Category: Applications

SignalsEverywhere: Investigating USGS Gaging Stations and their GOES Satellite Connection

The United States Geological Service maintains over 8500 "Gaging stations" in bodies of water all over the country. Gaging stations are devices that are used to measure environmental data such as groundwater levels, discharge, water chemistry, and water temperature. What's interesting is that they all upload their data in real time to GOES satellites - the same satellites that we can use with an RTL-SDR to receive weather images of the entire earth. The data is then downlinked in the L-band to the USGS scientists via a protocol known as DCP (Data Collection Platform).

In the latest SignalsEverywhere video, Corrosive investigates how these stations work, and how we can receive the downlink at 1.68 GHz with a simple Inmarsat L-band antenna. While a fully functional decoder is not yet available, Corrosive notes that one called goes-dcs is currently being worked on.

USGS Gaging Station | Satellite Uplink to GOES and DCP Messages

Tracking Company Jets with ADS-B to Give an Edge to Hedge Fund Investors

Financial news site Bloomberg recently ran an article about how hedge fund managers are using ADS-B to track private company aircraft in order to help predict the next megadeal between companies. They explain with an example:

In April, a stock research firm told clients that a Gulfstream V owned by Houston-based Occidental Petroleum Corp. had been spotted at an Omaha airport. The immediate speculation was that Occidental executives were negotiating with Buffett’s Berkshire Hathaway Inc. to get financial help in their $38 billion offer for rival Anadarko Petroleum Corp. Two days later, Buffett announced a $10 billion investment in Occidental.

There’s some evidence that aircraft-tracking can be used to get an early read on corporate news. A 2018 paper from security researchers at the University of Oxford and Switzerland’s federal Science and Technology department, tracked aircraft from three dozen public companies and identified seven instances of mergers-and-acquisitions activity. “It probably shouldn’t be your prime source of investing information, but as a feeder, as an alert of something else what might be going on, that’s where this work might be useful,” says Matthew Smith, a researcher at Oxford’s computer science department and one of the authors.

"Alternative data" collection firms like Quandl Inc. have services like "corporate aviation intelligence", where they use ADS-B data to keep tabs on private aircraft, then sell their data on to hedge funds and other investors who are hoping to gain an edge in the stock market.

Popular flight tracking sites that aggregate ADS-B data like FlightAware and FlightRadar24 censor data from private jets on their public maps upon the request of the owner, but it's not known if they continue to sell private jet data on to other parties. ADS-B Exchange is one ADS-B aggregator that promises to never censor flights, however the data is only free for non-commercial use. The value from using companies like Quandl is that they probably have a much more accurate database of who each private jet belongs to.

The Bloomberg article also mentions another use case for tracking private flights, which is  tracking the movements of known dictators via their private jets. We previously posted an article about this too. We've also in the past seen ADS-B data used to track world leaders, and help United Nations advisers track flights suspected of violating an arms embargo.

ADS-B data is typically collected these days with a low cost SDR like the RTL-SDR. We have a tutorial on setting up your own ADS-B home tracker here.

Features of Quandl Inc's Corporate Aviation Intelligence Service.
Features of Quandl Inc's Corporate Aviation Intelligence Service.

Rdio Scanner: A Web Based UI for Trunk Recorder

Trunk Recorder is an RTL-SDR compatible open source Linux app that records calls from Trunked P25 and SmartNet digital voice radio systems which are commonly used by Police and other emergency services in the USA. It can be used to set up a system that allows you to listen to previous calls at your leisure, however it does not have any UI for easy browsing.

Recently Chrystian Huot wrote in and wanted to share his new program called "Rdio Scanner", which is a nice looking UI for Trunk Recorder. Rdio Scanner uses the files generated by Trunk Recorder to create a web based interface that looks like a real hardware scanner radio. Some of the features include:

  • Built to act as a real police radio scanner
  • Listen to live calls queued to listen
  • Hold a single system or a single talkgroup
  • Select talkgroups to listen to when live feed is enabled
  • Search past calls stored in the database
  • Just upload Trunk Recorder files with Curl
Rdio Scanner Interface Screenshots
Rdio Scanner Interface Screenshots

Meteor M2 is Currently Experiencing Orientation Issues

Russian weather satellite Meteor M2 is a popular reception target for RTL-SDR radio enthusiasts, as it allows you to receive high resolution images of the Earth. However, currently it appears to be exhibiting orientation issues, causing off center and skewed images and sometimes poor/no reception. Russian blog "aboutspacejornal", writes that the orientation of the satellite can sometimes be restored presumably by a reset command from Earth, but shortly after goes back into uncontrolled rotation.

These sorts of off-axis images were commonly received from the older decommissioned Meteor-M1 satellite, which woke up from the dead in 2015. The resurrection was speculated to be from the batteries shorting out, allowing power to directly flow from the solar panels while in full sunlight. These days Meteor-M1 is no longer transmitting.

Meteor M2 proving the curvature of the earth due to it's orientation issues.
Meteor M2 proving the curvature of the earth due to it's orientation issues.  Image source aboutspacejornal.

Hopefully Meteor-M2 can be fixed, but if not, Meteor M2-2 is due to be launched on July 5 which should also have an LRPT signal that can be received easily with an RTL-SDR. Hopefully the launch is more successful than the November 2017 launch of Meteor M2-1 which unfortunately was a complete loss as it failed to separate from the rocket.

Hak5: Hacking Ford Key Fobs with a HackRF and Portapack

This weeks episode of Hak5 (an information security themed YouTube channel) features Dale Wooden (@TB69RR) who joins hosts Shannon and Darren to demonstrate a zero day vulnerability against Ford keyless entry/ignition. More details about the vulnerability will be presented at this years DEF CON 27 conference, which is due to be held on August 8 - 11.

In the video Dale first demonstrates how he uses a HackRF with Portapack to capture and then replay the signal from a Ford vehicle's keyfob. The result is that the original keyfob no longer functions, locking the owner out from the car. After performing a second process with another keyfob, Dale is now able to fully replicate a keyfob, and unlock the car from his HackRF.

Dale explains that unlike the well known jam-and-replay methods, his requires no jamming, and instead uses a vulnerability to trick the car into resetting the rolling code counter back to zero, allowing him to capture rolling codes that are always valid. Dale also notes that he could use any RX capable SDR like an RTL-SDR to automatically capture signals from over 100m away.

The vulnerability has been disclosed to Ford, and the full details and code to do the attack will only be released at DEF CON 27, giving Ford enough time to fix the vulnerability. It is known to affect 2019 Ford F-150 Raptors, Mustangs and 2017 Ford Expeditions, but other models are also likely to be vulnerable.

The video is split into three parts. In part 1 Dale demonstrates the vulnerability on a real vehicle and in part 2 he explains the story behind his discovery, how he responsibly disclosed the vulnerability to Ford and how to reset the keyfob yourself. Finally in part 3 Darren interviews Dale about his experiences in the RF security field.

Dales discovery has also been written up in an article by The Parallex which explains the exploit in more detail.

Hacking Ford Key Fobs Pt. 1 - SDR Attacks with @TB69RR - Hak5 2523 [Cyber Security Education]

Hacking Ford Key Fobs Pt. 2 - SDR Attacks with @TB69RR - Hak5 2524 [Cyber Security Education]

Hacking Ford Key Fobs Pt. 3 - SDR Attacks with @TB69RR - Hak5 2525 [Cyber Security Education]

Using a Software Defined Radio to Send Fake Presidential Alerts over LTE

Modern cell phones in the USA are all required to support the Wireless Emergency Alert (WEA) program, which allows citizens to receive urgent messages like AMBER (child abduction) alerts, severe weather warnings and Presidential Alerts.

In January 2018 an incoming missile alert was accidentally issued to residents in Hawaii, resulting in panic and disruption. More recently an unblockable Presidential Alert test message was sent to all US phones. These events have prompted researchers at the University of Colorado Boulder to investigate concerns over how this alert system could be hacked, potentially allowing bad actors to cause mass panic on demand (SciHub Paper).

Their research showed that four low cost USRP or bladeRF TX capable software defined radios (SDR) with 1 watt output power each, combined with open source LTE base station software could be used to send a fake Presidential Alert to a stadium of 50,000 people (note that this was only simulated - real world tests were performed responsibly in a controlled environment). The attack works by creating a fake and malicious LTE cell tower on the SDR that nearby cell phones connect to. Once connected an alert can easily be crafted and sent to all connected phones. There is no way to verify that an alert is legitimate.

Spoofed Presidential Alerts Received on a Galaxy S8 and iPhone X.
Spoofed Presidential Alerts Received on a Galaxy S8 and iPhone X.

SignalsEverywhere: Decoding Inmarsat EGC and AERO ACARS

On his latest video Corrosive from the SignalsEverywhere YouTube channel discusses Inmarsat LES EGC and AERO ACARS decoding. Inmarsat is a satellite provider that has multiple geosynchronous satellites that can be received from almost anywhere in the world at around 1.5 GHz with an RTL-SDR and appropriate antenna + LNA. Inmarsat EGC and AERO are two channels on Inmarsat satellites that can easily be decoded.

The Enhanced Group Call (EGC) messages typically contain text information such as search and rescue (SAR) and coast guard messages as well as news, weather and incident reports. AERO messages on the other hand are a form of satellite ACARS, and typically contain short messages from aircraft. More interestingly with a bit of work compiling audio decoders, it is also possible to listen in to AERO C-Channel conversations, which is an emergency phone call service available on some aircraft.

In his video Corrosive gives an overview and demonstration of EGC and AERO reception.

Inmarsat LES EGC and AERO ACARS Decoding

A LimeSDR Mini Based Es’Hail-2 DATV Ground Station Uplink

Daniel Estévez has posted on the LimeSDR Mini CrowdSupply blog about his ground-station build for the Es'Hail-2 satellite. Es'Hail-2 is the first geostationary satellite with amateur radio transponders on board. The LimeSDR Mini is a $159 RX/TX capable SDR with 10 MHz to 3.5 GHz frequency range.

The Es'Hail-2 satellite is positioned at 25.5°E which is over Africa. It's reception footprint covers Africa, Europe, the Middle East, India, eastern Brazil and the west half of Russia/Asia. There are two amateur transponders on the satellite. One is a narrow band linear transponder which uplinks from 2400.050 - 2400.300 MHz and downlinks from 10489.550 - 10489.800 MHz. Another is a wide band digital transponder for digital amateur TV (DATV) which uplinks from 2401.500 - 2409.500 MHz and downlinks from 10491.000 - 10499.000 MHz.

Daniel's ground station uses a LimeSDR Mini running on a Beaglebone Black. A 2.4 GHz WiFi parabolic grid antenna is used to transmit to the satellites digital amateur TV uplink. In order to generate enough power for the uplink transmission a GALI-84 amplifier chip is cascaded with a 100W power amplifier. All the electronics are enclosed in a watertight box and placed outside.

A LimeSDR Mini Based Es'Hail-2 DATV Uplink Ground Station
A LimeSDR Mini Based Es'Hail-2 DATV Uplink Ground Station