via the largesse of various people in the defence indistry (you will however find them at “invitation only” defence industry fairs.

Clive Robinson • September 7, 2016 4:23 AM

@ ???,

Swann makes home monitoring systems and components, they dabble in more invasion acktivities also?

They “may not directly” but their customers certainly do with their more covert products. As an example it was Swann ISM band and “pocket flap” cameras that the original RC drone micro helicopter and rocket builders used as they are very functional whilst being very light small, robust and importantly inexpensive. I’ve put them in several OO gage model railway engines and carrages so people using a layout can get both a Driver and Passenger eye view.

I’ve also put them in wall and desk clocks, briefcases, backpacks, ceiling mount fire/smoke sensors, desk lamps, book and file boxes spines and many many other things like childrens toys.

If you get one of those ISM band cameras and receivers, it’s incredibly easy to make very small “Up/Down band converters” all it needs is a double balanced mixer and tiny single chip synthesizer all of which comes in a tiny surface mount IC these days that can often be found in $10 toys. Ham / Amature Radio, RC enthusiasts and security researchers have designs you can find on the internet have a look at Open Hardware SDR designs to see some of them in use. Adding one or two MAR type surface mount broadband amplifiers will increase the power output, and also with a few simple tricks reduce both the ISM and image frequencies down to negligable levels.

Not quite “James Bond” postage stamp trackers you can hide in the coach of a “Faberge egg” but getting closer day by day.

If you want to make higher power “repeaters” there are quite a few things out there. You can get an RTL-SDR receiver for $25, likewise you can by quite cheaply SDR-Transverters, the likes of Mini-Circuits, HP and several others make cheapish surface mount broad band amplifiers. You can buy quite cheaply Amature Radio Kits for various VHF/UHF/Microwave bands that will get you from a few milliwatts to a couple of watts and they usually need very little modification to work outside of those bands.

Heck if you are just looking for analogue voice repeater, go and buy a blister pack of two ALAN / Midland G7 UHF licence free PMR446 radios. Then have a look on the internet for the “export mods” which involves three links on the PCB. You then have a 3watt TX and they work not just on the PMR446 but 69 LPD channels –in the Ham 70cm band– as well. Though technically illegal one heck of a lot of glider and ballon pilots have done this modofication so they can talk to their ground crews. Also do the antenna to SMA or BNC mods so you can get rid of the inefficient “Rubber duck” and put coax feeders to 1/4, 1/2, 5/8 wavelength, “Slim Jim”, “J pole” or “slot radiator” omnidirectional antennas or even Yagi, LPDA or “backfire” arrays.

Having done the mods you work the devices “back to back” with a simple audio lead and PTT switch the details of which are definatly easily found on the Internet in many many places. The important part is to use say PMR on 446 for receive and a low LPD channel on 433 to give you a little frequency diversity, use vertical polarisation for RX horizontal for TX and mount the two antennas as far appart as possible. Try to use short runs of Coax especially on the RX and get the distance by using long way way cheaper audio cables. You could for the TX buy quite cheaply Amature Radio equipment there are a whole range of combined scanners and amature TX hand helds out there, many of which just like the G7’s have PCB links that will change their TX frequency operating range.