SirenJack: Security Vulnerability Found in Wirelessly Controlled Emergency Sirens

Balint Seeber from security research firm Bastille has recently disclosed a major security vulnerability found in wirelessly controlled emergency sirens called "SirenJack". These sirens are used in many states and cities within the USA to warn large populations of disasters or other dangers, although at the moment only sirens by ATI System in San Francisco have been identified as vulnerable. The vulnerability stems from the fact that the wireless protocol used to activate the sirens is not encrypted, so a bad actor could record the monthly test activation transmissions, analyze them and forge control signals of his own. This would allow a hacker to take control the sirens at will using a simple $30 handheld radio and a laptop, or a transmit capable software defined radio.

This security research release comes after the Dallas tornado siren hack, which occurred in early 2017. During that hack a hacker activated 156 tornado sirens placed around the city of Dallas, Texas. In contrast to SirenJack, the Dallas siren hack was most likely caused by a more standard replay or brute force attack, since simple DTMF tones are used to activate Dallas' siren system.

ATI Systems have indicated that they have already patched the vulnerability as Bastille responsibly disclosed the vulnerability to them 3 months prior. However, it is likely that sirens created by other contractors in other states may have the same or similar vulnerabilities.

In the video below Balint shows the SirenJack vulnerability in action on a test siren setup. During the test he is able to take control of the siren and transmit any arbitrary audio to it using a software defined radio. Several other SirenJack video are available on Bastille's YouTube channel. 

Tweet
Share
Reddit
Vote
Email

Automatically Receiving, Decoding and Tweeting NOAA Weather Satellite Images with a Raspberry Pi and RTL-SDR

Over on Reddit we've seen an interesting post by "mrthenarwhal" who describes to us his NOAA weather satellite receiving system that automatically uploads decoded images to a Twitter account. The set up consists of a Raspberry Pi with RTL-SDR dongle, a 137 MHz tuned QFH antenna and some scripts.

The software is based on the set up from this excellent tutorial, which creates scripts and a crontab entry that automatically activates whenever a NOAA weather satellite passes overhead. Once running, the script activates the RTL-SDR and APT decoder which creates the weather satellite image. He then uses some of his owns scripts in Twython which automatically posts the images to a Twitter account. His Twython scripts as well as a readme file that shows how to use them can be found in his Google Drive.

mrthenarwhal AKA @BarronWeather's twitter feed with automatically uploaded NOAA weather satellite images.
mrthenarwhal AKA @BarronWeather's twitter feed with automatically uploaded NOAA weather satellite images.
Tweet
Share
Reddit
Vote
Email

Video on using an RTL-SDR + Noise Generator as a Poor Man’s Network Analyzer

Over on YouTube user AE0AI has uploaded a video where he explains how he uses an RTL-SDR and a home made noise source as a poor man's network analyzer. A network analyzer is a tool that allows you to analyze the response of RF devices, such as filters. By using a noise source together with an RTL-SDR the same functionality as a network analyzer can be obtained, however of course with less accuracy.

In the video AE0AI shows us his home made noise generator, which is a based on a simple circuit that he found online. He then shows the noise generator connected to the RTL-SDR, which shows that his home made generator works up to about 40 MHz. Later in the video he tests a home made 40m filter with the noise source and RTL-SDR, and the response is easily visible. With the response visible he is able to tune the filter by adjusting the inductor windings.

We have a tutorial on the same concepts available here.

Poor Man's network analyzer for measuring filters (noise generator + RTL-SDR)

Tweet
Share
Reddit
Vote
Email

Optimizing the RSP1A at LF/MW/HF by Understanding Intermodulation

SDRplay have recently published an informative white paper that explains what intermodulation and higher order mixing effects are, and how they can affect reception on an SDR such as the SDRplay. This paper could be a useful introduction to understanding how to optimize reception of weak signals when they are in the presence of strong signals. While written for the SDRplay, the same knowledge and tips could be applied to any similar SDR.

Later in the paper they also show how to eliminate intermodulation effects by enabling the MW/AM notch filters on the SDRplay RSP1A unit, and by carefully choosing the LO frequency.

The RSP1A covers the spectrum from 1kHz to 2GHz, and phantom signals can be a menace for all wideband SDR receivers. More and more is being published about the most obvious culprit which is inter-modulation caused by very strong interferers such as MW/FM broadcast transmitters – indeed, all the current SDRplay RSPs have built in filters to help reduce the problems caused by that.

But the reality is, particularly at HF and below, that a phantom signal may occur for other reasons such as higher order mixing effects. Sometimes, it can be difficult to know what is the cause of the phantom signal. If you can understand the cause, there are additional steps you can take to overcome it.

We’ve just published this white paper to explain the difference between intermodulation and higher-order mixing effects, and what practical steps you can take to reduce the latter in particular. Our example uses an RSP1A operating at frequencies below 60MHz.

First pager of the SDRplay whitepaper on intermodulation effects.
First pager of the SDRplay whitepaper on intermodulation effects.
Tweet
Share
Reddit
Vote
Email

Information on Time Correlating Signals with RTL-SDRs

In a previous post back in September 2017 Stefan Scholl (DC9ST) treated us to a very interesting write up about how to localize transmitters to within a few meters using time difference of arrival (TDOA) techniques with multiple RTL-SDR dongles spread out over an area.

Stefan has recently added to his post now with some additional information on how to properly correlate signals received between multiple RTL-SDR dongles, which is one of the key parts to TDOA. He writes that he covers the following questions:

- What signal parameters influence the quality of the correlation?
- Which type of correlation calculations are available (four)
- Which are suitable with RTL-SDRs, considering noise and phase and frequency offset?

Stefan writes that his findings could be interesting to people interested in the following techniques:

- TDOA localization
- Synchronizing several RTL-SDRs
- Passive Radar

Comparing various bandwidth sizes on correlation quality
Comparing various bandwidth sizes on correlation quality
Tweet
Share
Reddit
Vote
Email

Using QIRX SDR and DAB Signals to Calibrate RTL-SDR Dongles

Over on his site, Clem the author of the QIRX SDR software package has written up a three part series where he explains an ultra-fast and very accurate method for calibrating the frequency offset of RTL-SDR receivers by using DAB signals. If you are unfamiliar with DAB, it stands for 'Digital Audio Broadcast' and is a type of digital radio station available in multiple countries in the world, especially in Europe. However it is not used in the USA. Clem writes:

I wrote a three-part tutorial about an ultra-fast, generally available (where you have DAB reception) and very accurate method to calibrate RTL-SDR receivers. It is called "Tutorial: Calibrate your RTL-SDR in 15 Seconds", http://softsyst.com/QIRXCalibrate?sequenceNo=0. It is using the frequency of a DAB transmitter as the reference signal, and is coming in three parts:

· Part I: Method and Measurement, describes the method (example) and compares it to two other, well-known methods.

· Part II: Checks, Frequencies, Sampling Rates: Tells how to make plausibility checks on the obtained calibration result, goes into the foundation of different measuring methods, and explains why calibrating a receiver is generally beneficial, not only for DAB purposes (where at least the frequency correction is mandatory).

· Part III: Improving DAB, Tells why it is advantageous for DAB reception not only correcting the frequency, but also the sampling rate (which is often omitted).

Part I and Part II of these are already on our website, Part III will come soon.

QIRX Being used to Calibrate an RTL-SDR dongle on DAB signals
QIRX Being used to Calibrate an RTL-SDR dongle on DAB signals
Tweet
Share
Reddit
Vote
Email

Exploring CubicSDR with a Video Tutorial

Over on YouTube Corrosive has uploaded a new video where he explores CubicSDR, and explains all the windows and settings that it has. CubicSDR is a free RTL-SDR compatible cross-platform open source multi-mode SDR application, similar in nature to SDR#, HDSDR SDR-Console etc. It's quite popular due to it's multi-platform nature, meaning that it can run on Windows, MacOS and Linux.

RTL SDR CubicSDR Manual Gain and More | As requested by DATcarefreeCowboy

Tweet
Share
Reddit
Vote
Email

Going Portable with the Airspy HF+, Raspberry Pi and 7-Inch Touch LCD

Over on the swling blog we've seen a post where contributor 'Tudor' demonstrates his Airspy HF+ running nicely on a Raspberry Pi 3, 7-inch touchscreen LCD, and USB power bank. The video shows GQRX running very smoothly on the Pi, and how the setup is able to receive various HF signals. Tudor writes:

I bought the RPi to use it as a Spyserver for my Airspy HF+ SDR.

My main radio listening location is a small house located on a hill outside the city and there is no power grid there (it’s a radio heaven!), so everything has to run on batteries and consume as little power as possible.

My first tests showed that the Raspberry Pi works very well as a Spyserver: the CPU usage stays below 40% and the power consumption is low enough to allow it to run for several hours on a regular USB power bank. If I add a 4G internet connection there I could leave the Spyserver running and connect to it remotely from home.

Then I wondered if the Raspberry Pi would be powerful enough to run a SDR client app. All I needed was a portable screen so I bought the official 7” touchscreen for the RPi.

I installed Gqrx, which offers support for the Airspy HF+. I’m happy to say it works better than I expected, even though Gqrx wasn’t designed to work on such a small screen. The CPU usage is higher than in Spyserver mode (70-80%) but the performance is good. Using a 13000 mAh power bank I get about 3.5 hours of radio listening.

On the swling blog post comments Tudor explains some of his challenges including finding a battery that could supply enough current, finding a low voltage drop micro-USB cable, and reducing the noise emanating from the Raspberry USB bus. Check out the post comments for his full notes. 

Airspy HF+ and Gqrx running on Raspberry Pi

Tweet
Share
Reddit
Vote
Email