Schneier on Security

Clive Robinson • December 15, 2017 2:12 PM

@ CallMeLateForSupper,

“Just say no” to accelerometer, barometer magnetometer.

It’s not that easy these days, in fact it’s a “Hobson’s Choice”…

One of the problems with an electronic buffet, you don’t get to chose what gets shoved down your throat…

Clive Robinson • December 16, 2017 11:22 PM

@ Wael, Gordon, Jim Bob,

Certainly POCSAG pagers have an advantage at the cost of reduced usability.

Yes their use as a “cut out” or covert “control channel” has been discussed on this blog before between @Nick P and myself initially if my brain remembers correctly in regards remotely turning on a WiFi or Bluetooth node concealed in a public place in a similar way to the “Fake Rock” in a Moscow Park that supposadly was put there by British Secret Service Operatives.

So to go through it again,

The UK “Post Office Code Standardization Advisory Group” code 1, is a “one way broadcast system” often with transmitters using “Simul-Cast” across entire geograpic regions of seceral hundred square miles. With individual VHF transmitters having a 20-50mile radius depending on terrain. VHF POCSAG has around a 10-15db advantage over the 6400bps/3200baud UHF FLEX system which is often used in smaller coverage areas with much increased traffic such as towns or business districts and in smaller areas still including private organisations like hospitals, university campuses and factories etc. The general idea is that pagers act as a control channel for other communications such as the POTS / landline telephones.

Thus whilst slower at 1200bps/baud POCSAG has significant covert advantages over the faster FLEX system in terms of “area covered” at upto 64times, which a Find Fix and Finish (FFF) team would have to cover to find a receiver. Further as the number of receivers that can be on at any one time is large and EMC radiation small these days old / traditional HufDuf direction finding on the IF frequency is going to be largely ineffective except over the last few yards.

As for “traceability” via the subscription there are various ways this can be avoided with pagers. There is the administrative and technical ways.

The Administrative way is via “shell financing” etc for a “subscription” and honestly it is not recommend for use except by experts as it’s easy for even the likes of Mossad, CIA and NSA to make mistakes with, that become “Red Flag” issues down the line as we have seen. Primarily because financial records are realy “collect it all” and very actively monitored in many ways for many reasons. The other way used to be to buy with cash a “life time” system, you used to find them in the likes of Radio Shack, but they appear to have died out from retail outlets now. Further they have become “dodgy technology” much like new “Burner phones” became. Unlike used mobiles there never was a “street corner” used sales market for pagers.

On the technical side, the first thing to realise is that as both POCSAG and Flex are “open protocol broadcasts” on known frequencies you can use a cheap SDR dongle and PC/Computer “test” decoder software to view any and all messages sent. Importantly there are versions for cheap RTL dongles and small Single Board Computers like the Raspberry Pi abd Adrueno for instance.

Importantly for covert usage most pager systems do not do message sender authentication, only valid recipient subscription checking. In effect security wise they are wide open… Thus hijacking one or more valid subscriptions is not at all difficult, in fact it’s in effect trivial if you can get an account to service ID mapping. Which tends to be easy to do for quite a few services. Further users who get an occasional “false bleep” tend to treat it like a “wrong number” so the user report back of false bleeps are next to non existent if kept both sparse and during normal “office hours”. Which is a “social engineering” point to remember.

I’ve also mentioned that the pager message can be processed by the Single Board Computer the SDR dongle is connected to, and this can be used as a remote switching device. To turn on/off the likes of a “Mobile Phone Shield” that are less thsn 50USD if you shop around. Likewise WiFi or Bluetooth shields and even good old POTS modem dialup via old serial modems and the Hays AT command set.

Thus setting up a “digital cut out” for very low bandwidth use is technically quite simple, and often practicaly so as well. If you want to go down the HF Covert or LPI route as @Figureitout has mentioned in the past the likes of PSK31 exist as do other more interesting Amature Radio Protocols designed to help produce HF Propagation information. The only problems generaly being transnitter frequency stability and setting up a covert antenna. For the antenna can I suggest having a look at the The “Directional Discontinuity Ring Radiator (DDRR) described in CQ Magazine back in June 1964, or in ARRL/RSGB HF and VHF antenna books and similar[1] or a modification of the idea givrn in a now long expired US Patent[2]. In effect it’s a combination of a bottom fed high Q tranmission line used as a form of slot radiator, therefore even though low doen ~1/10th of a wavelength and horizontal it radiates verticaly polarised and omnidirectionally. Because the DDRR is effectively a quaterwave or longer loop a very short distance above a ground plane it’s very inconspicuous and to most including many electronics and radio engineers does not look like an HF antenna. Thus it can be made easily with wooden fence posts and two inch scaffolding pipe to look just like a lot of low cost but robust fences found in public parking areas as such it works well in the top half of the HF band ~15-40MHz (it also works supprisingly to many on the roofs of tower blocks and high rise carparks). However iron scaff poles do have a high radiation resistance which may be a bit problematical thus if out of the way 22mm copper water pipe drops the radiation resistance but the decrease in conductor diameter ups the Q making it more narrow band.

Whilst HF 10meter QRP transmitter designs are ten a penny on the internet, few have the sort of long term frequency stability you need for systems with a bandwidth of less than 100hz. There are various ways around this but they are quite technically involved such as home designed frequency standards or TCXOs (real or computer compensated). Another way around it is to use a quite complex PC based SDR at the RX end that listens in to all transmissons in a 10-100KHz bandwidth and finds your specific transmission by call sign etc. This keeps the high cost equipment at the covert receiver end of the cut out where it is far less likeky to get burned if you have appropriate alarm systems at the TX end of the cut out.

Getting back to the pager transmisson as for “secrecy” it has non built in at all, and getting “five letter code groups” of random text sent not at all practical and would raise alarm bells. However as I’ve mentioned befor the use of One Time Phrases that are plain english goes back to atleast WWII[3] and provided they are used correctly raise no alarm with operators or automated systems and give no information to an observer other than that a “broadcast communication” has been made, which can not be told apart from “circuit keep alives / padding” and “action messages”, thus rendering traffic analysis moot as well.

Thus you have the control channel using the One Time Phrase and a controled communications channel.

The most important thing about using such One Time Phrase systems is to decouple the the control channel from the communications channel as much as possible. That is not just “content from action in time” but also from the controled communication channel to prevent or reduce traffic analysis.

That is you do not do anything immediately on receiving a phrase, you wait untill the next schedualed “time slot” for the controled communications channel, or if you miss it the one after that. Further you also randomly use time slots independently of the One Time Phrase System channel for “Call mother” or “routine admin” messages.

Thus the only “Flash Traffic” / “immediate action” sent is a “close down” / “bug out” / “Final action” message after which that particular message system is considered “burned” (as is the operative often).

This is all fairly standard “Tradecraft” adapted from ages old “fieldcraft” using “route flags” and “dead letter boxes”.

[1]http://nashvillelibrary.dyndns.org:823/YourFreeLibrary/Antennas/ddrr/Build%2520a%25202%2520Meter%2520DDRR%2520for%2520Mobile.pdf

[2] http://google.com/patents/US3299428

[3] During WWII the BBC used to transmit “And now some messages for our friends” in it’s overseas broadcasts followed by random sentences. Most were “padding / keep alive” some were “action messages” to SOE and others for administration or other “time delayed actions”. Similar messages were also sent more covertly via the “Black Propaganda” broadcasts sent from the Aspidistra transmitter in Crowborough in SE England that poped up on main German broadcast frequencies that got cleared when allied bombers were detected heading for Germany etc (to stop them being used as DF beacons by the allied bombers).

Clive Robinson • December 18, 2017 7:14 AM

@ Gordon,

Hmm “F9” financial reporting from within Lotus “add on” that takes me back a long way. I liked 1-2-3 when I used to use it, because it did things in sensible ways. Then it got replaced with a Microsoft product that did things “The Micro$haft way” which every one just hated…

As for the P8GR it’s like one of those old jokes “When’s a pager not a pager?” … “When it’s a TETRA data terminal”… And that’s the most fun you will get out of it.

There is some kind of perversion to put “all the eggs in one basket” which in the case of TETRA is “an old and rotten basket that could not hold it’s own weight when new”. In order to sell TETRA you need the “War on Terror” marketing of Fear, Uncertainty and Down right lies, and the vague promises of it working when all the other networks have been shut down because mad bombers are using cellphones/pagers/etc as remote detonators…

Oh and there’s those other vague promises of “inter operability with security” and the saving of spectrum and base stations etc… The TETRA sales people make the Software industry marketers look honest and truthfull by comparison.

In the UK “First line responders” like TETRA so much they carry two sometimes three mobile phones. Because not only are mobile phones light, small and have a better battery life, they also work where they are supposed to oh and don’t break if you drop them, unlike the TETRA gear… The only good comment any one had to say about one after hefting it a few times was “you could derail a train with this”.

As for the supposed “security” of TETRA, the sage piece of advice is said in a voice like the “Don’t go into the water” line in a bad B movie horror film, and it’s “Don’t what ever you do turn it on” with he rider of “Unless you need a world filled with pain”.

The clue that P8GR is not so GR8 is the docking station with the integral quater wave whip, which not only will have somebodies eye out, it also tells you the P8GR is deafer than the proverbial door post like TETRA in general won’t work in buildings… Oh then there is the price of 700euros each –might be cheaper now– said with a straight face at a PMR show. All without mentioning the billion dollar infrastructure you have to put in three times over to get it to work only half as well as the old analog systems. Then there is the fact that an idiot could hack it or screw it up by plugging in a USB lead connected to a computer with a little bit of software…

The thing about TETRA was it was a “Paramilitary for Civilians” idea. The military had their “Soldier 2000” idea in the 1980’s to replace their old Battlefield Comms with something better that would integrate digital comms that could be encrypted. To sell it it had to be grandiose and it was promising all sorts of “integrated services” gps, IR cameras digital maps with colo troops etc. Thus other Guard Labour was given it’s “Me To Moment” with the likes of TETRA… Well the Mil have kind of given up on S2K as it was two decades late. Thus TETRA did not get the expected “spin offs” whilst the GSM mobile phone got everything whith bells whistles and extra nobs on apart from encryption. So even soldiers go to war with their iPhones in pocket. Thus the Mil are looking at troop level stuff being mobile phone based as “COTS is now King”. TETRA however is now “Cinders after the ball”, without the glass footware…

Anyone who buys into TETRA anew these days probably needs some serious help as it won’t just be their sanity that gets called into question…