Decoding Autocab in-car messages with SDR
I've been playing with Software Defined Radio for a little while, and was always curious how the Autocab radio's work that send jobs back and forth to the various drivers. I put the two together and can now watch real time job information from various taxi companies that operate in my area.
Using a simple RTL based HDTV tuner and a couple of bits of software its possible to tune to a wide range of frequencies. The taxi signals are usually in the 160-180Mhz band.
SDRSharp (http://sdrsharp.com/)
Taxi MDT Decoder (http://sourceforge.net/projects/taxidecoder/)
Set up the Virtual Audio Driver. This is a bit like an internal audio patch panel for your computer, you’ll be pushing audio data into the pipe from SDRSharp and reading from it using MDT Decoder. It behaves like a microphone and speaker device would, just internally.
It will register some new audio devices. Select the Cable Input as your output audio device in SDRSharp and Cable Output in Taxi MDT Decoder.
Here is SDRSharp tuned into a local frequency:
Start SDRSharp going, and you should start to see data filter into the MDT Decoder as and when events start happening.
A screenshot of some of the Taxi MDT Decoder in action:
Some of the logs are reasonably interesting. Apparently you should never pick up and drop off outside the Arndale Centre on double yellows, as tickets get given:
[L]19:05:32 (BAD CRC !) Autocab variant (0x4c7d) : System 255 : Ident 65535 : Message Type 1 : Length 74 : [L]DONT DROP OFF OR
PICK UP ON DOUBLE
YELLOWS AT ARNDALE
FINES BEEN GIVEN
And if you get picked up from a police station, expect to pay up front:
[L]18:54:39 (BAD CRC !) Autocab variant (0x4c7d) : System 255 : Ident 175 : Message Type 1 : Length 178 : [L]18:54+ C [L]DN: 0 [L]CN: marik [L]Fr: KILLINGBECK POLICE STATION, Foundry Lane, LS14 6NN [L]NB: cash up front agreed [L]To: FOUNDRY PLACE, Leeds, LS9 6DA [L]ER: [L]TEL: (RING) [L]
0
>
$
For more logs, see taxidata
Lots of unsecured data in the wireless world. It wouldn’t be too hard to turn this around and start sending spoofed messages. Can’t be bothered calling your local taxi company? Book yourself a job…
Want to remind taxi drivers to drive sensibly, after being cut up, using only the choicest words available in English… send a broadcast notification.
The above would easily be possible using something like a HackRF or USRP (which does transmit as well as receive) and Gnuradio.