Remoticon 2021 was an online conference held in November 2021 and videos of presentations have recently been uploaded to the Hackaday YouTube channel this month. One very interesting talk was the presentation by Hash Salehi (RECESSIM) on reverse engineering electricity smart meters that are used to remotely monitor and bill home electricity usage in some neighborhoods.
In the past we've posted about Hash (RECESSIM)'s series on smart meter hacking a few times before. In this latest talk Hash summarizes his smart meter hacking experience, talking about how he went from reverse engineering the firmware, to using an SDR to capture and decode information from all the smart meters in his neighborhood, and finally to determining how to actually transmit data to his own smart meter network.
Over on his blog Nils Schiffhauer (DK8OK) has recently uploaded a review of our RTL-SDR Blog Active L-Band Patch Antenna. This is a satellite patch antenna designed for experimenters who want to receive Inmarsat, Iridium, GPS and other GNSS signals. It covers 1525 - 1660 MHz. (Please note it does not cover GOES or other L-band weather satellites as these are much weaker signals that require a dish). The antenna comes as a set with mounting hardware and extension cable and can be purchased on our store for $49.95 including free worldwide shipping to most countries.
In his review Nils tests the patch antenna with his wideband BladeRF software defined radio showing a wide 60 MHz of bandwidth being received. He then goes on to show it being used to receive AERO, via the JAERO decoder, and STD-C via the Tekmanoid decoder.
We want to take this opportunity to pre-announce that due to rising shipping costs the price of this antenna set will be going up by $10 in early 2022. Before the price raise we will put out another post, but if you are interested in one we'd recommend picking one up soon.
A new decoder for RS41 and DFM09 radiosondes has been released as a plugin for SDR++ by dbDexter. A radiosonde is a sensor package with RF transmitter that is attached to a weather balloon. Meteorological agencies around the world typically launch two per day in order to gather weather forecast data. With an RTL-SDR, appropriate antenna and a decoder it is possible to receive this data, and plot the GPS location on a map.
Installing a plugin for SDR++ requires adding the build options to the SDR++ source, and building SDR++, so it could be a little difficult for Windows, but relatively simple build instructions for Linux are provided in the Readme.
Over on Twitter FelixTRG (@OK9UWU) has tested the plugin out and has found it to work well.
dbDexter developed a WX radiosonde decoding plugin for @ryzerth's SDR++, i tested it rn on Vaisala RS41 launched from Prostejov (CZ) and works wonders.
Tested on linux, question when it will be in win release is on Ryzehttps://t.co/K5vq2iJnW1
Supports RS41 and DFM09 so far. pic.twitter.com/XEK4tci3Vd
Gerrit's weather station wirelessly displays data on a wirelessly connected LCD screen, but he notes how difficult it is to view historical data, or to graph trends. Having discovered that the rtl_433 RTL-SDR decoder supports his particular weather station (a Fine Offset Electronics WH1080/WH3080 compatible Weather Station (Alecto WS-4000)), Gerrit decided to write some code to log data to a SQL database, and display that data via a Python Dash.plotly web interface. The RTL-SDR, rtl_433 and custom software all run on a Raspberry Pi.
The interface allows Gerrit to view live and historical data all on neatly plotted graphs. HIs complete open source code can be found on Github.
The La Crosse weather station system consists of a LCD base station, and various wireless sensors. Ryan first discovered that the devices used the 915 MHz frequency band via details written on the device itself. His next step was to open up Universal Radio Hacker and use one of his SDRs to record a packet. URH then allowed him to convert that data into bits for packet analysis. The rest of his post goes into detail on how he set the symbol rate, discovered the preamble and reverse engineered the CRC code.
The next step he took was to generate a spoofed packet generated by URH and transmitted by the PlutoSDR. This allowed him to set the base station display to any temperature that he specified. But he ran into a problem where only the first packet he sent after power up was received. Eventually he discovered that the system sets a randomized interval for each of the transmitters at startup, and data outside of that interval is ignored.
Ryan's post explains his whole though process and progress in detail, so is an excellent study for anyone looking to get into reverse engineering wireless signals.
SDRAngel is a general purpose software defined radio program that is compatible with most SDRs including the RTL-SDR. We've posted about it several times before on the blog, however we did not realize how much progress has occurred with developing various built in plugins and decoders for it.
Thanks to Jon for writing in and sharing with us a demonstration video that the SDRAngel team have released on their YouTube channel. From the video we can see that SDRAngel now comes stock with a whole host of built in decoders and apps for various radio applications making it close to an all-in-one SDR platform. The built in applications include:
ADS-B Decoder: Decodes aircraft ADS-B data and plots aircraft positions on a map
NOAA APT Decoder: Decodes NOAA weather satellite images (in black and white only)
DVB-S: Decodes and plays Digital TV DVB-S and DVB-S2 video
AIS: Decodes marine AIS data and plots vessel positions on a map
VOR: Decodes VOR aircraft navigational beacons, and plots bearing lines on a map, allowing you to determine your receivers position.
DAB+: Decodes and plays DAB digital audio signals
Radio Astronomy Hydrogen Line: With an appropriate radio telescope connected to the SDR, integrates and displays the Hydrogen Line FFT with various settings, and a map of the galaxy showing where your dish is pointing. Can also control a dish rotator.
Radio Astronomy Solar Observations: Similar to the Hydrogen line app, allows you to make solar measurements.
Broadcast FM: Decoding and playback. Includes RDS decoding.
Noise Figure Measurements: Together with a noise source you can measure the noise figure of a SDR.
The idea behind the attack is that ethernet cables can act as an antenna, leaking signals at frequencies which can easily be sniffed by a SDR. The specific technique in the paper does not decode normal network traffic, instead it requires that malicious code which modulates a custom signal over the ethernet cable be installed on the PC first. The technique used appears to be similar to what the Etherify software by SQ5BPF uses, which modulates data in morse code by turning the network card on and off.
On this weeks Frugal Radio YouTube video, Rob explores how to decode Fire, Ambulance and Hospital pager data using SDR++ and PDW. In the video Rob first explains what applications pagers are used for in 2021 and how they're typically received with pager or MDT hardware terminals mounted in fire and ambulance trucks.
He then goes on to show how we can receive and decode these pager messages using an RTL-SDR, SDR++, VB-Cable and the PDW pager decoder. The tutorial shows how to set up SDR++ settings for pager reception, how to install and setup PDW and how to interface the two programs with VB-Cable. Finally Rob explains how to fully understand some of the messages that you might receive.
Decoding Fire & Ambulance MDT data & hospital pages with a $10 SDR Radio