CCC Conference Talk: BlinkenCity – Radio-Controlling Street Lamps and Power Plants

In another talk at the Chaos Computer Club (CCC) 2024 conference, Fabian Bräunlein, and Luca Melette talked about how vulnerable Europe's renewable energy production is to attacks via the longwave radio ripple control system. Essentially, attacks over radio could be used to remotely switch loads and power plants on and off in a way that could damage the grid.

The recorded talk can be viewed directly via the CCC website, or via the embedded YouTube player below.  

A significant portion of Europe's renewable energy production can be remotely controlled via longwave radio. While this system is intended to stabilize the grid, it can potentially also be abused to destabilize it by remotely toggling energy loads and power plants.

In this talk, we will dive into radio ripple control technology, analyze the protocols in use, and discuss whether its weaknesses could potentially be leveraged to cause a blackout, or – more positively – to create a city-wide Blinkenlights-inspired art installation.

With three broadcasting towers and over 1.3 million receivers, the radio ripple control system by EFR (Europäische Funk-Rundsteuerung) GmbH is responsible for controlling various types of loads (street lamps, heating systems, wall boxes, …) as well as multiple gigawatts of renewable power generation (solar, wind, biogas, …) in Germany, Austria, Czechia, Hungary and Slovakia.

The used radio protocols Versacom and Semagyr, which carry time and control signals, are partially proprietary but completely unencrypted and unauthenticated, leaving the door open for abuse.

This talk will cover:

  • An introduction to radio ripple control
  • Detailed analysis of transmitted radio messages, protocols, addressing schemes, and their inherent weaknesses
  • Hardware hacking and reversing
  • Implementation of sending devices and attack PoCs
  • (Live) demonstrations of attacks
  • Evaluation of the abuse potential
  • The way forward
38C3 - BlinkenCity: Radio-Controlling Street Lamps and Power Plants

Tweet
Share
Reddit
Vote
Email

A USB-C Mod for RTL-SDR Blog V3/V4 Dongles

Over on GitHub, umbertoragone has uploaded some schematics for a USB-C modification he's made for RTL-SDR Blog V3 and V4 dongles. The modification removes the stock USB-A plug on the dongle, and instead replaces it with a USB-C connector mounted on an adapter PCB.

The repo contains all the gerbers, BOM, and assembly details required to replicate the modification. He notes that he is also selling a pre-made USB-C adapter board over on his Tindie or Lectronz store for US$4 (currently out of stock).

Let us know in the comments if you would be interested in seeing an official USB-C version of the Blog V3 and V4 line of dongles. Previous polling has indicated that USB-A is still the preferred choice by a wide margin, but attitudes may have changed over the years.

A USB-C Modification for RTL-SDR Blog V3 and V4 dongles.
A USB-C Modification for RTL-SDR Blog V3 and V4 dongles.
Tweet
Share
Reddit
Vote
Email

Locating an Intermittent Interferer with a KrakenSDR

Over on YouTube Thomas Brinkoetter has uploaded a video demonstrating his experience with the KrakenSDR, and how he used it to find an intermittent interferer that he set up for a test. The video was prepared to support the RF Interference and Mitigation class at the IWCE trade show Las Vegas March 17 and 18th 2025.

If you weren't already aware, KrakenSDR is our 5-channel coherent radio based on RTL-SDRs, and it can be used for applications like radio direction finding. It can currently be purchased either directly from our krakenrf.com website, or from Crowd Supply or Mouser.

The test involved his wife keying up a repeater for one second out of every 15 seconds. In the video Thomas was able to successfully locate the transmitter with an antenna array and KrakenSDR mounted in his vehicle.

Locating an intermittent interferrer with the Kraken SDR

Tweet
Share
Reddit
Vote
Email

Using an EFR32 IoT Microcontroller Transceiver as an SDR

Thank you to Joshua R. for writing in and sharing some links on how an EFR32 microcontroller can be used as a software-defined radio. The EFR32 is a microcontroller designed for IoT applications such as Zigbee, Z-Wave, Thread, Bluetooth. Of interest to us is that the EFR32 has a special mode that allows for the demodulator/modulators to be switched off and instead allowing for raw IQ data to be transferred from the chip.

An example of the EFR32 being used as an SDR has been provided by OH2EAT/tejeez and can be found in this write-up and in his 'geckokapula' GitHub repo. This MIT-licenced repo provides hardware schematics and software for creating a full handheld FM, AM, USB, LSB, and CW receiver with FM, CW, USB, and LSB transmit capabilities. It also supports a 12 kHz waterfall display. The tuning range is nearly 13.2 MHz to 2.9 GHz, but there are some gaps.

This Knowledge Article by Silicon Labs also explains the SDR mode of the EFR32.

This is an interesting low-cost chip, but the limiting factor appears to be the small bandwidth.

An EFR32 SDR by Tejeez/OH2EAT
An EFR32 SDR by Tejeez/OH2EAT
Tweet
Share
Reddit
Vote
Email

CCC Conference Talk: Investigating the Iridium Satellite Network

Over the years, we've posted numerous times about the work of “Sec” and “Schneider,” two information security researchers who have been investigating the Iridium satellite phone network using SDRs. Iridium is a constellation of 66 satellites in low Earth orbit that supports global voice, data, and messaging services.

In a talk at the Chaos Computer Club (CCC) 2024 conference, they provided updates on their work. The recorded video of their talk has recently been uploaded to YouTube.

The Iridium satellite (phone) network is evolving and so is our understanding of it. Hardware and software tools have improved massively since our last update at 32C3. New services have been discovered and analyzed. Let's dive into the technical details of having a lot of fun with listening to satellites.

We'll cover a whole range of topics related to listening to Iridium satellites and making sense of the (meta) data that can be collected that way:

  • Overview of new antenna options for reception. From commercial offerings (thanks to Iridium Time and Location) to home grown active antennas.
  • How we made it possible to run the data extraction from an SDR on just a Raspberry Pi.
  • Running experiments on the Allen Telescope Array.
  • Analyzing the beam patterns of Iridium satellites.
  • Lessons learned in trying to accurately timestamp Iridium transmissions for future TDOA analysis.
  • What ACARS and Iridium have in common and how a community made use of this.
  • Experiments in using Iridium as a GPS alternative.
  • Discoveries in how the network handles handset location updates and the consequences for privacy.
  • Frame format and demodulation of the Iridium Time and Location service.
38C3 - Investigating the Iridium Satellite Network

Tweet
Share
Reddit
Vote
Email

Saveitforparts: Hacking an Motorized RV Satellite Dish for Tracking LEO Satellites

Over on the saveitforparts YouTube channel, Gabe has uploaded a new video showing how he's hacking an old motorized Wineguard RV satellite dish for tracking low earth orbit satellites, such as the NOAA and Meteor weather satellites as well as the US Military's DMSP system.

The motorized RV satellite dish was originally intended for tracking TV satellites, but by connecting to the serial port on the control unit, Gabe is able to control the satellite dish through his own code.

In this video I'm creating a motorized satellite tracker for S-Band signals. S-Band includes NOAA weather satellites and the US Military's DMSP system (it's also the radio band for WiFi, which I might look at later).

I'm using a Winegard brand "Trav'ler" antenna designed for use on campers and recreational vehicles. It has a built-in three-axis motor system for pointing at TV satellites, but I wanted to use it for tracking satellites closer to earth. Since a low-orbit satellite like NOAA 18 or DMSP passes overhead in about 10 minutes, I need to move the dish faster and more precisely then it was intended for.

This project is still ongoing, and I don't yet have the code up on Github. When I do, it will be available at https://github.com/saveitforparts/ alongside the code for some similar antennas I've hacked in the past.

The serial cable I'm using is described here: https://saveitforparts.wordpress.com/2023/12/29/another-portable-radio-telescope/

Modifying RV Satellite Dish To Track Low-Earth-Orbit Satellites

Tweet
Share
Reddit
Vote
Email

Setting up a Dual RX System with an SDR and Ham Radio Rig via an SDRSwitch

There are two common options when using an SDR together with a ham radio rig. You can either create an IF tap within your ham radio and connect the SDR to that, or connect the SDR directly to the antenna via a switch that switches the SDR out when transmitting.

Over on YouTube, Ham Radio DX has uploaded a video discussing the latter option and revealing its advantages. In the video, he mentions results by HB9VQQ that show that connecting an Airspy HF+ directly to an antenna via an SDR switch from SDRSwitch.com results in 60% more spots on WSPR, compared to using an IF tap from an FT450D ham radio rig.

He goes on to explain and demonstrate his setup and the recommended switch that he is using, which is the SDRSwitch by N2EME, available at SDRSwitch.com. He notes that this switch is recommended due to its very low insertion loss and high isolation specifications and compares it against an MFJ switch, which has some rather terrible specifications.

Add a SDR Receiver to ANY Ham Radio Rig!

Tweet
Share
Reddit
Vote
Email

A Detailed Guide to Setting up RTL1090 for ADS-B Decoding

RTL1090 is a popular ADS-B decoder program that works with RTL-SDR dongles. With it, you can receive ADS-B signals from aircraft, decode them, and then pass that data to a mapping program to plot aircraft positions on a map.

Recently, RTL-SDR.COM reader Frank wrote in and wanted to share with us a detailed guide he's written on the process of setting up RTL1090. The guide starts by showing how to set up the RTL-SDR dongle by installing the WinUSB drivers via Zadig. It goes on to show how to download, unzip, and run RTL1090. Guides for RTL1090 V1, V2, and RTL1090 Scope are shown separately.

RTL1090 Scope
RTL1090 Scope
Tweet
Share
Reddit
Vote
Email