If someone can please provide some advice about the following problem I am trying to solve it will be great.

Scenario: A standard office room, with (say) a couple of people in it What I want to find: (1) How many cell phones are in the room (2) What are the phone numbers of the phones in the room (3) When is a specific number making a call (4) How long is the call

I am not interested in the call content.

Is there a hardware/software solution that already exists for these requirements ?

  • 1
    You could use a cellular repeater for each network people in the room connect to and inspect statistical data and connected clients through it. Alternatively, you could do the opposite - install a mobile phone jammer and see how many people seem disjoint in disbelief. :) – TildalWave Jul 9 '13 at 16:24
  • @TildalWave I have heard of these referred to as an MZ Catcher (I think that's what it was called) and you basically MITM cellphones near you by becoming the tower. I haven't played with them yet but it sounds like it could be an easy attack vector for badguys. – Four_0h_Three Jul 9 '13 at 18:06
  • Is it necessary to "intercept" the cell phone signal ? could it not be that I can sniff the signals going through the room and see the Device ID and signal strength at any point in time ? I am not really interested in the content of the call just the actual device is communicating or not. I will look up the cellular repeater link, thank you both! – abby Jul 9 '13 at 19:47
  • @TildalWave Cellular repeaters are of questionable legality, unless provided by an actual cell provider - and those usually prefer to only give them to their own customers. Jammers are definitely illegal, at least in the U.S.. – Iszi Jul 9 '13 at 20:40

Unless you shield your building completely, there is no way to determine if the signal is coming from in the room or from outside without triangulating the signal and there isn't a guaranteed way to force the phones to connect to your device instead of the actual cell tower.

Depending on jurisdiction, this may or may not even be legal since it could cause interference with people passing by who just happen to get caught in your net. I don't think you would be able to tell the cellphone numbers since that is established by the carrier, but you would be able to tell the cellular radio's identifying numbers. You wouldn't be able to tell who they are calling without breaking through the encryption (which would almost certainly be illegal.)

So in short 1)Not without triangulating the signal and even then unlikely to be reliable. 2) Unlikely, though you could identify the physical phone being used. 3) You could identify that a particular phone (but not phone number) is making a call. 4) You could tell how much time the connection stays alive. These all depend on them remaining connected to your repeater however which again, is not guaranteed unless you can block out the real tower.

  • Thanks AJ - how about this then: maybe I can use a device to measure signal strength and have a cut off for signal strength to say if value is above a threshold it means you are in the room. Furthermore, if I identify the device number - I could work with that - how would I sniff the device MAC/IMEI/some other ID ? Is there a hardware/software solution that can tell me - hey here are the 20 signals I can see, here are the device IDs and signal strengths ? – abby Jul 9 '13 at 19:41
  • @abby - you would have to use a cellular repeater with monitoring capabilities, but I'm not sure what the legal implications would be if you started sniffing information off of it. You'd need to check the legality with a lawyer in your area to make sure it doesn't run afoul of any monitoring or wiretap laws. – AJ Henderson Jul 9 '13 at 19:55
  • @AJHenderson Do you really need a repeater to monitor this? Isn't enough information sent in the clear that a passive sniffer can identify or infer the start/end of the call and the hardware ID of the local device? – Iszi Jul 9 '13 at 20:27
  • @abby Berkeley Varitronics (and other manufacturers, I'm sure) makes passive sniffers specifically made to detect cell phone signals and some can be configured to alert at a certain signal strength. However, I'm not sure if any of them can provide IMEI/MAC IDs of detected devices. Since the BVS devices are intended for use in environments where cell phone usage is prohibited, they are not concerned with collection of unique identifiers - just alerting and triangulation of the phone's existence. – Iszi Jul 9 '13 at 20:34
  • 1
    @abby the difficulty with measuring the strength would be that different cellphones could transmit at different strengths maybe I'm wrong I haven't done any cell phone phreaking. I'm going based on my wifi experience where I can have 2 routers right next to each other and get a better signal from one. I know the power of my device so I can (theoretically) calibrate a rough TX range. I can then transmit to a device. If that device responds that means it's within that range.. theoretically. I haven't actually done this... yet :) – Four_0h_Three Jul 9 '13 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.