One of the many uses of the RTL-SDR is as a random number generator for generating entropy. Entropy is needed in computing for many application such as in encryption and security.
Noel Bourke has written an article on his blog about using the RTL-SDR as an entropy source on Linux. Noel uses RTL-Entropy and shows how to set up Linux to use the RTL-SDR as the entropy source for /dev/random.
Wireless wall outlets are electrical outlets that can be turned on or off by a wireless remote. Fabien is an experimenter who was looking for a way to control the power of his home devices from a remote location using HTTP. He thought of building his own from scratch, but quickly realized that the device would need to be certified for insurance purposes. Instead he bought a cheap commercially made certified wireless wall outlet and reverse engineered the protocol using an RTL-SDR.
To do that he used the existing OOK-Decoder software available on GitHub. From the analysis provided by OOK-Decoder, Fabien was able to successfully reimplement the transmission using an AVR microcontroller and 433 MHz transceiver circuit from Sparkfun.
After being successful with this, Fabien decided to take the project a step further and create the OOKLONE – a device that could automatically clone any 433.92 MHz OOK signal and replay it. The video below shows the OOKLONE in action.
Another security and hacking conference that recently finished is Defcon 2014. During this conference there was a “Wireless Village” were there were talks discussing all things related to radio frequency. During this conference there were many talks related to Software Defined Radio.
A list of all talks at the Defcon Wireless Village 2014 can be found on this page. The most interesting talks that we found related to SDR are shown below.
Presented by Balint Seeber, SDR Evangelist as Ettus Research. Balint presented a similar talk at Black Hat and the slides to go along with that can be found here.
Ever wanted to spoof a restaurant’s pager system? How about use an airport’s Primary Surveillance RADAR to build your own bistatic RADAR system and track moving objects? What sorts of RF transactions take place in RFID systems, such as toll booths, building security and vehicular keyless entry? Then there’s ‘printing’ steganographic images onto the radio spectrum…
Wireless systems, and their radio signals, are everywhere: consumer, corporate, government, amateur – widely deployed and often vulnerable. If you have ever wondered what sort of information is buzzing around you, this talk will introduce how you can dominate the RF spectrum by ‘blindly’ analysing any signal, and then begin reverse engineering it from the physical layer up. I will demonstrate how these techniques can be applied to dissect and hack RF communications systems, such as those above, using open source software and cheap radio hardware. In addition, I’ll show how long-term radio data gathering can be used to crack poorly-implemented encryption schemes, such as the Radio Data Service’s Traffic Message Channel. If you have any SDR equipment, bring it along!
Not explained through erotic interpretive dance, though could be, this presentation will cover the essentials for getting into the software defined radio hobby. Hardware requirements, distributed nodes, architecture designs, tips/tricks, random projects and common mistakes will be explained. This will be a technical talk that will be open for harassment, jokes, interaction and presented in a way that everyone will be able to take something away from it; wait, this is Vegas… but we’re hackers…
HackRF and some other Software Defined Radio platforms can be used in creative ways. I’ll show methods, including a dirty trick or two, for using HackRF outside the advertised frequency range. I’ll also show how the HackRF design lends itself to use as an oscilloscope or function generator suitable for many hardware hacking tasks.
The PortaPack H1 transforms the HackRF One software-defined radio into a hand-held radio exploration tool. Spectrum analysis, monitoring and logging, and demodulation and injection of simpler digital modes will be demonstrated by Jared Boone, a HackRF project contributor.
The talk will touch on a variety of topics and projects that have been under development including YateBTS, PHYs, MACs, and GNURadio modules. The talk will deal with GSM/LTE/WiFi protocol stacks.
A panel with SDR Gurus Michael Ossmann, Balint Seeber and Robert Ghilduta.
Black Hat, a large conference about information security related topics has recently finished and videos of some of the talks given have now been uploaded to YouTube. This year we have found three talks related to Software Defined Radio.
We posted about Silvio’s successful attempt at breaking into a car wirelessly earlier this month and now here is his presentation.
In this talk, I look at a number of household or common devices and things, including a popular model car and physical security measures such as home alarm systems. I then proceed to break the security of those devices. The keyless entry of a 2004/2005 popular make and widely used car is shown to be breakable with predictable rolling codes.
The actual analysis involved not only mathematics and software defined radio, but the building of a button pushing robot to press the keyless entry to capture data sets that enable the mathematical analysis.
Software defined radio is not only used in the kelyess entry attack, but in simple eavesdropping attacks against 40mhz analog baby monitors. But that’s an easy attack. A more concering set of attacks are against home alarm systems. Practically all home alarm systems that had an RF remote to enable and disable the system were shown to used fixed codes. This meant that a replay attack could disable the alarm.
I built an Arduino and Raspberry Pi based device for less than $50 dollars that could be trained to capture and replay those codes to defeat the alarms. I also show that by physically tampering with a home alarm system by connecting a device programmer, the eeprom data off the alarm’s microcontroller can be read. This means that an attacker can read the secret passcode that disables or enables the alarm.
In summary, these attacks are simple but effective in physical devices that are common in today’s world. I will talk about ways of mitigating these attacks, which essentially comes down to avoiding the bad and buying the good. But how do you know what’s the difference? Come to this talk to find out.
“The large adoption of wireless devices goes further than WiFi (smartmeters, wearable devices, Internet of Things, etc.).
The developers of these new types of devices may not have a deep security background and it can lead to security and privacy issues when the solution is stressed.
However, to assess those types of devices, the only solution would be a dedicated hardware component with an appropriate radio interface for each one of them.
That is why we developed an easy-to-use wireless monitor/injector tool based on Software Defined Radio using GNU Radio and the well-known scapy framework.
In this talk, we will introduce this tool we developed for a wide range of wireless security assessments: the main goal of our tool is to provide effective penetration testing capabilities for security auditors with little to no knowledge of radio communications.”
Attacking AIS using software defined radio.
Wired.com has posted an article showing how security researcher Cesare was able to use his USRP software defined radio to unlock a car with wireless entry. Essentially his hack involves brute forcing the rolling security code used by the wireless unlocking security protocol. Even with just a brute force attack he was able to unlock his car in just a few minutes. While this hack probably won’t work with newer cars which disable unlocking for a few minutes after a number of failed code attempts, Cesare notes that the hack will probably work for many similar cars of the 10 years or older generation.
This article goes along with their previous one discussing how thieves could hack into a home alarm system using a software defined radio.
The USRP is an advanced software defined radio that sells for around a thousand dollars but we note that the same attack could be performed with the cheaper and almost available HackRF SDR.
A few months back we posted about how the the RTLSDR-Scanner software had been updated to include signal triangulation capabilities. Now blogger Tobby has written a post about his attempt at triangulating the source of an encrypted police signal with RTLSDR-Scanner.
To do this he set up a laptop in his car with RTLSDR-Scanner installed and connected his RTL-SDR with stock antenna and a GPS receiver. After driving around for only 15 minutes he was able to get a triangulation heat map of reasonable accuracy.
Hackaday has brought to attention a document written by a Rory O’Hare which discusses the journey Rory took in trying a decode an unknown 433 MHz signal received from his SDR dongle.
If you are interested in manually decoding some unknown signals you may be interested in this write up as it discusses his entire journey including the failures he encountered along the way. Basically he records some packets using his SDR dongle, works out their bit patterns manually and then attempts to find correlations between the packets in an attempt to discover their structure. In the end his efforts are successful as he discovers that he is receiving a temperature sensor and is able to decode the temperature readings.
Tomasz lives in a gated community, but as he doesn’t own a car he wasn’t given access to a gate remote control. This made it difficult for him to have friends who have cars visit him. So he decided to use an RTL-SDR to receive, capture, analyze the gate signal which is transmitted at 433 MHz and then copy the signal to use with his own homemade transmitter.
First Tomasz used his RTL-SDR with SDR# to capture a few sound files of the gate remote which transmits at 433 MHz. Then he viewed the sound waveform’s in Audacity, a free audio editing program. Just by looking at the waveform he was able to determine that the signal was On-Off Key (OOK) modulated and that each frame of the transmission was the same, meaning that no security scheme was used.
Next he wrote down the transmission parameters that he learned from his analysis and built a simple 433 MHz transmitter which he connected to a microcontroller. After programming his microcontroller to send a copied signal he was able to open the gate.
