Category: PlutoSDR

Running a Tesla Model 3 on Autopilot off the Road with GPS Spoofing

Regulus is a company that deals with sensor security issues. In one of their latest experiments they've performed GPS spoofing with several SDRs to show how easy it is to divert a Tesla Model 3 driving on autopilot away from it's intended path. Autopilot is Tesla's semi-autonomous driving feature, which allows the car to decide it's own turns and lane changes using information from the car's cameras, Google Maps and it's Global Navigation Satellite System (GNSS) sensors. Previously drivers had to confirm upcoming lane changes manually, but a recent update allows this confirmation to be waived.

The Regulus researchers noted that the Tesla is highly dependent on GNSS reliability, and thus were able to use an SDR to spoof GNSS signals causing the Model 3 to perform dangerous maneuvers like "extreme deceleration and acceleration, rapid lane changing suggestions, unnecessary signaling, multiple attempts to exit the highway at incorrect locations and extreme driving instability". Regarding exiting at the wrong location they write:

Although the car was a few miles away from the planned exit when the spoofing attack began, the car reacted as if the exit was just 500 feet away— slowing down from 60 MPH to 24 KPH, activating the right turn signal, and making a right turn off the main road into the emergency pit stop. During the sudden turn the driver was with his hands on his lap since he was not prepared for this turn to happen so fast and by the time he grabbed the wheel and regained manual control, it was too late to attempt to maneuver back to the highway safely.

In addition, they also tested spoofing on a Model S and found there to be a link between the car's navigation system and the automatically adjustable air suspension system. It appears that the Tesla adjusts it's suspension depending on the type of road it's on which is recorded in it's map database.

In their work they used a ADALM PLUTO SDR ($150) for their jamming tests, and a bladeRF SDR ($400) for their spoofing tests. Their photos also show a HackRF.

Regulus are also advertising that they are hosting a Webinar on July 11, 2019 at 09:00PM Jerusalen time. During the webinar they plan to talk about their Tesla 3 spoofing work and release previously unseen footage.

GPS/GNSS spoofing is not a new technique. In the past we've posted several times about it, including stories about using GPS spoofing to cheat at Pokémon Go, misdirect drivers using Google Maps for navigation, and even a story about how the Russian government uses GPS spoofing extensively.

Some SDR tools used to spoof the Tesla Model 3.
Some SDR tools used to spoof the Tesla Model 3.

SignalsEverywhere: What SDR To Buy? Choose the Right one For You

Over on his YouTube channel SignalsEverywhere, Corrosive has just released a new video titled "Software Defined Radio Introduction | What SDR To Buy? | Choose the Right one For You". The video is an introduction to low cost software defined radios and could be useful if you're wondering which SDR you should purchase.

The video includes a brief overview of the Airspy, KerberosSDR, PlutoSDR, LimeSDR Mini, HackRF, SDRplay RSPduo and various RTL-SDR dongles. In addition to the hardware itself Corrosive also discusses the compatible software available for each SDR.

Software Defined Radio Introduction | What SDR To Buy? | Choose the Right one For You

SignalsEverywhere: Running PlutoSDR over an Ethernet Network Connection

Over on YouTube Corrosive from his SignalsEverywhere channel has just uploaded a new video showing us how to run a PlutoSDR over an Ethernet connection. As the PlutoSDR does not have an Ethernet port built in he uses a USB to Ethernet adapter. The rest of the video shows how to configure the IP address settings in the PlutoSDR config files, and in Windows.

The PlutoSDR is a low cost (typically priced anywhere between $99 - $149 depending on sales) RX/TX capable SDR with up to 56 MHz of bandwidth and 70 MHz to 6 GHz frequency range. It also has an onboard FPGA and ARM Cortex-A9 CPU which can be used to run programs on the PlutoSDR itself.

It is possible to run streaming software such as OpenWebRX directly on the PlutoSDR's CPU. Using an Ethernet connection can help with having enough network bandwidth to serve multiple users over the internet.

PlutoSDR over Network With USB Ethernet Tutorial

SingalsEverywhere: Running OpenWebRX on a PlutoSDR with PlutoWEB Firmware

Over on YouTube Corrosive from the SignalsEverywhere channel has uploaded a new video that shows how to install the the PlutoWEB Firmware on a PlutoSDR, which allows OpenWebRX to run directly on the PlutoSDR itself. OpenWebRX is a SDR streaming platform that enables people to connect to the SDR remotely over the internet. Multiple users can access the SDR at the same time as well. Many public OpenWebRX servers running on KiwiSDRs can be found at sdr.hu as the KiwiSDR uses it by default.

The PlutoSDR is a low cost (typically priced anywhere between $99 - $149 depending on sales) RX/TX capable SDR with up to 56 MHz of bandwidth and 70 MHz to 6 GHz frequency range. It also has an onboard FPGA and ARM Cortex-A9 CPU which can be used to run programs on the PlutoSDR itself.

Corrosive's video shows us how to install PlutoWEB which is an unofficial firmware package for the PlutoSDR. It comes preinstalled with many programs such as OpenWebRX and dump1090. He then shows how to set up OpenWebRX and then shows a demo of it in action.

OpenWebRX via PlutoSDR using PlutoWEB Firmware

SignalsEverywhere: SDR Console V3 Transmitting with PlutoSDR

Over on YouTube Corrosive from the SignalsEverywhere YouTube channel has uploaded a video showing us how to use SDR-Console V3 and a PlutoSDR to transmit ham radio voice. In the video he sets his PlutoSDR to transmit from his microphone at 445.5 MHz, and to receive at 434 MHz. He is then able to talk to a friend using a handheld who is receiving at 445.5 MHz and transmitting at 434 MHz.

SDR Console v3 Transmitting With PlutoSDR

SignalsEverywhere: SDRAngel PlutoSDR Transmit Tutorial

Over on his YouTube channel SignalsEverywhere, Corrosive has uploaded a new video tutorial showing us how to transmit with a PlutoSDR and SDRAngel. His tutorial goes over the initial set up steps, selecting a modulator and changing modulator settings. He then goes on to demonstrate transmitting CW Morse code, using a CTCSS squelch tone and transmitting a Robot36 SSTV image via Virtual Audio Cable and MMSSTV.

SDRAngel Transmit Tutorial with PlutoSDR

Using Two PlutoSDR’s for Full Duplex Packet Radio Communications

Over on his channel SignalsEverywhere, Corrosive has uploaded a video showing us how we can create a full duplex packet radio communications system using two PlutoSDRs. Full duplex is the ability to transmit and receive at the same time. A single PlutoSDR is only half-duplex/simplex because it can only either receive or transmit at any one time. The PlutoSDR is a low cost (typically $99 - $149) RX/TX capable SDR with up to 56 MHz of bandwidth and 70 MHz to 6 GHz frequency range. 

On his video Corrosive explains how full duplex operation is desirable for amateur packet radio communications as it allows for faster and more continuous exchanges.  Demonstrations are performed with his PlutoSDR, SoundModem, EasyTerm, and SDRAngel. Later in the video he also speculates how it might be possible to do things like IP networks via the amateur radio bands with full duplex SDRs.

Full Duplex Radio Communication with PlutoSDR Tutorial

SignalsEverywhere PlutoSDR Videos: Applying the Frequency Extension and Dual Core CPU Hacks and Running on SDR#

Over on the SignalsEverywhere YouTube channel, Corrosive has uploaded two new videos about the PlutoSDR. The PlutoSDR is a low cost (typically $99 - $149) RX/TX capable SDR with up to 56 MHz of bandwidth and 70 MHz to 6 GHz frequency range. It also has an onboard FPGA and ARM Cortex-A9 CPU.

By default the bandwidth and frequency range of the PlutoSDR is limited to only 20 MHz and 325 MHz - 3.8 GHz. A minor hack which requires some commands to be input via a terminal screen is required to unlock its full potential, and in the first video Corrosive runs through how this hack can be applied. He also shows an additional hack which unlocks a second CPU core which can be useful for increasing the available CPU power for apps running on the PlutoSDR's ARM processor.

In the second video Corrosive shows how to install the PlutoSDR SDR# plugin, which allows the PlutoSDR to run in SDR#. He then shows how to actually use the plugin to connect to the PlutoSDR.

Adalm Pluto SDR Tutorial: 70Mhz to 6Ghz and Dual Core CPU Modification

Adalm Pluto SDR Sharp Plugin Tutorial ~ [Infamous SDR# on Your Pluto]