WarDragon: Testing EMEye/TempestSDR with Wyze Cam Pan V2 Cameras and a USRP B210

Last week we posted about University researchers who found that it was possible to recover live video images from the EM leakage emanating from various IoT security cameras. The 'EMEye' software to do this was released as open-source on GitHub.

Recently Aaron, who created DragonOS and WarDragon, has uploaded a video showing EMEye working on WarDragon. In the video, Aaron shows how to install and use the EMEye software on WarDragon, and demonstrates it working with a Wyze Cam Pan V2 that he purchased for this test.

In this video, I guide you through a practical demonstration of Tempest-based camera eavesdropping attack research. I'll be focusing on the EM Eye project, a tool derived from TempestSDR with some added features.

I'll show you how to construct the EM Eye project, step by step, and how to use it to tune into the EMI emitted by the Wyze Cam Pan v2 using an Ettus B210. By processing this EMI/RF signal, we're able to reconstruct the video stream using the algorithms provided by EM Eye and TempestSDR.

Additionally, I'll demonstrate how DragonOS FocalX and the WarDragon kit offer a cost-effective alternative by including a prebuilt version of TempestSDR that works with the Airspy R2. This allows for similar functionality at a lower cost.

If you're interested we reviewed WarDragon in a recent post as well.

WarDragon EMEye/TempestSDR Camera Eavesdropping Attack Research (B210, Airspy R2, Wzye Cam Pan v2)

The Latest Talks from the Society of Amateur Radio Astronomers

Over on YouTube a bunch of new talks from the Society of Amateur Radio Astronomers (SARA) have recently been uploaded from their recent SARA Western Conference that was held in April 2024. The talks typically involve small home-based radio astronomy setups that use small satellite or WiFi dishes and RTL-SDR or similar low-priced SDRs in their setup. Some of the latest talks include:

  • Nathan Butts: A Novice's Guide to Radio Astronomy (Link)
  • Dr Andrew Thornett: Detecting Cosmic Rays & Building your own version of the Large Hadron Collider (Link)
  • Dr Andrew Thornett M6THO: Lichfield Radio Observatory - Mapping Milky Way at 1420.405 MHz (Hydrogen) (Link)
  • Bruce Randall: IBT Eclipse and other Radio astronomy Failures (Link)
  • Felicia Lin: Mapping the Milky Way by Cross Section Data (Link)
  • Kent Britain WA5VJB: Antennas for Radio Astronomy (Link)
  • Charles Osborne: Eclipse Detection using a VLF Receiver (Link)
  • Rob Lucas - Eclipse Research (Link)
  • Dr Wolfgang Herrmann: Lunar Occultation Observation of Radio Sources (Link)
  • Keynote: Dr Linsay King - Gravitational Lensing (Link)

We note that the last talk was uploaded only a few hours ago at the time of this post, so we're not sure if more talks are yet to be uploaded. So please keep an eye on the SARA YouTube videos page.

Nathan Butts: A Novice's Guide to Radio Astronomy

Tech Minds: Review of the KiwiSDR 2

Earlier this year the KiwiSDR 2 became available for purchase and began shipping out to customers. The KiwiSDR 2 is an upgraded version of the original KiwiSDR with the main upgrades being an enhanced RF front end and the addition of a digital attenuator.

Over on the Tech Minds YouTube channel, Matt received his KiwiSDR 2 and uploaded a review and demonstration of the product. In the video, Matt shows the external ports of the KiwiSDR and discusses the differences between the KiwiSDR 2 and the original version. Matt goes on to show how to set up the KiwiSDR 2 and shows it receiving through it's web-based receiving software.

KiwiSDR is a 14-bit wideband RX-only HF software-defined radio created by John Seamons (ZL/KF6VO). The KiwiSDR has up to 32 MHz of bandwidth, so it can receive the entire 10 kHz - 30 MHz VLF/LF/MW/HF spectrum all at once. Other than the specifications, the main interesting feature about the KiwiSDR is that it is designed to be operated entirely as an online web-based SDR which is accessed over a network connection. Owners can optionally share their KiwiSDRs online with anyone who wants to access it, which also allows for interesting distributed applications, such as TDoA direction finding, which allows users to pinpoint the location of unknown HF transmissions such as numbers stations.

KiwiSDR 2 - A Standalone Software Defined HF Radio Receiver

New Tool to Convert Between SDR# and SDR++ Frequency List Formats

Thank you to 'thewsoftware' over on our forums who has shared with us his SDR# <-> SDR++ frequency list converter (sdrfc) software. SDR# and SDR++ are two popular SDR programs often used with the RTL-SDR, but each uses a different format for storing custom frequency lists.

The new sdrfc tool allows users to easily convert frequency lists between SDR# and SDR++ formats, so you don't need to manually type out a frequency list for both programs.

The sdrfc is a Windows command line tool and instructions for using it can be found on the GitHub Readme. A release zip file is available on the GitHub Releases page.

SDR# <-> SDR++ Frequency Converter Readme

Testing a WiFi Grid Antenna for L-Band Satellites

Over on YouTube dereksgc has uploaded a video where he tests out a 2.4 GHz WiFi Grid antenna for L-band weather satellite reception. WiFi grid antennas are typically repurposed in the SDR community for L-Band weather satellite reception because they are cheap and mostly work out of the box. They can also be used for hydrogen line radio astronomy. TV dish antennas are an alternative but with them, a custom feed needs to be built. 

In his video, dereksgc tests the WiFi dish on receiving various polar-orbiting L-band satellites including Metop, and Meteor M2. With the polar orbiting satellites the dish needs to point at the satellite as it passes over the sky and so dereksgc recommends using a mount if hand tracking them.

Later in the video he tests some geostationary satellites but finds that the dish is not tuned well enough to receive Elektro-LN3 properly without modifications. He was however able to receive a noisy image from FengYun-2H successfully.

We note that we also currently have our Discovery Dish product available for pre-order, which is similar to the WiFi grid dish, but smaller and lighter weight with a built-in optimized active feed.

I finally got a WiFi grid antenna for satellites

EM Eye: Eavesdropping on Security Camera via Unintentional RF Emissions

Researchers from the University of Michigan and Zhejiang University have recently published their findings on how it's possible to eavesdrop and wirelessly recover images from security cameras via RF unintentionally leaking from the camera electronics.

EM side-channel attacks aka receiving and decoding data from the unintentional RF transmissions from electronics are nothing new.  In the past, we've posted how some laptops unintentionally broadcast audio from the microphone via RF, how a tool called TempestSDR can be used to spy on monitors/TV's via RF leakage, how encryption keys can be stolen from PCs via unintentional RF, and even how Disney is looking to use RF leakage for RF fingerprinting.

In their research, the team discovered that security cameras leak enough sensitive RF that an image can be recovered from the leakage over a distance. In their tests, they used a USRP B210 SDR as the receiver and tested twelve cameras including four smartphones, six smart home cameras, and two dash cams. They found that eight of the twelve leaked strongly enough for the reception of images through windows, doors, and walls. Cameras like the Xiaomi Dafang and Wyze Cam Pan 2 performed the worst, allowing for images to be recovered from distances of 500cm and 350cm respectively.

The team has not only released a paper on the topic but has also released the full code as open-source software on GitHub. The software is based on a modified version of TempestSDR, so it may also work for other supported SDRs, like the HackRF and RTL-SDR.

EM Eye: How Attackers Can Eavesdrop on Camera Videos

PhantomSDR: WebSDR Software for the RX888 MKII and Other SDRs

Recently Reddit user magicint1337 brought attention in a post to PhantomSDR, a web SDR program for the RX888 MKII SDR. PhantomSDR is not new, having been first uploaded to GitHub two years ago, but it appears that it hasn't gained much attention so far. Web SDR software allows an SDR to be accessed publically or privately remotely over an internet connection. He writes:

PhantomSDR is a Web SDR Software that can sample the whole HF Band using the RX888 MK II, it utilizes the GPU to do so efficiently, the CPU can also be used but has to be strong enough to handle it.

The Software itself supports nearly all Devices, as they are passed from another program like rx_sdr to PhantomSDR. It features high quality Waterfall Zoom efficiently, it can handle hundreds if not thousands of users depending on the Hardware and is open source. There is also a sdr-list linked below.

It's a good alternative to OpenWebRX or WebSDR as it's easy to set up and can handle higher bandwidths and more users than the other alternatives i named. Decoders will also come and run in WebAssembly on the Client, so the Server has no Usage and can handle many Users. It can also handle higher bands, for example VHF.

It is developed further and further because it's open-source and everybody can help develop it further!

List: https://sdr-list.xyz
Software: https://github.com/PhantomSDR/PhantomSDR

The author of PhantomSDR also chimes in on the comments noting:

Author of PhantomSDR here, wondering where all the traffic to the github repo came from and discovered someone has posted it here.

This is started off as project to publish a self-made direct sampling SDR to the internet. Then it grew to became a learning project about SDR and DSP. I picked RX888 as the SDR to put in the screenshot due to it being easily available as compared to the one I built myself. This wasn't really meant to be much apart from a fun learning exercise!

I wanted to open source this because I think others might find it useful also to host higher bandwidth SDRs, or just have a different user interface.

sdr-list.xyz is made by a contributor to the project, but I would prefer to have more infrastructure under the PhantomSDR domain. This will happen once I get a suitable domain name and the server code up. And yes it will be https and the server will be open source.

Currently, there appears to be one publicly hosted server that can be accessed via the list at sdr-list.xyz. 

This web SDR software is reminiscent of the University of Twente WebSDR software which is currently closed source. It is also similar to KiwiSDR and OpenWebRX which is also an online web-based SDR system.

We note that there has been controversy over the RX888 SDR in the past as developers of popular software in the SDR community such as SatDump and SDR++ have frowned on it due to its poor driver support, the lack of any developer support from the manufacturer, and poor overall RF design.

UPDATE: Jie Feng, the author of the software would like to add that the official server list is at https://phantomsdr.github.io/servers. sdr-list.xyz is a third party list set up by a fan, and Jie is working out how to integrate it with his official list. Jie also notes that PhantomSDR also supports many other SDR's like RTL-SDR, HackRF, SDRplay RSP etc. 

Jie has also provided a follow-up Reddit post here

PhantomSDR Screenshot
PhantomSDR Screenshot

Saveitforparts: Receiving and Decoding L-Band Weather Satellites

Over on his YouTube channel 'saveitforparts' has uploaded a new video showing how he has been successful at receiving and decoding L-band weather satellites using his setup made from scavenged parts. He uses a custom-built helical feed on a scavenged dish, and an automatic pan-tilt rotator built from an old security camera mount. With this setup combined with an RTL-SDR and LNA and filter he is able to receive polar orbiting L-band weather satellites. 

In the video, he shows how his system works and what his software setup looks like. He uses SDR++ to record the pass initially, then SatDump to decode the data into images. We note that SatDump can be used to decode the images live, and can also record the raw radio files too, so SDR++ is not required.

How To Receive And Decode L-Band Weather Satellites