Tracking down a Water Leak with RTLAMR

Earlier in the year Clayton discovered that his water bill had suddenly gone up one month. Suspecting a leaky appliance he set out to discover what it was by using an RTL-SDR and the rtlamr decoder. The rtlamr decoder is able to decode water meters that transmit usage data wirelessly via the Itron ERT protocol which is typically found in the unlicensed 900 - 920 MHz band in the USA and Canada.

Clayton wrote a simple Python script to plot the usage data extracted by rtlamr, and after a week determined that water was being consumed at 10 liters an hour even while away from home. Suspecting a leak in the toilets he turned off their valves and the next day saw that the reading remained constant when away, indicating that he'd found the leak.

A water leak graphed by decoding an Itron ERT water meter with RTL-SDR
A water leak graphed by decoding an Itron ERT water meter with RTL-SDR

Using a HackRF for GPS Spoofing on Windows

Over on the TechMinds YouTube channel a new video titled "GPS Spoofing With The HackRF On Windows" has been uploaded. In the video TechMinds uses the GPS-SDR-SIM software with his HackRF to create a fake GPS signal in order to trick his Android phone into believing that it is in Kansas city.

In the past we've seen GPS Spoofing used in various experiments by security researchers. For example, it has been used to make a Tesla 3 running on autopilot run off the road and to cheat at Pokemon Go. GPS spoofing has also been used widely by Russia in order to protect VIPs and facilities from drones.

GPS Spoofing With The HackRF On Windows

KiwiSDR Now Supports DRM Decoding

KiwiSDR have recently implemented DRM decoding into their OpenWebRX implementation. Digital Radio Mondiale (DRM) is a type of digital shortwave radio signal that is used by some international shortwave radio broadcasters. It provides superior audio quality compared to AM stations thanks to digital audio encoding.

The KiwiSDR is a US$299 HF SDR that can monitor the entire 0 - 30 MHz band at once. It is designed to be web-based and shared, meaning that the KiwiSDR owner, or anyone that they've given access to can tune and listen to it via a web browser over the internet. Many public KiwiSDRs can be found and browsed from the list at sdr.hu.

The new DRM implementation is based on DREAM 2.1.1 which is an opensource DRM decoder that can be used with any HF capable SDR. Due to computational limits of the BeagleBone singleboard computer which the KiwiSDR runs on, only one DRM channel can be decoded at any one time, restricting this capability to only one user at a time. However, if the KiwiSDR is running on the newer BeagleBone AI, it can support up to four DRM channels. KiwiSDR write that work is still ongoing to improve the code, so this situation may improve in the future.

KiwiSDR Decoding DRM
KiwiSDR Decoding DRM

Meteor M N2-2 Has Failed but Recovery May be Possible

UPDATE: It has now been confirmed by Roscosmos that the satellite was struck by what is presumed to be a micrometeorite which caused a leak of thermal transfer gas, and hence a sudden orbit change. It seems unlikely that the satellite will begin operations again as the satellite cannot operate it's camera sensors without thermal cooling. Data is being transmit currently on the X-Band, however, it appears to be a stored image only, rather than live images.

On December 18, 2019, an abnormal situation was recorded on the Meteor-M spacecraft No. 2-2 associated with an external impact (presumably a micrometeorite) on its structure. As a result, he changed the parameters of the orbit and switched to a non-oriented flight mode with high angular velocities.

In accordance with the inherent logic of operation, the device stopped fulfilling the target task and automatically switched to energy-saving mode when the on-board systems that were not involved in ensuring its functioning (including all on-board target equipment) are turned off.

After entering into the zone of Russian ground-based controls with the Meteor-M spacecraft No. 2-2, communication was established and work began to restore its operability: damping angular velocities, transferring to the standard orientation, receiving telemetric and target information.

Currently, work is underway with the satellite under the program of the chief designer. Meteor-M No. 2-2 is in an oriented flight; regular control sessions are conducted with it to receive telemetric information and information from target equipment.

Happysat's Notes:

Depressurization caused gas that was inside and used for heat transfer to leak out.

Resulting in some devices onboard overheating, while others did stop working.

Batteries are working under harsh thermal conditions.

Experts analyzing MSU-MR images during the incident to confirm collision.

------------------------- Original Post -------------------------

On December 18 Meteor M N2-2 suffered a failure that appears to have changed it's orbit. Roscosmos is quiet on the issue, but speculation by R4UAB is that there was a depressurization or on board explosion. However, Happysat who appears to be in contact with Roscosmos insiders has noted that on December 20 the orbit has been stabilized, and that they are working on recovering the operation of the satellite. Currently the LRPT signal and all sensors remain OFF.

Meteor M N2-2 is a Russian weather satellite that was successfully launched into orbit on July 5 2019. Like with the NOAA and Meteor M N2 satellites, it is possible to receive weather satellite images from this satellite with an RTL-SDR (when it is operational).

The older but still operational Meteor M2 satellite has failed several times in it's history too, each time with the satellite entering an unstable tumble. However, each time the satellite was recovered back into full operation after a few days.

The Meteor-M2 Satellite
The Meteor-M N2-2 Satellite

PiSDR Updated to Version 3.0: Now Supports the Airspy HF+

PiSDR is a Raspberry Pi distribution that is pre-loaded with multiple programs for various software defined radios. It currently supports RTL-SDR, LimeSDR, PlutoSDR, Airspy, and as of the most recent update the Airspy HF+. The currently pre-installed software packages include SDR Angel, Soapy Remote, GQRX, GNURadio, LimeUtil, and LimeVNA.

Recently version 3.0 was released, and this new version adds a few new features like Desktop shortcuts, Raspberry Pi 4 support, Airspy HF+ support and documentation.

The latest image can be downloaded from the PiSDR website at https://pisdr.luigifreitas.me. It can be burned to an SD card in the same way that you would with a standard Raspbian installation. This is a great image to start from if you're experimenting with RTL-SDRs on a Raspberry Pi, as it means that you don't need to go through all the steps of installing the drivers and software like GQRX and GNU Radio which can take a long time to install.

PiSDR Running a SDRAngel with a LimeSDR
PiSDR Running a SDRAngel with a LimeSDR

Tech Minds Demonstrates Iridium Live on a Raspberry Pi

Over on YouTube Tech Minds has uploaded a video of him demonstrating Iridium Live plotting Iridium satellite tracks in real time. We just posted about Iridium Live yesterday. It is a new program by microp11, who is also the author of Scytale-C, a useful Inmarsat STD-C decoder. The software works with gr-iridium to visualize Iridium satellite tracks as they pass overhead.

In the video Tech Minds runs the software on a Raspberry Pi with an Airspy. The current video is only a demonstration, but in the near future he promises to upload a full tutorial

IridiumLIVE - Real Time Visualization Of Iridium Satellites - Raspberry Pi

RadioCapture – Software to Capture, Archive and Listen to Trunked Radio From Many Sources Now Open Sourced

Back in April 2019 we posted about Matt Mills' Radiocapture.com website which is a web service that you can feed that automatically captures analogue and digital trunked radio conversations with an RTL-SDR, and allows public users to play back conversations via the web interface. The Radiocapture page which shows what the software is capable of is also active at radiocapture.com/radio

Back in April Matt was fundraising via Patreon and hoping to make development of Radiocapture his day job, but unfortunately he's had to call it quits for now. Since he no longer has time to work on it, Matt has open sourced the RF side of the software. The software description reads:

[Radiocapture-rf] is capable of using multiple networked computers and multiple SDR radios to demodulate the control channel of P25, EDACS, and Motorola trunking systems, as well as some limited support (alpha quality) for scanning for systems, LTR trunking, and "police scanner" style audio capture.

It is designed to effectively scale to an infinite capacity of trunked systems, captured transmission volume, and dongle bandwidth (more dongles = more available bandwidth, more cpus = more channels and more systems). (There is one remaining feature to be implemented to really make this work well, dongle redis autodiscovery (frontend_connect should autodiscover and use available dongles) and splitting the rc_frontend/receiver.py into one process per dongle.

The frontend initializes the SDRs in whatever configured frequency range, and presents a server interface where clients can connect and request a specific channel be created and forward to them. The frontend will then attach a channel, and output to a UDP sink (might be something better now, I forget). On the backend side, a control_demodulator is listening to that sink and doing the actual RF demodulation, which is passed into redis for distribution to other services. The backend is effectively a bunch of microservices that work together to track & record all ongoing transmissions and do some amount of deduplication. This entire setup is designed such that it can be scaled across as many servers/computers as necessary (although there are a few caveats/things I never got around to implementing in how it actually works). Recorded transmissions are decorated with a metadata scheme in their mp3 tags that is designed to be able to be loaded into the Radiocapture.com database. Finally completed mp3s are dropped into an activemq queue for publishing.

Matt notes that the software in it's current state isn't considered as "ready to distribute" as you may need some decent experience with Linux and Python to get it up and running.

RadioCapture logged audio
RadioCapture logged audio

Mike from SDRplay Compares the RSPdx Against Other SDRs on MW/LW

Over on the SWLing post blog we've seen a post contributed by Mike Ladd who works with SDRplay. Mike has been comparing the new SDRplay RSPdx on medium wave and long wave reception against the Elad FDM-S2, Airspy HF+ Discovery and the Perseus. The RSPdx is SDRplay's latest product which sits at the top of their line as their highest performance single tuner receiver.

Each test consists of a video where he runs a comparison between the RSPdx and another receiver. All SDRs are run in SDRuno, the official application for SDRplay receivers. It is left for the listener to determine which SDR sounds better. From a listeners perspective, it appears that the RSPdx performs at least identically to the other SDRs.

Comparing the RSPdx Against other SDRs
Comparing the RSPdx Against other SDRs