Category: Antennas

DEF CON 30 RF Talks: Biohacking, Designing Antennas, Tracking Military Ghost Helicopters and More

DEF CON is a yearly conference with a focus on information security. At this years DEF CON 30 conference various talks on RF related topics were presented. In the past few weeks talks have been uploaded to YouTube for all to watch. Below we highlight a few we found interesting. The list of all main talks can be found on the Defcon YouTube channel, and talks from the RF Village can be found on the RF Hackers Sanctuary YouTube page

J9 - Biohacking Using SDR When You Don’t Know What You’re Doing

Security Researcher and BioHacker J9 presented an interesting and entertaining talk about how she used an SDR to listen in and decode a wireless pH sensor pill she ingested as part of a medical test.

What would you do if you were implanted with a medical device that broadcasts every 12 seconds?

Starting with loads of curiosity and very little knowledge about RF, how to use a software defined radio (SDR), and no knowledge of how to decode captured RF signals, I embarked on an adventure to teach myself something new. Jumping head first into the RF CTF helped greatly!

This presentation starts with cocaine and ketamine (in a controlled medical setting) and includes a near-death experience and new skills attained by building on the work of those who came before me. The end result of this adventure led me to the US Capitol to sit down with Senate staffers about the security and exploitability of medical devices.

DEF CON 30 RF Village - J9 - Biohacking Using SDR When You Don’t Know What You’re Doing

Erwin Karincic - Have a SDR? - Design and make your own antennas

In this talk Erwin Karincic explains how to design and make custom PCB antennas using home based or low cost techniques.

Most Software Defined Radios (SDRs) process a wide range of frequencies usually ranging from few MHz to multiple GHz where different antennas are used to pick up signals in a specific subset of that range. All applications using SDR require antennas to operate efficiently at very specific frequencies. Most inexpensive commercial antennas are designed either for wider ranges with lower gain over the entire range or very specific known frequencies with higher gain. The problem occurs when the researcher performs an assessment of a device and requires the use of specific frequency for which an antenna with high gain is not readily available. Most security researchers within wireless domain have outlined that their specific attack or exploit could be executed at higher range if antenna had better gain at that specific frequency. This talk focuses on bridging that gap by providing a way for researchers to create their own patch antennas without deep electrical engineering experience.

DEF CON 30 RF Village - Erwin Karincic - Have a SDR? - Design and make your own antennas

Andrew Logan - Tracking Military Ghost Helicopters over Washington DC

In this talk Andrew explains how ADS-B receivers, combined with ATC communications, public announcements and crowd sourced visual identification have helped track the activity of military helicopters operating over the Washington DC area.  

There's a running joke around Washington D.C. that the "State Bird" is the helicopter. Yet 96% of helicopter noise complaints from 2018-2021 went unattributed: D.C. Residents can not tell a news helicopter from a black hawk. Flight tracking sites remove flights as a paid service to aircraft owners and government agencies; even in the best case these sites do not receive tracking information from most military helicopters due to a Code of Federal Regulations exemption for "sensitive government mission for national defense, homeland security, intelligence or law enforcement." This makes an enormous amount of helicopter flights untraceable even for the FAA and leaves residents in the dark.

What if we could help residents identify helicopters? What if we could crowd source helicopter tracking? What if we could collect images to identify helicopters using computer vision? What if we could make aircraft radio as accessible as reading a map? What if we could make spotting helicopters a game that appeals to the competitive spirit of Washingtonians? And what if we could do all of this... on Twitter?

DEF CON 30 - Andrew Logan - Tracking Military Ghost Helicopters over Washington DC

A Broad Overview About HF on the RTL-SDR Blog V3

Over on YouTube, Tom the Dilettante has uploaded a video demonstrating how to receive HF signals with an RTL-SDR Blog V3 running in direct sampling mode. This is something already known to most RTL-SDR fans, but on the RTL-SDR V3 we have built in a direct sampling circuit that enables reception below 24 MHz with a simple settings change in software.

In the past and with other dongle brands, enabling direct sampling required hardware mods involving directly soldering a wire antenna to very small pins or pads. Direct sampling is not a high performance mode for HF, but in many situations it can be good enough for casual listening. 

In his video Tom demonstrates HF reception with the RTL-SDR Blog V3 and an MLA-30 active loop antenna. This is a cheap loop antenna available on Aliexpress that works very well for the price.

Listen Around the World - No Internet Required (HF & Shortwave on RTL SDR)

An Inside Look into FlightAware’s RTL-SDR

Over on the FlightAware blog, Hardware and Software Engineers Eric Tran and Ziquan Wang have put up a blog post showing how they have designed the FlightAware RTL-SDR hardware and software, and detail some future plans.

FlightAware is a company that specializes in distributed ADS-B aggregation, in order to produce real time maps and information about what aircraft are in the air. In 2021 FlightAware was acquired by Collins Aerospace, which is a subsidiary of Raytheon Technologies, a large US aerospace and defense contractor.

Most of the data that FlightAware obtains comes from volunteers all around the world running an RTL-SDR dongles on their Raspberry Pi based image. The dongles receive the ADS-B 1090 MHz broadcasts from aircraft which contain information about the aircraft including GPS location. 

Back in 2016 they released the FlightAware ProStick, which is an ADS-B optimized RTL-SDR with onboard 1090 MHz LNA.  Later in 2017 they released the Prostick Plus which improved performance in high interference areas due to the addition of a 1090 MHz SAW filter.

Their post goes into more detail about their products, and note that they are currently designing a new Prostick Plus with filter placed before the LNA instead of after. They also discuss how they are looking into higher end 12-bit ADCs for their receiver hardware, and at creating a dual channel receiver for the 978 MHz UAT band as well. They then go on to discuss the software architecture behind the ADS-B decoder they use.

FlightAware ADS-B Kitset

KrakenSDR Locates a TETRA Transmitter

Over on YouTube F4IPO has posted a video of him using a KrakenSDR and the KrakenSDR Android mapping app to quickly locate the source of a TETRA transmission at 427 MHz in France.

The KrakenSDR is our 5-channel coherent radio based on RTL-SDRs, and it can be used for applications like radio direction finding and passive radar. We successfully crowd funded the device on Crowd Supply.  

In the video F4IPO shows a dash cam recording of his vehicle alongside a screen recording of his Android phone screen. He makes use of the auto-navigation feature which navigates him right to the radio transmit tower. He notes that the entire process to locate the transmitter only took about 5 minutes. At the end of the video he shows the antenna setup on his roof.

KrakenSDR : recherche d'un émetteur TETRA

IEEE Spectrum: Chasing Weather Balloons with Software Defined Radio

Electrical engineering magazine IEEE Spectrum has recently shared a story about how RTL-SDRs can be used for chasing weather balloons. With an RTL-SDR, antenna and appropriate decoding software, it is possible to decode the telemetry signal from weather balloons radiosondes, and track their live GPS location.

The author, James Provost explains how chasing and hunting weather balloons can be a fun sport. To help with his hunt James uses an RTL-SDR, a directional antenna and the Sondehub Tracker website.

First James logged onto Sondehub Tracker which aggregates multiple weather balloon signals received by volunteer ground stations. One feature of Sondehub is that it can predict an approximate landing position of a balloon. It however cannot track a balloon right to its final landing spot as usually the ground station will loose signal when the balloon gets too low.

Knowing the approximate landing position, James drove out to the indicated location and then took out his RTL-SDR and directional antenna and was able to track and find the radiosonde by decoding the telemetry signal with Sonde Monitor

IEEE Spectrum Weather Balloon hunting graphic

Frugal Radio KrakenSDR Part 1 – Unboxing, Antennas and Initial Setup

Over on the Frugal Radio YouTube channel Rob has uploaded part one of his two part series on the KrakenSDR. The KrakenSDR is our 5-channel coherent radio based on RTL-SDRs, and it can be used for applications like radio direction finding and passive radar. We successfully crowd funded the device on Crowd Supply.  

In the video Rob unboxes his KrakenSDR, and explains how he will use it for radio direction finding. He shows his setup including the other required parts, like the Pi 4, and power supply, and then goes on to show the software installation process which involves burning an SD card and downloading an Android app. Next he sets up his antenna array by printing the antenna spacer and using the Excel antenna array calculator sheet.

Rob notes that Part 2 is coming in one to two weeks and will show him using the KrakenSDR in his vehicle to locate the source of a transmission.

KrakenSDR Unboxing / Prep & Setup device & antennas : Part 1

Decoding Inmarsat STD-C with Command Line Decoder STDCDEC and SigDigger

Over on his YouTube channel Aaron has uploaded a video showing how to use SigDigger and a C based command line Inmarsat STD-C decoder called 'stdcdec' together on his DragonOS SDR based Linux OS image.

STD-C is a marine satellite service that broadcasts messages that typically contain text information such as search and rescue (SAR) and coast guard messages as well as news, weather and incident reports. With the right software, an RTL-SDR and an appropriate L-Band satellite antenna like our 'Active L-Band 1525 - 1660 Inmarsat to Iridium Patch Antenna Set' these signals can be received and decoded.

The stdcdec software provides a way for command line only systems to receive and view STD-C data. In his video Aaron shows an example setup that uses SigDigger to determine the audio frequency offset, and receive the audio which is then passed to the stdcdec software. We note that SigDigger is a GUI based program but could probably be replaced with another CLI based program, in order to run on a headless system (as long as the tuning and audio center freq is determined before hand). Aaron is hoping to explore solutions for this in the future.

DragonOS Focal Rx and Decode Inmarsat-C Messages w/ SigDigger + STDCDEC (RTLSDR)

SelfieStick: Combining noisy signals from multiple NOAA APT satellites for clean imagery

Researchers from Carnegie Mellon University have recently presented a paper detailing how they combined noisy signals from multiple passes of low earth orbit (LEO) satellites NOAA 15, NOAA 18 and NOAA 19 in order to create a higher quality image. For a receiver they used a low cost RTL-SDR Blog V3 mounted indoors with a whip antenna.

In a normal setup, weather satellite images from NOAA LEO weather satellites can be received with an RTL-SDR, computing device and an appropriate outdoor mounted antenna that has a good view of the sky. If the antenna is not suited for satellite reception, and/or is mounted indoors, at best only poor quality very noisy images can be received.  

The researchers demonstrate that it is possible to combine noisy images received over time, and from different satellites in order to generate a higher quality image. The challenge is that the different satellites and different receiving times will all produce different images, because the satellites will be at a different location in the sky each pass. They note that simply transforming the images in the image domain would not work very well for highly noisy images, so instead they have devised a method to transform the images in the RF domain. The RF signals are then coherently combined before being demodulated into an image.

The results show that 10 noisy satellite images from the indoor system are comparable to one from a comparison outdoor system. However, they note some limitations in that the system assumes unchanging cloud cover during passes. In the future they hope to extend the system to cover other modulation schemes used by other low earth orbit satellites in order to increase the number of usable satellites.

Selfiestick: Combining noisy images from multiple NOAA satellites received by an indoor RTL-SDR system.