Giga-hurts radio: Terrorists build Wi-Fi bombs to dodge cops' cellphone jammers Terrorists have been caught strapping Wi-Fi-activated backup triggers to bombs in Indonesia, police claimed this week. The explosives were discovered in a raid earlier this month, and included a switching mechanism that enabled them to be detonated using a signal sent via Wi-Fi if the main trigger, which uses a SIM card and …
General wide area jamming: difficult. Jamming in specific locations: easier. . There is nothing that prevents hackers from selling access to wifi routers. Most have default passwords, can be taken over from the wan side due to bad configuration or just vulnerable software. How on earth are you going to jam all wifi routers? The jamming signal has to be extremely strong and omnidirectional to cover large areas.
Actually, there are any number of ways to generate an EMP. Any sufficiently large explosion is the "easy" way, but a one-shot "focused" EMP bomb is apparently possible:
https://science.howstuffworks.com/e-bomb3.htm
. . .which suggests, in turn, that the major powers already have them.
Or, just focus microwaves tightly enough, although that tends to leave signs. . . like cooked meat in the beam path. Alternately, that's a cheap way of training managers, they didn't need those higher brain functions to start with. . . (evil grin)
Erdinger's alkahol Frie wiessbier is pretty good. I like it for post run refreshment after summer runs when alcohol would go straight to my head. The proper stuff can, perhaps, come later when I'm properly rehydrated and have some food in me.
Spent a week in the US at a place that had its own canteen. Every day I ordered chips and the b******s kept giving me crisps.
A lot of places what you are going to get in any case is chips/crisps rather than fries/chips anyway.
I know Erdinger alcohol free is isotonic, so technically a sports drink, but that's taking it a little far..
It is the best alcohol free beer out there though.
Post run I'd rather have water or a fizzy drink coupled with a load of food, then beer later.
My thoughts exactly.
Or to make it even worse: Losing the connection starts a countdown of 3 hours or something.
Not precise enough to target a car, but if you know the plan of action (when the jammers are going to work) it will be enough to inflict major damage and panic upon a crowd of people.
Oh wait, the's one more: How about drones with an additional transmitter..?
Of course both side already thought about this as well..
Futures gonna be interesting..
A normal basic router has an isotropic aerial that transmits over an almost full sphere - a using a satellite dish instead could reduce this to under 2 degrees giving a massive signal boost.
(For more information on long range WiFi see the Wiki article - https://en.wikipedia.org/wiki/Long-range_Wi-Fi - there are WiFi links mentioned there that are over 300km !!!!)
A team of radio ham types took a standard USB stick, put it at the focus of a large parabola, on top of an Italian alp, then beamed wi-fi down Italy for many hundreds of kilometres. The ‘only’ trick was to re-write the protocol slightly to allow for wider packet timing...
...the last I heard, they were negotiating with NATO to borrow another alp with a troposcatter array
Bad guys use any available tech, from PIR , to radio-shack handies, to the actual exothermic stuff itself....luckily they are increasingly rare, in our ever safer, richer world. Media rarely puts things in context.
The hacking approach might vary depending on whether the person doing the mods is a programmer or hardware person.
I wouldn't bother with trying to mod WiFi gear. I'd cobble something together with some cheap "Software Defined Radio" (SDR) sub-assemblies. Cheap as chips and I could have the trigger set as a moderately long code phrase to prevent falsing. I could choose a frequency near the police or state security so it would be unlikely to be jammed.
http://www.unwiredadventures.com/unwire/2005/12/defcon_wifi_sho.html
125mile (~200km) unamplified 802.11b link (with massive dishes), and that was in 2005 or so.
Not practical for potential bomb detonation, but goes to show how far you can throw a standard wifi link. If you wanted to use amplifiers, altered frame timings and really get into tweaking it, you can get it even further (the GP wiki post lists notable links that are longer than the above).
>if you make it wrapped around a hollow tube you can point it accurately enough to work over a couple of miles with little problem.
I seem to remember (in the days of GSM) that pringles tubes made excellent directional waveguards - a useful trick if you needed to get the best out of a poor/weak signal.
@Duncan_Macdonald
Most of this discussion seems to about direct links to a device with a WiFi client.
*
But suppose the device (and its WiFi client) has logged in to a "free" access point nearby. Then with a little internet chicanery the device can be controlled from ANYWHERE ON THE PLANET.
*
As to plod using cellphone jammers, doesn't that jam their own phones? What am I missing?
As to plod using cellphone jammers, doesn't that jam their own phones? What am I missing?
They probably aren't using phones - they have radios instead.
In the UK the radios have a number of features which simply don't exist (and can't yet reasonably exist) on mobile phones, despite what the ESN bids would have you believe.
And what if the plod radios use a frequency-hopping system to avoid interference?
Frequency hopping or not, they're assigned a particular radio band and jamming that would disrupt their own comms. Using short keepalive (literally, in a way) pings using that band would probably work. Whether or not it'd be picked up as an actual signal for some purpose or just dismissed as brief blips of static I can't tell.
you're right in that a directional antenna will greatly increase range. think radar dishes and old-style TV antennas. but it also reduces the chance of a signal being jammed by an omnidirectional jammer.
and wifi isn't the only wireless system out there [it's just cheaper and more available].
jamming RF isn't going to fix the problem. Too many places in the world literally CODDLE these terrorists and even ENABLE them. Indonesia might have to re-examine its own domestic policies, and controlling EVERYONE isn't the solution, because laws only stop LAW ABIDING CITIZENS from having their freedom - criminals (and terrorists) simply do not care about laws and will do whatever they want, anyway.
DM proposed, "A normal basic router has an isotropic aerial that transmits over an almost full sphere..."
Not quite. It's difficult to achieve an isotropic pattern. A normal basic whip commonly found in a normal basic router is more like 'omnidirectional', not 'isotropic'.
You may look up the meanings if they're unclear to you.
A more expensive router, perhaps with 12 internal antennas like mine, might well approach effectively isotropic, by complex beam steering and MIMO.
In summary, omnidirectional is simple and common. Isotropic is more difficult and less common.
It is taking them the better part of the month to count the ballots and determine the election? Here in the United States we are able broadcast the election results moments after the polls close. This seems really lame.
Errr.... Let me rephrase that. Here in the United States we are able to broadcast the pre-determined election results moments after the polls close, as provided to us by foreign governments.
Even manual counting of results should only result in a delay of a couple of days. So I wonder what Indonesia is doing to require a month to count. Most Western elections are certified within 24 hours or so pending all known recounts (many automatically triggered by law). Even the recounts typically only take a day or 2 before being official.
Would this be the election in which 270 humans died, literally *died*, because they were counting votes until they died? And nobody seems to have cared. Can you literally imagine how stupid that is. That their own government killed 270 people through overwork? Who are the real terrorists here?
And in case you think I'm making it up:
April 29 (UPI) -- Nearly 300 poll workers in Indonesia have died while working to count tens of millions of ballots in the last two weeks, elections officials said.
Indonesia's election commission, the KPU, said 272 workers have died since the April 17 election and 1,900 have become ill. The election was the first time Indonesia held presidential and legislative elections on the same day for voters at 800,000 polling stations.
Commission chief Arief Budiman said many workers have worked to the point of fatigue in an effort to get the votes counted. Nearly 193 million ballots were cast in the election. Official totals will not be announced until May 22, but early results show incumbent President Joko "Jokowi" Widodo won with 55 percent of the vote. Challenger Prabowo Subianto won 44 percent.
Local election watchdogs have called on the KPU to review the vote-counting process because of the deaths. Some officials said, however, the counting must be finished before claims of overwork can be addressed.
"They still have to focus on the counting process and data entry on their website," Ferry Kurnia Rizkiyansyah, co-founder of Network for Democracy and Electoral Integrity, said.
Rizkiyansyah, a former KPU member, said Indonesian lawmakers can debate amending the law sometime after the election has been decided.
"Indonesia's election commission, the KPU, said 272 workers have died since the April 17 election and 1,900 have become ill"
"the counting must be finished before claims of overwork can be addressed."
"They still have to focus on the counting process and data entry on their website"
The fact these people have lost their lifes is a tradgey, no doubt.
However we don't know why they died yet. I hear on the news that the vast majority of people counting were unemployed and extremely poor / lowest end of the social economic scale. As such this group have a significantly lower life span and higher chance of dying early / severe untreated illness than the general population.
Would this be the election in which 270 humans died, literally *died*, because they were counting votes until they died?
The BBC published a statistical analysis that suggested this was not to far out of line with the normal mortality rate for the sample size over the exposure period. There were some seven million people involved in the election over a period of several days. The analysis was fairly rough and ready and suggested that there were legitimate questions to ask, such as whether an election on this scale in a logistical environment such as the Philippines might be better being staged over a longer period.
https://www.bbc.co.uk/news/world-asia-48281522
"Would this be the election in which 270 humans died, literally *died*, because they were counting votes until they died?"
Seeing as there were over 7 million election workers and that the elections and counting were a lengthy process there is nothing here to prove that wasn't due to natural causes?
Sorry, but in France the presidential election metropolitan results are available the same day. It is understood that External Territory results (ie the islands and other ex-colonies still under French rule) will take a few more hours, but in mainland French territory the ballots are hand-counted, verified and the tallies are centralised in Paris before 8 P.M.
So no, manually counting ballots does not impose a delay of several days. Stuffing the election, "arranging" the results and plain disorganization, however, can very well have such an impact.
"So no, manually counting ballots does not impose a delay of several days. Stuffing the election, "arranging" the results and plain disorganization, however, can very well have such an impact."
Considering the geography of the nation of Indonesia, I can easily see it taking days or even a week just to collect all the ballot boxes and get them to the counting stations, especially from the more remote places, eg small islands, mountain villages etc. Depending on how that is done and by whom, the numbers of people involved, it's conceivable that it could take a month in total. For example, there may be specific small teams tasked with collecting from multiple remote locations who may well be relying on small boats and 4x4s to get to some of these places. They may not be spending money sending helicopters for these collections.
"a). if the voting can happen in the remote areas, so can the counting"
Not if you want your elections to appear legitimate and above board. The counts have to happen in approved centres with proper supervision. You don't set up unsupervised counting centres in every tiny village. You don't seem to have considered the sheer remoteness of some parts of Indonesia and the cost or logistics involved in such a large and widely scattered population.
Here in the United States we are able broadcast the election results moments after the polls close
And sometimes even before that.
Someone more knowledgeable can correct me, but I believe Canada uses manually counted paper ballots in national elections. I live about 150km from Montreal and actually watched the results of their 2015 election on cable TV here in Vermont. They seemed to have no problem getting reasonably complete results within a few hours of the polls closing.
Population is somewhere around 269 million spread over many islands so logistics of getting all the voting papers to a central place for checking is difficult. This was parliamentary as well as presidential election.
The incumbent, Joko Widodo is a reformer. The hopeful, Prabowo is ex-military (dishonourable discharge) and ex-son in law of the former dictator President Suharto. Entirely possible Probowo supporters would plant a bomb then blamed it on the Islamists. Try to make the case that Indonesia needs a military man in charge to clean up the insurgents. It was this kind of clean up that got Prabowo kicked out of the army in the first place.
Indonesia has roughly 18,000 islands (opinions on the exact number vary somewhat). These vary wildly in population, access, level of development, sense level of local authorities etc etc. Corruption is a known issue. How far down the chain do you want to delegate the counting of the votes?
On the other hand, widespread availability of parts (the ISISpi?) would likely be preferred over something more traceable.
Enter 'LoRa' into an AliExpress search box and you're knee-deep in the stuff. For peanuts. Two of those are about all you need.
"Enter 'LoRa' into an AliExpress search box and you're knee-deep in the stuff. For peanuts. Two of those are about all you need."
I'm not disputing they are available, just in much smaller numbers than wifi parts from many local suppliers, avoiding the need to import parts or providing a delivery address.
Cash and anonymity beats availability with financial details and addresses.
avoiding the need to import parts or providing a delivery address.
If you're wary about leaving traces that way, you just delegate getting the devices via some poor sod who wouldn't mind pocketing a few rupiah for this service, and instruct him to visit one of the shops selling that stuff; they have those in Indonesia too. Or provide a shipping address.
The credit card they're bought with will not be the bomb maker's either.
If you're that determined, and even vaguely versed in electronics even to the standard of a secondary school electronics clubs, you can replace a GSM module with a satellite radio module (didn't The Reg use one for their paper plane thing? I remember an SMS-like interface, over satellites, that if you have a clear view of the sky received anywhere on the planet), a 433Mhz module, hell an FM radio module, or an SDR (which you can use a £10 DVB-T USB stick for) and a transmitter.
If you're that determined to blow something up, you do it the other way anyway - you do ABSENCE of a signal as the indicator. Text every 10 minutes, no reply before the next text and you activate. Then any jamming actually sets off the bomb. Or have a machine with a 4G module just poll a random Reddit page or whatever and if there isn't a post from a certain user within the time limit, detonate. Almost impossible to trace post-event, all you'll see if accesses to a page even if you can get a full Internet history of a smithereens-SIM... you'll have no idea what it was grepping for among the thousands and thousands of other posts.
Hell, just a GPS receiver with NMEA sentences that - if moved, hits a certain time, or loses triangulation... all kinds of methods.
For £50 I could wire up about ten different ways to activate a circuit board pin, inside something the size of a matchbox.
That sounds like madness (the idea rather than radio 4...). Who would use such an idea to trigger a weapon system?
It's not a bad idea, and it's only part of a system. Plus Brits know that R4 fans are a fanatical bunch of die-hards. So R4 longwave (or World Service shortwave) should be broadcasting and receivable wherever the submarines aren't. Then assuming they can't contact their normal Navy command, or hear radio signals out of UK, then it might mean the UK's chains of command are rather broken. Or just more dysfunctional than normal. So that triggers the 'letters of last resort', detailing what action the sub should take in the event that the UK is no more.
Otherwise they remain sealed, and must be hard letters to write.. As well as a rather sobering experience to have to write right after getting elected as PM. Think my letter would be a box, containing a bottle of the best rum, and a box of cigars. Plus a note saying 'so long, and thanks for all the fish'.
I don't think it's a good idea to add that level of complexity to a thing as dangerous as a bomb.
First, you're adding more bulk to something that is already conspicuous.
Second, terrorists (outside of Hollywood) are not exactly technical wizards - they go to terrorist school to learn how to make a bomb, they do not go for an engineering degree and then take that knowledge and build a bomb from scratch.
To think that the average terrorist not only knows how to make a bomb without killing himself and, on top of that, also has the hardware and software skills to program something that goes and "polls a random Reddit page" is frankly pushing the bar.
Finally, and most importantly, that 4G polling is a signal saying "I'm here !" to anyone who knows how to look for it. I'm sure that broadcasting the bomb's position is not a very intelligent way to go about bombing a place.
" they do not go for an engineering degree and then take that knowledge and build a bomb from scratch."
Back in the '70s the IRA had developed stuff a bit beyond the bought-in 27MHz model control receivers and actuators. Don't overlook that someone who's taken an engineering degree can become a terrorist, or even the fact that someone without an engineering degree can learn a bit about electronics, especially with the internet as a source of information.
Yup, PIRA liked the ham handies, the Icom IC2E in particular as it was easily opened up to give more usable 'quiet' frequencies, the security forces found the remains of them in several bombings, Hyde & Regents park IIRC and one of the reasons the SAS went for an absolute stop in Gib.
terrorists (outside of Hollywood) are not exactly technical wizards - they go to terrorist school to learn how to make a bomb, they do not go for an engineering degree and then take that knowledge and build a bomb from scratch.
I dunno. In the Middle East, an engineering degree seems to have been a career enhancer in Al Quaida. Engineering and other tech backgrounds... one of the Gitmo prisoners claimed to have Microsoft certifications. And even if that's just the upper echlons, no reason why the grunt in the field has to be the one who designs or manufactures the hardware.
@Dog11 - "one of the Gitmo prisoners claimed to have Microsoft certifications"
I can see two major problems with using this to suggest terrorists might be technically competent:
1. being a prisoner in Gitmo is not evidence of being a terrorist https://www.aclu.org/issues/national-security/detention/guantanamo-numbers
2. Holding a Microsoft certification is not evidence of technical competence in bomb making
"Second, terrorists (outside of Hollywood) are not exactly technical wizards - they go to terrorist school to learn how to make a bomb, they do not go for an engineering degree and then take that knowledge and build a bomb from scratch."
Yes, most likely their "experts" come up with a design that someone with minimal training can copy, step by step. That could mean buying a specific router which they can flash a downloaded firmware onto to increase the power output (what, you think legally mandated power levels will stop them?) or as other have mentioned, a battery operated WiFi relay on a roof with a Pringles can aerial.
To think that the average terrorist not only knows how to make a bomb without killing himself and, on top of that, also has the hardware and software skills to program something that goes and "polls a random Reddit page" is frankly pushing the bar.
RasperryPi, little bit of python to grab the page, little more python to set one of the GPIO pins high (or low) triggering a relay, or any number of other triggers (GPIO works on 3.3v IIRC, but with a simple transistor across the 5v rail you can boost that to 5v). It'd probably take me longer to find my last program to talk to GPIO than it would to modify it to download and grep a page. Or download a page and compare with the previous one.
Finally, and most importantly, that 4G polling is a signal saying "I'm here !" to anyone who knows how to look for it. I'm sure that broadcasting the bomb's position is not a very intelligent way to go about bombing a place.
Depends on the location. In a city where 4g or wifi signals are rare, sure. But if the device is hardwired, or in a location where cell signals/wifi are common, it's much harder... Any number of house alarm. "home automation", car alarm, weather station, sewer monitoring, person monitoring, laptop/tablet/phone/PC etc units going off within a few miles of me. Finding what is looking for a specific signal?
Oh, that Pi is also plenty powerful enough to tag in a VPN client as well. It could also perhaps be updating a page for another bomb in the sequence... You could even spread several of them out where they all talk to each other (through garbage posts - AMFM1 anyone?? :) ) and if one goes silent the next one explodes, triggering the 3rd after a few minutes and so on.
A dozen machines, all polling each other, all waiting till one explodes to set the rest off... Sounds like some of my scout kamps....
To think that the average terrorist not only knows how to make a bomb without killing himself and, on top of that, also has the hardware and software skills to program something that goes and "polls a random Reddit page" is frankly pushing the bar.
Great. Thanks. That's "knowing cron and curl" added to the signs you're a terrorist...
Nice idea but clearly an amateur.
Trying to use jamming = absence of signal to set off a bomb requires knowing exactly how and when jamming is turned on. If the goal is protection of a crowd, the jamming likely starts immediately - before the crowd gathers - so an absence of signal trigger would just kill the person's placing the bomb (or flipping the activation switch).
Then there's the little problem of testing. How do you test the absence of a signal is working correctly? What if you just connected the wiring wrong? Or you go through a blind spot/tunnel/elevator?
Read up on positive/negative action triggers.
Nice idea but clearly an amateur.
You are, but thanks for admitting it.
I am too - well except I have been paid to develop circuitry that while it has perfectly legitimate purposes (managing lighting in a public area based on certain inputs) it could easily be altered to trigger a bomb (instead of turning the lights on it closes the detonator circuit).
Now...
To test for jamming.. Swipe your finger across the screen, bring finger to mouth, taste substance. If it tastes like Raspberry then you've been jammed.
Another method that may be more palatable to these types.. Can you receive your control signal? If yes, you're not being jammed. If no, assume jamming.
To protect the person placing the bomb (assuming this is desired - it is not always the case, in fact many people have been sent out unknowingly with bombs intended to explode at a predetermined time, place, or by a remote control) - when you detect you cannot detect your control signal you start a 10 minute countdown. Or 5 minutes. Or 1 minute.
You could even start with the timer, and have the control signal reset it. No control pulse within allotted timeframe, then a bomb's gotta do what a bomb's gotta do - "let there be light!"
As to testing? You see if the software closes the relay (or in any other way sends the trigger pulse along the wires to the detonator) at the right time. That can be achieved by the incredibly difficult task of turning off the transmitter while the detonator is on your test bench and seeing if the right volts gets to the right places (you could even fit an actual detonator and stand back far enough - if it does what it is supposed to do you have achieved your result). If it does, it works. If it doesn't, fix it.
You can cover the 'going through a tunnel' bit by 1) avoiding tunnels or 2) not arming the device until you actually have it in place, or perhaps by 3) using a timer rather than an instant trigger (though 2 is probably the best way to handle that situation).
And yes, I have built or modified devices intended to detonate a small fuel/air explosion in a precisely timed manner. It's called an ignition system on a car. I've also designed circuits to manage lighting under pre-determined conditions.
My knowledge of explosives like C4 comes from movies, where a small metallic object with wires on it is stuck in the lump of C4. This is attached to a device that I assume supplies a certain amount of voltage to the object. Whether the object then explodes, heats up, or emits electricity in some fashion I don't know I understand C4 needs a charge to go on but again - I watch movies I don't research explosives. But I don't really need to know the chemistry behind a bomb, all I need is a way to give it a trigger and a way to convert electricity into that trigger. I'll bet I can ignite a match with a bit of wire wrapped around the head. I'll bet the same principle would work with funpowder, blackpowder and probably several other substances that get a little excited when they get warmed up.
Oh, and on final setup, if you're worried about wiring.. A little lamp/LED you wire across the detonator, a switch that bypasses the detonator, and a way to make the trigger "active" to trigger the light (instead of the bomb).
Designing a legitimate product in a legitimately accessed environment is entirely different than being a terrorist.
Among other things - the forensic analysis would likely show that your "easily repurposed" components and point the finger at all lighting designers and what not.
Your tests all also assume either the ability to be on scene beforehand and/or legitimate presence. Sure, if you have those, you *could* do all manner of nifty testing. Again, in the real world, really large public events are one-offs and so can't be nicely tested ahead of time.
For other venues, having access and being present also point the finger to you as a potential culprit - i.e. aren't terribly helpful unless you're a suicide bomber.
If you're a suicide bomber, you don't need fancy timing.
Kiwi, C4 is a very stable explosive that can take a lot of knocking about. A detonator is a twitchy explosive that only takes a few volts across the wires to do it's thing. It's all about proportions. The little bit of sensitive explosive sets off the big chunk of not so sensitive explosive. Think of it as a chemical form of mechanical advantage. Levers and fulcrums.
Don't tell them wind-up clocks are still available!
Really, there's all kinds of ways to set something off. In WW2 they used chemical timers to detonate bombs. And with modern electronics a smart timer is the size of a grain of sand. At least the terrorists are using something that can be hacked. Oh dear, detonation by spam!
It depends on what's required from the mechanism. A timer is good enough for allowing the bomber to get out of range. It may be good enough for attacking some specific event of significant duration such as a meeting. It wouldn't be good enough for targeting something less predictable such as someone passing a particular point; for that some sort of command system would be needed and this find suggests that that was the objective.
Aniseed Balls! No really, the original style made by repeatedly dipping forming multiple layers around a seed, rather than the more modern type. Used on magnetic mines, either to release from sea bed after the mine layer has departed the scene, or attached by divers to ships.
Easy enough to buy a AM or FM transmitter these days. Perhaps just buy a small boat transmitter or even a PMR from a shop?
For that matter rig up a telephone line and you can trigger a device from across the World.
Once SpaceX or Amazon get their thousands of Internet satellites up, why not just use that to rig a trigger. Let's see the local governments try to block a signal from Space.
Eeek.
Could a specific audio signal trigger a bomb? For example, an AM/FM radio set to a station, and listening for a specific song that triggers the detonation? I know a radio station in the SF Bay Area that used to play "Smoke Two Joints" at 5 PM every day. 98.6 FM in Silicon Valley is a user-supported station, and for a $98.60 donation, they would let you program an hour of airplay. Maybe you can even get in a request on stations that take those?
Stand on a hill or multistory building several hundred yards away and use a microwave link? Would the transmitter and receiver be small enough to conceal in the bomb and the person triggering it?
You'd probably have to be even closer, but an infrared signal could certainly trigger a bomb, and you couldn't jam that. You'd have to expose the receiver antenna/pad to get that to work.
And that's why AC.
I'm quite sure that, with the political climate in the UK, should "they" really be interested El Reg isn't going to be in a position to offer much protection...
In fact, I'm pretty sure "they" probably already know who we are. Just a mo, someone at the dooRZ:D:(FY*AMW$"OB^AM
Any competent engineer can think up several different methods without breaking a sweat without getting too tricky. For a real dose of fun, how about a mechanical Rube Goldberg device with rolling balls, strings, levers, springs, bobby pins and a number 2 pencil. BTW, it has to be a #2 or it won't work, that's part of the competition. Stick in an HB and nothing can happen.
If it was up to me, I’d use a FM pirate radio station and use an RDS code signal to trigger it instantly, and the loss of signal to trigger a failover on a 5 minute timer that could be cancelled on resumption of the correct signal as a secondary failsafe. Pretty sure there is enough bits out there to build it “off the shelf”.
Pretty sure there was a story on El Reg a couple of years ago about hacking RDS.
Sleep well....
We had an after hours "contest" to see who could quickly build a trigger mechanism for a remote device. The winner used a pair of RPI's, relays, and handheld police radios jacked from security cruisers in parking lot. It was up and running in 13 minutes (that included 7 minutes {engineers} to jimmy the locks on the cars).
If we were 16 years old this would have taken less than 5 minutes total.
There are alternatives that block all these frequencies and they are not even expansive either.
Even terrorist in Afghanistan have used it with unknown effect to me that is.
Take any electric motor, strip away all the insulation, connect a large copper rod to the most radio active part (simple software defined radio stuff will easily tell you where that is) and switch in on.
Biggest problem? It will probably destroy all radio communications in a certain range. With all I really mean all. This technique is indiscriminate and not frequency specific.
Another solution is a certain type of external battery, the charging circuit of which makes so much RF noise that I have sent two units back and gotten my money back because of it (okay that was 7 years ago, but there is still enough household equipment out there that effectively is radiating RF where it should not do so, including light dimmers, plasma TVs, solar panel transformers etc.).
Lower frequencies in the VHF (30-300Mhz) range have a longer distance perspective than the Ghz frequencies mentioned in this article.
Only the 900Mhz band comes close to these characteristics.
This has partially to do with reflections as well as that higher frequencies have more trouble penetrating materials, specially those containing metals.
And yes that's also why WiFI networks have trouble in your home between rooms. Specifically if the walls contain metal like in reinforced concrete.
Lower than then 30Mhz is unwise as that comes with larger antenna's as well as very different distance propagation characteristics (which may or may not work depending on time of day, sun spots etc.).
I assume the Black Hats have been using cellphone SIMs because they're easy, convenient, cheap and reliable. Why bother building a sui generis receiver-transmitter detonator system when you can buy it in a supermarket? With security services and police whacking that particular mole, WiFi is a reasonable thing to try, but it's easy to imagine this arms race regressing to the bad old days of the 1980s, when PIRA were developing their own technology for 'button jobs'—remotely detonated bombs. (ISTR they actually succeeded with one somewhere in mainland Europe.) There are also, of course, plenty of RC plane controllers and similar that could be adapted to the job. So blanketing the RF spectrum in vulnerable regions seems to be the way to go.
But then I think: you can buy the bits for a moderately powerful LED laser, something like the emitter for a desktop engraving system, and knock up a circuit to provide some modulation (simple on-off broadcast of a single byte over the course of half a second, even) and, with sensible choices for collimation, receiver sensitivity and filtering, achieve an effective range of several hundred metres at least. Perhaps several klicks on a clear night. All sorts of possibilities open up if you think about lasers. Your bomb just needs to be in line of sight, or trail a detector/detonator thread to a lens in a location that's LoS. Or just position it near something suitably reflective. And they're unjammable except by optical interruption.
In many types of arms race, one of the competitors tends to keep the initiative, and I suspect here it remains with the Black Hats—very much so if they are technologically savvy.
For a very long time—since at least the time of a bunch of lame brains who conspired with supreme incompetence to blow up planes with purportedly binary explosives—I have thought that the main thing preventing terrorist atrocities is the incompetence of the wannabe terrorists themselves. And it still seems to me that we should be most afraid of a disciplined, intelligent, careful bad guy who has competence in chemistry and electronics. With resources in less than four figures (£$€) I would expect such a person to be able to cause major havoc.
I'm not sure about the counter-terrorism work being done by MI5, FBI, NSA etc: no doubt it is excellent. But whoever has been somehow ensuring that wannabe perpetrators of atrocities are poorly educated, careless and lazy has really been doing sterling work. Long may this state of affairs continue.
I think lasers with stuff like cooling and the proper control technology would be way beyond the skillset of the average terrorist. You have to take into consideration a sophisticated receiver as well, since you don't want to make it happen by accident (no pun inteded) because of a reflection or sunburst.
I think lasers with stuff like cooling and the proper control technology would be way beyond the skillset of the average terrorist. You have to take into consideration a sophisticated receiver as well, since you don't want to make it happen by accident (no pun inteded) because of a reflection or sunburst.
You can get cheap laser pointers easily. As the OP said, a little encoding (morse code would do) over a second or two means you're less likely to get false signals.
I think I could cobble something together in a few hours - and that's only because the shops are closed at this time of night.
There are so many ways using relatively inexpensive and readily available parts to remotely trigger a device that it would be impractical to jam all of them. Model R/C, ham radio VHF & UHF transceivers, even modified wireless doorbells and garage door openers. You need not use radio at all - a strong ultrasonic signal could be made to work over a sufficient distance for the trigger person to be outside the blast radius.
They are ISP's broadband signals and you have to have some indication right there how'd you pull this off.
One way to do it - get an account on the local telco/cable ISP. Your primary router with associated address that links back to the ISP's IP addresses is hard wired into either a landline, or a fixed mobile broadband PoP. Preplan your target. Light up your account at a nearby residence or commercial building. Purchase a number of signal boosting repeaters available in electronic stores, or from the ISP. Connect the explosives at the endpoint to the specific wifi account. Extend this out.
One way how to thwart it - if you have places where crowds commonly gather, or will gather for an event, look at every wifi signal nearby and find out who the account holders and ISP are. Then start looking at repeater sales and rentals.
Then, good luck, you'll need a lot of manpower. #sickfuckingworld
Quite possibly, the "state of the art" in radio-mines is still this WW2-era Soviet item: http://eragun.org/minen/miny/rusmin_146.html
Try and build a portable jammer that out-shouts the megawatt+ "Radio Moscow" (or whatever present-day equivalent that the conspirators might use) on shortwave. (or, worse, longwave, where a magnetic receive-only antenna can be a half a metre long, while any effective transmitter is necessarily a multi-km and multi-megawatt farm of antennae.)
On top of this, consider that the operator could easily make use of very small bandwidth, such that may remain after jamming, with error correction (if he is ok with the "fire" signal taking multiple minutes, or even hours, to transmit.)
The usual "golden toilet" military contractors are certain to rake in a mountain of dough offering astonishingly-expensive and nearly useless "universal jammers", but physics will still get the last laugh. The answer to "gunpowder plots" remains old-fashioned police work, with informants, etc. And/or conducting politics in such a way that doesn't breed a population of people desperate to kill you at any cost.
Ive no interest in bombs but the subject of remote activation vs jammer dodging intrigued me. So i read all the comments.
regardless of the details of specific comments, i just find this place to be engaging. filled with wise and insightful commenters, some off base types, some questions, some answers, some humour and .. well, a professional, non back-biting bunch. who needs mods, or(J)gifs etc.
Cheers. Thanks for making Reg comments section what is.
Certain types of WiFi signals can travel much farther than 1km. Barring interference/jamming, reliable decoding of these can occur at up to 4,000 meters using standard off-the-shelf devices.
A few hardware manufacturers also sell products that use these same frequency bands, but tune their software layers to allow links to be established over a few dozen kilometers. While these devices do not interoperate with your standard cellphone, there are ways to use these types of signals for reliable command and control from these greater distances.
(Obviously being vague to prevent copycats...)
The best defense for all of these scenarios is probably wideband, white noise jamming, although simply setting up intentionally-interfering hotspots on every available channel would likely work just as well. Just don't set them all up to use a commonly-used SSID, or you may have lots of explaining to do!
It's only going to be a matter of time before the baddies realize that you can use the cheapest most robust low-speed wireless links to set off a bang. A cheap LoRa knockoff and the lowest most forward error corrected data-repeated data packet and you'll be able to reach +30km with just a piece of wire as an antenna for less than the cost of 2 cell phones, and you don't leave a call record. We are only talking about turning on one GPIO... and bang.
The problem with cops focusing on one system for triggering is that cell phones are only the most convenient and readily available, that can shift at any time. When it comes to doing something like setting off a bang, imagination has to come into play - the baddies aren't worried about breaking any laws, so things like EMI/RFI aren't a worry, nor is licensing or bandwidth sharing. They just have to worry about their immediate problems: 1) how to make it not go off early with the existing spectrum traffic and noise, 2) how to make it go off when they want it to, and 3) market availability.
Let's be honest, the FCC (in my country) isn't going to be the agency on point if there is a transmitter blasting a 20W LoRa low-bandwidth, low-data-rate, high-spread factor, frequency shifted signal with a Yagi antenna for 1 second - 75 miles from a bang... they might not even notice the interference, let alone be able to find the source. And then they can move on to the next newest coolest technology to do it again next week.
If the goodies are jamming the baddies, why not just look for broadband jamming to do the trigger? One broadcasts a link using more than one band and channel, then when they all go below the noise floor, that indicates you're being actively jammed.
This isn't the kind of war you win by playing by the rules we wrote for ourselves, against an enemy who doesn't respect the rule writers (after all, they are trying to kill us).
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
