Category: Airband

RF Fingerprinting ADS-B Signals for Security

At this years ICNP 2020 IEEE conference a paper titled "Real-World ADS-B signal recognition based on Radio Frequency Fingerprinting" (pdf file) was presented by researchers from the University of Harbin, China. The idea presented in the paper is to use RF "fingerprinting" techniques to uniquely identify and confirm that the ADS-B signal originates from the correct aircraft source.

RF fingerprinting works on the premise that every transmitter has small manufacturing variances that result in slightly different signals be transmitted, resulting in a unique "fingerprint" that can be traced to a particular transmitter. The idea here is to use these fingerprints to ensure that a known aircraft is indeed transmitting an ADS-B signal and the signal is not being transmitted from a fake spoofer. ADS-B is completely unencrypted and not authenticated, so spoofing of ADS-B signals may be a real security threat.

In the teams research they use an RTL-SDR to collect ADS-B signals from five different aircraft. They then use that data to create "Contour Stellar Images" and train a deep learning neural network which after training accurately identifies which aircraft a signal comes from.

Aircraft ADS-B Fingerprinting

In previous posts we've seen the idea of fingerprinting used by Disney research and others to identify electronic devices, to authenticate RF IoT devices and to identify handheld transmitters via CTCSS fingerprints.

A Dual Aircraft and Ship Tracking System with RTL-SDR

Over on his blog Ian Renton has posted about his dual plane and ship tracker project that he's titled "Plane/Sailing". The project consists of several elements including one FlightAware Pro Stick and Pimoroni ADS-B antenna for the aircraft tracking, and an RTL-SDR Blog V3 dongle and Diamond X-50 AIS antenna for the ship tracker.

Ian runs each dongle on a seperate Raspberry Pi. For aircraft the dump1090 software is used to decode the data, and it passes that data to multiple aggregator feeders such as FlightAware, FlightRadar24, ADS-B Exchange and OpenSky. For ships he uses rtl_ais which feeds into AIS Dispatcher which in turn feeds multiple marine aggregators such as Marine Traffic, VesselFinder, AIS Hub, Pocket Mariner and Ship Finder.

His system also feeds a personally hosted web front end based on his umid1090 software. umid1090 is a replacement for dump1090's web interface, the main difference being that the map is presented using military symbology. For the "Plane/Sailing" project he also extended umid1090 to be able to read the AIS ship position data from AIS Dispatcher's KML output file, and created a clean dark interface. The result is a slick looking map displaying both the tracked aircraft and ships. Ian's web interface for his system is public, and can be viewed at planesailing.ianrenton.com.

The Plane/Sailing Web Interface (Based of UMID1090)

 

QIRX Version 3 Beta: Built in ADS-B Decoder + Map, Multimode, Multi-Receiver

In the past we've posted about the QIRX software a few times as it is an RTL-SDR compatible program that has a focus on DAB+ decoding. However, recently QIRX author Clem wrote in to let us know about version 3 beta, which is now a multi-mode receiver supporting modes such as ADS-B, AM, NBFM, WFM, SSB as well as DAB+ as it did in previous versions. It also now support ADS-B plane mapping, and can run multiple RTL-SDRs at once. We note that this version is not yet available for public download, however you can get the beta by contacting the author (details below). Clem writes:

In short, there are two main new features:

  • Multi-Receiver: More than one hardware RX can be connected, all I/Q data are fed via TCP/IP, local or remote. The configuration is read from the config file, per default prepared for three receivers.
  • Multimode: DAB, ADS-B, AM, NFM, WFM, SSB (LSB, USB).

As before, TCP/IP drivers for RTL-SDR dongles, the RSPs (RSPDuo single-channel), and Airspy. All binaries are part of the installer.

Although the software is "general purpose", particular emphasis has been given to serve aviation enthusiasts.

  • ADS-B: Aircrafts are displayed on the map. Information for about 450.000 aircrafts comes from an open database kindly provided by Opensky-network.org, updateable by the user from within the software, similar like the DAB database. The ADS-B decoder is a C# port of the well-known dump1090 software, with enhancements to decode aircraft ground movements.
  • The displayed aircrafts are those within the range of the attached receiver. In contrast to some other applications, it might be noted that the software is capable to decode the movements of the aircrafts not  only when airborne, but also on the ground, of course when in range. This might be interesting for plane spotters, perhaps in the vicinity of an airport.
  • The AM decoder provides special features when tuned to the airband range and - as should be standard nowadays - 8.33kHz channel separation has been selected. In contrast to older times, in airband communications no longer frequencies in MHz are communicated, but channels. The software (in live mode, not visible in the above picture taken from a file replay) provides an own airband channel selector, directly accepting channel numbers as spoken by ATC controllers. This is paired with the indication of channels in the spectrum, together with the corresponding frequency. With 8.33kHz channel separation, cheap dongles should be calibrated to receive the correct frequency, e.g. with QIRX's DAB decoder (where DAB is available).

Readers interested to give this version a try might send an email to [email protected] and they will receive the current beta version (Win10 .msi installer). As it might not yet have its final stability, it is not yet provided for download. Of course all beta users are requested to give some feedback.

QIRX V3 ADS-B Interface: Showing activity over Zurich Airport

Clem has also provided a YouTube video demonstration 20 minutes of ADS-B and airband voice activity over Zurich airport via the new multi-receiver and ADS-B mapping features in QIRX.

QIRX V3: 20 Minutes at Airport Zurich

Reporters use ADS-B Data to Uncover the Role US Private Contractors Play in East African Air Operations

The Organized Crime and Corruption Reporting Project (OCCRP) have recently run a story about how they have used ADS-B aircraft data to uncover the role that US civilian aircraft contractors are playing in the East African "kill chain". The investigation began over concerns that while civilian contractors do not pull the trigger, they may be becoming too involved in the process of determining exactly who will be killed in combat via data collection and analysis through their high tech surveillance aircraft. In the article they also note how many of these civilian contractors hide their true owners behind a chain of multiple LLC companies, thus reducing any accountability for their actions.

OCCRP also supports the Dictator Alert project which we have posted about in the past. In a related article titled "Mapping the Secret Skies: Lessons Learned From Flight Data" Emmanuel Freudenthal who helped setup the Dictator Alert project discusses how censorship free ADS-B tracking is helping journalists uncover new stories. In the article he notes how he uses uncensored ADS-B data together with the leaked Paradise Papers to reveal the true owners of aircraft hidden behind multiple LLC and shell companies. Regarding the "kill chain" article Emmanuel's post also explains how the story came to be:

An upcoming OCCRP story focuses on U.S. surveillance flights over Somalia. The U.S. military operates out of a small air base at Manda Bay just over the border in Kenya. We had a tip that it would be worth checking on planes in the area, so we set up an antenna nearby, which fed us information about planes taking off and landing from the base.

We eventually had to take down the antenna due to security concerns. But we managed to collect data on a number of planes that had been purchased by obscure shell companies and modified with advanced surveillance equipment before being sent to Kenya.

Why is this article posted on this blog? ADS-B data from aircraft is most often received these days via RTL-SDR dongles due to their low cost, so it is interesting to see to what extent cheap SDRs may be affecting the world via this type of reporting.

We note that ADS-B Exchange is the only censorship free ADS-B data aggregator available. All other online flight trackers censor flights from the government as well as from some private jets that may be owned by high profile company directors or in some cases dictators. The argument for censorship is that ADS-B data collection may be made illegal otherwise.

In a previous post we also discussed how censorship free ADS-B data from ADS-B Exchange revealed how military Blackhawk helicopters and Predator drones were used for surveillance during the early Black Lives Matter protests. 

Emmanuel installs an ADS-B antenna in Liberia

Frugal Radio: Using an Airspy and RTL-SDR To Scan the UHF Military Airband in SDR#

In Frugal Radio's latest video he explores how you can use an Airspy or RTL-SDR dongle to scan the entire military UHF airband spectrum in a few seconds via SDR#. Frugal Radio notes that there are often many signals in the UHF milair band, but they can be difficult to find without a scanner.

In the first video he compares his Uniden BCT15X hardware radio scanner against an Airpsy, noting that his Uniden takes 1:10 minutes to scan the entire band, whereas the Airspy running SDR# with the frequency scanner community plugin can scan the same bandwidth in less than 2.5 seconds. Faster scanning means that you are less likely to miss an active signal. In the second video he tries scanning with an RTL-SDR and notes that it can scan the band in 9 seconds.

How to use Frequency Scanner to Search UHF MilAir in 2.3 seconds in SDR# using AirSpy R2

$25 RTL-SDR v3 Military Air band search in under 10 seconds! Frequency Scanner SDR Sharp plugin test

Frugal Radio: 2020 SDR Guide Ep 1 – The Incredible World of Software Defined Radio (RTL-SDR, Airspy, SDRPlay etc.)

Frugal Radio has begun his YouTube channel a few weeks ago, and we've already posted about his YouLoop and SDR-Kits L-band patch antenna reviews as well as his results with the YouLoop on LF & VLF.

He's now begun a new series on his channel where he will be exploring the world of software defined radio in more depth. The first video that he's uploaded today is an overview where he overviews EMS communications, aircraft signals, military air signals, maritime signals, space signals, as well as other interesting signals he's received like wireless earpieces for musicians at concerts and  TV studio talkback links. He writes:

The 2020 SDR Guide Episode 1 has just been released.  It serves as an introduction to the incredible world of Software Defined Radio and will be of interest to both beginners and more advanced users.

Over the next few weeks, Frugal Radio will be exploring various aspects of using SDRs within the  hobby.  These include :
  • Using Free online SDRs
  • Comparison videos (eg Budget dongle shootout - Generic / RTL-SDR V3 / Nooelec SMARt v4)
  • "Must have" software guide
  • Antenna options and more

Users can view the channel at https://www.youtube.com/c/FrugalRadio or visit https://www.youtube.com/c/FrugalRadio?sub_confirmation=1 to subscribe directly.

If you're getting started with SDR, or are looking for new projects this might be a series to follow.

2020 SDR Guide Ep 1 : The Incredible World of Software Defined Radio (RTL-SDR, Airspy, SDRPlay etc.)

Characterizing Yagi Antenna Directionality via ADS-B Reception

Over on his blog Alex Krotz has been investigating whether adding more passive director elements actually affects the directionality of his home made Yagi-Uda antenna. Instead of using modelling software, Alex wanted a more accurate result that took into account all the imperfections of his antenna.

His idea was to receive ADS-B signals with his Yagi and a dipole antenna, then compare the data received in order to determine in which directions the Yagi receives better than the dipole. To do this he first creates a standard 2D map of plane tracks collected over a 24hr period for both the dipole and Yagi. A gaussian blur is applied to the two maps in order to fill in blank space and the data is normalized. Then he simply subtracts the dipole plot from the Yagi-Uda plot. The resulting difference plot reveals a mapping of where the Yagi receives better or worse compared to the dipole in a 2D plane.

Directivity of the Yagi revealed by comparing against a dipole
Directivity of the Yagi revealed by comparing against a dipole

Tech Minds: Testing the OpenEar DMR TETRA ADSB POCSAG Decoder for RTL-SDR

Back in March we posted about the release of OpenEar, a standalone TETRA decoder for the RTL-SDR. Since then OpenEar has undergone massive developments, not only improving upon the TETRA decoder, but adding DMR, ADS-B and POCSAG decoders as well as a waterfall display.

Recently Tech Minds reviewed this software on his YouTube channel. In the video he shows how to download the software, install the rtlsdr.dll file, and run and use the software. He then demonstrates reception of an amateur radio DMR repeater, reception of POCSAG pager messages and finally reception of ADS-B aircraft messages.

OpenEar Digital Decoder - DMR TETRA P25 ADSB POCSAG RTL-SDR