insinuator.net Open in urlscan Pro
2a03:a920:1000:1000::a  Public Scan

Form analysis
1 forms found in the DOM

GET https://insinuator.net/

<form role="search" method="get" class="search-form" action="https://insinuator.net/">
  <label>
    <span class="screen-reader-text">Search for:</span>
    <input type="search" class="search-field" placeholder="Search …" value="" name="s">
  </label>
  <button type="submit" class="search-submit"> Search </button>
</form>

Text Content

Insinuator.net

Bold Statements

Primary Menu
 * About

 * RSS Feed
 * Follow us


CATEGORIES

 * Breaking
 * Building
 * Events
 * Misc


TAGS

4G Active Directory advisory Android Black Hat blackhoodie Bluetooth C3 Cisco
cloud Day-Con disclosure Docker ERNW white paper exploit forensics fuzzing GSM
hardening hardware HITB iOS IoT IPv6 Linux malware medical network pentest
reversing RIPE risk SAP SDR Telco TelcoSecDay tool TROOPERS trust virtualization
VMware VoIP vulnerability web application Windows


ARCHIVES

Archives Select Month April 2024  (4) February 2024  (1) October 2023  (3)
September 2023  (2) August 2023  (1) July 2023  (1) June 2023  (2) May 2023  (3)
December 2022  (1) September 2022  (2) August 2022  (1) June 2022  (1) April
2022  (1) March 2022  (1) December 2021  (1) October 2021  (1) July 2021  (1)
May 2021  (4) April 2021  (2) March 2021  (1) February 2021  (3) January 2021
 (5) December 2020  (4) November 2020  (6) October 2020  (2) September 2020  (5)
July 2020  (3) June 2020  (1) May 2020  (1) April 2020  (2) March 2020  (3)
February 2020  (3) January 2020  (2) December 2019  (2) November 2019  (6)
October 2019  (4) September 2019  (3) August 2019  (3) July 2019  (6) June 2019
 (6) May 2019  (7) April 2019  (7) March 2019  (2) February 2019  (4) January
2019  (14) December 2018  (4) November 2018  (11) October 2018  (6) September
2018  (1) August 2018  (4) July 2018  (3) June 2018  (3) May 2018  (3) April
2018  (5) March 2018  (8) February 2018  (12) January 2018  (2) December 2017
 (2) November 2017  (3) October 2017  (7) September 2017  (5) August 2017  (3)
July 2017  (3) June 2017  (6) May 2017  (5) April 2017  (3) March 2017  (8)
February 2017  (6) January 2017  (8) December 2016  (12) November 2016  (14)
October 2016  (12) September 2016  (12) August 2016  (9) July 2016  (9) June
2016  (7) May 2016  (10) April 2016  (23) March 2016  (29) February 2016  (14)
January 2016  (12) December 2015  (15) November 2015  (6) October 2015  (9)
September 2015  (7) August 2015  (5) July 2015  (6) June 2015  (14) May 2015
 (9) April 2015  (9) March 2015  (13) February 2015  (10) January 2015  (18)
December 2014  (10) November 2014  (10) October 2014  (7) September 2014  (3)
August 2014  (9) July 2014  (5) June 2014  (1) May 2014  (9) April 2014  (1)
March 2014  (3) February 2014  (5) January 2014  (13) December 2013  (5)
November 2013  (5) October 2013  (4) September 2013  (1) August 2013  (10) July
2013  (10) June 2013  (5) May 2013  (4) April 2013  (10) March 2013  (4)
February 2013  (12) January 2013  (6) December 2012  (2) November 2012  (4)
October 2012  (1) September 2012  (3) July 2012  (3) June 2012  (3) May 2012
 (8) April 2012  (2) March 2012  (5) February 2012  (6) January 2012  (4)
December 2011  (7) November 2011  (7) October 2011  (6) September 2011  (3)
August 2011  (3) July 2011  (6) June 2011  (4) May 2011  (4) April 2011  (5)
March 2011  (5) January 2011  (2) December 2010  (6) November 2010  (5) October
2010  (3) September 2010  (4) August 2010  (5) July 2010  (6) June 2010  (2)
December 2009  (1) November 2009  (1) October 2009  (3) 0  (1)
Search for: Search
 * ERNW
 * ERNW Research

Back
Breaking
July 15, 2016 by Stefan Kiese


GOTTA CATCH ‘EM ALL! – WORLDWIDE! (OR HOW TO SPOOF GPS TO CHEAT AT POKÉMON GO)

The moment, when your team leader asks you to cheat at Pokémon GO…everyone knows
it, right? No? Well, I do

GPS Spoofing Setup

As I’m not a gamer, the technical part was of much more interest – that’s the
real gaming for me.
So, challenge accepted!

In the past I was often fiddling around with SDR (Software Defined Radio),
started with DVB-T sticks some years ago. When I came to ERNW in 2014 I got in
touch with Michael Ossman’s great HackRF One for the first time, and
subsequently my thesis was based on SDR.

WARNING: In most countries transmitting on these frequencies is prohibited by
law! As satellite’s GPS signals are very weak while receiving on earth,
transmitted signals with the HackRF will be very strong in comparison – use
attenuators and/or shielding boxes, as GPS receivers of navigation systems are
very sensitive! Don’t abuse this knowledge, it’s just a proof of concept!

Okay, now that you’ve all read and understood this, back to our technical topic!

Short summary? It’s easy. Pretty easy.
I already knew that there was some tool in the wild since last year. After
asking uncle Google, I came across “GPS-SDR-SIM” by Takuji Ebinuma and to be
honest I didn’t expect a working tool. Way off the mark! The tool compiled quite
well on my machine and really works like a charm. You just have to follow the
instructions in the readme to make it work.
By setting up the HackRF in transfer mode, I initially “jammed” the whole GPS L1
band. I’ve used some phones running Android to check the GPS signal with some
GPS test app. Before transmitting, I received a few satellites in my lab; when
transmission was started, the phones lost contact to every satellite’s signal.
I’ve already reckoned on this, as the HackRF’s internal clock (~30ppm) is much
too vague. This means, it isn’t as precise as needed by GPS and that is, why the
HackRF acted like a jammer, not faking satellites here.
Now, you’ve got two options:

GPS Fix

The first is, to use kalibrate-hackrf, which uses the frequency correction
channel (FCCH) of the GSM network to calculate an average error in ppm (parts
per million). This would be the easiest way. As the master branch of HackRF on
Github currently doesn’t support a ppm correction, there is already a pull
request, which adds the option “-C” for error correction rate. I didn’t give it
a try, yet – but I hope this will work for you, guys.
The second option, and also my preferred one, is to use an external clock that
is much more precise than the internal one. Mostly this option makes use of a
TCXO, which is a temperature compensated oscillator and has a precision of +/- 1
or 2.5ppm. There are already some parts available in online shops, which were
designed for the HackRf. If you’re the DIY-/hacker-type of cheater, you’ll also
find some gerbers in GPS-SDR-SIMs “extclk”-folder
As I had no TCXO lying around, I made use of our function generator and set up a
10MHz square wave signal with 3Vpp.
Starting the transmission again, the fake satellites immediately came up with a
strong signal (you should use attenuators to weaken the signal and also keep in
mind local law!). A few minutes later I’ve got a fix on all of my devices.
A hint from my side: This works much better, if you disable the A-GPS (Assisted
GPS) features of your device. Don’t know, what I’m talking about? Either go in
flight mode or disable in your phone’s location settings the use of the mobile
network and WIFI/BT. While using a GPS app on your phone, you could also delete
your A-GPS data if supported by the app.

Now, just start Pokémon GO and see your avatar walking/standing around in the
wild.
But…this is boring, isn’t it? Just anywhere…not where you wanted to be?

So, prepare for the next step: Plotting routes.
In the “satgen” called folder of GPS-SDR-SIM is another application, which could
be compiled with the same settings as the main app itself. After compiling, just
follow the instructions in the readme file.
Starting the transmission again, you’ll find your avatar walking around on your
own route

That’s it!

Well, to be honest…you can’t stop anywhere Catching Pokémon isn’t that easy
doing it this way This still needs some code to improve it. Maybe you’ll make
your avatar move on your smartphone by hitting the cursors on your laptop’s
keyboard But that’s all still up in the air…have fun!

Cheerio,
Stefan

Back
 * 2 Klicks für mehr Datenschutz: Erst wenn Sie hier klicken, wird der Button
   aktiv und Sie können Ihre Empfehlung an Facebook senden. Schon beim
   Aktivieren werden Daten an Dritte übertragen - siehe i. nicht mit Facebook
   verbunden
    
 * 2 Klicks für mehr Datenschutz: Erst wenn Sie hier klicken, wird der Button
   aktiv und Sie können Ihre Empfehlung an Twitter senden. Schon beim Aktivieren
   werden Daten an Dritte übertragen - siehe i. nicht mit Twitter verbunden
    
 * Wenn Sie diese Felder durch einen Klick aktivieren, werden Informationen an
   Facebook, Twitter, Flattr, Xing, t3n, LinkedIn, Pinterest oder Google
   eventuell ins Ausland übertragen und unter Umständen auch dort gespeichert.
   Näheres erfahren Sie durch einen Klick auf das i.


gpsHackRFSDR


POST NAVIGATION

Jenkins Remoting RCE II – The return of the ysoserial
Notes on Hijacking GSM/GPRS Connections


COMMENTS

 1. Alaa eldin Essam says:
    July 17, 2016 at 3:11 pm
    
    So interesting .. Good JOB
    
    1. Stefan Kiese says:
       July 27, 2016 at 12:54 pm
       
       thanks!
    
       
    
 2. Marcos Ramírez Paricio says:
    July 18, 2016 at 11:04 am
    
    Great and nice! until they trace giroscopes xD then “ban ell all!”
    
    1. Stefan Kiese says:
       July 27, 2016 at 12:54 pm
       
       thank you
    
       
    
 3. John says:
    July 22, 2016 at 3:44 pm
    
    Which antenna have you used for trasmitting GPS signal?
    
    Thanks
    
    1. Stefan Kiese says:
       July 27, 2016 at 12:58 pm
       
       See comment below
    
       
    
 4. D says:
    July 26, 2016 at 11:21 pm
    
    What kind of antenna was being used?
    
    1. Stefan Kiese says:
       July 27, 2016 at 12:57 pm
       
       Here, the standard ANT500 of the HackRF was used. It is not intended for
       the frequency range GPS uses, so the signal is much weaker. As range was
       never the aim of this PoC, ANT500 was okay.
    
       
    

Comments are closed.

Imprint | Privacy Policy | ©2024 ERNW Enno Rey Netzwerke GmbH

 * 
 *