Slashdot Mirror
Jailbreak Turns Cheap Walkie-Talkie Into DMR Police Scanner
An anonymous reader writes: Last Shmoocon, famous reverse engineer Travis Goodspeed presented his jailbreak of the Chinese MD380 digital handheld radio. The hack has since been published at GitHub with all needed source code to turn a cheap digital radio into the first hardware scanner for DMR digital mobile radio: a firmware patch for promiscuous mode that puts all talk groups through the speaker including private calling. In the U.S. the competing APCO-25 is a suite of standards for digital radio communications for federal users, but a lot of state/county and local public safety organizations including city police dispatch channels are using the Mototrbo MotorolaDMR digital standard.
Very cool, but not the first hardware scanner: http://www.aorusa.com/receiver...
If you can monitor things you shouldn't, the problem is with the insecure communications system not with the hacked walkie talkie.
Okay, I gotta say that's a pretty nifty little hack.
Just cruising through this digital world at 33 1/3 rpm...
A nice simple way for the new owners to demonstrate their good intentions:
Please can we have the "Read more..." link back for all stories and not just on the polls ?
Thanks.
Anyone else read that as "Jailbreak Turns Cheap Walkie-Talkie Into DRM Police Scanner"?
but a lot of state/county and local public safety organizations including city police dispatch channels are using Mototrbo Motorola DMR digital standard.
Isn't it wonderful that the lessons of 9/11 and other major events is being lost in the push for more sales of commercial radio systems?
It's critical that first responders from different agencies be able to communicate with each other when a large event requires mutual aid. It is just as critical for neighboring agencies to be able to communicate on each other's systems when an event crosses a border. A first responder from county A who responds to something just over the border because he's closer shouldn't have to relay his communications through his dispatch to be able to talk to the resources coming from county B.
Motorola is making hay while the sun shines by selling P-25 systems, Mototurbo systems, and then bridges to link the two together, instead of using a single nationwide standard.
It's bad enough that agencies that use only 700MHz (and have single band radios) can't interop with agencies using legacy VHF or UHF systems, but Motorola profits from that, too. They'll happily sell multiple radios to solve this problem, and have each patrol vehicle or dispatch center carry two radios when one would do. And companies like Harris will gladly step in and sell $5000 portable multi-band radios.
Yes, there are nationally defined "interop" channels, but many agencies have no clue what they are (even a decade or more after they were created) or where to find them on their radios, if they are programmed to contain them. And if one agency has only the 700MHz "7CALL" etc available while the other has only the "VCALL" etc channels, those interop channels are useless.
"Mototrbo Motorola DMR digital standard"
Is a complete misnomer. DMR is not a Motorola standard, it's a European standard (ETSI) and effectively a digital radio replacement for the MPT1327 standard (a British standard from the Ministry of Post and Telecommunications). Having said that many radio manufacturers would have had input to the standard, including Motorola. The one I worked for did.
DMR/P25 are similar, in that if you don't want people to listen in on what you're broadcasting, encrypt it! As far I can remember, AES256 was the best encyrption option availble to P25... I can't remember the details for DMR, or even if it supported it.
DMR standard had/has some weirdness: for instance the vocoder wasn't specified. Everyone seems to have defaulted to the AMBE half rate vocoder from DVSI, the same as what is being used for P25 phase 2.
and open source software like Gnu Radio. No need to spend $150 bucks and then void your warranty.
The thing GNU Radio is just just a bunch of software routines. People have cobbled things together that will allow you to listen to AM, FM, and SSB, but the UI is crude and it's not something an average person would find usable. On top of that the digital voice decoding is a separate piece of software which (except on Windows) you have to compile from source and figure out how to bolt that on.
It'd be nice if more people were putting their hacking energies into SDR, because then maybe someone would come up with a nice, slick plug-and-play solution anyone could download from a distro repository. It's happened in other somewhat technical areas, like GIS (e.g., Quantum GIS) or computer algebra.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
I like to monitor the LAPD and the big LA trunked system.
I've had an MDR380 for a while but it's been sitting in a drawer because DMR for amateur radio is a joke.
They've built all these local, regional, and national talk groups but everyone is afraid to use them in case somebody else wants to use them, so everyone who does try is either scared or they are idiots who hog it for tens of minutes.
And the DMR system is broken such that when you turn on your radio, you have no idea if the repeater you are calling is linked into anything. The act of transmitting will cause an idling repeater to wake up and reconnect at which point you stomp on an existing conversation if any are taking place.
So DRM for hams is a real mess that makes D-STAR look amazing by comparison.
Anyway, now maybe this 380 will have a use. But probably not.
Sig for hire.
This statement is not correct:
"Here in the US Project 25 (P25 or APCO-25) is a suite of standards for digital radio communications for federal users, but for state/county and local public safety organizations including police dispatch channels are using Mototrbo DMR digital standard."
It should say "Here in the US Project 25 (P25 or APCO-25) is a suite of standards for digital radio communications for federal users, but SOME state/county and local public safety organizations including police dispatch channels are using Mototrbo DMR digital standard."
Most state/local agencies are in fact using P25. Some are using DMR, others use other things. The same is true for commercial businesses. They can operate in P25, DMR, Nextedge, etc on a variety of bands, which means it's rather more complicated to hear everyone and everything at the same time.
Sig for hire.
This firmware mod does not make the radio into a scanner, nor does the promiscuous mode even work properly. I bought the MD-380 as soon as I read the PoC||GTFO article on it and immediately installed the alternate firmware. I found that you must have the correct DMR 'Color Code' to monitor communications. The Color Code is a number between 0 and 15. You must also have the correct repeater time slot as well. (there are two time slots TDMA with 30ms frame each) This seriously limits the usefulness. They need to make the promiscuous mode ignore the Color Code setting as well to make it useful for monitoring.
I find myself going onto DSD with RTLSDR to discover the Color Code (or DCC as DSD calls it) and Time Slot.
key phrase: "People have cobbled things together "
And that is the problem. All those nice little bits and pieces are just that: bits and pieces, poorly documented, often not handling everything.
I cut my teeth in a radio shop in the late 1980s; I left several years later. I know and understand why they were converting the getting-crowded cellular system to digital back then (bandwidth --> $), but why did the municipal/commercial radios follow suit when the transmissions I hear are of such terrible quality versus the analog I remember?
And if your answer involves crowded bandwidth, I ask, is it really? I have seen graphics describing the use of radio bands, but every time I've had the opportunity to use a scanner and poke around over the years, I find very little in my suburb of a major U.S. city. Haven't a major portion of businesses gone to cellular communication anyway?
FYI ...if you care ...the original argument against scanners by the police was to cut back on ambulance chasers ...criminals just aren't that smart and cops really aren't that much into trying to pull over folks secretly. I applaud all attempts to break the code and listen. It's a beautiful thing to drive technology forward! Besides ...smart guys need hobbies :-)