Building a remotely-accessible car GPS tracker/logger with a Raspberry Pi

Some high-end cars come with GPS trackers that report their position in case of theft (until the thieves put your car inside a refrigerated truck or metal shipping container on its way to its new “owner” abroad). These usually come with a monthly subscription of around £/$/€25, which seems like rather a lot when a mobile phone contract is often much less. What about making your own version that will last a lifetime, for less than the cost of four months’ subscription on a commercial version? In fact, it can do a lot more than that too!

This article contains some technical stuff about Linux, Raspberry Pis, navigation satellites, the cyber kill chain, Chinese espionage devices, NMEA sentences, Bash scripting, Google Maps APIs, funky car wiring, broken Land Rovers, DC-DC converters, cooking car criminals with CANBUS, and Perl. Don’t worry, there’s not too much Perl.

I live in London, so crime is… not exactly unknown. I’m also an engineer, so I have a propensity to put my own Linux-based computers in just about everything with a power supply. Thanks to Moore’s Law and Eben Upton, we’re now able to buy some seriously powerful computers for pocket money. Like the one represented by this abstract fruity logo:

Raspberry Pi is a trademark of the Raspberry Pi Foundation.

Lots of people have put Linux-based computers in their cars before, and plenty of the cheap double-DIN head units you can find on eBay run Android, which is essentially Linux. I’m happy with the head unit my car comes with, I just want a hidden headless computer in the car that I can do lots of other stuff with. A bit like my rooftop music player that has subsequently become a dual-head DVB-T2 TV server and multi-band SDR receiver as well (more about that in future posts). It runs my rooftop fairy lights at Christmas, too.

Today’s requirement: a Linux-based headless “carputer” for GPS tracking

We want this thing to keep an internal log of its position, and also send its position to a remote server periodically so we can see its last reported position when it is offline.

Components

You need a computer. I chose a Raspberry Pi 3B+ because it was the first one I found in my drawer. You could probably use a smaller and cheaper Pi like the Pi Zero, or a competitor like the Beaglebone, but make sure its USB ports can supply enough juice to run the 3G dongle because those things are thirsty. You could use a rack-mount quad-core Xeon if you really want to, but that would be silly. And your car battery won’t thank you.

GPS (or, strictly speaking, “GNSS”) dongle

There are loads of cheap dongles on eBay and Amazon, but I like those based on the u-blox MAX-7 chipset because they’re cheap and work well. They support both the American GPS and the Russian GLONASS systems so they can get a quicker and better fix by using more satellites. Some modern chipsets also support the Chinese BeiDou and the European Galileo system, when it’s working.

Whichever dongle you choose, it’ll need as good a view of the sky as you can give it. If you car has built-in Satnav then its GNSS antenna is probably hidden underneath a plastic panel on the roof, which is a good place to put it. It’s not so easy for us without ripping the car apart and poking holes in it. It’ll be fine under some plastic trim next to a window. A 1-2 metre USB extension cable won’t be too lossy.

3G dongle

OK, pedants: yes, 4G will work great and 5G is designed for exactly this kind of thing (although they call it the “Internet of Things, because they have a marketing budget). 3G dongles are cheap and plentiful and you want to keep the cost down so you aren’t going to be streaming HD films on this thing anyway. You want a connection that’s fast enough for a simple shell connection and flinging some lines of text between your car and a server. Cheap is good.

I’ve tried a few of these and – long story short – buy a Huawei E3231. They’re around £15-20 second-hand on eBay and they just work. I spent hours trying to get an older dongle to connect to the 3G network, playing with different kernel modules, server and client programs and APN settings to no avail. Perseverance is a fine quality in an engineer, but life is finite and I’ve got lots of other things to get done. Spend £16 and save yourself some grey hairs.

The E3231 is virtually plug-and-play. Raspbian automagically sets up a VLAN and a gateway so it’ll connect to the Interwebs just like that. It defaults to the 192.168.1.0/24 subnet, so make sure that doesn’t conflict with any other networks you have set up on your Pi. What else might you have connected? I’ve connected the Raspberry Pi’s built-in WiFi to the untrusted segment of my home network with a high-gain (+15dB) WiFi antenna on my roof pointing at my car in the street. This saves my monthly 3G allowance when I’m running updates and downloading GPS logs at home.

Of course, it is made by Huawei so we’d better encrypt anything we put over it, hmm?

Courtesy: telegraph.co.uk
I’m linking to this image for legal reasons, so you might see a cartoon here that’s completely out of context!

This dongle also needs to be positioned somewhere with a good view of the nearest cell tower: use a short (for minimum loss) USB extension cable and, like the GNSS dongle, tuck it under the plastic trim near a window.

SIM

Prepay (PAYG) deals change all the time, but I got a PAYG SIM from 3 (a UK cell provider, not a typo) that cost £10 and tops itself up with 200MB every month for free. I’m their worst customer: my Pi never needs more than 200MB a month so I never need to pay a penny more. £10 for a lifetime of Internet connectivity – perfect!

Software

Get Raspbian up and running on your Pi, then add some flavour…

GPS logging – NMEA 0183 and GPX

NMEA is the American standards body for electronics fitted to ships. NMEA 0183 is the standard (dated, replaced by NMEA 2000) used for sending information (GPS, AIS, wind speed, compass direction, etc) between a vessel’s systems. Since ships have made use of GPS for far longer than cars and mobile phones (and because they could justify the cost when it was still really expensive), NMEA 0183 messages have become the defacto output standard for GPS devices. If you cat the GPS device, you’ll probably see raw NMEA 0183. Here’s one such a message logged on my Pi:

$GPGSA,A,3,30,02,09,23,06,07,29,16,,,,,1.95,0.99,1.68*04

$GP means it’s from the GPS system. GSA means the message contains a list of the satellites that are being used to determine a position fix. A means automatic and 3 means it’s a 3D fix. It’s using 8 satellites (30, 02, 09, 23, 06, 07, 29 and 16) to provide the fix. The extra commas are for more satellites (up to a total of 12) that it could use in the fix if they had a good enough signal. The last 3 figures before the * are the fix accuracy, expressed as DOP (dilution of precision) in metres for overall position (PDOP), horizontal (HDOP), and vertical (VDOP). The 04 on the end is a checksum.

MicroSD cards are cheap, so I don’t mind logging raw NMEA data on the Pi’s card. We’ll use gpsd to save all the NMEA sentences in a daily logfile on the Pi. The guys at Instructables have provided comprehensive instructions for this bit here.

As the Instructables folks have also pointed out, we’ll need to convert it to a useful format (like GPX) to do anything useful with it. GPSBabel is a great tool that does exactly that.

gpsbabel -i nmea -f [input_filename.nmea] -o gpx -F [output_filename.gpx]

There are lots of things that can display GPX files, including Google Earth with a simple drag-and-drop. Here’s one I prepared earlier. This is a GPX file that I created from the NMEA dump of a distillery tour I did on Islay. Bowmore, Laphroig, Lagavullin and Ardbeg. I won the coin toss and my amazing wife did the driving 😀

Distillery crawl on Google Earth. So proud.

Sending our position to the server

There are plenty of websites that offer to do all this work for you if you send them your GPS position, but do you really trust them to follow your every move? Even if they’re not spamming your personal data all over the Internet, they’ve probably failed to secure their S3 buckets properly and are just waiting for Little Bobby Tables to come and play with their SQL API. As usual, if you want something done properly…

I’ve got a number of web servers doing various things. For the sake of argument, I’ll assume you also have a spare one for this purpose. It needs to be Internet-accessible (have a public IP address), run a web server that can handle CGI (like Apache) and an SSH server.

We’ll use gpspipe to get our GPS data in a useful format. There are lots of different NMEA message types from our GPS device and we’re only interested in those that contain a position. We’ll get 10 lines of output from our GPS dongle (-n 10) and ask it to output in JSON format (-w) instead of raw NMEA. We’ll grep that output for positions (using the JSON tag “lat”) and send the first of those lines to a file:

gpspipe -w -n 10 | grep lat | head -n 1 > currentposition.json

Using the password-less SSH certificate we’ve set up earlier, we’ll send that to our server:

rsync [path]/currentposition.json [user]@[your_server]:[path_to_log]/.

On our server, we’ll create a Bash script to append this position to our log of positions. It includes a check to see if it’s the same position as last time (because no new positions have been reported), in which case it won’t append it:

#!/bin/bash

currentposition=`cat [path]/currentposition.json`
lastposition=`tail -n 1 [path]/gpshistory.json`

if [ "$currentposition" = "$lastposition" ]; then
        # Last position is unchanged.  Do nothing.
        :
else
        # Last position has changed.  Update GPS history log.
        cat [path]/currentposition.json >> [path]/gpshistory.json
fi

This is the log of positions on our server that we can use even when the Pi is powered off. We’ll use it for the last position report webpage. Put that script in a crontab and run it every minute.

Viewing the last position on a webpage

Let’s create a webpage to view the last-reported position of the car. I’ve written a simple CGI script in Perl (below) because I’m a cranky old UNIX guy (no beard, though). Python will do the job perfectly well for you young kids. Knock together something in PHP or HTML5 if you’re feeling especially 1337.

#!/usr/bin/env perl
use CGI qw(:standard);
use JSON;
use File::ReadBackwards;

# Open GPS log
my $file = File::ReadBackwards->new( 'YOUR_GPS_LOGFILE.json' ) or die "Can't open file $!";                                                                                                                

# Read last line of GPS log and decode JSON
my $log_line = $file->readline;
my $json_line = decode_json $log_line;

# Extract values from JSON
my $time  = $json_line->{"time"};
my $lat   = $json_line->{"lat"};
my $lon   = $json_line->{"lon"};
my $speed = $json_line->{"speed"};

# Make Google Maps URL
my $url = 'https://www.google.com/maps/embed/v1/place?key=YOUR_GOOGLE_MAPS_KEY'.$lat.','.$lon.'&zoom=18';                                                                                                               

print "Content-type:text/html\n\n";
print <<EndXML
<html>
<body>
<title>Car Tracker</title>

<h1>Car Tracker</h1>

Postion reported at: $time </br>

<iframe
  width="600"
  height="450"
  frameborder="0" style="border:0"
  src=$url allowfullscreen>
</iframe>

</body>
</html>
EndXML

You’ll need to provide the script with access to your GPS logfile, perhaps using a bind mount to set the permissions of a copy the script can see without compromising the security of your original file. You also need to get a Google Maps API key if you want to use Google Maps to show your position. I’d suggest controlling access to this page with an .htaccess file (or equivalent) in your CGI directory or an Apache conf file to prevent random strangers from finding out where you’ve parked your car, too. Security through obscurity is no security at all!

The first thing the script does is opens the GPS logfile. We then read the last line of that enormous file using the File::ReadBackwards library. That gives us a line of JSON containing the complete position report. We parse it to extract the fields we want: time, latitude, longitude and speed.

The next bit uses the power of the Google Maps API to generate a URL that does all the clever work of presenting that position as a pin on a map.

Lastly, we stick all this together in an XHTML file as the CGI script’s output. This is what the end result looks like (not my real address, honest):

My car logger in action. With sample data. Or is it…?

Reverse Proxy

You’ve got a remote headless server, so obviously you want to be able to SSH into it to control it. Problem: its IP address is at the whim of your cell network provider. You could use DynDNS, but its probably hidden behind a NAT as well so that won’t help you. So you can’t SSH to your Pi from across the Internet. Oh noes!

Fortunately, hackers solved this problem years ago. Imagine you’re hacking a company (for the sake of argument let’s say you’re legally pentesting it, before you get prudish in the comments box). You’ve thrown a USB stick over the fence into the company car park where loyal employee Joe Bloggs finds it and, being a helpful chap, wants to return it to its rightful owner. Joe sticks it into his computer to see what’s on it and it and, unbeknown to him, it installs the hacker’s malware in the background. Our white-hat heroine is working her way down the Cyber Kill Chain and has now passed Delivery (the USB stick), Exploitation (of an unpatched flaw on Joe’s computer), and reached Installation (of a persistent implant on Joe’s computer).

Mr Bloggs’ company has a commercial firewall at its network boundary, protecting it from nasty stuff on the Internet. So how does Ms Hacker get to the next step in the Kill Chain: Command and Control? How does she reach in from the Internet to control her payload?

She doesn’t – the implant reaches out to her instead. Most firewalls are designed to block external threats and don’t do much about internal ones reaching out to the Internet.

Obligatory Matrix screensaver hacking picture.
I’ve got an Anonymous hoodie one for my next post.
Hack da planet!

A Reverse Proxy is a simple technique that exploits this. Instead of our SSH client connecting to the SSH server on the Pi, the Pi connects to our server and presents its own SSH server as a port on our server that we can connect to with our client as if we were connecting to the Pi’s SSH server. Eh? Here’s an SSH command for the Pi that sets up a reverse SSH tunnel.

ssh -N -R [server_port]:localhost:22 [server_user]@[server_address]

You’ll need to set up a user on your server beforehand, and set up a certificate in your authorized_hosts file so it doesn’t need a password. You might use the same user and certificate that you used to upload your GPS data to the server. Make sure this user has very limited permissions. I’d recommend setting the user’s shell to /dev/null in your /etc/passwd file too.

Put that, or something equivalent, in to an executable script and put that script in a cronjob so it runs every time the Pi boots. Here’s the complete user crontab on my Pi, including the scripts for logging the position in the last section:

# m h  dom mon dow   command
*/1 *  *   *   *     ~/create_ssh_tunnel.sh > tunnel.log 2>&1
*/1 *  *   *   *     ~/gpscurrentposition.sh > gpslog.log 2>&1
*/5 *  *   *   *     ~/sendcurrentposition.sh > gpslog.log 2>&1

You’ll then be able to SSH to your Pi by SSHing to your chosen port on your server. You can reconfigure it, update it (be careful of your monthly data allowance!) and pull files off of it using SCP. Perfect.

Installing it in your car

Usual health-warnings apply: only do this if you know what you’re doing, get supervised by an adult (or an unusually precocious child), car insurance blah blah, don’t sue me, objects in the mirror aren’t vampires, your investment may go down as well as bang…

I used to own a Land Rover, so I learnt a great deal about fixing broken cars. If you’ve got an old one with electrics by Lucas the Prince of Darkness then you’ll know exactly what I mean.

“A Land Rover will go anywhere. And break down when it gets there”.

Me, just now.

There are plenty of options for powering this thing, but the simplest option is to take a tap off a 12V supply somewhere convenient. Obviously, your Pi runs off 5V not 12V so you’ll need a step-down converter (aka “buck”) and there are lots of them available on Amazon and eBay. DROK is a reliable brand. Get one that can supply at least 3A at 5V so it isn’t struggling or getting hot. Get one with a MicroUSB connector on the end to make life easier.

In an older car there are plenty of wires connected to “+12V ACC” which are powered when you turn the key and unpowered when you’ve turned the ignition off – ideal for a GPS tracker. Unfortunately, I have a newer car with electrics that are too clever for their own good. I couldn’t find a convenient ACC cable so I had to connect it to BATT, i.e. permanent +12V. This is good for continuing to use the Pi after I’ve parked, but bad because it keeps draining the battery. I needed one of these:

This is a “low voltage disconnect module”, or battery-saver. It turns on at a pre-set voltage and off at another pre-set voltage with a handy green/red LED to tell you its state. I’ve set the DIP switches to turn mine on at +12.8V (when the alternator is running) and off at +12.1V so, if the battery is in good condition, it’ll stay on for a little while when I’ve parked but turn off before it kills the battery (I tried it set to 11.4V and I don’t want to have to jump start my car again).

Needless to say, every new circuit in the car should be fused in case something goes awry with the wiring. I installed my Pi near a fuse box in the back of my car, so the easiest way to tap into +12V with an inline fuse on my new circuit is one of these:

You put the original fuse in the bottom holder and an appropriate fuse for the Pi in the top holder. The Pi draws a maximum of 2A from a 5V supply, which is 10W, which is less than 1A at 12V. Add in a fudge factor for conversion losses in the step-down converter and I chose a 1.5A fuse. Obviously make sure the circuit you’re tapping into has enough capacity for another Amp, which shouldn’t be a problem 99.9% of the time. Assuming your car is chassis-earthed, connect the ground to a convenient bolt welded to something solid nearby. The end result looks something like this:

Et voilà! A headless carputer running Linux, turning itself on and connecting to your server every time it boots, logging its position and regularly sending updates to your server, turning itself off before it flattens your battery and with lots of spare capacity for future projects.

What else can I do with this thing now I’ve installed it?

Oh, plenty! Recording a mere few GPS positions leaves lots of CPU cycles free for doing more-exciting things. Here are some things I’ll think about when I have more time:

Add a camera

There’s a header on the Raspberry Pi for its own-brand camera, but really any old USB webcam will do. You could put it inside the car to take a selfie of the criminal who’s just stolen your car, and then send that, the GPS log and the car’s current position to the local rozzers to go and snatch the felon red-handed.

Alternatively, if you sit on the other side of the legal fence (and if you do you should be ashamed of yourself!), you could put the camera on the back of the car and run a some open-source ANPR software to alert you when the car behind you is an undercover police car following you home from your recent bank job. But don’t do that. It’s naughty.

Maybe you’d just like to record a picture of the scenery every ten minutes to document your road-trip. Car selfie!

Connect it to the Infotainment system

You could play music from your MP3 collection or Spotify account, if the mood takes you. Or you could play a message through the car speakers to the aforementioned criminal, politely asking him/her to refrain from purloining your pride and joy.

Depending on how your car is set up, this could be as simple as connecting an audio jack into your amplifier or as complex as tapping into the car’s fibre-optic AV CANBUS network. Which brings me on to…

Add a CANBUS module

Pretty much all modern cars have done away with thick wiring looms for discrete systems and instead use a bus to send messages between the various components. These things are usually hideously insecure, which is a good thing if you want to play with them.

You could log the engine performance of your racing car and link it to its position on the track you’re recording with the GPS logger.

You could make the car do strange things when it’s been stolen. I’d suggest this would include turning off the engine but, if you want to make the crim sweat a bit first (literally), then you could turn the heating and seat heater to max and lock the doors. Hours of fun.

CANBUS hacking is a huge topic in itself (which I may cover at a later date), but the good news is that Wireshark now supports CANBUS so it’s much easier to have a look at which messages are travelling over which bit of which bus and take it from there. You can get a USB CANBUS adaptor from eBay, or a cheap USB/Bluetooth OBD-II device that plugs into the diagnostic port you’ll find somewhere near the steering wheel of all modern cars.

My car comes with a small diesel-powered heater under the bonnet for pre-heating the cabin on a cold morning. You can set this on a timer the night before, but I never remember. I’d love to turn it on from my phone before I walk down to the car on a cold morning. A future project for the Raspberry Pi!

Be First to Comment

Leave a Reply

Your email address will not be published. Required fields are marked *