Over on YouTube user Samy Kamkar has uploaded a video showing how he was able to use an RTL-SDR to copy his friends wireless doorbell signal and prank him by replaying it using an Arduino and 433 MHz transmitter. His video goes through the entire reverse engineering process he used from recording the wireless doorbell signal with the RTL-SDR, to analyzing and understanding the signal and finally to programming the Arduino with the code to replicate the doorbell signal. If you don’t like video explanations, Samy has also done a write up of the same material on his website.
Digital Ding Dong Ditch Prank - hacking wireless doorbells w/Arduino and RTL-SDR
Earlier this year the American TV show Good Morning America featured a segment on software defined radios being used to break into houses with wireless alarm sensors. The story is based on a Defcon 2014 paper “Home Insecurity: No Alarms, False Alarms, and SIGINT” by Logan Lamb. In the TV segment Logan shows how he uses a USRP software defined radio to send a false alarm signal, jam a wireless sensor and finally to record sensor activation data from the alarm system.
Although Logan used a USRP, the same attack could be done with the cheaper HackRF.
SDR HackRf: Home Insecurity: No Alarms, False Alarms, and SIGINT
Recently RTL-SDR.com reader DE8MSH wrote in to let us know about his experiments with receiving WSPR with his RTL-SDR. WSPR is an acronym for “weak signal propagation reporter” and is a software program and RF protocol designed for very weak signal radio communications between ham radio users. With less than 5W of transmitting power, a WSPR signal could potentially be copied all over the world.
To receive WSPR, DE8MSH used a direct sampling modified RTL-SDR dongle together with a 9:1 unun, 10m RG58 coax cable from RTL-SDR to unun and a 12m wire antenna outside his house. Then by using SDR# together with the WSPR software he is able to copy signals from all over Europe and Canada/USA from his home in Germany.
Some Received WSPR LocationsWSPR Report InformationThe WSPR Software
Over on YouTube user BSoD Badgers has uploaded a video showing his reception of FreeDV digital speech at 14 MHz. He uses SDR# combined with the FreeDV software to decode the signal.
FreeDV is a open source software application that allows digital speech to be sent at HF frequencies in a 1.25 kHz wide signal. The same software can be used on the receiving end to decode the signal into speech.
To gather the power usage data he used an RTL-SDR connected to a PC running rtlamr, which is software that can read data from ERT compatible power meters that transmit in the 900 MHz ISM band. He also uses some custom code he wrote that automatically plots the data over time and allows him to integrate it with his home automation system. In addition to his post he also uploaded a video shown below that shows his system in action.
Monitoring house power using a $20 RF RTLSDR USB stick
Over on YouTube user Jane feverlay has uploaded a video showing a new AIS decoder called AISRec for Windows that he has developed.
AIS is an acronym for Automatic Identification System and is a system used by ships to broadcast position and vessel information. By monitoring AIS transmissions with the RTL-SDR we can build a boat radar system. We have a tutorial on this here.
The new software is not free, but he offers a trial version that limits the run time to 20 minutes and 5000 max messages. The paid version removes these limits and also decodes both AIS channels simultaneously. The program monitors data from the RTL-SDR and sends decoded data out via UDP. Software such as OpenCPN can then be used to display the AIS data on a map.
We tested the trial version on our machine and found that it worked well at decoding AIS messages. To download the trial go to http://pan.baidu.com/s/1pJiEzEV and enter the code kn44. The download site is in Chinese, but it is obvious where to enter the code. We found the software to be virus free, but remember to always scan unknown software like this yourself. The full price of the software is unknown, but purchasing instructions are given in the trial download readme. The author also writes that his software now supports the Airspy, but not in the trial version.
Note that we discovered that the software doesn’t use a PPM correction setting as expected. Instead it uses a frequency shift setting. To set the shift in the AISRec.ini file, we had to calculate freqshift = 162.025 MHz – frequency of the second AIS channel as shown in SDR# with no PPM correction set.
Over a year ago we wrote a tutorial on how to analyze GSM cellular phone signals using a RTL-SDR, a Linux computer with GNU Radio, Wireshark and a GSM decoder called Airprobe. With this combination it is possible to easily decode GSM system messages. Setting up Airprobe is can be difficult as it is unmaintained and incompatible with the new version of GNU Radio without patches.
Now a new software package called gr-gsm has been released on GitHub which seems to be a newer and improved version of Airprobe. The gr-gsm software is also much easier to install, uses the newer GNU Radio 3.7 and seems to decode the system data with much less trouble than Airprobe did. We will soon update our tutorial to use gr-gsm, but the instructions on the GitHub are already quite good. The author of gr-gsm also appears to be actively adding new features to the software as well. The video below shows gr-gsm in action.
Sniffing GSM data with gr-gsm and cheap RTL-SDR receivers
NOTE: There is now a plugin available for SDR# that will decode TETRA fairly easily. It is still in beta and misses a few features found in telive. Check it out in this post.
TETRA is a trunked radio communications system that stands for "Terrestrial Trunked Radio". It is used heavily in many parts of the world, except for the USA. Recently, a software program called Tetra Live Monitor (telive) was released on GitHub. This software can be used along with the (patched) Osmo-TETRA software to monitor and listen to unencrypted TETRA communications.
Below we show a tutorial on how to listen to TETRA communications using a RTL-SDR RTL2832U software defined radio. This tutorial is based heavily on the telive_doc.pdf file that is written by the author of telive and included in the telive git download. Please refer to that pdf file for further details on how the software works. We have modified their tutorial slightly to make it a little easier to understand. As this code is still under heavy development if you have trouble please check their PDF file for modifications to the procedures.
Most of this tutorial is performed in Linux and we assume that you have some decent Linux experience. We also assume you have some experience with the RTL-SDR dongle and have a decent antenna capable of picking up TETRA signals in your area. If you don't have a RTL-SDR dongle yet see our Buy RTL-SDR dongles page.
Note: As of October 2016 there is now a Windows port of the Telive decoding software available. This may be an option for you if you prefer to run in Windows. More information here.
First, we will need to find some TETRA signals. The easiest way to do this is to open SDR# or another program like GQRX and look for them. TETRA signals are continuously broadcasting with a bandwidth of around 25 kHz. In most European countries they can be found at 390 - 470 MHz. In some countries they may be found around 850 MHz or 915 - 933 MHz. There may be several TETRA signals grouped in close proximity to one another. See the example images below.
A Zoomed in TETRA Signal
A Grouping of TETRA Signals Zoomed Out
An example audio clip of a TETRA signal recorded in NFM mode is shown below.
Once you have found some TETRA signals, record their frequencies. Now close SDR#, or whatever software you were using and boot into Linux. In this tutorial we use a 32-bit Ubuntu 14.04 virtual machine running on VMWare Player as our Linux system. Some of the commands may vary if you are using a different system.
