With a majority of comms devices being primarily digital....

[Radiorick]

Now the subject above may cause a little disagreement but let me get to my question. With freq counters and near field recievers only being able to register the freq of analog exchanges (With the exception of the Digital Scout I know of no other frequency counter that has the ablity to measure the pulses and get the freq*granted I think thats how it works*)
General idea how they work:
http://en.wikipedia.org/wiki/Frequency_counter
http://www.epanorama.net/wwwboard/messages/530.html
http://web.textfiles.com/phreak/fc.txt

whats in the tool box for CDMA, PCS type networks? I've never used a counter but have been interested in them for awhile ( could just drop the 119 on a cheap analog model) . A few other questions as well just came to mind. Most counters come with a little rubbers ducky type antenna....would a directional beam( yagi ) on a tripod or with a fitted hand grip work well (I guess thats a loaded question since there are a few variable in play there ie the environment in general...the quality of the antenna's hardware...ect). Okay I'm not sure that I've done anything more than ramble so gonna leave now....


Digitalear@wi-foo.com

 

[N_Jay]

Re: With a majority of comms devices being primarily digital

. . . Okay I'm not sure that I've done anything more than ramble so gonna leave now....


Digitalear@wi-foo.com

Is there a question in there?

 

[Radiorick]

What devices can be used to register the freq of : CDMA and PCS phones?
(Since a cellphone is nothing more than a micro wave radio)
Can anyone recommend a decent freq counter?
Can anyone recommend a good digital counter?
An have/do any of you own a counter?

 

[N_Jay]

What devices can be used to register the freq of : CDMA and PCS phones?
(Since a cellphone is nothing more than a micro wave radio)

Any frequency counter that is of the proper range and can get enough clean signal.

You would have to be very close to a phone to get enough signal at the higher frequencies and low power of a phone.
The wide bandwith of CDMA type transmissions and the intermittant nature of TDMA trasmissions also complicate the issue.

Why do you want it?? :roll:

Can anyone recommend a decent freq counter?

Agelint, Tektronics, Rhodes&Schwartz.

Can anyone recommend a good digital counter?

Not sure what you mean?

An have/do any of you own a counter?

Not any more

 

[Radiorick]

I was under the impression that those two technologies can't be picked up
(CDMA and PCS)....TDMA, TRUNKED Radios ect are not a problem though.
The reason is due to the nature of both standards....CDMA like tdma is mulit plex with 51 frames...c is just coded (w/ the cave algorythm) now what I'm not sure about is if you mean cdma (2g/3g) or cdma2000(3g)
PCS is just a network if I'm not mistaken....gotta get back to work...
thanks jay

 

[N_Jay]

I was under the impression that those two technologies can't be picked up
(CDMA and PCS)....TDMA, TRUNKED Radios ect are not a problem though.
The reason is due to the nature of both standards....CDMA like tdma is mulit plex with 51 frames...c is just coded (w/ the cave algorythm) now what I'm not sure about is if you mean cdma (2g/3g) or cdma2000(3g)
PCS is just a network if I'm not mistaken....gotta get back to work...
thanks jay

TDMA field equipment transmitts in a pulsed mode. The bandwidth is typically the same (or some multiple) of the FDMA systems that predate it.
The pulsed mode of the carrier would make it more difficult (maybe imposible) for a low cost frequency counter to calculate and lock on teh information.

CDMA typically uses a much wider bandwith but transmitts continuously. The wide bandwith signal is also something that is difficult for a frequency county to lock onto due to teh very low energy at any particular frequency.

I have not played with either much, so I don't know if it is going to be hard or imposible. EIther way, I still do not understand what you are trying to find out, or how you are going to use the information? :roll: :roll:

PCS is a fairly meaninless term that does not imply much more than Cellular (of any kind) in the 1.8/1.9 GHz band.

IS54/IS136 (USDC) is TDMA on 30 kHz Channels at a 40 msec frame rate
iDEN is TDMA on 25 kHz Channels at a 90 msec frame rate
IS96 (CDMA 2000) is CDMA on 1.25 MHz channels
GSM and DCS are TDMA on 200 kHz channels and a 20 msec frame rate
UMTS and CDMA 2000-3X are CDMA on 5 MHz channels (I think)

Much of this is from memory so some of the number may be off a bit.

 

[Radiorick]

Theory if anything.....just curious....spent two months researching
mag stripe technology (bought the reader and that jazz) just curious.

Knew they couldn't pick up CDMA sig's but didn't know why....thanks again



Digitalear@wi-foo.com

 

[N_Jay]

Theory if anything.....just curious....spent two months researching
mag stripe technology (bought the reader and that jazz) just curious.

Knew they couldn't pick up CDMA sig's but didn't know why....thanks again



Digitalear@wi-foo.com

You know what they say; "Curiosity killed the cat!"

Of couse the cat said; "Curiosity never killed more than an anternoon!"

Just curious, what did you learn about mag stripe technology, beyond teh obvoius?

 

[Auren]

Hi I just bought a readio (bc246) from Universal Radio Inc. and they sell this AOR radio surveillance system with a spectrum analizer that can also be a vector analyzer for use in monitoring digital comunications. Data packets in PDC, PHS and GSM formats that can be displayed and identifyied in binary and its also possible to see hex information. This unit is no joke is costs 6899.95 is this actually capable of monitoring digital communiations?

 

[Radiorick]

N_Jay

"Counters work by measuring a sample period (one cycle)
which is called the timebase. What the device does is measure
the waveform's voltage drops from there peaks to zero within
a given date time." -Black Axe

So applying what you said about the width of a CDMA sig would
make sense. UMTS is an AT&T standard, which they got from NTT's
Do Como *Japanese cell phone provider.... and I think NTT has 49
shares that belong to the government* But yeah after NTT bought
a large chunk of AT&T wireless's services they tried introducing the
UMTS to allow for I MODE *which is a attempt to bring a true 3G
network North America*

-------------------------------------------------------------------------------------
Do como buys a chunk of AT&T wireless
-------------------------------------------------------------------------------------

http://www.forbes.com/2000/11/30/1130topnews.html



In my area Verizon has the 800mhz cell band..... and sprint is up at 1.9ghz
Dude look at the spacing you wrote for the channels.... doesn’t the ITU have its standard set at 4khz *I've always been fascinated by comms man,
thought the spacing on TDMA was closer.... um never mind I'm think about OFDM*

Curiosity never killed more than an afternoon...I like that

Now what do you mean by obvious?
Um...the paste on the plastic card *that parts obvious* is ionized and allows data to be added or removed via reverse flux *5 volts are need*
There are three tracks separated by .110 inches
The first two tracks are the most used
Track two is in fact standardized by something some thing banking association and last but not least your pin number is off set encrypted
on this trk...that’s about it

6899.95 that’s some serious cash...but beware allot of that stuff is over priced crap. I say this "spymall" selling an IC R-3 unblocked for almost
Seven bills.... seven hundred dollars is allot for a hand held that goes for
364 or 400 unblocked.

Digitalear@wi-foo.com

--------------------------------------------------------------------------------------
Mag Stripe Technology Links
--------------------------------------------------------------------------------------
http://www.yak.net/acidus/
This gent wrote a decent artical (2600 publication) that sparked my intial
interest
http://www.magtek.com/
They sell decent readers...the project on the above site will require a
reader without an external power source....so you'll have to fabercate
a db 15 serial cable
http://www.phrack.org/phrack/37/P37-06
Count Zero started the craze about a decade ago....

 

[N_Jay]

N_Jay

"Counters work by measuring a sample period (one cycle)
. . . .
So applying what you said about the width of a CDMA sig would
make sense. UMTS is an AT&T standard, which they got from NTT's
Do Como *Japanese cell phone provider.... . . . .

In my area Verizon has the 800mhz cell band..... and sprint is up at 1.9ghz
Dude look at the spacing you wrote for the channels.... doesn’t the ITU have its standard set at 4khz . . . .

*I've always been fascinated by comms man,
thought the spacing on TDMA was closer....


Now what do you mean by obvious?
. . . . .

6899.95 that’s some serious cash...but beware allot of that stuff is over priced crap. I say this "spymall" selling an IC R-3 unblocked for almost
Seven bills.... seven hundred dollars is allot for a hand held that goes for
364 or 400 unblocked.

....

Yeah, I know how counters work. The issue is if they can get a clean enough signal to work from. And they all (today) do some post processing to keep the display from jumping all over the place.

UMTS is a ETSI standard for the evolution of GSM to wider bandwidths and CDMA modulation to carry additional data traffic.
It was the first thing cdalled 3G, and DoCoMo's FOMA system is using a form of UMTS.

I would bet there are more than 2 carriers in your area. At least 2 on 800 and up to 5 on 1.9

As for the spacing, I think I am right, and the ITU does not control frequencies in the US, the FCC and NTIA do.

As for obvious: I assumes that it is a pieced of magnetic tape with digital information encoded on it.

From what I understood for casual reading it has all the information on the back that is on the front of the card. I don't think it has the PIN on it, as that would be way to insecure, and I am fairly sure I have changed PINs and not had to have my card re-encoded.
I also assumed that it had some verification information, but never gave it much thought.

I don't think the card would require the "5 volts", however the equipment to read it might. :wink:

Now, how many afternoons did you kill? :twisted:

 

[Radiorick]

N_Jay

Never said that there was only two cell carriers...nor did I not say that the 800 mhz or 1.9 ghz weren't shared, then again I never said that we
had more than two. DoCoMo has a great network...gosh man Japan was
good times.

The ITU does not allocate freqs in the US that’s right.... its the FCC to the
none government/federal agencies (NTIA assigns em out to big brother)...Who said you were wrong (Sounds like you have issues there)..j/k hahaha

You would not be the first nor last to assume that your PIN is not encrypted on the card.

"Offset-data will specify 16 numeric digits (0-9), or a character variable containing 16 numeric digits, representing the value to be added to the intermediate personal identification number before the comparison"(1)

*The PIN (Personal Identification Number) is basically encrypted as follows. The card number is taken as a hexadecimal number and is encrypted with the DES algorithm using a secret key, which is called the "PIN key". The first four digits are decimal zed (i.e., A = 0, B = 1,) and are called the "natural PIN". An offset is added (without carry) to the natural PIN in order to obtain the customer PIN. The customer PIN may be changed but the natural PIN cannot. The offset is what is written in track 2 and called the "encrypted PIN". Here you have an example:

Card number: 1234567890123445hex input for DES.

PIN key: 0123456789ABCDEFhex key for DES.

Encrypted card number: 9A466AD30DFE0381hex output from DES.

Natural PIN: 9046.

Offset: 2298 (this number is written on track 3).

Customer PIN: 1234.(2)

Check out link two its has an amazing amount of info.


"From what I understood for casual reading it has all the information on the back that is on the front of the card. I don't think it has the PIN on it, as that would be way to insecure, and I am fairly sure I have changed PINs and not had to have my card re-encoded. "

Some machines do allow for the user to enter another pin at the ATM (when you do this you are editing the information...or in your words "re-
encoding")A neat trick I've found is you can amplify the data and hear it
at 1khz using a modified set of mag heads off a tape player.

Their are a few other ways to get the pin:
Sniffing and decrypting the 3des packet...
Asking the card owner for the pin...
I'm sure there may be other ways....

By no means am I an expert at this subject but its fun to play with.

okay off to work..man I'm tired...*rubs eyes*
-------------------------------------------------------------------------------------
REFFERENCES
-------------------------------------------------------------------------------------

(1)taken from:
http://publib.boulder.ibm.com/infocenter/iseries/v5r3/ic2924/info/cl/vfypin.htm
(2)A nice brake down of what the data on the card looks like:
http://www.gae.ucm.es/~padilla/extrawork/magexam1.html

-------------------------------------------------------------------------------------
UMTS SPEC'S
-------------------------------------------------------------------------------------

http://www.umtsworld.com/technology/overview.htm



Digitalear@wi-foo.com

 

[Radiorick]

http://www.cl.cam.ac.uk/TechReports/UCAM-CL-TR-560.pdf
Good stuff several attacks

http://www.amarshall.com/crypt101.html
Applied Cryptography for Magnetic Stripe cards

 

[N_Jay]

N_Jay

Never said that there was only two cell carriers...nor did I not say that the 800 mhz or 1.9 ghz weren't shared, then again I never said that we
had more than two. . . . .

.Who said you were wrong (Sounds like you have issues there)..j/k hahaha

You would not be the first nor last to assume that your PIN is not encrypted on the card.

. . . .
By no means am I an expert at this subject but its fun to play with.

No prob.

Well lets drop the mag card stuff cause;
1) I don't care
2) It ain't radio
3) :twisted:

As for UMTS, "its been a long strange road we are on!"

Its all about the EU group thinking that they were geniouses with the "invention" of GSM, and therefore they felt obligated to do "The Next Big Thing"!!!!