A Guide to the NanoVNA: Kindle eBook for $2.99

With the NanoVNA (and upcoming NanoVNA 2.0) being so affordable and readily available many budget focused RF enthusiasts and hams are now adding a tool to their arsenal that used to only be for the wealthy and commercial users. Vector Network Analyzers (VNAs) allow you to do things like make SWR measurements on antennas, characterize RF filters and detect coax cable faults, among other applications.

However, much like the RTL-SDR there is no one company or entity controlling the NanoVNA concept or development. The NanoVNA name now encompasses a mishmash of similar but slightly different hardware created by multiple manufacturers/community members, and multiple firmware and software developed by the community. This can be frustrating for some people as community developed products typically do not have full manuals and support that you would find in products from a larger commercial company. Instead some time to research and understand the product may be required.

Whilst almost plug and play, to use the NanoVNA you still need to understand what a VNA is, how to calibrate it, and how to read it's measurements. And in addition, for the NanoVNA in particular you'll want to know the differences in NanoVNA versions, how to update the firmware and where to find optional PC programs for it.

In order to help people new to VNAs and the NanoVNA, Christoph Schwarzler (OE1CGS) and Maximilian Schwarzler (OE1SML) have written a Kindle eBook called "A guide to the NanoVNA". The guide goes over what a VNA is and how it works, NanoVNA hardware versions and what to avoid, what accessories you might need, how to update the firmware, how to read the various charts, how to navigate the menus, how to calibrate and how to use NanoVNA PC software. The book also goes over some use cases for the NanoVNA, including creating a loading coil for a 40m short vertical antenna, creating a band pass filter, and checking for coax short circuit defects. At only US$2.99 it's a good way to get started with the NanoVNA.

Kindle Book "A Guide to the NanoVNA"
Kindle Book "A Guide to the NanoVNA"

Airspy HF+ Discovery Wins the WRTH 2020 Best Value SDR Award

The World Radio TV Handbook (WRTH) is a directory book (or CD) of world radio stations on LW, MW, SW and VHF broadcast FM which is released yearly. Along with the directory, the WRTH authors often review the latest shortwave listening hardware including SDRs and give out awards to the best units. 

Last year the Airspy HF+ won the WRTH 2019 award for best value HF SDR, and this year the Airspy HF+ Discovery wins the 2020 award. The award comes with a glowing review in the magazine (the review is freely accessible) noting the HF+ Discoveries' "spectacular combination of performance and versatility" as well as it's affordable price point. 

World Radio TV Handbook (WRTH) Reviews the Airspy HF+ Discovery and awards it the 2020 "best value SDR" award.
World Radio TV Handbook (WRTH) Reviews the Airspy HF+ Discovery and awards it the 2020 "best value SDR" award.

SDRplay Updates: RSPdx Now Supported by SDR Console V3, RSPdx EXTIO Released

SDRplay have recently released an update regarding third party software support and availability of their latest RSPdx receiver. They write:

Happy new Year from all of us at SDRplay.

Here’s an update on additional software for the RSPdx. SDRplay’s SDRuno fully supports the RSPdx but it takes several weeks for other software to catch up to the capabilities offered on the other RSP models.

Simon Brown has released his latest version of SDR Console V3 which supports the RSPdx (Version 3.0.18 dated January 1st) over on https://www.sdr-radio.com/ (make sure you download the latest API 3.x from our downloads page first)

We have released an EXTIO plugin for the RSPdx which will enable the RSPdx to work with any EXTIO-based software (e.g. HDSDR) although it doesn’t support HDR mode. HDR mode will not be added and the source code for the plugin can be found on our GitHub repository (https://github.com/SDRplay/ExtIO_SDRplay) we will not be supporting the plugin source code or extending the plugins capabilities. They are all free to be modified.

It is important to note that the RSPdx ExtIO plugin does NOT, AND WILL NOT, support HDR mode. If you need HDR mode, then SDRuno is the best option. HDR mode requires the end application to work in a certain way and this is not something that can be controlled via the ExtIO protocol.

Work has also begun on supporting RSPdx for SoapySDR based applications such as Cubic SDR (again this won’t include HDR mode). A Gnu Radio source block for the RSPdx will follow.

We are working with Steve Andrew, author of the Software Analyser software programme (see https://www.sdrplay.com/spectrum-analyser/ ) to help get compatibility for the RSPdx – this is a slightly longer process so this will take several more weeks.

Regarding stocks of the RSPs, SDRplay and most of our resellers on www.sdrplay.com/distributors/ have plenty of stock of RSP1A and the RSPduo. However there continues to be a shortage of the RSPdx whereby many of the resellers have sold out of their first deliveries. SDRplay is queuing up their replacement orders on a first come, first served basis. We also have our own quantity planned in there to allow us to sell direct from our website. We still hope that by the end of January we will have supplied this second wave of RSPdx demand.

The RSPdx
The RSPdx

KiwiSDR Portal SDR.HU Now Requires a Ham Licence + OpenWebRX Development Discontinued

The KiwiSDR is a US$299 HF SDR that can monitor the entire 0 - 30 MHz band at once. It is designed to be web-based and shared, meaning that the KiwiSDR owner, or anyone that they've given access to can tune and listen to it via a web browser over the internet. 

OpenWebRX is code originally created by András Retzler and a modified version runs on the KiwiSDR devices. This code is what allows them to be accessed online by a browser and was popularized by it's use in the KiwiSDR. The original code can also be used by other compatible SDRs such as the RTL-SDR.

Recently András released news that he is discontinuing work on OpenWebRX due to interest in other projects, but it will remain on GitHub as open source code. András also notes that the security of OpenWebRX will soon be in question as it utilizes Python 2, which has been designated end of life on January 1 2020. In addition, if you've been following OpenWebRX since the beginning, you'll know that in the past OpenWebRX was involved in an legal/ethical issue over open source licencing with KiwiSDR. Although the problems with KiwiSDR were resolved amicably, Andras also references his frustrations with similar situations to do with his code being forked again and again. 

We note that maintenance and development of the KiwiSDR OpenWebRX code will continue as they are considered separate projects. Due to some confusion, we importantly reiterate that the KiwiSDR product is unaffected by OpenWebRX being discontinued. Although KiwiSDR is based on OpenWebRX they use their own custom branch of the software that is maintained by the KiwiSDR owners and not by András.

András also runs the popular sdr.hu OpenWebRX/KiwiSDR directory, which was/is considered the main directory for finding and accessing public KiwiSDR and other SDR devices running OpenWebRX. Recently the directory was restricted, and now can only be accessed by those with a ham radio callsign. It is unclear why this decision was made as sdr.hu was very popular with shortwave listeners and radio newbies who are typically not hams. But the sdr.hu FAQ notes "The purpose of the site is to serve amateur radio. I decided to restrict access to the receiver list in order to protect the site and its purpose in the long term."

Fortunately, over on his SWLing.com blog, Thomas has noted that there are still other KiwiSDR directories available such as https://ve3sun.com/KiwiSDR, http://kiwisdr.com/public and http://rx.linkfanel.net.

SDR.HU Requires a Login Now
SDR.HU Requires a Login Now

Bypassing Chamberlain myQ Garage Doors with a Jamming SDR Attack

McAfee Advanced Threat Research have recently uploaded a blog post describing how they investigated Chamberlain’s MyQ Hub, a “Universal” IoT garage door automation platform.  Such a device allows you to operate and monitor the status your garage door remotely via an app. This can allow you to open and close the garage door for couriers, or for couriers to do it themselves if they are on the app.

Whilst they found that the internet based network side was secure, they discovered a flaw in the way that the MyQ hub communicates with the remote sensor over RF radio frequencies.

Although the system utilizes rolling codes for security,  McAfee researchers made use of the "rolljam" technique, which is one well known method for breaking rolling code security. The basic idea is to use an SDR or other RF device to jam the signal, collect the second rolling code after two key presses, then play back the first. Now the attacker has the second unused rolling code ready to be played back at any time.

McAfee Researchers Jam the actual signal (red) with a jamming signal (black)
McAfee researchers jam the actual MyQ signal (red) with a jamming signal (black)

In their threat demonstration they utilized a SDR running GNU Radio on a computing platform which sits outside the target garage door. The method used in the demonstration actually only involves jamming and not the use of a replay. It exploits a method that confuses the state of the MyQ device, allowing the garage door to be mistakenly opened by the owner when he thinks that he is closing it. They write:

With our jamming working reliably, we confirmed that when a user closes the garage door via the MyQ application, the remote sensor never responds with the closed signal because we are jamming it. The app will alert the user that “Something went wrong. Please try again.” This is where a normal user, if not in direct sight of the garage door, would think that their garage door is indeed open, when in reality it is securely closed. If the user believes the MyQ app then they would do as the application indicates and “try again” – this is where the statelessness of garage doors comes into play. The MyQ Hub will send the open/closed signal to the garage door and it will open, because it is already closed, and it is simply changing state. This allows an attacker direct entry into the garage, and, in many cases, into the home.

McAfee Advanced Threat Research Demo Chamberlain MyQ

RadarBox Optimized ADS-B Antenna + RTL-SDR Bundle Sale $39.95 + Shipping

Over in our store we're currently selling a RadarBox branded bundle that includes an ADS-B optimized antenna with 10 meters of coax, AND an ADS-B 1090 MHz optimized RTL-SDR dongle. RadarBox24 is an ADS-B aggregation flight tracking service similar to other services like FlightRadar24 and FlightAware. The set is RadarBox branded, but of course can be used with any tracking service, or just for your own private ADS-B station.

The bundle is now on sale for US$39.95 + shipping! The sale will last until stock runs out and this sale is only available from us. At other places like Amazon it is currently selling for US$64.95.

To purchase please visit our store and scroll down to find the RadarBox bundle "Add to Cart" button.

The antenna has 7 dBi gain, 50 (+-5) Ohm impedance, and is made from fiberglass and aluminum. It is fully waterproof and outdoor rated with 10 meters of coax cable and includes mounting clamps. The RadarBox RTL-SDR is specifically optimized for 1090 MHz ADS-B reception with it's built in filter and low noise amplifier.

The bundle ships out once per week and tracking is provided 1-2 days after shipping.

RadarBox Bundle: Includes 1x Outdoor ADS-B Antenna, 1x ADS-B Optimized RTL-SDR
RadarBox Bundle: Includes 1x Outdoor ADS-B Antenna AND 1x ADS-B Optimized RTL-SDR

Receiving and Decoding NFC with an RTL-SDR and GNURadio

Having been inspired by an NFC activated coffee machine at his work, back in 2017 Jean Christophe Rona uploaded a blog post showing how he used an RTL-SDR and GNU Radio to sniff and decode NFC (Near-Field Communication) tags. His post first goes into detail showing how NFC works and goes on to create a GNU Radio flow graph with custom GNU Radio block for decoding the NFC Miller code. The final result was him being able to demodulate the coffee machine to tag communication. We note that in Jeans experiments he used a standard RTL-SDR dongle with the HF driver hack in order to receive the NFC frequency of 13.56 MHz, but these days it should also be possible to simply use direct sampling on an RTL-SDR Blog V3 unit.

More recently Martin Schaumburg (5ch4um1 on YouTube), wrote in and wanted to share his video showing his replication of Jean's experiments. Martin's video shows him using a simple coiled up wire antenna on his RTL-SDR to receive NFC communication from an NFC reader to NFC tag, and he shares a few tips on getting the software to work.

RTLSDR NFC decoding reader to tag communication with a rtl-sdr and gnuradio.

Update 13 January 2020: Martin has added a second video with some additional information and tests.

RTLSDR decoding NFC, or: how to get two signals for the price of one.

A Simple Step by Step Guide to Updating the NanoVNA Firmware

Thank you to RJ Juneau (ylabrj / VA3YLB) for sharing with us his NanoVNA firmware update guide for idiots. NanoVNA firmware is updated fairly often, so this is a good reference guide for those who want to test the latest code as updating the firmware is a multi-step process. He writes

I've put together a "for idiots" document (I'm both  the writer and the target audience) that holds your hand through the process of upgrading from Windows, and covers some important issues like:

  •  Are you using a nanoVNA or an updated nanoVNA-H? 
  • Where to pick up the right software for the board
  • Do you want the VNA or the antenna analyzer version?
  • The software you need to load it, drivers, etc.
The NanoVNA: A $50 Vector Network Analyzer
The NanoVNA-H: A $50 Vector Network Analyzer