Hacker News Reader

Hacker News

Comment by kwiens | Hacker News Reader

Full thread

kwiens

I did the teardown, and I'm a regular hacker news reader. I'll answer any questions for the next hour or so.

View on HN

So this tracker does NOT use cell connections? A receiver would have to get whitin range to download tracking data?

Correct. There's specs on the short-range transmitter here: http://xemics.com/docs/xe1200/xe1201evk_userguide.pdf

Now this is an old device, and they very well might be using cell phone transmitters now.

You mentioned it works in the 400MHz band.

Do you know the range, roughly?

When do you expect to find one of these stuck to the bottom of your car? ;)

In all seriousness, do you believe it would be possible for the FBI to make a similar device to use on bicycles (inside handle bars), motorcycles, scooters, or Segways?

I'd be surprised if they _didn't_ make one for honeypot bicycles.

You think the FBI is trying to catch bike thieves?

No, leftists. (sorry :-)

Does it use military mode (the one that is even more precise than regular GPS)? Now that would be great reverse engineering project :)

Where was the GPS receiver mounted? These things need view of the sky, no?

I don't know the answer to either of these questions. It appeared to be a standard GPS receiver, but some investigation would reveal whether the manufacturer supports military mode. http://docs.google.com/viewer?a=v&q=cache:7hhk_GsNmTQJ:w...

I never saw it on the car, but the antenna mount had a hinge that would allow it to stick out from the side of the car. But that would be rather conspicuous—I think that's why the antenna is so large.

Is there a legal way to block them? Either the GPS signal, or the transmitter? (I'm assuming tampering with the device directly is illegal).

Sure, just transmit stronger white noise on 433.92 MHz. I haven't looked up who owns that frequency and whether there are restrictions.

Or get a GPS blocker. Which I think are illegal to operate.

AFAIK 433MHz can be used for any short-range application, similar to 27/49MHz for R/C cars. There are plenty off-the-shelf 433MHz transceivers for hobbyists, and I think car remote-unlockers use that band as well. And this doesn't appear to have a particularly powerful transmitter, so you'd have to bring the transmitter relatively close to the receiver (like <100ft, usually) in order to download...whatever.

If they're able to put this thing on your car in the first place, I guess it's not infeasible for them to drive by to download updates.

Sparkfun sells 434 MHz transmitters for $3.95 [1]; just hook it up to a coin cell or four, and you should be good to go.

[1] http://www.sparkfun.com/products/8946

I wonder what would happen if you took it off and attached it to a random other car. Then the FBI would be tracking someone else illegally, in theory.

I would bet intent is part of the law.

Why would tampering with such a device be illegal? Or blocking their signal? It's your car and until proven otherwise, you have no reason to bear with other people or the government installing such surveillance equipment.

If you're a convict then you might be released earlier but with some electronic surveillance, but even that is with your own consent.

Very cool. Have you all done any firmware/software hacking?

Could you estimate the price of this thing, as the FBI told him it was expensive (and at least the batteries seem to be).

Off the cuff BOM for this thing is on the order of $30 in 1K quantities (maybe add 20% for government bureaucracy).

For the manufacturer, maybe. But then you have to factor in bribes to the federal procurement officers and junkets to Atlantic City to land the contract, and then medical payments for the workers who burned themselves hand-soldering resistors on that board. That's gotta up the price to at least $3K/unit or so! :-)

Can't really. Cost of BOM bears no relationship to selling price. His post below says it costs about $30 in 1k quantities. So estimating about $50 in 10pc prices, if I were building a few for a government agency/large corporation, ignoring NRE charges I'd probably price them upwards of $1000 each. This is not exactly something you can purchase at Best Buy...

We have not—I had limited time with the device at Wired's office. We powered it on and used a frequency analyzer on it, but that was the extent of our investigation. We were concerned that black helicopters might show up if we left it on too long. But I hope someone else does!

Don't you guys have a Faraday cage for this sort of teardown?

What, you mean for all the other devices we take apart that regularly phone home to their manufacturer, who would show up at a moment's notice in a black helicopter to put an immediate halt to our technical analysis?

Of course! We have to block RF transmissions all the time!

Didn't Apple have that one reporter guy who was sent the 'lost prototype iphone' SWAT'd?

Yes, the police raided the house of a journalist and seized his computers. http://news.cnet.com/8301-13579_3-20003446-37.html

That was a rhetorical question I'm sure.

What protocol is it using to transmit the location? Is it encrypted or authenticated? (Could it be spoofed?)

Do you know the maximum range the transceiver can transmit? The datasheet gives lots of design guidance, but nothing specific.

Data sheet: http://www.datasheetarchive.com/pdf-datasheets/Datasheets-40...

App note: http://www.datasheetarchive.com/pdf-datasheets/Datasheets-31...

I don't know, but perhaps an RF engineer could weigh in given the frequency and transmission power.

Reply on news.ycombinator.com