A few weeks ago we posted about the recently uploaded talks listed on the Defcon YouTube channel. However, there is a second YouTube channel dedicated to talks presented as part of the Defcon Aerospace Village which was also held virtually. A number of these talks involve software defined radios and RTL-SDRs and so may be of interest to readers. We have listed a few interesting talks below, but the full list can be found on their YouTube channel.
A Deeper Dive into ILS and ADS-B Spoofing - Harshad Sathaye discusses weaknesses in the security of the Instrument Landing System and ADS-B and how these can be spoofed.
Introduction to ACARS - Alex Lomas explains aircraft ACARS text messages in detail and discusses receiving them with an RTL-SDR
Low-Cost VHF Receiver - Alan Tart, Fabian Landis show how to build a low cost VHF airband receiver from an RTL-SDR, Raspberry Pi and the RTLSDR-Airband software.
Over on his YouTube channel TechMinds has uploaded a new video showing how to use RF amplifiers to extend the transmit range of transmit capable SDRs like the LimeSDR, HackRF and PlutoSDR. Whilst they are transmit capable, most low cost SDRs like those mentioned above can only transmit at very low power levels typically much less than 30 mW. In the video TechMinds tests a wideband SPF5189Z and filtered 2.4 - 2.5 GHZ CN0417 based amplifier, and shows the output power obtained using an inline power meter.
He also notes that these wideband amplifier will also amplify harmonics so filtering is recommended. At the same time we note that you should only transmit if you are licenced to do so (for example with a ham radio licence), especially if you are amplifying the output.
The Organized Crime and Corruption Reporting Project (OCCRP) have recently run a story about how they have used ADS-B aircraft data to uncover the role that US civilian aircraft contractors are playing in the East African "kill chain". The investigation began over concerns that while civilian contractors do not pull the trigger, they may be becoming too involved in the process of determining exactly who will be killed in combat via data collection and analysis through their high tech surveillance aircraft. In the article they also note how many of these civilian contractors hide their true owners behind a chain of multiple LLC companies, thus reducing any accountability for their actions.
OCCRP also supports the Dictator Alert project which we have posted about in the past. In a related article titled "Mapping the Secret Skies: Lessons Learned From Flight Data" Emmanuel Freudenthal who helped setup the Dictator Alert project discusses how censorship free ADS-B tracking is helping journalists uncover new stories. In the article he notes how he uses uncensored ADS-B data together with the leaked Paradise Papers to reveal the true owners of aircraft hidden behind multiple LLC and shell companies. Regarding the "kill chain" article Emmanuel's post also explains how the story came to be:
An upcoming OCCRP story focuses on U.S. surveillance flights over Somalia. The U.S. military operates out of a small air base at Manda Bay just over the border in Kenya. We had a tip that it would be worth checking on planes in the area, so we set up an antenna nearby, which fed us information about planes taking off and landing from the base.
We eventually had to take down the antenna due to security concerns. But we managed to collect data on a number of planes that had been purchased by obscure shell companies and modified with advanced surveillance equipment before being sent to Kenya.
Why is this article posted on this blog? ADS-B data from aircraft is most often received these days via RTL-SDR dongles due to their low cost, so it is interesting to see to what extent cheap SDRs may be affecting the world via this type of reporting.
We note that ADS-B Exchange is the only censorship free ADS-B data aggregator available. All other online flight trackers censor flights from the government as well as from some private jets that may be owned by high profile company directors or in some cases dictators. The argument for censorship is that ADS-B data collection may be made illegal otherwise.
In a previous post we also discussed how censorship free ADS-B data from ADS-B Exchange revealed how military Blackhawk helicopters and Predator drones were used for surveillance during the early Black Lives Matter protests.
The KerberosSDR is our 4-channel phase coherent capable RTL-SDR unit that we previously successfully crowdfunded back in 2018. With a 4-channel phase coherent RTL-SDR interesting applications like radio direction finding, passive radar and beam forming become possible. It can also be used as 4 separate RTL-SDRs for multichannel monitoring.
In one of our latest tests we've been able to track a weather balloon radiosonde via the direction finding ability of KerberosSDR. These balloons are launched twice daily by meteorological agencies around the world, and the radiosonde carried by the balloon transmits an RS-41 signal continuously throughout it's flight sending back telemetry such as weather information and GPS coordinates. The KerberosSDR tracks the bearing towards the balloon using only the raw signal - it does not decode. Having the actual GPS location from the RS41 data allows us to compare and confirm that the KerberosSDR is indeed tracking the bearing of the balloon.
In this test we used the excellent 4-element dipole array made by Arrow Antennas. In particular we used the 406 MHz element version as the RS-41 signal is broadcast at 403 MHz. The antenna array is mounted on the roof, the KerberosSDR is in the attic connected to a Raspberry Pi 4. Our KerberosSDR Android app is used to plot the bearings. A separate RTL-SDR running on the video recording PC is connected to it's own antenna and is used to receive and decode the RS41 signal. The free software RS41 Tracker is used to decode and map the balloon for location confirmation.
We are currently using the latest beta code in development (unreleased at the time of this post - it will be released within 1 to 2 months) which handles non-continuous intermittent signals better.
Arrow Antennas 4-Element Dipole Array Mounted on Roof
The short video below shows a timelapse of the RS41 decoder tracking a balloon which circled the south of our KerberosSDR. The red line indicates the zero degree direction of the antenna array, while the blue line indicates the estimated direction of the balloon determined via the MUSIC radio direction finding technique.
The GPS balloon map from RS41 tracker is overlayed on top of the KerberosSDR Android app map for clarity via video editing. We can see that it mostly tracks the balloon to within a few degrees. When the blue bearing line diverges this is due to the balloon's line of sight path to the antennas being obscured by terrain, buildings or trees. When this is the case a multipath signal reflecting off surrounding hills tends to become dominant.
In the second short video below the weather balloon tracked northwards. Towards the north, north west and north east we have antenna obstructions in the form of rising terrain, houses and hills, so the overall accuracy is poorer. However, it still tracks within a few degrees most of the time.
Finally the YouTube video below shows the same as the above, but in the second half includes the full screen including the KerberosSDR DoA graphs and SDR# waterfall showing signal strength.
KerberosSDR Tracking a Weather Balloon Radiosonde with Radio Direction Finding
In the future we hope to test with two or more KerberosSDR units producing multiple bearing lines on RDFMapper, hopefully resulting in cross points that can be used to estimate the actual location of the balloon.
Over on his YouTube channel "saveitforparts" has been working on creating a handheld scanner/sensor box on a budget. This is a simple and fun build which is attempting to create something like a real life Star Trek scifi tricorder that you might imagine taking with you to analyze systems on another planet. The box embeds a Raspberry Pi, USB hub, battery pack, RTL-SDR and thermal camera inside. In the video he shows how everything fits into the box and gives a quick demo of the RTL-SDR and thermal camera in action. In the future he plans to add more sensors as well.
Handheld Scanning Device with Raspberry Pi - Part 2
At the BSides OK 2020 virtual conference Cameron Mac Millan recently presented a talk titled "It’s 2020, so why am I still able to read your pager traffic?". On this blog we have posted numerous times about privacy breaches stemming from insecure wireless pager traffic. Anyone with a radio or SDR can receive and decode pager messages, and this has been known and done since the 1980's. Cameron's talk explains how paging systems work, who are the modern users of pagers, how to capture and decode pager messages and how to best log and filter through messages. He goes on to describe a number of major pager security breaches that he's personally seen. The talk preview reads:
This talk explores why pagers remain a potential threat vector in many environments despite the technology being 40 years old. This is not a the-sky-is-falling presentation: everything from paging history to how simple it is to decode pager traffic (and the associated risks) is covered without FUD.
I enjoy poking things with sticks and turn over rocks to see what crawls out from under them. One of my interests is seeing how technologies believed to be obsolete can still pose a problem for security today, and do that from the perspective of a 20-year career in infosec. When not creating tomorrow’s problems with yesterday’s technology, I can usually be found wrenching on unusual cars.
It’s 2020, so why am I still able to read your pager traffic? - Cameron Mac Millan - BSidesOK 2020
Ars Technica recently ran a story about how University researchers have been able to eavesdrop on LTE mobile phone calls using a USRP B210 software defined radio which runs the Airscope software. The technique exploits a flaw in how some LTE carriers are implementing their keystream. A keystream is a stream of random data combined with the actual voice data, resulting in encrypted data.
It turns out that many LTE carriers reuse the same keystream when two calls are made within a single radio connection. An attacker can then record an encrypted conversation, then immediately call the victim after that conversation. The attacker can now access the encrypted keystream, and as the keystream is identical to the first conversation, the first conversation can now be decoded.
The ReVoLTE attacks exploit the reuse of the same keystream for two subsequent calls within one radio connection. This weakness is caused by an implementation flaw of the base station (eNodeB). In order to determine how widespread the security gap was, we tested a number of randomly selected radio cells mainly across Germany but also other countries. The security gap affected 12 out of 15 base stations.
The ReVoLTE attack aims to eavesdrop the call between Alice and Bob. We will name this call the target or first call. To perform the attack, the attacker sniffs the encrypted radio traffic of Alice within the cell of a vulnerable base station. Shortly after the first call ends, the attacker calls Alice and engages her in a conversation. We name this second call, or keystream call. For this call, the attacker sniffs the encrypted radio traffic of Alice and records the unencrypted sound (known plaintext).
For decrypting the target call, the attacker must now compute the following: First, the attacker xors the known plaintext (recorded at the attacker's phone) with the ciphertext of the keystream call. Thus, the attacker computes the keystream of the keystream call. Due to the vulnerable base station, this keystream is the same as for the target (first) call. In a second step, the attacker decrypts the first call by xoring the keystream with the first call's ciphertext. It is important to note that the attacker has to engage the victim in a longer conversation. The longer he/she talked to the victim, the more content of the previous communication he/she can decrypt. For example, if the attacker and victim spoke for five minutes, the attacker could later decode five minutes of the previous conversation.
The ReVoLTE Attack
Demonstration of the ReVoLTE attack in a commerical LTE network.
A few days ago we posted about two SDR related DEFCON talks which were recently released. One of the talks was about detecting fake 4G base stations with a bladeRF SDR and a tool they created called "Crocodile Hunter". It is currently compatible with the bladeRF x40 and USRP B200. The talk summary is posted below as it nicely summarizes what fake 4G base stations are and what Crocodile Hunter can do.
4G based IMSI catchers such as the Hailstorm are becoming more popular with governments and law enforcement around the world, as well as spies, and even criminals. Until now IMSI catcher detection has focused on 2G IMSI catchers such as the Stingray which are quickly falling out of favor.
In this talk we will tell you how 4G IMSI Catchers might work to the best of our knowledge, and what they can and can't do. We demonstrate a brand new software project to detect fake 4G base stations, with open source software and relatively cheap hardware. And finally we will present a comprehensive plan to dramatically limit the capabilities of IMSI catchers (with the long term goal of making them useless once and for all).
The Crocodile Hunter software is apparently a little difficult to install and get running, so Aaron who runs DragonOS YouTube tutorial channel has uploaded a video documenting how to install and configure the software. The tutorial assumes that you are the running the latest DragonOS image which already includes a lot of the prerequisite software, and in his example he uses a USRP B205mini-i SDR.
