analyzing the HF network traffic on 5120 KHz (OS BiH)

 

First of all I want to thank IZ6BYY Alain from Martinsicuro (Italy) who allowed me to use his KiwiSDR receiver without time limits: I very appreciated. 
I monitored this Bosnian HF network (I logged them first time on 2016) for more than two weeks: transmissions occur almost exclusively in the morning, not on weekends, and start around at 0730 UTC, likely following a certain schedule. The traffic consists of standards-based email exchange:

– 141A 2G ALE for link establishment
– Up to 2400 bps modem (Serial 110A, 39-tone 110A App.B)
– STANAG 5066 & CFTP client used for reliable over-the-air data delivery
– Standard SMTP email protocols into the wired network

All stations are members of the same ALE network and use the 3-way handshake for link management. In a few cases, a link closure similar to that used in STANAG-4538 is adopted, i.e. the link is terminated by the called station and not by the calling one.
The analysis of the 5066 PDUs after the removal of 110A overhead, figure 1, show the use of HBFTP compressed files (Harris Basic File Transfer Protocol) which, as for 5066 Annex F, is used along with CFTP for transfers from one SMTP server to another. 

Fig. 1 - STANAG-5066 PDUs showing the use of CFTP and HBFTP protocols

After HBFTPn.gz files have been extracted and unzipped, the email headers finally emerge and allow a bit of "intelligence" (figure 2):

Fig. 2 - email headers

 

wmtuser@OMEGA.ok, wmtuser@CIKLON.ok
The email addresses reveal that the messaging system software, and most likely the connected radios, are provided by Harris Corporation: indeed "wmtuser" is the email address default name that is prompted by Harris RF-67x0W Wireless Gateway. The ".ok" e-mail domain name stands for Operativna Komanda or Operational Command,
 

received: from osbihbutmir, received from kstbrvspvo
The server name "osbihbutmir" must be split as OS BiH Butmir where OS BiH (Oružane Snage Bosne i Hercegovine) stands for Armed Forces of Bosnia and Herzegovina, and Butmir is a neighborhood in Ilidža municipality site of the AF Operational Command HQ. Similarly, the name "kstbrvspvo" could be formed by the acronyms KSTBR and VSPVO, where KSTBR may stand for Communications Systems and Technologies Brigade (Komunikacioni Systems i Tehnologije BRigada).
I also noted the server name "jovana" which may have been chosen to honour the memory of Jovana Divjak, a Bosnian army general who died on April 8th, 2021: but that's just a my guess.

X-Mailer
The underlaying PCs run a Microsoft OS, likely Windows 2000 Professional or Windows XP Professional; Outlook 11 is used to draft and send the emails by OMEGA while other nodes seem to use Outlook Express.

X-HSMTP
(likely Harris SMTP, Simple Mail Transfer Protocol) The routing rows show that the recipient node is at 1-hop distance (DP and NP values).

By processing the bitstreams is then possible to derive the the 5066 addresses of the nodes and associate them to the related stations names and 141A ALE addresses  (in brackets):

 

000.000.000.001 OMEGA (OMA)
000.000.000.006 ASTRA (ASA)
000.000.000.007 CIKLON (CIN)
000.000.000.011 GRANIT (GRT)
000.000.000.016 LI(?)A (LIA)
000.000.000.017 LI(?)1 (LI1)
000.000.000.029 ORKAN (ORN)

 

It must be noted that:

1) the 5066 address range 0.0.0.0 — 0.255.255.255 does not have a Regional Assignee, rather the actual block allocation for Bosnia-Herzegovina is 6.6.y.z ( STANAG-5066 Annex N);

2) during the monitoring period I have not heard any other station or ALE address other than those listed. 

 

We also might compare the current station names with the old ones in use in year 2016, assuming that the 5066 addresses of the stations have not changed; notice that at that time the 141A ALE addresses were assigned  by using some popular automotive brands (HFMREZA is the Bosnian translation for HF Nerwork):

000.000.000.001 GAMAHFMREZA (GAMA)
000.000.000.003 FIATHFMREZA (FIAT)
000.000.000.005 FORDHFMREZA (FORD)
000.000.000.007 OPELHFMREZA (OPEL)        
000.000.000.009 SKODAHFMREZA (SKODA)   
000.000.000.011 VOLVOHFMREZA (VOLVO)        

Searching in the UDXF logs, this network appears for the first time in 2014: even in that case the ALE addresses were formed by the union of the first two and the last letter of the station names (TAO = TAngO), the latters consisting of the letters of the Greek alphabet: ALA (=ALFA), BRO (=BRAVO), DEA (=DELTA), GOF (=GOLF), EKO (=ECHO), OMA (=OMEGA), OSR (=OSCAR),TAO (=TANGO), ZUU (=ZULU).

The particular 5066 address (.001), the site (the AF Operational Command HQ), the traffic (OMEGA almost always initiates the ALE sessions) and the software too (Outlook 11 rather than Outlook express), led to think of OMEGA (OMA) as the net-control station as it was for the station GAMA. In addition to the change of station names and addresses, the most relevant change compared to 2016 is the paradigm used for emails: PEM - Privacy Enhanced Mail is now used for secure that traffic (figure 3).

Fig. 3

 

In some cases the contents of the emails are in clear-text, as for example the list of telegrams received/sent by the DK brigade (DK brTP) along with the greetings (*** Greetings from the team DK brTP OS BiH **** ) and the name of the operator of the "Workstation DK 6.pbr"; due to privacy, I have masked his surname:

 

Fig. 4

As said above, in some links the messages are also exchanged using the 39-Tone (110A App.B/FED-1052B) as HF waveform: this evidence proves the use of (at least) two radio networks where all or a subset of the nodes are members of both nets; at this regard, it's to be noted that Harris RF-6750 WG does not allow the use of multiple waveforms/protocols in a same radio-network. Likely, the HF email domain ".OK" coincides with only one radio network.
(yep I know, it's not good and it's definitely not discreet! anyway - to better illustrate my hypothesis - I had recourse to a old copy of the 6750 WG to simulate the software setup that I imagine and which in my opinion comes closest to the configuration which they use)

Fig. 5 - two distinct radio-networks with different waveforms/protocols

Another interesting point is that some bitstreams carried by the 39-tone and 188-110 modems have initial 41-bit length similar patterns (figure 6) that - in my opinion - reveal the use of encryption, therefore in those cases 5066 PDUs are not readable. I tried some analysis of the patterns and maybe they could be "partial" strings of the sequence generated by the polynomial x^42+x^41+x+1. 

Fig. 6 - 41-bit patterns in Serial 110A and 39-tone bitstreams

As far as the encryption device is concerned, my guess is that some links use Datotek encryption which is used in Harris RF-5022 and RF-5800 based radio stations. In that regard, I did some research in the web and found that as early as 2009 they were just using Harris RF-5022 transceivers during their participation as a PfP country in the "NATO Combined Endeavor" 2009 exercise (1). If my guess is correct, the 41-bit sequences could be a kind of "distinctive sign" of the Datotek encryption.

Fig. 7 - Datotek encryption may be used in RF-5022 based radio stations

https://disk.yandex.com/d/B0wHSW1Tfhz2Eg

(1) Bosnia and Herzegovina joined the Partnership for Peace (PfP) programme in 2006.At the beginning of 2021, Bosnia and Herzegovina established the Commission for Cooperation with NATO in order to facilitate the development of their Reform Programme for 2021-2022 and other matters on their path to accession.  
http://mod.gov.ba/Zdruzeni_napor/?id=21449 

 

cars, chameleons, networks... (update 2)

OPL-OPn net (5424.0 KHz)

I have already talked here about this QRG, where the heard ALE addresses were 5B, AB, 1PB, 1PC, 2PB, and 3PB (the so-called PB net), but in these days, at least from 1st December, in that same frequency I heard addresses as OPL, OP1, OP2, OP3, and OP4 (so the name OPL-OPn net). Transmissions start from about 0800 UTC and OPL seems to act as the net-control station. The used technology is the same than PB net, i.e. 188-110A and FED-1052 App.B for the messaging system, and 2G-ALE for the link setup, aside just three 188-110 App.B/FED-1052 App.A frames (see below).

 

Fig. 1

Same QRG and same nodes configuration mean the same source, OS BiH, and the same stations: just a "rotation" of the tactical on-air ALE addresses. I do not know if it's a monthly update or if the update was due to some other reason, further monitorings will help in this direction.

As expected, once removed 188-110A and FED-1052 headers, I got files with ARX and TNEF extensions but this time I had more luck: since the informal nature of the messages (in the reported example, a simple list of sent/received telegrams) these were sent in clear-text. The reading of the extracted files in Figs 2,3 confirms the source and the rotation of the on-air addresses while the e-mail addresses of the network nodes remain unchanged (see Fig.5 of the Part I for what concerns 5PBR), so the old 5B, AB, 1PB, 1PC, 2PB, 3PB,... and the current OPL, OP1, OP2, OP3, OP4,... refer to the same nodes of a single radio-network belonging to OS BiH and running on 5424.0 KHz/USB.

Fig. 2

Fig. 3

Thre is an oddity in one of the recordered transmissions: the presence of three 188-110 App.B/FED-1052 App.A frames just before the link termination (Fig. 4).

Fig. 4

This is the first time, on my side, I see such modality during the e-mail exchanges monitored in this frequnecy: it's hard to say if it just belongs to this transmission or it appeared randomly from some other (unid) source. Anyway, it's worth noting that its time-position in the transmission flow is correct as well as its obsolescence is justified by the use of FED-1052.

https://yadi.sk/d/W19eZn8W32AwPg 

cars, chamaleons, networks, and other stories (I)

For some days I monitored (and I'm still monitoring) some frequencies on 5 MHz band, hearing curious MIL 188-141A  "cars" addresses such as OPELHFMREZA, VOLVOHFMREZA,... (here denoted as HFMREZA-net) as well as FORDBRTP and FORD1BRTP  (BRTP-net), and same other ones in the format 1PB, 2PB,... (PB-net) and ABC7, ABD1,... (AB-net).  This post is about the identification of the first three networks,  a second post will cover the AB network and possible updates. Maybe I will be criticized for the share of this kind of "do-it-yourself COMINT", but its purpose is only hobbystic; sensitive and confidential messages contents, if any, are anyway not published.

car-HFMREZA net (5120.0 KHz)
MIL 188-141A is used for the link setup and, after the 3-way handshake, data are sent using STANAG-5066  and MIL 188-110A as HF waveform (fig.1): a quite common 2G configuration. The prefixes used in the ALE address are some popular automotive brands as FIAT, FORD, OPEL, SKODA, and VOLVO, while GAMA is maybe the less popular "Georgia Automotive Manufacturers Association" or the GAMA Automotive Aenter, but it could be intended as the third letter of the Greek alphabet or  as "collection". As a further option, in my opinion the most interesting, GAMA was a German maker of toys, usually cars and trucks.
Anyway, at least in my logs, GAMA always initiates the ALE sessions which precede the transmissions of data, thus acting as the net-control station.

fig. 1

In some bitstreams, obtained after removing the S-5066 headers, I could find compressed files which are originated by HBFTP protocol. As known, BFTP (Basic File Transfer Protocol) is based on the ZMODEM protocol and is often used in conjunction with CFTP protocol to transfer e-mail messages from one SMTP e-mail server to another, as specified in the Annex F of S-5066 profile. The file HBFTP--3.gz is reported in this example (fig. 2).

fig. 2 - BFTP zipped file

Since BFTP is used for informal interpersonal e-mail only, it may happen that such messages are transmitted in clear-text, thereby facilitating the identification of the network through the contents and the headers added by the SMTP server that forwards the e-mail message.  As expected, and with a bit of luck, the extracted file HBFTP--3.eml offer some useful tips and clues.

fig. 3

The points indicated as 1 and 4 inform about the configuation of the station(s). The e-mail addresses wmtuser@GAMA.ok and wmtuser@VOLVO.ok reveal that the messaging system, and most likely the connected radio, are provided by Harris: wmtuser, or  WMT user, is just the default username used in Harris RF-6750W Wireless Gateway (WG) and RF-6710W Wireless Messaging Terminal (WMT). The underlaying PC run a Microsoft OS, likely Windows 2000 Professional or Windows XP Professional; Office Outlook is  the e-mail client running at GAMA, but also Outlook Express is used (eg at station VOLVO).

From the timestamp, point 3, we can get informations about the geographic area since it exposes the time-zone of the system: in this case +0200, ie GMT +2. The time-zone helps European people like me to parse the hostname osbihbutmir, visible in point 2, and the suffix HFMREZA. Indeed, the latter can be split in HF MREZA where MREŽA is a Slavic word for "network" (google-translator is your friend): the geographic area matches the time zone. About the hostname, since BiH is a well-known ISO Country Code for that area, osbihbutmir could be split in "os bih butmir". Well, now let google do the work for you: simply enter that string, hit enter, browse some results pages and you will get the HF network we're talking about.

The official site has the English version so that you can browse its pages and find many interesting informations such as HQ locations, structure, sectors, multimedia and so on.  Specifically, "Butmir" (indicated in the hostname of the station GAMA) is the AF Operational Command HQ and we have seen above that  GAMA just act as the net-control node. About the other stations (VOLVO, FIAT, OPEL,...) they belong to the "ok" e-mail domain which almost 100% stands for  Operativna Komanda, hence the HFMREZA-net could be the main radio-network. Difficult to say their locations and their role in the "structure" diagram shown in the web site.
About the HF equipment, still from the web site we learn that Harris RF-5800 was aleady owned in September 2009, just seven years ago, during their partecipation at "NATO Combined Endeavor"  as PfP country.

I do not go beyond, anyone on their own can obtain from the web all the (public!) informations he wants; moreover the e-mails contents, although interesting, are out of the scope of this blog.

PB net (5424.0 KHz)
Same origin and owner emerge also by the analysis of this newtork, even if the configuration of the nodes is a bit different: same ALE technology (118-141A) and HF waveform (188-110A) but messaging is achieved using FED-1052 rather than S-5066 (fig. 4). It's hard to say if the choice of 1052 is due to specific requirements or if the network shall be upgraded. The addresses logged during the monitoring are 5B, AB, 1PB, 1PC, 2PB, and 3PB: 5B seems to play the net-control role.

fig. 4

Once removed FED-1052 DLP protocol headers, I got files with ARX and TNEF extensions. 
Files whith the .ARX extension are known as ARX Compressed Archive files, however other file types may also use this extension. Regardless of the extensions, a "path" inside the sender host is exposed in one of the received ARX files:

TNEF (Transport Neutral Encapsulation Format) is a proprietary e-mail attachment format used by Microsoft Outlook and Microsoft Exchange Server. TNEF attachments can contain security-sensitive information such as user login name and file paths from which access controls could possibly be inferred. This format is probably used since TNEF files may contain information used by only Outlook to generate a richly formatted view of the message, such as embedded (OLE) documents or Outlook-specific features such as forms, voting buttons, and meeting requests. Note also that native-mode Microsoft Exchange 2000 organizations will, in some circumstances, send entire messages as TNEF encoded raw binary independent of what is advertised by the receiving SMTP server. An interesting and complete description of TNEF can be read here.

One of the TNEF files obtained from the monitoring is shown in fig. 5.

fig. 5

Point 3 confirms the use of Harris equipment (although a confirm is not needed since the use of FED-1052), but the most relevant are the points 1 and 2 which show the stations in the play: specifically (from the cited web site) 3PB stands for 3 Pješadijski Bataljon (3rd Infantry Battalion) with headquarter in Bijeljina, and 5B stands for 5 Pješadijska Brigada (5th Infantry Brigade). By the way, all the addresses heard from this nework can be easily "humanized" through the official web site (thanks to Patrick for his hint).

About the contents, TNEF4 file consists of Outlook MAPI strings which their meaning can be retrieved from the web. I just want to point that, since:
PR_ORIGINAL_SENDER_EMAIL_ADDRESS contains the e-mail address of the sender of the first version of the message, that is, the message before it is forwarded or replied to;
PR_DISPLAY_NAME contains the message sender's display name;
most likely this message is a reply sent by 3PB to a previous message received from 5B.


BRTP net (5025.0 KHz)
For what concern FORDBRTP and FORD1BRTP addresses, belonging to the third monitored network, they probably form a two-points circuit rather than a network: so far I never logged other xxxxBRTP addresses, at least on that frequencies. 
These stations use the same configuration  of the first net (ie S-5066 + MIL 188-110A) as well as the "automotive brand" suffix in their ALE addresses. The traffic in this "circuit" seems to be less frequent and unfortunately I could not yet hear good quality transmissions. My friend Kristian successfully suggested Brigada Taktičke Podrške (Tactical Support Brigade) for BRTP.

Sumarizing 
From what seen above:

1. the three networks are operated by the same Authority;
2. HFMREZA-net and BRTP-net use STANAG-5066 and 188-110A;
3. network PB-net use FED-1052 and 188-110A;
4. all the three networks use 188-141A 2G-ALE technology, Harris equipment and Microsoft Windows systems;
5. stations, and hence the netwoks, belong to different e-mail domains.

About the different messaging systems, it's worth noting that the Harris RG-6750 Wireless Messaging Gateway software (WMG) provides mixed networks compatibility between stations with STANAG-5066 and stations with FED-1052 by running simultaneous 5066-1052 sessions.

Processing the STANAG-5066 headers, thus except the 1052 PB-net, it is possible to derive the on-air 5066 addresses of the (heard) nodes:

GAMAHFMREZA   000.000.000.001
FIATHFMREZA   000.000.000.003
FORDHFMREZA   ? (prob. 000.000.000.005) *
OPELHFMREZA   000.000.000.007           
SKODAHFMREZA  000.000.000.009      
VOLVOHFMREZA  000.000.000.011           
FORD1BRTP     000.000.000.012
FORDBRTP      000.000.000.013
*  note that when alphabetically sorted they use odd numbers in the 4th byte of the 5066 address.

Now, since:

• 5066 adresses are contiguous passing from HFMREZA-net (ending with 011) to BRTP-net (beginning with 012);   
• so far I never heard "cross" links among the three networks (eg: xHFMREZA <--> xPB) hence the ALE networks are not overlapping;
• so far I never heard traffic between two "peripheral" nodes (eg: VOLVO <--> FIAT);

they could use a "star" network topology, or rather a "tree" network topology, where traffic between two peripheral nodes, or between two net-control nodes, is routed ouside the HF network. Indeed, looking at the routing rows in the e-mail headers (fig. 6), the stations have a "radio1" asset and it could indicate the existence of a second radio (say radio2) - at the same site - that belongs to a different station which, in turn, belongs to a different network and e-mail domain... but this is another speculation.

(to be continued)