Researchers from the University of Shandong have recently demonstrated in a paper that they can transmit data from an air-gapped PC by using a Trojan to implement imperceptible pixel modulation in a monitor.
Every electronic device unintentionally emits RF, and PC monitors, TVs, and screens are no exception. In the past, we have shown that with simple TEMPEST tools, it is easy to recover the image on a screen over a distance using an RTL-SDR or Airspy SDR.
TrojPix relies on the unintentional emitted RF from a PC monitor's video cable. By subtly modulating the pixels on a screen, it is possible to enable data transfer via the unintentional emissions. This means that any PC infected with the TrojPix Trojan could transfer data wirelessly to a snooper, even if the PC is totally disconnected from any wired or wireless network. The only way to stop such an attack would be to completely shield the PC with a faraday cage.
The team note that they were able to achieve a peak data throughput of 8.1 MBps over a max range of 208 meters. They tested nine commercially available monitors and fifteen digital video cables, each demonstrating significant usable RF leakage.
The receiver hardware used was a USRP X310 software-defined radio sampling at 10 MHz and the transmissions appear to have been at 148.5 MHz and 297 MHz.
TrojPix Experiment: Receiving Data over 210 neters,.
Dragon Labs have recently announced that the CR-8 model is getting ready for crowdfunding on CrowdSupply. The CR-8 is an 8-channel coherent software-defined radio with a 12-bit ADC, a tuning range of 25 MHz to 1750 MHz, and 8 MHz of bandwidth per channel. A coherent SDR unlocks various applications such as radio direction finding, beamforming, and antenna diversity.
The CR-8 was originally designed for a Master's thesis by Alexandre Rouma, who is also the creator of the popular SDR++ software, which is commonly used by RTL-SDR enthusiasts.
The core of the build appears to consist of R860 tuners for each channel and an MCP3721-200 analog-to-digital converter (ADC). The MCP3721-200 is a chip commonly used for radar, imaging, and cellular base station applications, as it naturally provides aligned samples with built-in fractional delay recovery, making it ideal for coherent applications. A seperate signal source on the PCB provides the needed signal for the phase calibration of the tuners.
SDR++ and SatDump will natively support the CR-8, and there is also a GNU Radio source block. While the C API is open source, they note that the firmware will be closed source.
Pricing has yet to be announced, but we found a recent comment from the team indicating a target price of US$500 - $600 for the bare PCB, with a CNC-milled enclosure available as an optional add-on.
Over on Reddit and YouTube, user Hubquhq has shown how he created a live incident map using an RTL-SDR, Whisper and an LLM. The idea behind the system is to monitor multiple public safety voice communication channels with an RTL-SDR, transcribe everything into text using Whisper, and then use an LLM to categorize events and extract details such as addresses. Categorized incidents are then plotted on a map, allowing the user to visualize patterns.
For example, in his YouTube video, he shows how he mapped cardiac, animal, drug overdose, vehicle collision, rescue, and hazmat events over time, building a powerful database of what is happening in his city.
The program and code does not seem to be available for download anywhere, but Hubquhq does provide a contact link for anyone interested.
Systems that can monitor every RF voice and data channel on the spectrum and summarize them via an LLM are something we expect to see more of in the future as AI and LLMs improve.
Over on her YouTube channel SignalsEverywhere, Sarah has uploaded an interesting video showing her doing a wardrive for DECT devices, with an Android device connected to a HackRF, running her own Android version of DECT toolkit. In the past, we also covered her DeDECTive software, which is a fully DECT scanner and voice decoder for Linux and the HackRF.
DECT is a digital wireless protocol operating at around 1.9 GHz, which is typically used by modern cordless home phones, baby monitors, headsets, intercoms, and more. If you are unfamiliar with the term wardriving, this is when someone drives around in a vehicle and looks for interesting signals around the area. Wardriving is typically associated with mapping out the local WiFi environment and looking for security flaws, but it can apply to any signal.
During her wardrive, Sarah finds mostly VTech cordless phones, but a few other models like 'Binatone' and 'RTX' pop up, which she suspects are headsets, one possibly from a local McDonald's. She notes that only one active call was found, although the video has voice decoding stripped out for privacy reasons. She also notes that no encryption was found to be enabled on any device, despite DECT supporting it. The Android App also records the GPS position of any found DECT devices on a map.
Over on X @lambdaprog, (aka Youssef Touil), the developer of SDR#, has been teasing development of a new web client called "WebSpy" for Airspy software-defined radios. The web client allows users to tune in to a remote Airspy SDR via a web browser interface that mimics the SDR# Windows software. Before WebSpy, it has only been possible to access Airspy devices remotely via the SpyServer server software and the SDR# Windows application.
While the software is still in development and not yet available for download, you can access a demo version (HF server) (Broadcast FM server) that Youssef has currently set up on his own server in France. From the X posts on the development of the software, it seems that WebSpy boasts some impressive efficiency in terms of the low 6 kB/s network bandwidth required. This means that even over slow connections, the FFT and audio should be smooth and clear. The web interface also works well on mobile, providing a touch-optimized interface.
Youssef wrote in and wanted to share some additional information about how SharpIQ and SharpFFT work:
Under the hood, WebSpy streams both the radio signal and the spectrum display using two purpose-built compression codecs: SharpIQ for the channel data and SharpFFT for the FFT display.
A key design choice is what gets streamed: unlike most web receivers, which demodulate on the server and send you compressed audio, WebSpy sends the raw IQ signal of the tuned channel and does all the demodulation right in your browser — the same DSP chain as the gold standard SDR#. This matters more than it might sound: with server-side audio you're listening to a lossy rendition of what the server decided to demodulate, with voice-codec artifacts baked in; with local IQ, the actual signal arrives at your machine, so demodulation, filtering and mode changes happen instantly and the audio quality is limited only by the signal itself, not by an audio codec.
Unlike general-purpose compressors, SharpIQ and SharpFFT were designed from the ground up for radio: they adapt in real time to what's actually happening on the band, spending bits only where there is information worth keeping, while preserving the weak-signal fidelity that SDR users care about — a CW signal buried near the noise floor comes through intact.
The result is that a complete listening session — channel IQ, live spectrum, waterfall and all — typically fits in about 5 kB/s, a fraction of what conventional audio streaming would need. That's low enough to comfortably operate a remote receiver over a modest mobile connection, which is precisely what makes a full SDR experience in a browser tab practical — nothing to install, nothing left behind, just a tab you can close; and at 5 kB/s the stream itself hides in the noise of ordinary web traffic. Discreet SIGINT, if you're so inclined.
Thank you to Paul Maine, who wrote in and wanted to share some experiments he and Gary Schafer have been doing with spectral painting. Spectral painting is the art of drawing pictures directly on the spectrum waterfall, which a software-defined radio makes visible. Paul has written the post below:
What happens when radio technology meets digital artwork? The result is something fascinating called Spectral Painting—the ability to create images that appear inside the radio frequency spectrum.
Gary Schafer (@signalgalaxiesunlimited) and Paul “The SDR Guy” Maine (@paulmaine6433) have teamed up to explore this unique combination of software-defined radio, signal processing, and creativity. Together, they have created companion videos on Spectral Painting and released them at the same time, each approaching the topic from a different perspective. For the best experience, it is recommended to watch Gary’s video first, followed by Paul’s practical demonstration.
Gary begins the journey by diving into the theory behind Spectral Painting. Using GNU Radio flowgraphs and GNU Octave scripts, he explains how images can be transformed into signals and displayed within the frequency spectrum.
Paul then takes Gary’s GNU Radio flowgraph and GNU Octave scripts from theory into practice. Using multiple SDR platforms, he demonstrates how to transmit spectral images using both the HackRF and TRX-DUO SDRs. He then completes the process by receiving and displaying the images using several different SDR receivers, including the RTL-SDR V3, RTL-SDR V4, and Airspy HF+.
Together, these videos provide a complete journey—from understanding the science behind Spectral Painting to seeing it come alive on real SDR hardware.
Below is an example screen capture of Spectral Painting in action.
Spectral Painting Example
Start with Gary’s video to learn the concepts and signal processing techniques:
Creating Spectral Paintings using Gnu Radio Companion (and other open source tools)
Then watch Paul’s video to see Spectral Painting transmitted and received using real SDR equipment:
Modifying RTL-SDR dongles to run from the same clock source to create a phase-coherent receiver is something that has been done for many years. The original experiments from 2015 by Tatu Peltola and others are what inspired the creation of the KerberosSDR and KrakenSDR coherent RTL-SDR radio systems for radio direction finding.
Recently, Mykhailo Shumilov, an independent researcher in Ukraine, wrote a paperon running RTL-SDR dongles from the same clock, which may be of interest to those working on coherence experiments. In his experiments, he uses an Si5351A as the reference clock and two RTL-SDR dongles. While his paper doesn't cover any new ground, he presents concrete measurements confirming the phase coherence-stabilizing effect of running two RTL-SDR dongles from the same clock.
AI-Disclaimer: The paper author notes that AI was used to aid in the writing of the paper.
Running two RTL-SDR dongles from a shared clock for phase coherence
Thank you to Ivan (NO2CW) for submitting news about how he added HD Radio decoding capability to his FM DX Webserver receiver. The FM DX Webserver is a community of worldwide FM broadcast-band online receivers that mostly use SDRs based on the TEF6686 chip, with a few also using RTL-SDR receivers. HD Radio (aka nrsc5) is a proprietary digital audio standard used by FM broadcasters in North America. It's often observed by SDR users in a waterfall as the two rectangles flanking both sides of a broadcast FM signal. Ivan writes:
A major challenge has been that up until now none of the online receivers were HD Radio capable. I have now added this capability with the help of an RTL V3. The online receiver uses a combination of two receivers: a TEF6686 which is known to be highly sensitive and, when an FM HD Radio signal is present, an RTL V3 automatically kicks in to provide HD radio capability opening up HD1, HD etc audio streams together with bundled album art, traffic and weather. The program was initially conceived by discord user seehed and then further developed by me.
The core code for this plugin was developed by GitHub user seehed and can be found here: https://github.com/Seehed/NRSC5_HDRadio. I had to make a few tweaks to get it fully working.
How the Setup Works: The hardware setup requires both a TEF6686 receiver and an RTL dongle operating simultaneously.
I tested an RTL-SDR V4 first, but the necessary DLLs worked much better with an RTL-SDR V3 in my current build.
By default, the server uses the TEF6686 for browsing the FM band for analog signals. When a user tunes to a frequency where an HD Radio signal is present, the logic switches to "HD Mode" and the RTL V3 takes over. The NRSC5 library is used to process the digital signal. In this mode, users will notice the change in audio quality and the available subcarrier streams (HD1, HD2, HD3, etc.) become visible and selectable.
How Users Can Set It Up: To replicate this, a user would need:
A working FM DX Webserver with a TEF6686.
An RTL-SDR V3 plugged into the same host.
The NRSC5 library installed.
The plugin from the GitHub link above installed and configured in the webserver directory.
Ivan also notes that currently his Miami NO2CW receiver is the only one on the network supporting HD Radio.
HD Radio on FM DX Webserver. Receiving HD Radio inside the fm dx webserver application.
