| |
RSS
Harald's Web
gnumonks.org
hmw-consulting.de
sysmocom.de
Projects
OpenBSC
OsmocomBB
OsmocomTETRA
deDECTed.org
gpl-violations.org
gpl-devices.org
OpenMoko
gnufiish
OpenEZX
OpenBeacon
OpenPCD
librfid
openmrtd
opentom.org
netfilter/iptables
Categories
Archives
Other Bloggers
David Burgess
Zecke
Dieter Spaar
Michael Lauer
Stefan Schmidt
Rusty Russell
David Miller
Martin Pool
Jeremy Kerr
Tim Pritlove (German)
fukami (German)
fefe (German)
Bradley M. Kuhn
Lawrence Lessig
Kalyan Varma
Aggregators
kernelplanet.org
planet.netfilter.org
planet.openezx.org
planet.openmoko.org
planet.foss.in
identi.ca
twitter
flattr
Linked in
Xing
 Articles on this blog/journal are licensed under a Creative Commons Attribution-NoDerivs 2.5 License.
Contact/Impressum
|
|
|
Convert RSS feed subscriptions from N810 feed reader to Android com.meecal.feedreader
I'm subscribed to a considerable number of RSS feeds, and so far I actually used
to read them all on my Nokia N810, which is more or less permanently located at
the bedside table
Now I wanted to import all the subscriptions into an Android RSS feed reader on
the Galaxy S. Unfortunately the feed reader that I found most useable doesn't
have OPML import. However, looking at its sqlite3 database for feed
subscriptions, it was pretty easy to come up with a small perl script to
generate "INSERT" statements for all the feeds from the N810 OPML file. In
case anyone is interested, the script is available from here.
If you have any suggestions on a good Android RSS reader that can manage large
number of subscriptions and put them into a tree/hierarchy of groups, feel free
to let me know.
[ /linux/mobile |
permanent link ]
India jails activist doing research on weak voting machine security
According to several sources such as indianevm.com, Hari Prasad was
being arrested. He is part of a team of IT security researchers that gathered
evidence to demonstrate how incredibly weak the security of India's voting
machines is. For more details, read the indianevm.com article linked above,
and the various quotes/links in it.
This is very upsetting. They should jail those who have authorized the
deployment of such an insecure system in the first place. Those are the people
responsible - not some researchers who go out of their way to uncover the
technical problems to warn the general public about the inherent risks of
this technology.
I sincerely hope that the authorities will understand the grave mistake
they're doing here. Don't shoot the messenger. It's not his fault
that engineer, engineering management and/or regulatory government
authorities have permitted such a system in the first place.
[ /politics |
permanent link ]
Started to play with the Galaxy S (GT-I9000) phone
For many years I'm on a more or less consistent hunt for finding a
reasonably open and free mobile phone. This started in 2004 with OpenEZX,
has continued with Openmoko, project gnufiish and has resulted in a bit of
peeking and poking in the Palm Pre. However, none of those projects ever had
the success I was hoping for:
- OpenEZX was never really finished, and only for the 1st generation phones (A780) by the time they were long end of life
- OpenMoko Neo1973 and FreeRunner were a great project, and they are still the most open+free mobile phones that ever existed. However, they're GPRS only and the hardware is even more outdated now then it was when we created it.
- gnufiish was an attempt of running software from the Openmoko days (such as freesmartphone.org) on some E-TEN glofiish phones. However, we never could make the SPI-based modem communication work from our re-engineered Linux driver :(
- Palm Pre is an interesting device, in that Palm provides easy root
access, does not attempt to lock the device down with cryptographic signatures
and provides full recovery flashing tools by means of WebOS Doctor. But once
again, the proprietary communication protocol with the 3G Modem was the big
blocker item for using real custom software and not the WebOS stuff they ship.
So I've constantly been on the watch for new devices that are coming out. Most
of the phones you can buy in recent years are either running proprietary
software like Windows Mobile, Symbian, Apples iPhone-OSX - or they run Android
but then use some integrated Qualcomm Smartphone-on-a-chip product. The
problem with the latter (from a Free Software point of view) is that Qualcomm
is very secretive about their products, does not provide any kind of public
documentation, and the ever-increasing integration between application
processor and baseband processor makes it more difficult to run custom software
on them.
The Samsung Galaxy S (GT-I9000) seemed like a good candidate to me, for several
reasons:
- Samsung does not use cryptographic signature techniques and gaining root as well as flashing the AP software is relatively easy
- The phone is based on a traditional separate application processor (AP) and
baseband processor (BP) design. The AP is a Samsung S5PC110, the BP is some
Qualcomm MSM6xxx.
- High-end hardware, with the S5PC110 running at 1GHz and 512MB RAM
- Samsung provides excellent "GPL source code offers" containing the Linux
kernel used in their firmware - including detailed instructions in how to build
it. Also, many of the drivers are included under GPL, such as drivers for all
the integrated peripherals of the SoC, some custom components like the USB
multiplexor ASIC, etc. as well as the driver for the dual-ported RAM between
the AP and BP for the 3G Modem communication
- The Android RIL shipped by Samsung contains lots of debugging/decoding/dumping
code that can make reverse engineering the AP/BP protocol.
So right now I'm in the exploration phase, making myself familiar with the
bootloader, the flashing process, the userspace ABI of the custom (GPL
licensed) kernel drivers, etc. It's a fairly pleasant experience so far,
and I now have a debootstrap'ed Debian lenny on an additional ext2 partition
on the SD card. This provides me with an actually useful userland I can
chroot() into, such as lsof, strace, ltrace, tcpdump, etc. to do some more
exploration of the phone.
The only real ugliness on the software side so far is the use of proprietary
Samsung filesystems (RFS/TFS4). The only reason those filesystems existed,
as far as I can tell, was to run legacy filesystems like FAT on top of raw NAND
or OneNAND flash. This is mainly necessary if you want to export e.g. a FAT
partition via USB Mass Storage to a Windows PC. However, the GT-I9000 doesn't
have any OneNAND, but only an internal moviNAND (basically a SD-Card in a BGA
package that you can solder on the board). MMC/SD cards already include the
wear leveling algorithm, so there is absolutely no point (from what I can tell)
in running the RFS/TFS4 stack.
In fact, in several forums people are complaining about the slow I/O performance
of the Galaxy S, and they have a much better performance when using ext2/ext3
directly on that moviNAND device.
[ /linux/mobile |
permanent link ]
Doing RFID related research and development again
More or less a bit surprising to me, I got again involved in RFID research,
on which I hadn't really done much ever since my involvement in the OpenPCD
and OpenPICC projects some five-to-four years ago.
It's a lot of fun, and I didn't seem to forget much. What really bothers
me a bit is that the OpenPCD / librfid / OpenPCD integration never really
was completed, and that libnfc doesn't work with OpenPCD. Let's hope I'll
somehow find some time to change this. It just feels wrong that OpenPCD
was the first hardware project created to encourage (security) research into
RFID, and now all the current tools only run on the Proxmark or on proprietary
readers...
[ /linux/mrtd |
permanent link ]
Worlds first 20 minute voice call from a Free Software GSM stack on a phone
As Dieter
Spaar has pointed out in a mailing list post on the OsmocomBB developer
list, he has managed to get a first alpha version of TCH (Traffic Channel)
code released, supporting the FR and EFR GSM codecs.
What this means in human readable language: He can actually make voice calls
from a mobile phone that runs the Free Software OsmocomBB GSM stack on its
baseband processor. This is a major milestone in the history of our project.
While Dieter has been working on the Layer1 TCH support and the setup of the
voiceband path in the analog baseband chip (audio ADC/DAC), Andreas Eversberg
has been quietly working on getting call control of Layer3 into a state where
it can do all the signalling required for mobile-originated and
mobile-terminated call.
Combining both of their work together, they have been able to make a 20 minute
long voice call from a baseband processor running a Free Software GSM stack.
For all we know, it is the first time anything remotely like this has been done
using community-developed Free Software. Five years ago I would have thought
it's impossible to pull this off with a small team of volunteers. I'm very
happy to see that I was wrong, and we actually could do it. With less than
half a dozen of developers, in less than nine months of unpaid, spare-time work.
Sure, the next weeks and months will be spent on bringing the code from alpha
level to something more stable, fixing known issues and known bugs, etc. But
I'm confident the biggest part of the work on the OsmocomBB stack is behind us.
Big thanks to the developer team driving this project forward.
[ /gsm/osmocom-bb |
permanent link ]
Wondermedia WM8505 Linux + u-boot source code
In recent months, a number of alleged GPL-violation reports regarding products
(tablet computers, mini netbooks and the like) using the Wondermedia WM850x
line of ARM SoCs. People have been contacting me, as I was working as VIA
Open Source Liaison, and there is the general belief that VIA and Wondermedia
Technology (WMT) are one company.
I had investigated this issue even before there were any reports, and I'd like
to publicly state that:
- Wondermedia is a separate company from VIA, with independent management, making
their own business decisions. The 850x SoC development was started inside VIA,
but is no longer part of VIA for a long time.
- Any references to VIA in the source code or old data sheets date from that
time before the SoC business became part of Wondermedia
- I have had assurances from Wondermedia, even before there were any allegations,
that similar to VIA they explicitly notify their customers about the GPL
and always provide their SDK / BSP as full corresponding source code.
- Effectively, this means that GPLv2 Section "3a" is used. WMT has provided
the Linux and u-boot source code to its customers, and thus has no obligation
under GPLv2 Section "3b" to provide it to anybody else (any 3rd party)
- So, if you buy a product including a WMT SoC and u-boot/Linux, like always,
GPL compliance of what has been shipped to you has to be assured by the
manufacturer of the product, not the semiconductor maker
Notwithstanding all of the above, Wondermedia was willing to provide the Linux
kernel and u-boot source code of their SDK to me, so I can share it with the
community. As indicated, they're not legally required to do this and I'm happy
they do it anyway to show their good intentions.
You can download the released source code from the gpl-devices.org ftp-server, more specifically here are the latest Linux kernel (modified 2.6.29 android derivative) and u-boot source code archives.
This software is provided without any kind of support. If you see some GPL
related legal problems (i.e. you believe it is incomplete), don't hesitate to
contact me. To the best of my knowledge WMT (basically a small hardware
start-up with small software development team) has no resources to actively
push any of this mainline.
[ /linux/via |
permanent link ]
Working on a document on smartphone hardware architecture
I've started to write upe some information on modern smartphone hardware
architecture. It will be in a similar style to what I previously wrote
on feature phones and gsm modem hardware, but with a specific focus on
smpartphones, their multiple processors, memory sharing, AP/BP interface,
audio architecture, etc.
I should have done this a long time ago. In fact, I think I should write
more documents like that on various technical subjects. If you want to
learn about low-level aspects of modern telephones, there is way too
little published information out there.
[ /gsm |
permanent link ]
On my way to Taiwan for COSCUP
Tomorrow early morning I'll be on my way to Tapei/Taiwan. The main reason for
this trip is the invitation to speak at
[ /linux/conferences |
permanent link ]
Official wiki page on GSMTAP created
I've come up with GSMTAP about two years ago while working on airprobe. The goal was to have something
similar to what radiotap does in
the wifi world: A pseudo-header that adds additional information and context
that is not present in the actual message.
Initially, GSMTAP was intended to be a separate link-layer type in the pcap
file format, but this would preclude its use in real-time protocol analysis.
So I modified it to be encapsulated in UDP packets, which are sent and received
using normal UDP/IP sockets.
Over recent years, GSMTAP has not only been integrated into multiple programs
of the airprobe project, but is also understood by wireshark. OpenBTS has also decided to
adopt the format and can generate GSMTAP messages for debugging purposes.
After creating OsmocomBB, it was taught
how to generate GSMTAP messages very quickly, too.
So by now, at least when it comes to Free Software, it is definitely the
de-facto standard for capturing/transmitting and analyzing protocol messages
from the GSM air interface.
However, until now, there has never been any official "homepage" of the GSMTAP
header. This has changed now, the GSMTAP homepage is now part
of the OsmocomBB wiki.
[ /gsm |
permanent link ]
Playing more with Erlang
Last year I started to occasionally play with Erlang. People who know me as
die-hard C coder who tries to avoid C++, Java and Python wherever possible
will probably be surprised here now.
I have no intention of changing my general position on programming languages. I
don't feel comfortable using something where I don't know and/or understand the
immediate impact on how this code will be executed on the actual silicon.
However, if you have a need to play with anything that uses ASN.1, but
particularly the aligned/unaligned PER encoding variants, then it is pretty
clear that there is nothing available as Free Software that can compare to the
Erlang asn1ct/asn1rt modules.
At that time last year I was doing some rapid prototyping with the RANAP protocol,
and the progress was quite quick. I never had time to return to that project,
so it (and my Erlang skills) were left dormant.
In recent weeks, I have picked Erlang up again - again to work on ASN.1 encoded
messages: This time TCAP and MAP. While we still need the in-progress TCAP+MAP
implementation in C for OsmoSGSN, there are other tasks at hand where an
Erlang-based implementation might yield a much higher productivity.
So right now I'm working on a program that parses/decodes and iterates through
every MAP component in a TCAP message and replaces certain fields, re-encodes
the entire message and sends it off the wire. Once that is done, I think I'll
actually try to do a more complete TCAP server and implement a simplistic HLR
for OsmoSGSN testing.
[ /gsm |
permanent link ]
On the recent news items about the homebrew IMSI-catcher for 1500 USD
Some news sites seem to do very limited research and present it as big
news that you can now build an IMSI-Catcher for a budget of USD 1500,
using OpenBTS and a URSP.
Let me bring some clarity into this situation:
- Fundamentally, an IMSI-Catcher is nothing special but a GSM base station
(BTS) that is configured to the network country code (NCC) and mobile
network code (MNC) of a commercial network operator.
- In GSM, the phone has no way to authenticate and thus verify the legitimacy
of the mobile network. This is like a "rogue access point" in a open
(unencrypted/unauthenticated) WiFi network.
- Thus, anyone who has a device that can run as a GSM base station has the
ability to run an IMSI catcher.
- There are two Free Software / Open Source projects for running your own
GSM network, both have first been published in 2008: OpenBTS and OpenBSC.
- None of those two projects are intended to be used as an IMSI-Catcher but
for legitimate operation of GSM networks. However, if a user choses to
configure the NCC and MNC of a commercial operator and allow
"unknown/unregistered/unprovisioned IMSIs (SIMs) on his network, he will
effectively have an IMSI catcher.
- Such operation is in violation of spectrum usage regulations, even if you
have a valid test/experimental license, since that license does not permit
you to use somebody else's NCC/MNC.
- Furthermore, such operation is in violation of criminal law in most
jurisdictions. In Germany there is a separate offense in the criminal code,
called Paragraph 317
Stoerung von Telekommunikationsanlagen, combined with Paragraph 202b Abfangen von Daten.
- Furthermore, there are certainly civil claims to be made by the affected
operator (and its subscriber) against anyone who unlawfully operates
such a fake base station
- OpenBTS and OpenBSC, as well as the problems resulting from this fake
base station attack have been covered in a variety of conference presentations
from 2008 through today.
- Thus, there is nothing new about what has been presented at Defcon 18
Also, the theoretic basics ow how to operate an IMSI catcher are nothing new
either. There are even a number of patents covering IMSI catchers, the first
that I know of has
been patented by Rohde & Schwarz in 2003. Also, see this blog post by OpenBTS founder David Burgess on this topic.
So all that you always needed is a bit of hardware and software to send
radio waves containing messages formatted in the way how they are described
in the (equally public) GSM specifications as published by ETSI and 3GPP. Commercial, proprietary systems have existed
for a decade. From 2008 on, there is some Free / Open Source Software to
operate GSM networks. The situation remains unchanged in 2010.
So please, remember this the next time somebody is trying to tell you that
this is the latest invention since sliced bread.
[ /gsm |
permanent link ]
|
|