Over on YouTube the web show Hacker Warehouse have created a video explaining wireless pagers and how RTL-SDRs can be used to sniff them. In the video host Troy Brown starts by explaining what pagers are and how they work, and then he shows how to decode them with SDR# and PDW. We have a tutorial on this project available here too.
Later in the video he shows some examples of pager messages that he's received. He shows censored messages such as hospital patient data being transmitted in plain text, sports scores, a memo from a .gov address claiming allegations of abuse from a client, office gossip about a hookup, a message about a drunk man with a knife, a message from a Windows server with IP address and URL, a message from a computer database, and messages from banks.
In the past we've also seen an art installation in New York which used SDR to highlight the blatant breach of privacy that these pager messages can contain.
Over on Twitter and his github.io page, Pieter Noordhuis (@pnoordhuis) has shared details about his low cost RTL-SDR based GOES satellite receiving setup. GOES 15/16/17 are geosynchronous weather satellites that beam back high resolution weather images and data. In particular they send beautiful high resolution 'full disk' images which show one side of the entire earth. As the satellites are in geosynchronous orbit, they are quite a bit further away from the earth. So compared to the more easily receivable low earth orbit satellites such as the NOAA APT and Meteor M2 LRPT satellites, a dish antenna, good LNA and possibly a filter is required to receive them. However fortunately, as they are in a geosynchronous orbit, the satellite is in the same position in the sky all the time, so no tracking hardware is required.
In the past we've seen people receive these images with higher end SDRs like the Airspy and SDRplay. However, Pieter has shown that it is possible to receive these images on a budget. He uses an RTL-SDR, a 1.9 GHz grid dish antenna from L-Com, a Raspberry Pi 2, the NooElec 'SAWBird' LNA, and an additional SPF5189Z based LNA. The SAWBird is a yet to be released product from NooElec. It is similar to their 1.5 GHz Inmarsat LNA, but with a different SAW filter designed for 1.7 GHz GOES satellites. The total cost of all required parts should be less than US $200 (excluding any shipping costs).
Pieter also notes that he uses the stock 1.9 GHz feed on the L-com antenna, and that it appears to work fine for the 1.7 GHz GOES satellite frequency. With this dish he is able to receive all three GOES satellites at his location with the lowest being at 25 degrees elevation. If the elevation is lower at your location he mentions that a larger dish may be required. It may be possible to extend the 1.9 GHz L-Band dish for better reception with panels from a second cheaper 2.4 GHz grid dish, and this is what @scott23192 did in his setup.
For software Pieter uses the open source goestools software that Pieter himself developed. The software is capable of running on the Raspberry Pi 2 and demodulating and decoding the signal, and then fully assembling the decoded signal into files and images.
Thank you to Christopher for submitting to us an article that he's written for a project of his that demonstrates how vulnerable vehicle keyless entry systems are to jam and replay attacks. In the article he explains what a jam and replay attack is, the different types of keyless entry security protocols, and how an attack can be performed with low cost off the shelf hardware. He explains a jam and replay attack as follows:
The attacker utilises a device with full-duplex RF capabilities (simultaneous transmit and receive) to produce a jamming signal, in order to prevent the car from receiving the valid code from the key fob. This is possible as RKEs are often designed with a receive band that is wider than the bandwidth of the key fob signal (refer Figure 3, right). The device simultaneously intercepts the rolling code by using a tighter receive band, and stores it for later use. When the user presses the key fob again, the device captures the second code, and transmits the first code, so that the user’s required action is performed (lock or unlock) (Kamkar, 2015). This results in the attacker possessing the next valid rolling code, providing them with access to the vehicle. The process can be repeated indefinitely by placing the device in the vicinity of the car. Note that if the user unlocks the car using the mechanical key after the first try, the second code capture is not required, and the first code can be used to unlock the vehicle.
In his demonstrating the attack he uses the RTL-SDR to initially find the frequency that they keyfob operates at and to analyze the signal and determine some of it's properties. He then uses a Raspberry Pi running RPiTX to generate a jamming signal, and the YardStick One to capture and replay the car keyfob signal.
Jam and Replay Hardware: Raspberry Pi running RpiTX for the Jamming and a Yardstick One for Capture and Replay.
Over on YouTube radio content creator Techminds has recently started a series that shows how to decode various signals using an SDR such as the SDRplay RSP1A. The first video explains what FT-8 is and shows how to decode it using the WSJT-X software. FT-8 is a modern digital HF ham mode that is designed to be receivable even in weak signal reception. However, the amount of information sent in a FT-8 message is small, so it is not possible to have a full conversation, and you can only make contacts.
In his second video Tech Minds explains RTTY and also shows how to decode it. RTTY is another much older mode that is used by the military as well as hams. To decode it he uses Digital Master 780 which is a program included in the Ham Radio Deluxe software.
Decoding FT-8 With WSJT-X And A SDRplay RSP1A SDR Receiver
Decoding RTTY With Digital Master And A SDRplay RSP1A SDR Receiver
Welle.io is a Windows/Linux/MacOS/Android/Raspberry Pi compatible DAB and DAB+ broadcast radio decoder which supports RTL-SDR dongles, as well as the Airspy and any dongle supported by SoapySDR. It is a touch screen friendly piece of software which is excellent for use on tablets, phones and perhaps on vehicle radio touch screens.
DAB stands for Digital Audio Broadcast and is a digital signal that is available in many countries outside of the USA. The signal contains digital broadcast radio stations, and is an alternative/replacement for standard broadcast FM.
Early last year we posted about Welle.io a couple of times, but now the software has reached maturity as version 1.0 has just been released. Author Albrech writes to us:
We fixed a lot of bugs again and added the translation to Hungarian, Norwegian, Italian and French.
Binary packages are available for Windows, Linux and Android (APK and Play store). The macOS support is possible via Homebrew and we now that welle.io runs also on a Rapsberry Pi 2 and newer.
For questions and support please feel free to use the new forum (https://forum.welle.io).
Over on his YouTube channel user Andy Clarke has uploaded a video where he demonstrates his HackRF being used as a wideband spectrum analyzer with the HackRF Spectrum Analyzer software. About a year ago the HackRF team released a new firmware update which enabled the HackRF to be able to sweep through the frequency spectrum at a rate of up to 8 GHz per second. This allowed the HackRF to be used as a wideband spectrum analyzer which is able to display an arbitrarily large swath of spectrum. Shortly after the firmware update spectrum analyzer program by 'pavsa' was released on GitHub.
In the video Andy demonstrates the HackRF being used to view the WiFi band and show a 2.4 GHz WiFi connection between a drone and it's controller. He also shows it working with a handheld radio and the uplink of his mobile phone. Andy hopes to use the HackRF to avoid losing his drones due to interference.
Thanks to Andrey for writing in and showing us his Java based Meteor-M decoder for the RTL-SDR which he uses on a Raspberry Pi. The decoder is based on the meteor-m2-lrpt GNU Radio script and the meteor_decoder which he ported over to Java. Essentially what he's done is port over to Java a bunch of GNU Radio blocks as well as the meteor decoder. The ported Java blocks could also be useful for other projects that want to be cross platform or run without the need for GNU Radio to be installed.
In his blog post (blog post is in Russian, use Google Translate for English) Andrey explains his motivation for writing the software which was that the Windows work flow with SDR# and LRPTofflineDecoder is quite convoluted and cannot be run headless on a Raspberry Pi. He then goes on to explain the decoding algorithm, and some code optimizations that he used in Java to speed up the decoding. Andrey notes that his Java version is almost 2x slower compared to the GNU Radio version, but still fast enough for real time demodulation.
Meteor-M2 is a Russian weather satellite that operates in the 137 MHz weather satellite band. With an RTL-SDR and satellite antenna these images can be received. Running on a Raspberry Pi allows you to set up a permanent weather satellite station that will consistently download images as the satellite passes over.
Images received with Andry's Meteor-M software running on a Raspberry Pi.
Last week we posted about the release of a new TETRA decoder plugin for SDR#. The plugin made setting up a TETRA decoder significantly easier compared to previous methods, but it still required the installation and use of the MSYS2 environment on Windows.
Thanks to reader Zlati for letting us know that the TETRA plugin has recently been updated once again and now no longer requires MSYS2 to be installed first. Now it is as easy to install as any other plugin, just drop the .dlls into the SDR# folder and add the magicline to the plugins.xml file. We tested it out and decoding worked fine. At the moment the "Net info" button is not working however.
In the future news and download lines for newer versions will probably be available on the programmers radioscanner.ru forum thread which is available here (use Google Translate to read): http://www.radioscanner.ru/forum/topic50051-9.html
