Category: HackRF

TechMinds: Demonstrating the QT-DAB Digital Audio Broadcast Decoder

Over on YouTube TechMinds has uploaded a video where he explores the QT-DAB software (formerly known as SDR-J), which is a program capable of decoding Digital Audio Broadcast (DAB) signals. QT-DAB is compatible with several SDRs including the RTL-SDR, HackRF, Airspy and SDRplay units. 

DAB stands for Digital Audio Broadcast and is a digital broadcast radio signal that is available in many countries outside of the USA. The digital signal encodes several radio stations, and it is considered a modern alternative or future replacement for standard analog broadcast FM.

In the video TechMinds explains how to download, install and use the software on a Windows machine. He goes on to demonstrate some DAB decoding in action with various SDRs and then shows how to connect QT-DAB to a remote RTL-SDR via rtl_tcp.

DAB Radio Decoder For SDR (RTL_SDR - HACKRF - AIRSPY)

DragonOS Updated: Now with OP25 Installed and many new YouTube Tutorials

Last month we posted about Aaron's "DragonOS" project, which is a ready to install Linux ISO aimed to make getting started with SDR software easy by providing several programs preinstalled, as well as providing multiple video tutorials. Recently he's updated the build, this time basing it on Lubuntu 18.04 allowing for Legacy and UEFI support, along with disk encryption. The OS supports RTL-SDRs as well as the HackRF and bladeRF and probably supports most other SDRs via the SoapySDR interface.

In terms of software he's also added OP25 and bladeRF support. Other programs pre-installed include rtl_433, Universal Radio Hacker, GNU Radio, Aircrack-ng, GQRX, Kalibrate, hackrf, wireshare, gr-gsm, rtl-sdr, HackRF, IMSI-catcher, Zenmap, inspectrum, qspectrumanalyzer, LTE-Cell-Scanner, CubicSDR, Limesuite, ShinySDR, SDRAngel, SDRTrunk, Kismet, BladeRF.

His DragonOS YouTube tutorial channel is also growing fast, with several tutorials showing you how to use DragonOS to perform tasks like listen to trunked mobile radios, use QSpectrumAnalyzer with a HackRF, receive NOAA APT weather satellite images, retrieve cellular network information via a rooted Samsung Galaxy S5, create a ShinySDR server with rtl_433 and how to capture and replay with a HackRF.

DragonOS running CubicSDR
DragonOS running CubicSDR

DragonOS: Debian Linux with Preinstalled Open Source SDR Software

Thank you to Aaron for submitting news about his latest project called "DragonOS" which he's been working on while in COVID-19 lock down. DragonOS is a Debian Linux based operating system which comes with many open source software defined radio programs pre-installed. It supports SDRs like the RTL-SDR, HackRF and LimeSDR.

Aaron's video below shows how to set up DragonOS in a VirtualBox, and he has two other videos on his channel showing how to set up ADS-B reception with Kismet, and how to run GR-RDS in GNURadio. He aims to continue with more tutorial videos that make use of the software installed on DragonOS in the near future.

DragonOS 10 Installer (download in description)

Screenshot of the GR-RDS Tutorial

Opening a Parking Barrier with a HackRF Portapack and a Replay Attack

Over on YouTube user kwon lee has uploaded a video demonstrating a replay attack against a parking barrier arm. The tools he uses are a HackRF and Portapack running the Havok firmware. A replay attack involves recording a control signal with the HackRF+Portapack, and then replaying it later with the transmit function of the HackRF. If no wireless security mechanism like rolling-codes are used, simply replaying the signal will result in the transmission being accepted by the controller receiver.

As he has access to the remote control he records the transmission that is sent when the open button is pressed on the remote. Later once outside he shows how transmitting with the HackRF+Portapack results in the barrier arm opening.

This reminds us of a previous post where we noted how a HackRF was used to jam a garage door keyfob to prevent people from leaving in the TV show "Mr. Robot".

RF Replay Attack _ Parking-Breaker via HackRFone+Portapack+havoc

SignalsEverywhere: Exploring Cable Modem Signals with Software Defined Radio

Over on YouTube SignalsEverywhere has just uploaded his latest video about using a HackRF and Airspy R2/Mini to explore the signals coming out of an internet cable modem's coax cable. In the video he performs a wideband scan with his Airspy R2 and the SpectrumSpy software which shows not only his, but the downstream signals from other users in his neighborhood on the cable network too.

Next using his HackRF with Spectrum Analyzer and the hackrf_sweep fast sweeping software, he was able to determine the uplink portion of his cable modem. By running an internet speed test in the background he was also able to visualize the increased cable data activity on the spectrum waterfall display.

The Secret Signals Hiding In Your Cable Modem | SDR Used to Sniff Cable Internet Modem Coax

Creating a Low Cost Ground Penetrating Radar with Two HackRFs

A ground penetrating radar (GPR) is a system that uses RF pulses between 10 to 2.6 GHz to image up to a few meters below the ground. A typical GPR system consists of a transmitting radio and antenna that generates the radar pulse aimed towards the ground, and a receiving radio that receives the reflected pulse.

GPR is typically used for detecting buried objects, determining transitions in ground material and detecting voids and cracks. For example, in construction it can be used to determine rebar locations in concrete, and in the military it can be used to detect non-metallic landmines and hidden underground areas. 

These GPR devices are usually very expensive, however researchers Jacek JENDO & Mateusz PASTERNAK from the Faculty of Electronics, Military University of Technology, Poland have released a paper detailing how two low cost HackRF software defined radios can be used to create a simple GPR.

Their system uses a step-frequency continuous waveform (SFCW) signal which scans over multiple frequencies over time, and  the software was written in GNU Radio. In their tests they were able to detect a dry block of sand buried 6 cm below the ground, and a wet block 20 cm below. 

Ground Penetrating Radar with two HackRF software defined radios.
Ground Penetrating Radar with two HackRF software defined radios.

Using HackRFs to Locate a UAV Transmitter via Signal Strength Analysis

During the 2019 IEEE International Symposium on Broadband Multimedia Systems and Broadcasting conference, authors Xuemei Huang, Kun Yan, Hsiao-Chun Wu and Yiyan Wu presented a research paper titled "Unmanned Aerial Vehicle Hub Detection Using Software-Defined Radio". In their work they describe how they were able to use three HackRFs to determine the location of a UAV drone transmitter. The method they use is fairly simple as it makes use of path loss propagation models to determine an estimated distance from each HackRF, so prior knowledge of the transmitter properties is still required.

The applications of unmanned aerial vehicles (UAVs) have increased dramatically in the past decade. Meanwhile, close-range UAV detection has been intriguing by many researchers for its great importance in privacy, security, and safety control. Positioning of the UAV controller (hub) is quite challenging but still difficult. In order to combat this emerging problem for public interest, we propose to utilize a software-defined radio (SDR) platform, namely HackRF One, to enable the UAV hub detection and localization. The SDR receiver can acquire the UAV source signals. The theoretical path-loss propagation model is adopted to predict the signal strength attenuation. Thus, the UAV hub location can be estimated using the modified multilateration approach by only three or more SDR receivers.

Unmanned Aerial Vehicle Hub Detection Using Software-Defined Radio

Using a HackRF for GPS Spoofing on Windows

Over on the TechMinds YouTube channel a new video titled "GPS Spoofing With The HackRF On Windows" has been uploaded. In the video TechMinds uses the GPS-SDR-SIM software with his HackRF to create a fake GPS signal in order to trick his Android phone into believing that it is in Kansas city.

In the past we've seen GPS Spoofing used in various experiments by security researchers. For example, it has been used to make a Tesla 3 running on autopilot run off the road and to cheat at Pokemon Go. GPS spoofing has also been used widely by Russia in order to protect VIPs and facilities from drones.

GPS Spoofing With The HackRF On Windows