Cell Phone/GPS Jammers

[PYRO500]

<a href="http://www.netline.co.il/new/c-guard.htm" target="_blank">http://www.netline.co.il/new/c-guard.htm</a>

I found this link at powerlab's message board,I think this concept of cell phone jamming is better than others, and could possibly be improvised with crude transmitters

<small>[ January 30, 2003, 11:38 PM: Message edited by: nbk2000 ]</small>

[nbk2000]

Ironically I was searching for the very same thing last night. Unfortunately the company doesn't have any prices listed on their site, they require that you send in a request for a price quote. And they'll probably be asking why you want it, especially after what's happened.

My reasons would be to prevent any do-gooder interference while doing something I'd rather not have the piggies interuppt me in the middle of.

We've all heard about how someone does something and gets away, only to have some do-gooder following him while on the phone to 911 (999 for the brits) till they catch him. A person needs to be able to squash that kind of shit from happening.

The problem with all the various units I've seen so far is very limited range, under 50 yards. That's OK fir inside of a room or small building, but a larger building, freeway, or rural? Forget it.

Now I KNOW there are military units that can squash for several miles! That would be the shit to be having. You'd have to build it yourself unless you have enough money to go to russia to buy one ready made.

All the information needed to build one is readily available on the net: Cellular protocols, frequencies, transmission modes, etc. Construction details for electronic and radio equipment is freely available, especially ham radio.

So, anyone with enough money (think several thousand+) could readily kill all cellular communications for at least a kilometer. This itself would be a terrorist act in a busy city. Just think of all the phones being used in lower manhatten or tokyo at any given moment.

The scenario I've envisioned is robbery/kidnap, where you have to prevent any immediate response by the police to distress calls by passing motorists/pedistrians who witness the job going down.

By having a jammer active at the time, you'd force people to use a landline. This takes time, especially in the country or late at night when stores are closed, finding a phone then is near impossible.

By the time they did, you're long gone.

You bring the jammer with you naturally. This way, anyone following you won't be able to call the cops and follow you at the same time. They'll have to break off the persuit to find a phone, meaning the cops won't know where you went to.

So, for a major job that'll net you many thousands of $, it'd be worth the time to build one. Other than that, it's just one more thing to have to worry about.

------------------
"The knowledge that they fear is a weapon to be used against them"

Go here (http://members.nbci.com/angelo_444/dload.html) to download the NBK2000 website PDF.

Go here (http://briefcase.yahoo.com/nbk2k) to download the NBK2000 videos.

[J]

The problem with carrying it on you is that they could use it to track you down. I suppose it would depend on how long you were using it for, a massive disruption in mobile comms wouldn't go un-noticed for very long. This might be counter productive; you'd be discovered because of the jammer!

It shouldn't be too difficult to modify a low powered unit for higher power output. After all, you'd only be changing the RF amp, not the jamming frequency generator.

J

------------------
Download the forum archive (http://forumarchive.tripod.com)
PGP key available here (http://pgpkeys.mit.edu/) (ID = 0x5B66A792)

[PYRO500]

It would take less than several thousand to make one of these, all you need is a few transmitter circuits that transmit on the cellular datastream (FM signal) and transmitters are easy, making them precise isn't you could probably make a tube amp really slopply and get near 2 KW! it does not take much for the datastream to get fucked, just some static, I think it is jusk FSK signalling. also if you did have a transmitter/scanner+downconverter you could possibly hook one to a computer and transfer calls every witch way and screw the system that would be funny, althoughI don't think much info on the cell data stream is avalable.
recently I have been working on a cellular downconverter or mixer to bring cellular frequency's down to a freq. that any scanner can pick up. I came up with two options, use a gilbert cell IF to RF mixer to bring the frequency's down or to use a mar based circuit, there is a kit that ramsey electronics used to make but they got raided and such kits became illegal. the PDF for the manual of the converter is online, but I am trying to convert the pic in there to a pcb schematic, this is how far I got with the help of codeblue,

here is the manual of the scanner converter,

www.ramseyelectronics.com/sitepages/pdf/hmanuals/scn-1-4a.pdf (http://www.ramseyelectronics.com/sitepages/pdf/hmanuals/scn-1-4a.pdf)

I have a hand drawn bmp of the pcb, it is crappy but might work with some improvements,
codeblue says that it probably needs to be reduced to 88%

------------------
visit my web page at:
[URL=http://www.geocities.com/pyro2000us/]

[Machiavelli]

If you construct a cheap broadband jammer you could set up several static units which would be triggered eg by time delay, by remote control using non-jammed channels (eg infrared for line-of-sight or ultrasonic) or simply by wire and depend on these to cover your whole area of operation.
Yes, the jamming will be noticed very quickly.
But the cops will have no idea what's going on. It will be possible to roughly localize the jammers, but as long as the cops are busy searching rather small jammers (you might even use some Ham tricks to make direction finding more dificult) and sorting out the huge mess that is created in a modern city when a major portion of the spectrum goes garbage, you have lots of time to make your getaway.

For a suitable jammer design I'd focus on spark gap transmitters, they're easy and cheap to build and create lots of broadband noise. Hook up a powerful trafo and some good car batteries and you can easily get hundreds of kW. No need to be subtle here.

------------------
Give someone a match and he'll feel warm for a few seconds, set him on fire and he'll feel warm for the rest of his life

[PYRO500]

it is hard to conceal a transmitter, even harder to conceal one that transmits in every band, there are several way's they can locate you,

1.directional antenna's:
these are sometimes yagi antenna's on a rotating mount but can be strange Higain antenna's mounted in a circle to give direction information

2.Yagi antennas
these are antenna's that have several elements across a beam to act as reflectors and increase the gain of reception in one direction. these can be carried on foot by someone, often used to catch cell phone cloners teams of 3 people use radio's to relay direction findings to eachother and to the station where they pinpoint the area

3.dopplar shift tracking:
The most accurate of the three methods this device is usually mounted on a vehicle and when it is driven around coordinates a gps system with the dopplar shift of the frequency's pinpointing the target, this system only takes one person to make rapid direction finding but multiple vehicles can be used in coordination, vehicles with this system have 4 identical antenna's on the corners of the car at the same hiegth.

How they use direction findings to find you:

1. 2 line intersection, this method requires extremly precise equipment to be accurate and can be something like 2 computer controled yagi's on building tops or a VERY expensive dopplar shift detector system.
the two sources plot their locations on a map and draw lines to where they picked up the signal, they then know how far it is from them by finding the length of the hypotinuse of the triagle formed by 2 lines.

2.triagulation they get 3 refrence points and uses less precise equipment and the area where the 3 lins meet is the point, if the lines don't meet they have a rough estimation of the transmitter there is a triangleular field in the middle that is where the transmitter lies, almost any direction finding equipment will work for this.

3.another form of triangulation:
same as above but several points are taken instead of just 3.

the best way to conceal a transmitter is to make it directional, then you can make it intermittent and also you can lower the power and freq range to make it less aparrent

------------------
visit my web page at:
[URL=http://www.geocities.com/pyro2000us/]

[Anthony]

If the transmitter is going to be remote (not with you) then make it so they can't turn it off in any hurry, even if they locate it really quickly.

Something like locate it at the top of an old chimney stack and cut off any kind of ladder going up as you climb down.

Or encase it in a concrete block with a 3" diameter solid steel rod sticking out of the top as the arial.

Something like this would be quite fun to do, you'd make the news for sure and it'd be unlikely that you'd be caught.

------------------
"Shit happens. Get a fucking helmet"

[Ctrl_C]

would it work if you were to intercept the particular freq that the cell phone service you are trying to jam uses, shift it 1/2 a wavelength out of phase and then retransmit?

you could broadcast the freq from their own towers too. they have very little security aside from cctv which can be taken out with a rifle.

[nbk2000]

Closely related to cellular jamming is GPS jamming.

Thanks to the prevalence of civilian GPS, it's now possible to use GPS in coordination with cellular to transmit information, location, and other uses.

Police are now integrating GPS into their systems so HQ knows where all units are at all times.

But, thanks to the good ol' soviets, we now have GPS jammers.

<a href="http://www.ac11.org/gps1.htm" target="_blank">http://www.ac11.org/gps1.htm</a>

A Google search on "AviaConversa" pulls up a lot of references to a GPS jammer that they have made available that'll scramble all signals for 100+kilometers! <img border="0" title="" alt="[Eek!]" src="eek.gif" />

'Course, at $40,000, it's not cheap, but it could have it's advantages. <img border="0" title="" alt="[Wink]" src="wink.gif" /> Further searching may reveal a cheaper source of lower range.

[Dunkelmann]

This brings another type of jamming to my mind:

In Germany, we have a VLF Transmitter called DCF77 that transmits the official Time throughout the country. It is located in
Mainflingen.

Many official Buildings get their time from that signal,
Railway Stations, Schools, Computer Networks and many more, i think you should have something similiar in your country, too.

The Protocol is very simple, so it should be very easy to build your own Transmitter.
Think of the nice confusion you could create by shifting the time.
or think of alarm systems that turn themselves on and off scheduled by the official time..

dkm

[nbk2000]

Ah...spoofing the time signal to trick the alarm into turning off...nice! :D

This brings to mind using the same tactic to fiddle with the "atomic" clocks that set themselves to the Universal Coordinated Time via radio signal from the US Naval Observatory, or wherever it is that the central atomic clock is kept.

I'm sure there's got to be some nefarious purpose that could be put to. <img border="0" title="" alt="[Wink]" src="wink.gif" />

<small>[ January 31, 2003, 07:03 AM: Message edited by: nbk2000 ]</small>

[Machiavelli]

Just thought this one would fit in nicely:
<a href="http://www.phrack-dont-give-a-shit-about-dmca.org/show.php?p=60&a=13" target="_blank">http://www.phrack-dont-give-a-shit-about-dmca.org/show.php?p=60&a=13</a>
"Low Cost and Portable GPS Jammer"

[Jumala]

Jamming the 77,5 KHz DCF time-signal is no problem. But it will take no effects. Every DCF clock is only syncronised by the timesignal but not addicted to it. Without the signal it is a normal quarz clock wich fails only a second a month.
I don´t know if a own 12 o´clock signal can syncronize the clocks new. It would need a powerful transmitter and a large coil antenna but
it would be an interesting experiment.
Perhaps the original signal can be received stored on a endless tape.

<small>[ February 01, 2003, 02:30 AM: Message edited by: Jumala ]</small>

[nbk2000]

If you were only jamming the signal, then that'd be true, but the clocks set their time by the radio signal, so if the signal is broadcasting a false time, then the clocks would set themselves to that false time.

The only way I see this not happening would be if there was a button that had to be pushed to synchronize the time, otherwise it'd be spoofed.

[Flake2m]

I have read about about these GPS jammers. They are apparently quite easy to to make. I read that you could extend the range by putting it in a plane.

GPS systems are used by some armaguard companies to keep track the vehicles. theroetically you could use one of these to make an armed transpsort dissapear. Go in hard and fast. Jamming the signal, neutralising the crew, taking the cash and then dissapearing.

If dispatch notices the interference, but gets no calls for help they might think that the GPS system needs to be fixed.

[Machiavelli]

Apparently, even military receivers are not that hard to jam:
"10 GPS Vulnerabilities":
<a href="http://www-cgsc.army.mil/milrev/English/MarApr01/adams.asp" target="_blank">http://www-cgsc.army.mil/milrev/English/MarApr01/adams.asp</a>

[Tuatara]

The best place for a cellular jammer would be right next to the base-station. This makes it easy to swamp incoming signals from phones without requiring too much power from your jammer. This also means you effectively kill the entire cell covered by that base station. You could even turn the thing on and off remotely by using the pager system.

GPS jamming shouldn't require much effort - the signals coming from the satellites are in the region of -120dBm. The only tricky thing is that GPS antennas are designed to receive from the sky - usually covering about 135 degrees. This is intended to reduce multipath interference from buildings, mountains etc. So put your GPS jammer as high as you can.

[Flake2m]

Well if wanted to disrupt communication more effectively, then your best bet would be to put the GPS/mobile phone jammer in a plane and direct the signal downwards. If you had a light aircraft then you could make a fairly powerful jammer.

If this was done during a war and set to the right frequency, you could possibly jam missles and a low flying aircraft. If you flew over a city with it turned on you could create one helleva lot of chaos.

A jammer in this case; hypothetically would be really effective if it was combined with another attack, such as a bombing, becuase it would disrupt communications leading to more casaulties.

[I_am_the_Black_one]

If you place one in a bunker and had it connected to the steel rods in the concrete Trap the entrances and you have a nice lil safe place to conduct your err Bizness what ever that may be they cant shut it down if you get caught and if they find your place of hideing by the time they get thru all the traps you can be long gorne or if you got sighted getting away no radio for them no help you could also hav a radio set up on a rare freq (im not well versed in radios) and set ur jammer so you can use only that freq

I am sorry for the lack of grammer and spelling in this message but im in a big hurry

<small>[ April 07, 2003, 02:33 AM: Message edited by: I_am_the_Black_one ]</small>

[Anthony]

What sort of range do you expect from aerial(s) embeded deep down in the concrete structure of a bunker?

[I_am_the_Black_one]

lol I do not know I must have being drinking when I posted that!!

but they may work for localised jamming or you can run cables off to antannas hidden in the area I honestly do knot know

[jelly]

Here is the circuit diagram of a cell phone jammer I have found in a book.
I haven't tried out the jammer and don't know if it works ;)

The jammer is built simply, the components should fit in a matchbox and cost just a few dollars.

A sawtooth generator (on the left) "wobbles" a VCO (the integrated circuit on the right)
(VCO = Voltage Controlled Oscillator... that means the frequency of the output signal
is depending on the amplitude of the input signal).

The frequency of the antenna signal rises from 885 MHz to 950 MHz 1000 times per second
(wobble frequency = 1 KHz) and jams the input stages of the mobile phones nearby.

If the cell phones in your area are working in another frequency range, you
have to use another VCO.

Cell Phone Jammer (http://jelly146.tripod.com/jammer)

[Tuatara]

Yup, that'll work. Power is a bit low ( only -8dBm) but add a couple of RF power amps (e.g. MAX 2235) and you'd be able to jam a decent area.

[yt2095]

This is only half an idea, and MAY/MAYNOT apply to cell fones or the likes.

I seem to remember MANY years ago (old C.B days) that a transmiter broadcasting an external I.F signal could be used to jam radios typicaly 10.7 Mhz for CB.
6.0Mhz for TV and 455khz (I think that numbers right?) for standard AM radios.

the Zenner diode breakdown voltage was amplified through an Op-Amp (741 or LM301 back then)
the output fed to an FM oscilator to modulate that approx freq a few KCs` either side.
I`m wondering if the same principal may apply to cell fones? as all radio uses an I.F, and I.F range of freq`s are alot cheaper in terms of wattage per buck, because high freq parts at power are quite expensive (they were back then).

I`m sure if it`s workable someone more knowledgable and up-to-date than me will pick up the ball from here :)

All the best :)

[jelly]

Install the jammer into the case of an old cell phone and you will get the antenna for free,
additional space for bigger batteries and RF power amplifiers...
and it lets the jammer look unsuspicious ;)

[controlphreak]

I'm going out on a limb here, k? But when I was on my way to the DR, there was a Canadian with me, that was going down there and for about an hour he was talking to me about cellphones. He is a cellphone engineer and technician. And he said that on the ones that are using TDMA that is all good and possible what you are talking about. The ones that most people use now, except there is one thing that people most often forget, and that is that most cellphones are dual band.

Apparently in the early days, the cell phone companies setup many 'nodes' all over the country that are able to pickup cellphone transmissions, and is what they used to make them work. Now adays we have better cell sites, however, if for any reason, its newer technology is broken, it will revert to what it was originally based on and use those.

Another thing is that the newer CDMA is very different from the TDMA. CDMA is to explain it plainly very hard to break block or intercept. When you intercept it in the air, all there is is Static. The onlyw ay to tap is on the hardline connections it sends it through. Also, it uses a 1024bit cipher, because this is recently outdated Military technology that they are using. The protocol is at least.

This is all typed from memory and I was in a very sleep depraved state at the time. If any of this is incorrect please let me know, and I apologize a head of time if this has no relevence.

Oh and bye the way, those Radio Atomic Clocks, they automaticly sync themselves with the tower every 2-3 minutes,a t least the ones I have do, so you can change the time, but if the real signal ever gets to them, it will change it back. Just an FYI ( we tried it in school once to try and fool the teacher into letting us out early).

controlphreak

[vulture]

I know that the US uses a very different cell phone system from Europe. The US uses 1900Mhz and Europe 900 and 1800Mhz. The european standard is called GSM and is fully digital, automatically switching frequencies depending on bandwith usage/signal strength.

I remember that people who departed for the US needed a cell phone that could deal with 1900Mhz and the old analog networks in the US. Could somebody tell me/us what the current situation in the US is, because we have members from all over the world.

[controlphreak]

Here is somethings that were interesting that had to do with this topic, as I have been researching it lately.

http://gbppr.dyndns.org/PROJ/mil/celljam/

and here, she has a nice idea that leads very well into 802.11b technology:

http://www.ladyada.net/techproj/freshair/index.html

controlphreak

[controlphreak]

Here is somethings that were interesting that had to do with this topic, as I have been researching it lately.

http://gbppr.dyndns.org/PROJ/mil/celljam/

and here, she has a nice idea that leads very well into 802.11b technology:

http://www.ladyada.net/techproj/freshair/index.html

controlphreak

[controlphreak]

Here is somethings that were interesting that had to do with this topic, as I have been researching it lately.

http://gbppr.dyndns.org/PROJ/mil/celljam/

and here, she has a nice idea that leads very well into 802.11b technology:

http://www.ladyada.net/techproj/freshair/index.html

controlphreak

[Jacks Complete]

There are 4 different bands in use around the world, using digital and analogue. UK analogue has been turned off for a few years now. You will need to check your area, and use the right jammer for the area.

UK police cars often have DF on them. They have GPS systems for traffic navigation, too. Also, they have switched to a digital system for voice and data transmission which uses encryption, to stop tea-leafs listening in.

If the jammer was small, you could have several. Keep one with you, put another near to your swap car, and leave another at the scene. No-one would approach the one at the scene, as they would think it was a bomb (stick wires out of it for an aerial, or something), you put the one near your swap over point a street away, on a timer perhaps, and the one you are carrying you just drop out the back of the car after some distance.

I want one purely for use at the cinema, though. Bloody ignorant fools wrecking the film with the Nokia theme, or "Frog on a motorbike". Twats. A box that made them explode via a short in the Li-ion battery would be best.

[Jacks Complete]

There are 4 different bands in use around the world, using digital and analogue. UK analogue has been turned off for a few years now. You will need to check your area, and use the right jammer for the area.

UK police cars often have DF on them. They have GPS systems for traffic navigation, too. Also, they have switched to a digital system for voice and data transmission which uses encryption, to stop tea-leafs listening in.

If the jammer was small, you could have several. Keep one with you, put another near to your swap car, and leave another at the scene. No-one would approach the one at the scene, as they would think it was a bomb (stick wires out of it for an aerial, or something), you put the one near your swap over point a street away, on a timer perhaps, and the one you are carrying you just drop out the back of the car after some distance.

I want one purely for use at the cinema, though. Bloody ignorant fools wrecking the film with the Nokia theme, or "Frog on a motorbike". Twats. A box that made them explode via a short in the Li-ion battery would be best.

[Jacks Complete]

There are 4 different bands in use around the world, using digital and analogue. UK analogue has been turned off for a few years now. You will need to check your area, and use the right jammer for the area.

UK police cars often have DF on them. They have GPS systems for traffic navigation, too. Also, they have switched to a digital system for voice and data transmission which uses encryption, to stop tea-leafs listening in.

If the jammer was small, you could have several. Keep one with you, put another near to your swap car, and leave another at the scene. No-one would approach the one at the scene, as they would think it was a bomb (stick wires out of it for an aerial, or something), you put the one near your swap over point a street away, on a timer perhaps, and the one you are carrying you just drop out the back of the car after some distance.

I want one purely for use at the cinema, though. Bloody ignorant fools wrecking the film with the Nokia theme, or "Frog on a motorbike". Twats. A box that made them explode via a short in the Li-ion battery would be best.

[controlphreak]

Well ya could knock them out if your could create and EMP, but I have no knowledge in that area as of yet.

The ladies website that i posted, that has different plans on it has one that is quite small, and she calims can be made for $20 a piece, and have a decent range.

controlphreak

[controlphreak]

Well ya could knock them out if your could create and EMP, but I have no knowledge in that area as of yet.

The ladies website that i posted, that has different plans on it has one that is quite small, and she calims can be made for $20 a piece, and have a decent range.

controlphreak

[controlphreak]

Well ya could knock them out if your could create and EMP, but I have no knowledge in that area as of yet.

The ladies website that i posted, that has different plans on it has one that is quite small, and she calims can be made for $20 a piece, and have a decent range.

controlphreak

[Silentnite]

There is such a thing that is currently selling in the USA called a "World Phone". So maybe it would support all of those frequencies.

I for one (theoretically of course) think that if your going to bother 'jamming' someone's phone, then just alter a microwave box into one of those microwave guns. The phone is already giving you cancer, this just might speed it up a little. But not only do you get the phone, but you also get the jackass driving down the road with his head up his ... phone.

On an alternate and slightly OT note, there was a guy arrested for tapping into the frequency that Burger King uses for its drive through. Apparently he was telling people that they were too fat, go eat somewhere else, and generally cursing at them. Quite hillarious.

And if we are talking about jamming radio signals, let us not forget Spaceballs. "He gave us the raspberry!"

[Silentnite]

There is such a thing that is currently selling in the USA called a "World Phone". So maybe it would support all of those frequencies.

I for one (theoretically of course) think that if your going to bother 'jamming' someone's phone, then just alter a microwave box into one of those microwave guns. The phone is already giving you cancer, this just might speed it up a little. But not only do you get the phone, but you also get the jackass driving down the road with his head up his ... phone.

On an alternate and slightly OT note, there was a guy arrested for tapping into the frequency that Burger King uses for its drive through. Apparently he was telling people that they were too fat, go eat somewhere else, and generally cursing at them. Quite hillarious.

And if we are talking about jamming radio signals, let us not forget Spaceballs. "He gave us the raspberry!"

[Silentnite]

There is such a thing that is currently selling in the USA called a "World Phone". So maybe it would support all of those frequencies.

I for one (theoretically of course) think that if your going to bother 'jamming' someone's phone, then just alter a microwave box into one of those microwave guns. The phone is already giving you cancer, this just might speed it up a little. But not only do you get the phone, but you also get the jackass driving down the road with his head up his ... phone.

On an alternate and slightly OT note, there was a guy arrested for tapping into the frequency that Burger King uses for its drive through. Apparently he was telling people that they were too fat, go eat somewhere else, and generally cursing at them. Quite hillarious.

And if we are talking about jamming radio signals, let us not forget Spaceballs. "He gave us the raspberry!"

[ke6ziu]

it is hard to conceal a transmitter, even harder to conceal one that transmits in every band, there are several way's they can locate you...

Or, you can place an extremely low power device (> 1 W...) right beneath the repeater site. That way, whoever was trying to df you would have a hell of a time trying to find you...confuses the hell out of everyone!!!

++++

Quoting whole posts is a quick way to banned. Don't repeat the mistake.

NBK

[sidhusavi]

well here is one link to a research project conducted by some students,
this ppt presentation clearly gives the circuit diagram of a small-scale GPS jammer

www-ee.eng.buffalo.edu/faculty/paololiu/413/G1005.ppt

[nbk2000]

According to the file, it's not a GPS, but a CDMA cellular phone jammer.

[akinrog]

I'm not sure if I should post this here or under EMP thread but actually there is a thread in SM by Jpsmith (who is, I believe, a member here too) regarding spiral pulse generator. This gadget when slightly modified (i.e. by removing copper foil hoop around it), can be used as a short range EMP weapon.

He states that he made a mistake to remove the said copper foil hoop and device killed his multimeter caused his computer (about 2 m away) to reboot and killed its AGP card.

This might be a good option for killing surveillance cams, burglar alarms, nearby cellphones, radios, etc. etc. and might find several uses ranging from heists to prison breaks. :D Regards

[nbk2000]

Did a recent search, and ran across an article about unintentional GPS jamming interference created by VHF-UHF dish antennas with 'noisy' pre-amps.

The device was causing complete loss of GPS to a harbor, with a range of more than a kilometer in harbor, and three kilometers at sea.

The article didn't identify the make directly, but further digging brought up a US Coast Guard advisory that named names. :)

TDP (Tandy Distribution Products) Electronics - MINI STATE Electronic Amplified UHF/VHF TV Antenna - Models 5MS740, 5MS750, 5MS921

Radio Shack Corporation - Long Range Amplified Omni Directional TV Antenna - Model 15-1624

Shakespeare Corporation - SeaWatch - Models 2040/Code Date 02A00, 2050/Code Date 03A00 (Code Dates are found on the antenna power supply.)

None of these are still manufactured (AFAIK), but shouldn't be very difficult to find used.

[Jacks Complete]

Do a search for "Wavebubble". It's an MIT student's project, it jams anything within 30m, almost regardless of frequency. The clever part? It detects the transmitter and jams that frequency, rather than being a wideband high power affair, so has better range than any other packet of cigarette-sized RF jammer!

Actually, I found it's homepage: http://www.ladyada.net/portfolio/2006/index.html

[nbk2000]

I saw the Wavebubble when it was posted on Hack-a-day.

While it'd work great for cellphones and such, it's useless against GPS, as GPS receivers are passive devices and not detectable.

Unless you pre-programmed the Wavebubble to the frequency of the GPS, it wouldn't do anything.

The other thing is that the Wavebubble is rather complicated to make, compared to buying an existing OTC device.

[Jacks Complete]

Would it not pick up the aerial re-radiation? I suppose it would depend on the sensitivity.

As regards home-brew, you can avoid answering all those tricky questions when you are talking to yourself. And you can save a fortune, or even make money selling them to those who are after one without similar questions being asked.

[InfernoMDM]

Just a thought, but why attack the cellphone? Granted most cops these days probably do go out with a cellphone on hand, but would it not be possible to look up the repeater channels for the local police, and jam them instead? Hell some systems can be jammed by simply transmitting, although I know Motorola has some ways to defeat that administratively. I would also think broadcasting a high enough power signal on the repeaters output could potentially shut down reception by the police in the area.

If turned on during, or right before a event you could at least gain a few extra minutes.

That being said I don't think any police department really has the resources for tracking down signal easily. I know how damn difficult it is to track down ELTs and EPERBs in cities, while they are on the move, or even stationary in the woods. Sometimes it takes several hours even with rough coordinates from the satellite.

[nbk2000]

Another pig tool (http://www.officer.com/publication/article.jsp?pubId=1&id=34899)that uses GPS:

Slowing the Pursuit

Posted: February 13th, 2007 08:02 PM EDT


Far too often high-speed police chases end in a fiery crash, serious property damage or needless injuries to innocent bystanders, officers and suspects.

Pursuits are often begun by non-violent misdemeanor offenses such as persons: with expired drivers' licenses; who had too much to drink and afraid of a DUI charge; carrying contraband; driving a stolen vehicle; or driving an improperly licensed vehicle.

According to a report for the National Institute of Justice (NIJ), "Police Pursuit: Policies and Training," by Dr. Geoffrey Alpert, expert on high-speed pursuits at the University of South Carolina, in 40 percent of high-speed pursuits reported, the primary vehicle resulted in an accident.

"As the number of vehicles involved in police pursuits increases, the likelihood of apprehension and the chance of accidents, injuries and property damage increases," says Alpert.

The StarChase Pursuit Management System, from StarChase LLC of Virginia Beach, Virginia, enables suspect tagging and tracking for a more safe and controlled interdiction strategy.

Conceptually, a low-speed pursuit.

System start
The StarChase system concept consists of a projectile attached to the suspect vehicle acting as a tracking device for law enforcement to ultimately back-off the accelerator and safely control the situation without the dangerous factors hand-in-hand with high-speed pursuits.

"StarChase is a tagging and tracking technology," says Sean Sawyer, company president. "Our system is designed to forestall dangerous high-speed pursuits of fleeing vehicles under the principle of if an officer tags it and tracks it, that officer doesn't have to chase it."

But the StarChase concept doesn't end with high-speed pursuit management. It also can be used for automatic vehicle location (AVL), anti-theft protection and real-time tracking of assets and targets.

"StarChase's core technology is the firing and tagging of a tracking device to a suspect vehicle through a launching device installed in the police vehicle's grill," says Sawyer.

The tag contains a miniaturized global positioning system (GPS) module, global system for mobile communications (GSM) transmitter and built-in lithium battery power supply. It adheres to the suspect vehicle by a very aggressive adhesive that dries almost immediately.

The tag is targeted by a laser intended to be sighted or lined-up by a joystick-like control within the police vehicle.

The laser-guided tag launches from a safe, less-lethal, compressed air-activated launcher mounted on the police vehicle. Tags are front-loaded into the dual-barreled launcher for the extra shot at the suspect vehicle when needed.

Installation includes a heavy-duty construction with a small installation footprint designed for over-the-road conditions and fits most law enforcement vehicles.

Inner workings
The system is similar to an AVL system, however designed for a hostile scenario instead of the friendly confines of a department's garage or lot.

Suspect tracking technology uses assisted global positioning system (AGPS) techniques utilizing GSM communication frequencies to transmit a suspect's coordinates.

AGPS is capable of using cellular towers to augment GPS signals. Therefore, tracking continues through typical "dead zones" between steep urban canyons, amid tall buildings or under leafy canopies that might disrupt the typical GPS signal.

The tag computes its position from GPS satellites which, from the radio transmitter within the tag, transmits that position's coordinates to a StarChase Control central computer server. The server then displays the tracked suspect's positions in a typical view like any other GPS readout.

The current version of StarChase has tagged information accessed by the department dispatcher through a secure Internet portal into the StarChase Control central computer server.

"Security is built into the connection portal and limited only to authorized access," says Sawyer.

StarChase utilizes an extensive 100-percent Internet Protocol (IP) portal for end-to-end law enforcement communication administrator control. The digital roadmap computer displays real-time suspect/asset location. Security protocols are built into the vehicle transmissions to the server and the IP connection from the server to the dispatcher.

Affecting the future
As the StarChase system has the potential to be a vital tool for law enforcement, beta testing is in development. The Florida State Highway Patrol and Los Angeles (California) Police Department (LAPD) are performing field tests beginning early 2007.

"We would like to pair it to some of our license plate recognition technology," says Sgt. Dan Gomez, officer in charge of the LAPD Tactical Technology Unit. "That technology seems to have the highest likelihood of finding a stolen vehicle, so combining the two technologies seems to be a good fit."

A common strategy is to have a helicopter communicate suspect ground movements from the air.

"High-speed pursuits in which a helicopter was involved to track the suspect ended successfully in the suspect's apprehension in, on average, 95 to 98 percent of the cases involved," says Alpert.

However, a helicopter can only track; a potentially dangerous pursuit may still be required.

One more in the tool box
"When this technology was introduced to the department, Chief Bratton recognized it for its potential to give yet another tool to the officers in the field," says Gomez.

"The end result would be that law enforcement would be able to deploy the device and hopefully slow down in pursuit and be able to track the suspect."

The system has the potential to impact pursuits, risk management, liability issues and safety concerns for the community, adds Gomez.

StarChase LLC is a company specializing in tagging and tracking pursuit management solutions for the law enforcement sector. The privately held company has been in operation since 2001. The StarChase products are patent protected in several countries, including the United States

"We see the high-speed pursuit as a national issue," says Sawyer, "not only in large urban areas but in all cities around the country.

"It's a solution so scalable that it fits any police department from the county sheriff to a big city department, from a highway patrol to federal agencies like border patrol, customs and homeland security. We see StarChase as part of an entire range of law enforcement tools."

If they're depending on this technology, they'll tag you and back out of visual range, thinking they'll be able to catch up to you at their leisure.

But, if you are jamming the GPS, they'll have lost visual track of you, giving you a much greater chance of escape. :p

[Jacks Complete]

A simple bug sweeper will enable you to tell if one of these has been fitted, and it would be trivial to see it, whereever it was attached. The easy answer then is to stick it in a slingshot, and fire it at a car you overtake, and then bugger off down a second route. Finding a car that looked a bit like yours (model and colour match!) would be incredibly entertaining for the occupiers...

[nbk2000]

Assuming you have the desire to stop, get out, scan, remove (it might be embedded inside the bodywork), and get close enough to another vehicle to attach it to, while the thing is broadcasting your position up until the moment you pass it off to someone else.

Or just turn on the jammer and disappear.

[Jacks Complete]

I was thinking more of using the jammer/detector to detect the presence of the unit without stopping, and then, if possible, send the trackers in the wrong direction. If you were alone and driving, then you aren't going to be able to do this, but if you are in company, you can have your passenger(s) try to reach it.

Has anyone got details on the anti-magnetic systems used by minesweeper ship units to avoid mines detecting them? I'm not sure if the system stops magnets from sticking, but I know that it stops the magnetic anomoly detection systems from detecting the presence of a ship overhead, whilst alerting the ship to the presence of a mine.

[Hirudinea]

If you want to jam all these different systems why don't you just set up a spark gap transmitter, they were used 100 years ago, are easy to make (if you know what your doing) and will blot out anything within range, which is they were fazed out almost 100 years ago.

Has anyone got details on the anti-magnetic systems used by minesweeper ship units to avoid mines detecting them?

Try this link http://www.fas.org/man/dod-101/sys/ship/weaps/degaussing.htm

[grayssk]

Another link from GBPPR, this is their GPS jammer design. The notes section at the bottom may be the most valuable, in fact.

http://gbppr.trighost.org/mil/gps/index.html

Here's more, this one is defeating "burst" tracking GPS:

http://gbppr.trighost.org/mil/track/index.html


(First post, don't murder me)

[nbk2000]

Ah! I used to have that bookmarked, but lost the bookmark. Good job finding it for me. :)

[Mr Science]

http://hackerscatalog.com/Products/Jammers/index.html
$180 cell jammer, yet only 20m range. I sure a few mods to it could greatly up its output range.

EDIT- Here are plans for other scanners/jammers, $9.
http://hackerscatalog.com/Products/PlanPackage/CellularGPSJammers/Index.html

Overall, this site has very interesting stuff and I encourage people to look around. But anyways, if I find any of these files today on demonoid or tracker sites, I'll post.

[nbk2000]

...It can be hided inside cloth pocket or handbag etc. and products and incredible...

They provide no physical address, only a PO box, and no phone-number since they'll call you. :rolleyes:

And they want $200 of my dollars when they can't even build a proper sentence? I'll let someone else buy from them.

[Jacks Complete]

The spark gap is also incredibly inefficient, and unless you have a very high powered system, you won't get very far, even close up. Think about how your FM radio is almost totally uneffected by a thunderstorm. Sure, you can hear the 10,000,000V discharge a few miles away, but it hardly ruins the song.

You need a transmitter that is narrowband (tuned) and which adapts rapidly to the transmitters in range, within the frequency range you wish to jam. This is why LadyADA's design can run off batteries for days on jamming cellphones - it only transmits when it detects something to jam, and it puts all it's power into the right place. More like a sniper than the flamethrower effect of a sparkgap.

Oddly, I got a call from my folks today, asking about a cell phone jammer! I explained they were illegal, and they said they already had one, they got it off the internet, but it isn't very good!

[Pollsmoor]

The best place for a cellular jammer would be right next to the base-station. This makes it easy to swamp incoming signals from phones without requiring too much power from your jammer.

You have a point, but... :)

Firstly, if the one tower goes down the other cells will take over, at least on the fringes. Around here the cells are quite close together (in the cities), so you'd want to take out quite a few.

So, what I would do *grin* is find a high point and beam the jamming signal to all the towers I'd want to kill, one directional antenna per tower. I'd use the same jamming signal generator and feed that into one RF amplifier per antenna.

Sure, it would take a while to set up, but it's far from the tower so you have all the time you need.

Another thought : each cell tower has a fixed capacity, a certian number of calls it can make at any one time. It should be possible to build a device to make the maximum number of calls, even if it consists of N stripped cellphones connected to a PC to "press" the buttons. Around here we strongly suspect that the cell operators disconnect calls after a minute in favour of new calls when the traffic gets heavy, this way they make more money. Or maybe we're just paranoid. But using N+1 cellphones will effectively prevent anyone else from being connected, and if they are, they'll be dropped after a minute anyway.

Oh yes, and this device will look just like a normal cellphone to the direction finding equipment, so it should take them longer to realise that it's a malicious event, and it won't be as easy to trace. I think :rolleyes:

[Jacks Complete]

I think there are a few flaws in your plan.

Firstly, you beam the jammer signal at the tower, you won't do much, since it won't swamp the incoming signals from other directions. It's my opinion that your beam would kill any phones in it's path, but those off to the sides of the beam would be mostly unaffected. (A microwave engineer could confirm, it's been a long time.)

Secondly, as regards the DDoS attack, you would need N+1 cellphones, which would cost a fortune in fees, etc. and phones. Even buying them secondhand would be daft.

Thirdly, the attack would be noticed rapidly, since the UIDs of the phones would always be the same. This would be even more obvious if the phones had faked or invalid SIM cards in them.

The best idea would be to determine the exact frequencies of each band, and use a high number of tunable transmitter systems to spoof the transmissions of a real phone. This would use more of the cell towers resources, as you could hand it fake and hard to checksum IDs, so increasing the time taken per event, and reduce the number of transmitters you require. Using the data stream from a PC would allow you far more flexibility, too, so a change in the protocols or data structures wouldn't be able to stop your attack.

Probably the easiest way to deny mobile phone servie in the town and country would be to map out where the towers are, and simply physically attack them just before you need the DoS. I'd suggest ewaring your lead underpants and sticking foil or something else conductive over the microwave heads facing the way you want to 'jam'.

[nbk2000]

I have a paper that describes a DDos against the cellular network that is geographically targetable.

By using broadband connections ('bots) to send SMS messages over the internet to a large percentage of phone numbers in the target area, you fill up all the available call slots, making it nearly impossible for voice calls to get a dial-tone. :)

Only complication is that you need to know the majority of cellphone numbers in the target area. :(

Might be possible to get such information from the cellular network itself, since every phone broadcasts its ID to the network.

[Fourfifth]

Hi there, I have read reports that this following jammer works, go to the url on the image for more info:

Edit, pic too big

http://www.imagecage.com/files/1/index5.gif heres the link instead

[imported__Jim]

I think there are a few flaws in your plan.

Firstly, you beam the jammer signal at the tower, you won't do much, since it won't swamp the incoming signals from other directions. It's my opinion that your beam would kill any phones in it's path, but those off to the sides of the beam would be mostly unaffected. (A microwave engineer could confirm, it's been a long time.)

These sites today are three-sectored 120 degree/sector sites; place a signal strong enough to degrade the SNR (signal to noise ratio, and that could be 6 to 10 dB below the other signals) +- 60 degrees from the sector's nominal boresignt and *your* signal will have done its deed. At 10 dB down a 100 miliWatt signal will work to 'take out' (degrade) a 1 W signal enough to potentially cause the BER (bit error rate) to become high enough on a digital/TDMA call that the 'switch' will release it.

The AT&T Wireless Services 800 MHz cell system here locally was aligned as a 60/180/300 system and the old 'Bell' (wireline carrier) 800 MHz system was aligned as a 0/120/240 system; ATTWS had a 'flat' on the south sector and Southwestern Bell Mobile Systems had their 'flat' on the north.

Full disclosure: Former cellular RF design eng here.

[HIM]

While at work searching for high speed coax, I ran across this company: http://www.antennasystems.com/.
A problem with the last link...The fun toys, they only sell to Federal Govt Agencies. But they do advertise that they have "Solutions for Homeland Security.

[Pollsmoor]

I think there are a few flaws in your plan.

:eek:


Firstly, you beam the jammer signal at the tower, you won't do much, since it won't swamp the incoming signals from other directions. It's my opinion that your beam would kill any phones in it's path, but those off to the sides of the beam would be mostly unaffected.


Your beam would be directional, but the receiving antenna is omnidirectional, it has to be. You beam enough power in there, you *will* swamp the front end.


Secondly, as regards the DDoS attack, you would need N+1 cellphones, which would cost a fortune in fees, etc. and phones. Even buying them secondhand would be daft.


Idunno, cellphones seem to be getting really cheap and available and I'm not even in what can be regarded as a first world country.

Also, I don't think N is all that big (would like to know though).

I can get a SIM card for less than, actually, I can get about three for the price of a beer in a bar. They're prepaid, so you still have to buy the airtime, but sheesh, compared to RF amplifiers and specialised electronics it's cheep :-)


Thirdly, the attack would be noticed rapidly, since the UIDs of the phones would always be the same. This would be even more obvious if the phones had faked or invalid SIM cards in them.


But would the cell company be on the lookout for this? As far as they can see, it's just a whole bunch of people calling in.

You are after all trying to prevent a third party from getting a connection, and how is he going to report the fault, phone them? *grin*


By using broadband connections ('bots) to send SMS messages over the internet to a large percentage of phone numbers in the target area, you fill up all the available call slots, making it nearly impossible for voice calls to get a dial-tone.


Now *that's* clever! Use someone else's phone to ddos. I like it.

[nbk2000]

Found the website detailing the SMS DDoS attack:

http://www.smsanalysis.org/

[imported__Jim]

:eek:

But would the cell company be on the lookout for this?



Yeah; ever since the ESN cloning days of analog cellular there are 'algorithms' that run in the 'switch' (literally, the 'switching' computer that sets up, supervises and 'bills' the mobile calls) that look at 'system access' (when you place or make a call on the setup or control channel) - whether that access is simultaneous, using the same SIM/ESN but different sector/different cell/same cell/etc - and it spits out on a report that the 'revenue assurance' boys look at ... most times the subsequent (other than the first attempt by a certain ESN) will simply be rejected (by the Ericsson switches anyway from what I recall.)

[Gumby]

If you wanted to broadcast from the air small weather ballons would do the trick. Granted you've have no control where the wind blew them, but if they had a great enough range it wouldn't matter much.

[nbk2000]

That's where a ground tether comes in handy. Keeps 'em from drifting away. ;)

[nbk2000]

A link to (mostly) chinese manufacturers selling GPS and Cellular jammers and related devices:

http://www.alibaba.com/showroom/GPS_Jammer.html

[akinrog]

A few days ago, I ran across the Phrack Magazine article giving details of a homemade GPS jammer.

This device raises concerns of even military security experts, because military GPS devices have to acquire civilian GPS signal before acquiring military (i.e. precision) GPS signal.

Anyway here's the link:
http://www.phrack.com/issues.html?issue=60&id=13#article

and text-only version

http://www.phrack.org/archives/60/p60-0x0d.txt

By copying and pasting the last part of the article, you can also obtain gzipped version of a poscript file containing schematics of the device.

In addition, you may also check out this handmade GPS GMS tracking device.

http://www.navigadget.com/index.php/2007/07/16/build-your-own-gsm-gps-tracking-device/

The chip / module mentioned in the article is so exiting, the sky is the limit for the things you can do with it.

Since it has capability to connect to a camera, it may even be applied to telesniper idea of NBK. :D

Only downside is you need a GSM SIM card, which might mean paper trail depending on the country. Regards.