There are one or two answers that come close to answering this question but they either fall short or go in straight at the deeper end.

Essentially, I am interested (for genuinely academic reasons!) in being able to record the number of active devices (cell phones, basically) in different locations in space/time. I absolutely DO NOT want to know what they are doing, who they are, or anything about the users, I just want to know a) how many phones in a given radius and b) if it helps, some sort of signal strength so I can normalise/measure how many devices are present in each locale.

1) Is this possible? I am half-decent with Linux, a rasp pi and a bit of Python... (factor that in) 2) What hardware is needed? 3) Any links to help me out on this topic?

I am not an infosec person at all, so this is a world I know little about... be kind :)

closed as off-topic by Ron Maupin Jun 21 at 21:28

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

migrated from security.stackexchange.com Apr 24 '15 at 6:56

This question came from our site for information security professionals.

  • Thanks for the comment Matthew (and the link!)... I'm happy for this to move to NetworkEngineering.SX but I don't think I can personally move it? – user1992923 Apr 23 '15 at 23:00
  • Just be aware of your local laws. In the UK for example where I am I think it is illegal to broadcast on the same frequencies unless you are using a mobile telephone specifically for "mobile phone purposes" (like calling, SMS, internet etc). The network operators own the frequencies here (mostly). If you had to broadcast a radio signal on one of the registered mobile phone frequencies to pretend to be a cell tower for example to see what mobiles responded, I think in the UK that would be illegal so you need to check your local law! – jwbensley Apr 24 '15 at 22:26

You could use one of many IMSI catchers available out there, but that would be quite costly. If you want a more "DIY" approach, you better use a software defined radio card and write some code.

The OpenBTS project develops a software defined GSM base station, and their hardware page has some links to compatible SDR devices. Buy one and then go through their code to implement your own software defined IMSI catcher (publish the code if possible).

Modifying an ISP-provided femtocell device is possible in theory, however you'll need to spend ages on reverse-engineering how to talk to the GSM chip - there is no publicly-available documentation and the only thing you'll have to work with is the binary that handles the femtocell stuff.

  • Great! This sounds much more feasible (I have financial as well as technical constraints!) – user1992923 Apr 24 '15 at 13:43

You kind of want to do a site survey of a cell signals, but focus more on the users and not base stations. Yes, this is possible. There are commercial products which the cell phone companies use. There are also so called "stingrays"- This is how you hear about police tracking down cell phones, looking for specific devices. Similar technology could be used to map out the usage in an area.

You may also be able to do this by converting a femtocell device. Some cellphone providers sell these to customers to make up for poor coverage. You can search for articles on building and using off the shelf technology to modify to do your site survey. I also recently saw that the Pwnie Express people are coming out with a product that works in this area.

Now, keep in mind that this is technically possible, but it may not be legal based on municipality or other regulations. For example, operating unlicensed equipment in the cell spectrum may not be allowed (e.g., FCC regulations in USA). The legal issues are out of scope for SEC.SE

  • This is great, thanks for the info, I will read up. However, I had hoped to try and do my study in the US... hopefully it isn't illegal but I expect it may be a non-starter :( – user1992923 Apr 24 '15 at 8:35

One cheap way - but only for GSM: Buy a RTL SDR stick (about 15€) and trace the GSM traffic.

In the traffic you will find the Paging Requests (GSM 04.08 section 7.1.1). Paging requests are send from time to time from the base station to all GSM phones in the appropriate cell. The phone is either identified by the IMSI or the TMSI.

You need to add some evaluation, statistics and heuristics (e.g. the TMSI is only temporary - and will be reused from time to time).

You can also evaluate the 'Immediate Assignment' packets: those packets are send from the base station that a phone should ask for a channel. If you count these, you could do some statistics comparing the number of phones in the cell against number of activities per hour or so. Disadvantage: there is no IMSI or TMSI in this packets (the correlation is done using some traffic that is send via the uplink channel).

If you are lucky and find a cell without channel hopping, it is also easy to trace 'CM Service Requests'. Here you can get information about ongoing traffic channel setup (e.g. TCH / SACCH) - it is even possible to see if there will be a SMS delivered or a voice call starting. These packets contain the IMSI or TMSI.

This solution has the advantage that it is cheap, everything you need is send unencrypted, it is easy to build up and there is no need to send anything. It should be legal: your GSM phone listens the whole day for these packets.

  • This is a really great idea and suggestion, but 3G devices are unlikely to ever make a 2G connection, right? So it would only be old phones that this picks up... part of the underlying motive for this is to look at how 'connected' different spaces are in terms on Internet connectivity, so I really need to find a way to count 3G devices and preferably 4G too... – user1992923 May 9 '15 at 11:38
  • 3G devices still can make 2G calls if they have no 3G coverage or if they are locked to 2G. – vladiz May 12 '15 at 8:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.