A few readers have written in to let us know the role SDRs played in the last season of "Mr. Robot". The show which is available on Amazon Prime is about "Mr. Robot", a young cyber-security engineer by day and a vigilante hacker by night. The show has actual cyber security experts on the team, so whilst still embellished for drama, the hacks performed in the show are fairly accurate, at least when compared to other TV shows.
Spoilers of the technical SDR hacks performed in the show are described below, but no story is revealed.
In the recently aired season 4 episode 9, a character uses a smartphone running an SSH connection to connect to a HackRF running on a Raspberry Pi. The HackRF is then used to jam a garage door keyfob operating at 315 MHz, thus preventing people from leaving a parking lot.
Shortly after she can be seen using the HackRF again with Simple IMSI Catcher. Presumably they were running a fake cellphone basestation as they use the IMSI information to try and determine someones phone number which leads to being able to hack their text messages. The SDR used in the fake basestation appears to have been a bladeRF.
HackRF Used on Mr Robot
In season 4 episode 4 GQRX and Audacity can be seen on screen being used to monitor a wiretap via rtl_tcp and an E4000 RTL-SDR dongle.
E4000 RTL-SDR Being used for Wiretap Monitoring
Did we miss any other instances of SDRs being used in the show? Or have you seen SDRs in use on other TV shows? Let us know in the comments.
If you've been following our blog over the years, you'll know that we've mentioned the "Outernet" (now known as "Othernet") service a few times. Othernet is a satellite service that wants to provide one way data such as news, weather, audio, books and Wikipedia articles to those in areas with poor, censored or no internet connection. Previous iterations made use of home satellite TV equipment, then L-band (with RTL-SDR receivers) and now the Ku-band with LoRa receivers. Currently it's only available in North America and Europe.
However, thanks to a reader we were recently informed about an interesting and long running Othernet-like service for the Middle East called "Toosheh" (aka Knapsack) which makes use of satellite TV dishes and receivers that are very common in the Middle East. While not specifically related to SDRs, this is an interesting RF related project and situation that we wanted to post about.
After two rough weeks of no internet access at all, finally, we're gaining access again and getting back online slowly. As you may know (if you are following the news) a complete internet shutdown conducted by the I.R. of Iran due to some intense protests across the whole country against the government because of a 200% sudden and unannounced gas price increment. The internet is censored in my country anyhow but this time it was a big one. We only had access to a few domestic websites and NOT even Google services! That was tough!
I know it may be irrelevant to the subject of your blog but it's good for your audience to understand and know the people who have worked hard way before the OUTERNET project to develop a satellite offline broadcast with almost no special devices to receive and use and bring free and uncensored information to the people in Iran.
The major role of the Toosheh project occurred in the Iran 2012 presidential election protests which there were no major broadband internet services all over the country and it a lot to bring daily updates of news and TV programs. The Toosheh is a one-way receive only from the satellite but the tricky part is that Toosheh is not just like a simple satellite data link but it appears as a TV channel in all satellite TV receivers which are very common in Iran, so the blockage of it is hard for the government. However, some trials were arranged by the government back in that time to collect the satellite dishes or jam the signals or mass destruction (!) of the satellite receivers which they currently no longer common in most parts of the country. (at least without unnecessary violence. check out this link: بجستان نیوز » معدوم سازی تجهیزات ماهوارهای در بجستان+عکس(Admin note: Article is in Perisian, use Google Translate to translate Persian to English)
The procedure to use this service is freaking simple. Set your dish to Yahsat and search for the channels on 11766 Mhz. Select the Toosheh channel, plug a flash drive to your receiver and record the blank screen in.TS format using the PVR capability. After several hours of recording unplug your flash drive and connect it to your phone, tablet or laptop. Then open the Toosheh app and you are good to go. Now you have access to dozens of free podcasts, music, books, movies, news, webpages, TV shows and much more that will be updated every single day and if you need something specifically just send them an email. Exactly as same as the OUTERNET but without any special equipment and only with ordinary receivers that are available in almost every home nowadays.
Also if you see their website at toosheh.org and search some other press blogs about Toosheh you can gain more info about the topic.
Toosheh Website Image
We also note that this appears to be the English language version of Toosheh project which provides some more information about coverage and the technology used: https://knapsackforhope.org. Coverage is only available in the middle east.
Suspecting interference generated by the HDMI clock, Mike Walters (@assortedhackery) used a HackRF and a near field probe antenna to investigate. By placing the near field probe on the Raspberry Pi 4's PCB and running a screen at 1440p resolution he discovered a large power spike showing up at 2.415 GHz. This interferes directly with 2.4 GHz WiFi Channel 1.
There's an interesting story doing the rounds about the Raspberry Pi 4 WiFi not working at higher HDMI resolutions. I had a quick look with a HackRF & near-field probe and there's definitely a big spike that stamps right on channel 1 pic.twitter.com/FXRebYYJxw
There’s a giant spike that could easily interfere with Channel 1 of a Wi-Fi adapter. So why is this happening? Because a 2560×1440@60Hz has a pixel clock of 241.5MHz and has a TMDS (transition-minimized differential signaling) clock of 2.415GHz, according to Hector Martin (@Marcan42). And what frequency does the RBP4 use for Wi-Fi? 2.4GHz. Which means… outputting on HDMI over 1440p can cause interference in a Wi-Fi channel.
The ExtremeTech article also notes that this problem is not unique to the Raspberry Pi 4 only. It turns out that USB 3.0 hardware is to blame, and this problem has occurred before with USB3.0 hard driver and on some MacBooks.
While the interference appears to be localized to the near field around the Pi4 PCB, we suspect that you could use TempestSDR to remotely eavesdrop on the Pi 4's video output if the interfering signal was boosted.
Talks from this years DEF CON 27 conference which was held back in August are now available on YouTube. DEFCON is a yearly conference that a focuses on information security topics and often includes talks about SDRs and other wireless radio topics too. In particular we wanted to highlight the the DEF CON 27 Wireless Village playlist which contains numerous talks related to wireless, radio and SDRs.
Most talks from the wireless village relate to WiFi, but one talk with some very useful information that we really enjoyed was "Antennas for Surveillance" by Alex Zakhorov.
We will cover the various kinds of antennas available to optimized your SDR radio for different types of spectrum monitoring. We will also explain why RF filters are necessary on most SDR's and when Low Noise Amplifiers help, and when Low Noise Amplifiers hurt reception.
Kent Britain/WA5VJB - Antennas for Surveillance - DEF CON 27 Wireless Village
Another interest talk was called "The Ford Hack Raptor Captor video" by Dale Wooden (Woody) where he shows how he used an RTL-SDR and HackRF to hack a Ford car key fob. If you're interested we wrote about the Hak5 videos on this hack in a previous post.
This talk will show flaws with development of security protocols in New Ford key fobs. This will exploit several areas. The ability for a denial of service to the keyfob WITHOUT jamming. How to trick the vehicle into resetting its rolling code count. How to lock, unlock, start, stop, and open the trunk of ford vehicles using a replay attacked after resetting rolling code count. How to find the master access code for Fords keypad to bypass security. This talk will also demonstrate how to reset your key fobs if they are attacked by a deauth attack. We will also demonstrate gnu-radio script to automate RF collection of Ford key fobs. As seen on HAK5 episodes 2523-2525
Woody - The Ford Hack Raptor Captor video - DEF CON 27 Wireless Village
Outside of the Wireless village there were also some interesting SDR topics including this talk titled "SDR Against Smart TVs URL Channel Injection Attacks" by Pedro Cabrera Camara. If you're interested we also wrote about Pedro's work in a previous post.
Software-defined-radio has revolutionized the state of the art in IoT security and especially one of the most widespread devices: Smart TV. This presentation will show in detail the HbbTV platform of Smart TV, to understand and demonstrate two attacks on these televisions using low cost SDR devices: TV channel and HbbTV server impersonation (channel and URL injection). This last attack will allow more sophisticated remote attacks: social engineering, keylogging, crypto-mining, and browser vulnerability assessment.
Pedro Cabrera Camara - SDR Against Smart TVs URL Channel Injection Attacks - DEF CON 27 Conference
Over on YouTube channel Tech Minds has uploaded a short tutorial video that shows how to perform a replay attack with a HackRF and the Universal Radio Hacker software. A replay attack is when you record a control signal from a keyfob or other transmitter, and replay that signal using your recording and a TX capable radio. This allows you to take control of a wireless device without the original keyfob/transmitter. This is easy to do with simple wireless devices like doorbells, but not so easy with any system with rolling codes or more advanced security like most car key fobs.
In the video Tech Minds uses the Universal Radio Hacker software to record a signal from a wireless doorbell, save the recording, replay it with the HackRF, and also analyze it.
Universal Radio Hacker - Replay Attack With HackRF
Over on YouTube user HackedExistence has uploaded a video explaining how POCSAG pager signals work, and he also shows some experiments that he's been performing with his HackRF PortaPack and an old pager.
The Portapack is an add on for the HackRF SDR that allows the HackRF to be used without the need for a PC. If you're interested in the past we reviewed the PortaPack with the Havok Firmware, which enables many TX features such as POCSAG transmissions.
POCSAG is a common RF protocol used by pagers. Pagers have been under the scrutiny of information security experts for some time now as it is common for hospital pagers to spew out unencrypted patient data [1][2][3] into the air for anyone with a radio and computer to decode.
In the video HackedExistence first shows that he can easily transmit to his pager with the HackRF PortaPack and view the signals on the spectrum with an RTL-SDR. Later in the video he explains the different types of pager signals that you might encounter on the spectrum, and goes on to dissect and explain how the POCSAG protocol works.
Canadian based researchers from the "Open Privacy Research Society" recently rang the alarm on Vancouver based hospitals who have been broadcasting patient data in the clear over wireless pagers for several years. These days almost all radio enthusiasts know that with a cheap RTL-SDR, or any other radio, it is possible to receive pager signals, and decode them using a program called PDW. Pager signals are completely unencrypted, so anyone can read the messages being sent, and they often contain sensitive pager data.
Open Privacy staff disclosed their findings in 2018, but after no action was taken for over a year they took their findings to a journalist.
Encryption is available for pagers, but upgrading the network and pagers to support it can be costly. Pagers are also becoming less common in the age of mobile phones, but they are still commonly used in hospitals in some countries due to their higher reliability and range.
In the past we've seen several similar stories, such as this previous post where patient data was being exposed over the pager network in Kansas City, USA. There was also an art installation in New York called Holypager, that continuously printed out all pager messages that were received with a HackRF for gallery patrons to read.
HolyPager Art Installation. HackRF One, Antenna and Raspberry Pi seen under the shelf.
Over on YouTube Black Hills Information Security (aka Paul Clark) has uploaded a one hour long presentation that shows how to use a software defined radio to reverse engineer digital signals using GNU Radio.
One of the most common uses of Software Defined Radio in the InfoSec world is to take apart a radio signal and extract its underlying digital data. The resulting information is often used to build a transmitter that can compromise the original system. In this webcast, you'll walk through a live demo that illustrates the basic steps in the RF reverse engineering process, including:
- tuning - demodulation - decoding - determining bit function - building your own transmitter - and much, much more!
