FBI Tracking Device Teardown(ifixit.com)
ifixit.com
FBI Tracking Device Teardown
http://www.ifixit.com/Teardown/Tracking-Device-Teardown/5250/1
82 comments
If the FBI didn't want anyone tampering with the unit, they would have potted it in heavy epoxy or welded the case shut. Maybe even put a light-sensitive thermal charge inside.
More likely they were worried about the screws vibrating themselves off while stuck to the underside of a car - thus the threadlocker glue everywhere.
More likely they were worried about the screws vibrating themselves off while stuck to the underside of a car - thus the threadlocker glue everywhere.
The fact that they didn't pot it is interesting. I hadn't thought about that. Potting seems to be on the decline over the last 10 years from what I've seen.
I had to drill it open. There's a video of the process here: http://www.wired.com/threatlevel/2011/05/gps-video/
Re: software—we linked to the reference design, which includes a lot of information about the software. There should be plenty of information available to start investigating their implementation.
Re: software—we linked to the reference design, which includes a lot of information about the software. There should be plenty of information available to start investigating their implementation.
Potting is still used heavily in industrial electronics and a lot of appliance work (think of washing machine control boards). I would think the military uses it a lot as well.
FIPS 140-2 Level 4
http://en.wikipedia.org/wiki/FIPS_140-2
Level 2-4 are used in commercial and military grade hardware security Modules.
Level 2-4 are used in commercial and military grade hardware security Modules.
I remember finding a teardown of an IBM 4765 module somewhere. That was badass.
Is that the PCIe crypto module shown in Google searches for IBM 4765? Please share the link if you have it, as I couldn't find a teardown in my brief search. I'd like to see how one would dismantle a potted circuit.
Yeah it's the crypto module. I think the teardown involved shaving the part down layer by layer and examining all the parts like the fine wire meshes that would instantly blow the chip if disrupted and etc. Wish I could remember where I saw it.
Yeah it looked to me more like the product designer was concerned about ruggedizing it for the automotive environment and possibly making a weak attempt at making it tamper-evident.
It certainly didn't look like anything designed to protect secrets.
It certainly didn't look like anything designed to protect secrets.
Does this thing actually transmit at 433.92 MHz? That's right in the 70 cm ham band!
This is part of ISM and it's a fairly common frequency for low power tx/rx modules
http://www.google.com/search?q=433.92+MHz&ie=utf-8&o...
Even car keys operate around this frequency.
http://www.google.com/search?q=433.92+MHz&ie=utf-8&o...
Even car keys operate around this frequency.
That band is a shared service.
I did the teardown, and I'm a regular hacker news reader. I'll answer any questions for the next hour or so.
So this tracker does NOT use cell connections? A receiver would have to get whitin range to download tracking data?
Correct. There's specs on the short-range transmitter here: http://xemics.com/docs/xe1200/xe1201evk_userguide.pdf
Now this is an old device, and they very well might be using cell phone transmitters now.
Now this is an old device, and they very well might be using cell phone transmitters now.
You mentioned it works in the 400MHz band.
Do you know the range, roughly?
When do you expect to find one of these stuck to the bottom of your car? ;)
In all seriousness, do you believe it would be possible for the FBI to make a similar device to use on bicycles (inside handle bars), motorcycles, scooters, or Segways?
In all seriousness, do you believe it would be possible for the FBI to make a similar device to use on bicycles (inside handle bars), motorcycles, scooters, or Segways?
Does it use military mode (the one that is even more precise than regular GPS)? Now that would be great reverse engineering project :)
Where was the GPS receiver mounted? These things need view of the sky, no?
Where was the GPS receiver mounted? These things need view of the sky, no?
I don't know the answer to either of these questions. It appeared to be a standard GPS receiver, but some investigation would reveal whether the manufacturer supports military mode.
http://docs.google.com/viewer?a=v&q=cache:7hhk_GsNmTQJ:w...
I never saw it on the car, but the antenna mount had a hinge that would allow it to stick out from the side of the car. But that would be rather conspicuous—I think that's why the antenna is so large.
I never saw it on the car, but the antenna mount had a hinge that would allow it to stick out from the side of the car. But that would be rather conspicuous—I think that's why the antenna is so large.
Is there a legal way to block them? Either the GPS signal, or the transmitter? (I'm assuming tampering with the device directly is illegal).
Sure, just transmit stronger white noise on 433.92 MHz. I haven't looked up who owns that frequency and whether there are restrictions.
Or get a GPS blocker. Which I think are illegal to operate.
Or get a GPS blocker. Which I think are illegal to operate.
AFAIK 433MHz can be used for any short-range application, similar to 27/49MHz for R/C cars. There are plenty off-the-shelf 433MHz transceivers for hobbyists, and I think car remote-unlockers use that band as well. And this doesn't appear to have a particularly powerful transmitter, so you'd have to bring the transmitter relatively close to the receiver (like <100ft, usually) in order to download...whatever.
If they're able to put this thing on your car in the first place, I guess it's not infeasible for them to drive by to download updates.
If they're able to put this thing on your car in the first place, I guess it's not infeasible for them to drive by to download updates.
Sparkfun sells 434 MHz transmitters for $3.95 [1]; just hook it up to a coin cell or four, and you should be good to go.
[1] http://www.sparkfun.com/products/8946
[1] http://www.sparkfun.com/products/8946
Why would tampering with such a device be illegal? Or blocking their signal? It's your car and until proven otherwise, you have no reason to bear with other people or the government installing such surveillance equipment.
If you're a convict then you might be released earlier but with some electronic surveillance, but even that is with your own consent.
If you're a convict then you might be released earlier but with some electronic surveillance, but even that is with your own consent.
Very cool. Have you all done any firmware/software hacking?
We have not—I had limited time with the device at Wired's office. We powered it on and used a frequency analyzer on it, but that was the extent of our investigation. We were concerned that black helicopters might show up if we left it on too long. But I hope someone else does!
Don't you guys have a Faraday cage for this sort of teardown?
What, you mean for all the other devices we take apart that regularly phone home to their manufacturer, who would show up at a moment's notice in a black helicopter to put an immediate halt to our technical analysis?
Of course! We have to block RF transmissions all the time!
Of course! We have to block RF transmissions all the time!
Didn't Apple have that one reporter guy who was sent the 'lost prototype iphone' SWAT'd?
Yes, the police raided the house of a journalist and seized his computers. http://news.cnet.com/8301-13579_3-20003446-37.html
That was a rhetorical question I'm sure.
Could you estimate the price of this thing, as the FBI told him it was expensive (and at least the batteries seem to be).
Off the cuff BOM for this thing is on the order of $30 in 1K quantities (maybe add 20% for government bureaucracy).
For the manufacturer, maybe. But then you have to factor in bribes to the federal procurement officers and junkets to Atlantic City to land the contract, and then medical payments for the workers who burned themselves hand-soldering resistors on that board. That's gotta up the price to at least $3K/unit or so! :-)
Can't really. Cost of BOM bears no relationship to selling price. His post below says it costs about $30 in 1k quantities. So estimating about $50 in 10pc prices, if I were building a few for a government agency/large corporation, ignoring NRE charges I'd probably price them upwards of $1000 each. This is not exactly something you can purchase at Best Buy...
What protocol is it using to transmit the location? Is it encrypted or authenticated? (Could it be spoofed?)
Do you know the maximum range the transceiver can transmit? The datasheet gives lots of design guidance, but nothing specific.
Data sheet: http://www.datasheetarchive.com/pdf-datasheets/Datasheets-40...
App note: http://www.datasheetarchive.com/pdf-datasheets/Datasheets-31...
Data sheet: http://www.datasheetarchive.com/pdf-datasheets/Datasheets-40...
App note: http://www.datasheetarchive.com/pdf-datasheets/Datasheets-31...
I don't know, but perhaps an RF engineer could weigh in given the frequency and transmission power.
Those batteries are impressive. I did some Googling and found:
http://www.batterymart.com/p-ls33600-ba-d-size-lithium-cell....
61 Watt-hours. That little battery could power a 60W light bulb for an hour!
(I'm currently working on a bluetooth -> IR bridge. I was worred about battery life from a coin cell, but now I'm not anymore. I will get one of these in half-AA size and keep the thing powered for the next decade :)
http://www.batterymart.com/p-ls33600-ba-d-size-lithium-cell....
61 Watt-hours. That little battery could power a 60W light bulb for an hour!
(I'm currently working on a bluetooth -> IR bridge. I was worred about battery life from a coin cell, but now I'm not anymore. I will get one of these in half-AA size and keep the thing powered for the next decade :)
>That little battery could power a 60W light bulb for an hour
It's a useful 'analogy', but it's not actually true. They are 3.6V, max continuous current 250mA, so max continuous power is 0.9W
It's a useful 'analogy', but it's not actually true. They are 3.6V, max continuous current 250mA, so max continuous power is 0.9W
True.
I bet it would release its energy a bit more quickly if you dropped it into a nearby fire.
I bet it would release its energy a bit more quickly if you dropped it into a nearby fire.
They're not cheap, either. They cost us $25 EACH plus a $10 Hazmat shipping fee.
Batteries(maybe not these but definitely car batteries) are typically rated at the 20hour drain rating. If you increase the current draw you will increase the power dissipated over the resistance inside the battery and reduce the amount of available power in a non linear fashion.
P = v*I
So, can we study the frequency and if the out signal uses any encryption?
Maybe we can use a homemade receiver to find the people the FBI is tracking...
Maybe we can use a homemade receiver to find the people the FBI is tracking...
Frequency and transceiver information are already posted. My guess is that the transmissions aren't encrypted, or are encrypted trivially or encoded (to obfuscate).
Since you said "we should", you should get started on it and post your findings here or better yet on a blog. The iFixit article provides a lot of bases to research from.
Since you said "we should", you should get started on it and post your findings here or better yet on a blog. The iFixit article provides a lot of bases to research from.
The board is running at 4MHz, so I'm not sure if too much can be done with such hardware.
[deleted]
If the trackee removed this from his own car and attached it to some other car, would he be violating some law?
I am sure they could find one. When dealing with the government it's heads they win, tails you lose.
edit: I still think it would be worth it. One of these cars for maximum effect: http://homeland.house.gov/about/membership
edit: I still think it would be worth it. One of these cars for maximum effect: http://homeland.house.gov/about/membership
It might be more effective, and more legal, to just sell your car as soon as you become aware that you've been tagged. Bonus points if you sell it to someone who is either taking a cross-country drive, or shipping it overseas.
Surely it's much, much easier to just put it on your neighbour's car. They'd probably believe they were getting real data or your partner was using the car. And could probably never accuse you of tampering as they couldn't be sure it wasn't just a mistake by the planting agent.
if he does it to tamper with federal investigation - then i'd guess it'd be a violation.
If he does it to improve fuel efficiency of the car and remove unnecessary weight from the car ... it'd be interesting whether it is possible to bill the government for the service of carrying their stuff around. Or for not being able to use the car at all as having the GPS tracker attached the car may become unsuitable for your use. Shouldn't anybody whose property taken over and used by the government to be justly compensated?
If he does it to improve fuel efficiency of the car and remove unnecessary weight from the car ... it'd be interesting whether it is possible to bill the government for the service of carrying their stuff around. Or for not being able to use the car at all as having the GPS tracker attached the car may become unsuitable for your use. Shouldn't anybody whose property taken over and used by the government to be justly compensated?
Well you can bill the govt. but not sure you'll get paid ... ;-)
In general, and most people are surprised by this, you cannot sue the US govt in court. Well you can, but only in certain cases where it allows itself to be sued -- tort cases and some IP laws and even then you almost never get a trial by jury, only a federal judge.
So you'd have to construct this as a tort case and use Federal Tort Claims Act (FTCA) to your advantage. I suspect if you try that, FBI will invent some reason to arrest you or at least harrass you (interfering with an investigation, obstruction of justice, damage of federal property, etc etc...).
In general, and most people are surprised by this, you cannot sue the US govt in court. Well you can, but only in certain cases where it allows itself to be sued -- tort cases and some IP laws and even then you almost never get a trial by jury, only a federal judge.
So you'd have to construct this as a tort case and use Federal Tort Claims Act (FTCA) to your advantage. I suspect if you try that, FBI will invent some reason to arrest you or at least harrass you (interfering with an investigation, obstruction of justice, damage of federal property, etc etc...).
Wow, the components on the GPS board look like they are hand soldered, which to me means very low volume/specialized production.
Yeah, that was the first thing I noticed. Some of the solder joints look rather suspect.
Checking under my car with a mirror after work.
I don't want to trivialize how scary it is that the FBI does this, but what I found interesting about this story was the insane capacity of the batteries. Why aren't more consumer electronics(especially iStuff where they aren't user serviceable) using this technology?
Lithium thionyl chloride batteries are not rechargeable. You get 2-3x the capacity of a rechargeable battery, once. Makes sense for this application but not consumer devices.
To be honest, I think it's perfectly fine for the FBI to do this if there's judicial oversight.
The problem is there ain't.
The problem is there ain't.
I wonder where they got the device? In Wired's account, the FBI demanded back from a fellow who found one on his car:
http://www.wired.com/threatlevel/2010/10/fbi-tracking-device...
http://www.wired.com/threatlevel/2010/10/fbi-tracking-device...
The device torn down was one given to them by a woman who kept it after being tracked in 2005: http://www.wired.com/threatlevel/2011/05/gps/
This story gives background on Karen Thomas, the environmental activist who was tracked by the device.
http://www.wired.com/threatlevel/2011/05/gps/
The FBI demanded the device back and she said no. Amazingly, that was the end of the story—until the Afifi story came out, and she decided to give Wired the tracker.
The interesting legal question (in addition to whether you need a warrant to do this sort of thing) is who owns something attached to your car?
The FBI demanded the device back and she said no. Amazingly, that was the end of the story—until the Afifi story came out, and she decided to give Wired the tracker.
The interesting legal question (in addition to whether you need a warrant to do this sort of thing) is who owns something attached to your car?
I'll be very interesting in hearing what the Supreme Court has to say about all this. Consider the following worst-case scenario:
1. Supreme Court rules that use of GPS tracking devices by law enforcement do not violate 4th Amendment.
2. Future court rulings find that tampering with GPS devices amounts to interfering with a police investigation.
3. Law enforcement starts planting GPS devices directly on persons, such as in a purse, or when miniaturized further, in wallets or attached to clothing. Maybe these devices only capture data "when in public areas" and are eventually declared legal.
4. Since they cannot be tampered with, police begin attaching wristbands to citizens stopped at routine traffic stops who they suspect of crimes.
Sounds far-fetched, but not when you consider the amount of surveillance that goes on already via cell phones and credit cards.
1. Supreme Court rules that use of GPS tracking devices by law enforcement do not violate 4th Amendment.
2. Future court rulings find that tampering with GPS devices amounts to interfering with a police investigation.
3. Law enforcement starts planting GPS devices directly on persons, such as in a purse, or when miniaturized further, in wallets or attached to clothing. Maybe these devices only capture data "when in public areas" and are eventually declared legal.
4. Since they cannot be tampered with, police begin attaching wristbands to citizens stopped at routine traffic stops who they suspect of crimes.
Sounds far-fetched, but not when you consider the amount of surveillance that goes on already via cell phones and credit cards.
What do you mean "sounds far-fetched"?
There are people walking around with government installed GPS bracelets right now: http://en.wikipedia.org/wiki/Ankle_monitor
There are people walking around with government installed GPS bracelets right now: http://en.wikipedia.org/wiki/Ankle_monitor
The interesting legal answer is... apparently iFixIt.
The article indicates that court rulings have been mixed as to whether a warrant is required. I suspect the FBI doesn't want to force the issue, in case they lose.
If the tracking were completely legally sanctioned, I can't imagine that the trackee would have any claim to ownership over the device.
If the tracking were completely legally sanctioned, I can't imagine that the trackee would have any claim to ownership over the device.
To force the issue they'd have to prove they had the right to put it there in the first place, right?
Alternatively they expect these to go missing and it's not worth the hassle to get them back.
Alternatively they expect these to go missing and it's not worth the hassle to get them back.
You do, as whoever put it there clearly intentionally abandoned possession of it.
I suppose if they really really wanted it you could send them the parts back.
I suppose its as simple as their demands not being met. "We want it back." "Nope, I already took it apart and posted it to teh intarwebs." "Well then."
[deleted]
I'd love to see how much those devices cost. And the TCO.
I want a kit! Would be good fun to play with.
-Battery pack --The device is powered by four lithium-thionyl chloride (Li-SOCl2) D cell batteries --Each cell is good for 13,000 mAh and are suited for extremely low-draw applications where longevity is needed, making them ideal for powering an always-on transmitter/receiver --Minimal service life is 10 years.
-GPS antenna --A quick peek at the antenna board indicates it was manufactured by SIgem, a company that partnered with Tyco in the early 2000s to make GPS components. --The FBI really did not want anyone tampering with the innards of their tracking devices. The screws were coated with so much threadlocker that we had to break out the power drill and eliminate the screw heads. --The module providing the GPS signal processing on this device is a µ-blox GPS-MS1 that's sort of ancient in the realm of modern electronics. --This module was 1st released June 29, 1999 and it features 0.125 MB of SRAM and 1 MB of flash memory.
-Transmitter/receiver ICs --XEMICS XE1201 Ultra low power single chip transceiver ---The XE1201 allows for data transmission and data reception in half duplex mode. --RFM RF1172 SAW (surface-acoustic-wave) filter ---The RF1172 provides front-end selectivity (the capability to separate signals in one frequency from all other frequencies) in 433.92 MHz receivers.
[Edit: Please note, much of the text above is c/p'd from the ifixit post.]