3

If someone can please provide some advice about the following problem I am trying to solve it will be great.

Scenario: A standard office room, with (say) a couple of people in it What I want to find: (1) How many cell phones are in the room (2) What are the phone numbers of the phones in the room (3) When is a specific number making a call (4) How long is the call

I am not interested in the call content.

Is there a hardware/software solution that already exists for these requirements ?

Adi
  • 43,808
  • 16
  • 135
  • 167
abby
  • 31
  • 3
  • 1
    You could use a [cellular repeater](https://en.wikipedia.org/wiki/Cellular_repeater) for each network people in the room connect to and inspect statistical data and connected clients through it. Alternatively, you could do the opposite - install a [mobile phone jammer](https://en.wikipedia.org/wiki/Mobile_phone_jammer) and see how many people seem disjoint in disbelief. :) – TildalWave Jul 09 '13 at 16:24
  • @TildalWave I have heard of these referred to as an MZ Catcher (I think that's what it was called) and you basically MITM cellphones near you by becoming the tower. I haven't played with them yet but it sounds like it could be an easy attack vector for badguys. – Four_0h_Three Jul 09 '13 at 18:06
  • Is it necessary to "intercept" the cell phone signal ? could it not be that I can *sniff* the signals going through the room and see the Device ID and signal strength at any point in time ? I am not really interested in the content of the call just the actual device is communicating or not. I will look up the cellular repeater link, thank you both! – abby Jul 09 '13 at 19:47
  • @TildalWave Cellular repeaters are of questionable legality, unless provided by an actual cell provider - and those usually prefer to only give them to their own customers. Jammers are *definitely* illegal, at least in the U.S.. – Iszi Jul 09 '13 at 20:40

1 Answers1

7

Unless you shield your building completely, there is no way to determine if the signal is coming from in the room or from outside without triangulating the signal and there isn't a guaranteed way to force the phones to connect to your device instead of the actual cell tower.

Depending on jurisdiction, this may or may not even be legal since it could cause interference with people passing by who just happen to get caught in your net. I don't think you would be able to tell the cellphone numbers since that is established by the carrier, but you would be able to tell the cellular radio's identifying numbers. You wouldn't be able to tell who they are calling without breaking through the encryption (which would almost certainly be illegal.)

So in short 1)Not without triangulating the signal and even then unlikely to be reliable. 2) Unlikely, though you could identify the physical phone being used. 3) You could identify that a particular phone (but not phone number) is making a call. 4) You could tell how much time the connection stays alive. These all depend on them remaining connected to your repeater however which again, is not guaranteed unless you can block out the real tower.

AJ Henderson
  • 41,816
  • 5
  • 63
  • 110
  • Thanks AJ - how about this then: maybe I can use a device to measure signal strength and have a cut off for signal strength to say if value is above a threshold it means you are in the room. Furthermore, if I identify the device number - I *could* work with that - how would I sniff the device MAC/IMEI/some other ID ? Is there a hardware/software solution that can tell me - hey here are the 20 signals I can see, here are the device IDs and signal strengths ? – abby Jul 09 '13 at 19:41
  • @abby - you would have to use a cellular repeater with monitoring capabilities, but I'm not sure what the legal implications would be if you started sniffing information off of it. You'd need to check the legality with a lawyer in your area to make sure it doesn't run afoul of any monitoring or wiretap laws. – AJ Henderson Jul 09 '13 at 19:55
  • @AJHenderson Do you really need a *repeater* to monitor this? Isn't enough information sent in the clear that a passive sniffer can identify or infer the start/end of the call and the hardware ID of the local device? – Iszi Jul 09 '13 at 20:27
  • @abby [Berkeley Varitronics](http://bvsystems.com/Products/Security/Cell_Phone_Detection/cell_phone_detection.htm) (and other manufacturers, I'm sure) makes passive sniffers specifically made to detect cell phone signals and some can be configured to alert at a certain signal strength. However, I'm not sure if any of them can provide IMEI/MAC IDs of detected devices. Since the BVS devices are intended for use in environments where cell phone usage is *prohibited*, they are not concerned with collection of unique identifiers - just alerting and triangulation of the phone's existence. – Iszi Jul 09 '13 at 20:34
  • 1
    @abby the difficulty with measuring the strength would be that different cellphones could transmit at different strengths maybe I'm wrong I haven't done any cell phone phreaking. I'm going based on my wifi experience where I can have 2 routers right next to each other and get a better signal from one. I know the power of my device so I can (theoretically) calibrate a rough TX range. I can then transmit to a device. If that device responds that means it's within that range.. theoretically. I haven't actually done this... yet :) – Four_0h_Three Jul 09 '13 at 20:39
  • @Iszi - that's a good call, a sniffer might work too. I'm not sure what information is available to a sniffer, though I thought GSM uses frequency hoping that might be problematic to follow. Cellular technology isn't really my strong suite. – AJ Henderson Jul 09 '13 at 20:46
  • Man! you guys are awesome! 2 thumbs up! - this is what I am thinking based on the potential roadblocks: (1) I can use a passive sniffer to sniff for signals (2) use statistical sampling for a period of time (say 15 mins) to set up a baseline Tx strength. (3) Monitor how Tx strength changes - from this I can try to see (a) how many different signals are there (even if I cannot get the IDs I can say channel X, strength Y is device 1) (b) whether a call is being made (by identifying increase in Tx strength and length of Tx (how much time is the signal at a level) – abby Jul 09 '13 at 22:27
  • Of course I may over/under count the # of devices using the strategy above - I will contact the BV guys and check out the products. – abby Jul 09 '13 at 22:34
  • Found out about cellbusters.com - seems like a more slick solution - thanks again all! – abby Jul 10 '13 at 01:30