Tracking Trains: Monitoring Railroad ATCS Control Signals with an RTL-SDR

Over on his YouTube channel GusGorman402 has uploaded a tutorial which shows how he monitors ATCS (Advanced Train Control System) signals from trains. ATCS signals are found in the USA, and is used for things like communications between trains, rail configuration data, train location data, speed enforcement, fuel monitoring, train diagnostics and general instructions and messages.

In the video he first shows how to determine the frequency of trains signals in your area by using the US FCC database. He then shows how to download and install the ATCSMonitor software which is used for decoding the signals, and then walks us through configuring the correct settings within the software. The train signal audio is piped from SDR# to ATCSMonitor via VBCable, and received with an RTL-SDR and simple whip antenna.

Later in the video he shows how to fully set up the software with train databases so that the actual spotted train names show up. He also shows how to set up the dispatcher display which visually shows the current train locations and track configurations.

GusGorman402 has uploaded the tutorial in two videos. The first shows the full tutorial, configuration and demo for trains in the BNSF fleet. The second video shows how to monitor the Union Pacific fleet which uses a different protocol, which requires a slightly different set up in ATCSMonitor.

RTL-SDR Railroad ATCS Monitor BNSF Omaha

RTL-SDR Railroad ATCS Monitor Union Pacific Omaha

Nullcon 2017: Drone Hijacking And Other IoT Hacking With GNU Radio And SDR

Nullcon is a yearly security conference which was held this year during early March. Recently videos of some of the presentations have been uploaded. One presentation of interest is Arthur Garipov’s presentation on “Drone Hijacking And Other IoT Hacking With GNU Radio And SDR”. In his talk he explains how he uses software defined radios and GNU Radio to hack various IoT devices based on the nRF, and even a drone. The talk blurb reads:

Internet of things is surrounding us. Is it secure? Or does its security stand on (deemed) invisibility? SDR (Software-defined radio) and GNU Radio can answer these questions. In this presentation, we will play some modern wireless devices. They have similar protocols, and none of them encrypts its traffic.

We will show how easy it is to find them using SDR and proprietary chipsets, and how to sniff/intercept/fuzz these devices using a small python script and GNU Radio.

As an example we will show a Mousejack attack to wireless dongles, wireless keyboard keylogger and even a drone hijacking.

Speaker Bio
Senior Specialist, Network Application Security Team, Positive Technologies Artur was born in 1987. He is a graduate of the Ufa State Aviation Technical University, was a software developer at OZNA and an independent security researcher. He started his career at Positive Technologies in 2014. Now he is engaged in security research of wireless technologies, mobile systems, and IoT. He is also an organizer of the MiTM Mobile contest and hands-on lab at PHDays V and PHDays VI.

The talk slides can be downloaded from their archives.

nullcon Goa 2017 - Drone Hijacking And Other IoT Hacking With GNU Radio And SDR by Arthur Garipov

Building a Ground Plane / Spider ADS-B Antenna for 2€

Thanks to Manuel aka Tysonpower for submitting to us his extremely cheap ADS-B antenna build. Manuels ADS-B antenna consists of a simple SMA connector with flange and some wires cut to the correct resonant length for 1090 MHz ADS-B. This ground plane design has been around for years on the internet with atouk’s guide being the most commonly used, although atouk’s design uses a larger SO-239 connector instead. Manuel takes the design one step cheaper by using cheap single core copper wire for the elements, and a low cost SMA connector. The wires are soldered onto the SMA connector flange so you will need to know how to solder to complete the antenna.

Manuel has uploaded a video which shows the build steps for his cheap antenna in a step by step guide. We note that the video is narrated in German, but there are English subtitles.

[EN subs] ADSB Antenne für 2€ - DIY

Video Tutorial on Setting up the SDRplay RSP2 in Linux

Over on YouTube user Kevin Loughin has recently uploaded a video that shows a step by step guide on how to set up an SDRplay RSP2 in Linux. Setting up the RSP2 in Linux is not a simple task, but Kevin’s video walks us through the entire process step by step. At the end of the process you’ll be set up with the SoapySDR framework which is the glue software that sits between the hardware driver and SDR software. You’ll also have the CubicSDR software installed which is what you use for general browsing and listening. CubicSDR is similar to SDRuno, SDR#, HDSDR etc.

Over on his blog he’s also posted the steps in text form, and uploaded some of the scripts that he’s created to simplify the install process.

Ham Radio - How to set up the SDRPlay RSP2 under Linux. (See description below)

Exposing Cordless Phone Security with a HackRF

Over on YouTube user Corrosive has been uploading some videos that explore cordless phone security with a HackRF. In his first video Corrosive shows how he’s able to use a HackRF to capture and then replay the pager tones (handset finding feature) for a very cheap VTech 5.8 Gigahertz cordless phone. He uses the Universal Radio Hacker software in Windows.

In the second video corrosive shows how bad the voice security on the VTech 5.8 GHz phone can be. It turns out that while advertised as a 5.8 GHz phone and the handset does transmit at 5.8 GHz, the VTech basestation actually transmits voice in clear NFM at around 900 MHz. Cordless phones advertised as 5.8 GHz are typically considered as more secure due to their high frequency which is inaccessible to most scanner radios. In the video he also shows some of the digital pairing signals that the phone and basestation transmits.

Cordless Phone Security Exposed With HackRF SDR

Using a LimeSDR as a Simple 4G Repeater

Over on YouTube user Goat Industries has uploaded a video that shows him successfully using his LimeSDR as a 4G repeater. More information about his project to build a cell phone signal repeater can be found on his hackaday.io page, and he describes the project as follows:

In more remote areas it is often not financially viable for the cell network operator to build extra base stations for a small number of people and their phones/modems etc. Fortunately, this is not the end of the road as we can, in theory, build our own base stations and even create our own cells.

There are currently available two groups of devices that already claim to do this, one of which is reassuringly expensive and the other is just plain illegal! This project aims to democratise the situation enabling cost effective, hackable devices to be built that not only work properly but also conform to the telecoms regulations.

In his video he shows the repeater running on his LimeSDR. For software he uses Pothos to create the receiver and LimeSuite to control the LimeSDR settings.

The LimeSDR is advertised as a full duplex RX/TX capable SDR with a 100 kHz – 3.8 GHz frequency range, 12-bit ADC and up to 80 MHz of bandwidth. Back in June 2016 they surpassed their $500k goal, raising over $800k on the crowdfunding site Crowdsupply, and today it’s now up to over $1.1 million. Most crowdfunding backers have now received their units in the mail, but some are still waiting. We paid $199 USD for an early bird unit, and currently a preorder unit costs $289 USD on Crowd Supply.

LimeSDR working as a simple 4G signal repeater

Does the RTL-SDR.com FM Bandstop Filter Withstand TX Power?

Thanks to PY2RAF for writing in and sharing some tests that he did on our RTL-SDR Blog BCFM bandstop filter. The RTL-SDR Blog filters were designed for RX purposes only, and no provisions were made for TX with only small SMD components being used. However PY2RAF wanted to test to see if the filter could at least handle 5W. The gist of his results is that the filter seems to handle 5W just fine, but as a precaution we wouldn’t recommend that anyone do this unless you really know what you are doing! 

As he does not have a blog, we present PY2RAF’s write up here:


Introduction

I am a Ham Radio Operator (PY2RAF), live in a metropolitan and very RF-polluted area.

Recently, I bought a handheld device and was back to the ether, after a 12-year hiatus. I assembled myself a 3-band quarter-wave “cat whisker” antenna for 144, 220 and 430 MHz (https://rf01.co/q/antena.jpg), calibrated it using a VNA and was quickly back up in the air.

Despite great and complimentary reports of good audio and transmission reports, my reception was sub-par: Lots of interference (QRM), static, squelch closing despite high S-bar signal.

I got intrigued by that, it just did not make sense: Had the VX-8 large mouth but bad ears? After a couple of days puzzled, I got a good idea: Put my RTL-SDR.com filter in the antenna.

The result was great: It immediately reduced the idle band noise from 6-7 S-bars to 3-4 S-bars. The squelched interrupted audio also stopped happening.

So, I could conclude that the strong FM BC band was overloading the receiving stage of the radio. Culprit found.

However, it brought another problem: the filter is NOT designed to cope with TX power (it is actually expressly stated at the product description page). However, the enhancement was just too good and I reached Carl asking about TX support or tests. Carl explained me that while the filter was not designed with TX power in mind, it withstand some minor current, because it supports Bias Tee currents.

I took it as a ‘good enough, I’ll test it’. See the results below.

Material

The Device Under Test (DUT) is a RTL-SDR.com FM Bandstop Filter. The transceiver is a Yaesu VX-8DR. I used a PocketVNA Vector Network Analyzer for checking the filter S21 characteristics and antenna S11 VSWR and impedance figures.  The realtime VSWR and TX power were monitored by a Diamond SX-200. I also used a Rtl-SDR.com SDR dongle and GQRX software to check for any transmission distortion. The radiant system (antenna) is a homebrew 3-band multiple dipole antenna, with VSWR < 1:1.3 in frequencies under test.

Method

Prior to any transmission, I put the DUT in the VNA and noted its frequency and attenuation figures.

Next step, assembled the test environment:

Transceiver – wattmeter – DUT – antenna.

I did then the first test: set the radio to its lowest power (0.05 W) and transmitted in frequency 144.320 MHz. I have also tuned the SDR dongle in the same frequency and watched the  waterfall pattern, while listening for the resulting audio. Then, repeated the very same test now adding the DUT before the antenna. The waterfall signature and the audio quality was pretty much the same and coherent. Transmitted for approx. 30 seconds using the Filter.

In the next step, I repeated the tests raising the TX power to 1W and 2.5W. I requested feedback from a fellow Ham operator and got report that the audio quality was pretty much the same with and without the filter, with no changes in RX S-units figures. It means, it did not distort the audio nor put significant attenuation into the signal.

The next test was the real world conditions test. I switched to the repeater 146.910 MHz, negative shift (actual TX 146.310, https://goo.gl/maps/45cUY58yot52). This repeater is located circa 100 KM north from my residence. After introducing myself to the repeater and stating the device test, I started transmitting first with a single watt: successfully hit the repeater. After around 7 comms averaging around 2 minutes, I asked for feedback with and without the filter: The reports that I have heard were of no change in the quality or fidelity of the transmission. The SWR was being continuously monitored by the Diamond SX-200, paying attention for any component disruption and sudden SWR raise: The operation was just normal. The filter also did not present any temperature change noticeable by touch.

Finally, I raised the TX power to 5W and requested report. I did a 1’30” TX and got report of normal transmission.

Results

This test validated, to me, the useful and robustness of the bandstop filter in my antenna as a permanent solution: It did not change the SWR figure, produced heating, noticeable attenuation or signal distortion: It became, since then, a permanent item between my radio and the antenna.

After the tests, I ran another round of DUT tests in VNA and the attenuation of the filter were the same as original: Working the way it should be.

Next day, I joined the repeater net again and spent around two hours ragchewing in the radio, accumulating something around 25 minutes of TX. Nothing wrong was noticed.

A Final Note

It is important to register that the DUT is working in a nicely matched (VSWR < 1:1.5) antenna system. Unmatched or higher VSWR figures can result in higher voltage, enough to break down the isolation. High-Q antenna systems might also present the same issue.

A Tour of Satellites in the QB50 Experiment

Over the last two weeks the QB50 experiment was launched from the International Space Station (ISS). The experiment consists of 36 cubesats built by various universities around the world, with the main science goal being to make measurements of the thermosphere (an upper atmospheric layer that the ISS orbits in). All the cubesats broadcast their telemetry in the 70cm (420 – 450 MHz) amateur band and they are expected to stay in orbit for about 3 months before falling back to earth. In a previous post we made a point to mention Lilacsat-1, which is one of the most interesting QB50 satellites due to its implementation of a FM to digital voice repeater on board.

The QB50 Experiment Launch
The QB50 Experiment Launch

Over on his blog destevez has been following these satellites, and has uploaded a post that shows him receiving and decoding several of the satellite telemetry packets. His gr-satellites GNU Radio package provides a means to decode many of the satellites in the experiment.

Some packets from QB50 and other satellites in the 70cm amateur band.
Some packets from QB50 and other satellites received by destevez in the 70cm amateur band.