The first prize is a NESDR SMArt XTR HF Bundle. The NESDR SMArt XTR is an E4000 unit with SMA connector in the SMArt form factor. E4000 dongles have a higher maximum frequency range of up to 2.3 GHz, but a lower frequency minimum of 64 MHz. However, generally the R820T2 chip has better RF performance. The prize bundle comes with a ham-it-up upconverter, a balun 1:9, and some whip antennas.
The second prize is a NESDR Nano 2+ ADS-B bundle. The Nano 2+ is a small 1 cm x 1 cm dongle which is often used for Android mobile devices, or computing hardware like Raspberry Pi’s. The bundle comes with 1090 and 978 MHz whip antennas and some adapters.
Third prize is the same as the second prize, but with a Nano 2. The difference between the Nano 2 and Nano 2+ is that the Nano 2 does not have a TCXO. The fourth, fifth and sixth prizes are individual dongles.
Recently Outernet released their new ‘Dreamcatcher’ hardware which is an RTL-SDR + L-band LNA & filter + computing board all on the same PCB. The Dreamcatcher costs $99 USD and can be bought directly from their store. For your $99 you get the Dreamcatcher board, as well as a new ceramic L-band patch antenna which has a built in L-band LNA and filter. The built in LNA is useful as it allows you to use a few meters of extension cable in order to get the patch antenna in a good position outdoors.
At the moment the Dreamcatcher can be run with two different SD card images: the Skylark Outernet software, or Armbian (Linux). The Armbian image is basically just standard Armbian and at the moment does not actually run any Outernet software, and cannot decode their signal – but this is being worked on. Eventually they hope to depreciate the Skylark image and instead use an Outernet receiver app that runs on Armbian.
When running on the standard Armbian image, the Dreamcatcher can be used as a regular RTL-SDR connected to Linux, as there is a bypass port which bypasses the built in L-band LNA and filter. This port is enabled by default, but can be software switched to the L-band port if desired. There is also a 4.8V bias tee on the bypass port that can be turned on in software and used to power external devices via the coax cable. Currently there is no display support on the Dreamcatcher so the unit must be run headless, meaning that you must connect to it via UART or SSH from another PC.
The Outernet Dreamcatcher
The Dreamcatcher is advertised with the following specifications:
L-band SAW filter (1525 – 1559 MHz)
Two-stage L-band LNA with 34dB gain
1 PPM TCXO
RF bypass for tuning from 24 – 1600 MHz – use as a regular RTL SDR!
Software switchable bias tee
3 USB ports
GPIO forest
UARTs, I2C, SPI headers (unpopulated) for driving external hardware
Two microSD card holders – for boot and storage!
1 GHz CPU
512 MB RAM
USB wifi dongle (based on RTL8188CUS chipset) – AP mode capable!
Lots of LEDs!
Switches!
microUSB OTG
microUSB power port
Audio In/Out
Fully mainline (4.10) kernel and Uboot (2017.01) support!
Also as explained on the forums, Dreamcatcher uses an Allwinner A13 SoC, which has inside an ARM Cortex A8 @ 1 GHz CPU. They’ve also added 512MB of RAM. The PCB measures 12 cm x 12 cm.
Currently the Dreamcatcher is being advertised as beta hardware, as they give the following warning:
Although some assistance can be found on our forums, Outernet provides no direct support for this product. If you are not a tinkerer, hobbyist, or hardware hacker, you may be disappointed with your purchase.
The Dreamcatcher also comes with Outernet’s latest L-band patch antenna. The new patch antenna uses a ceramic patch and a 12 cm x 12 cm PCB ground plane. The antenna is ‘active’, as it has a built in L-band LNA and filtering. It is powered by the bias tee on the Dreamcatcher, and can also be powered by the bias tee on our V3 RTL-SDR’s. An active antenna is a good idea as this allows you to place the antenna outdoors (you’d need to waterproof this antenna in a plastic box though), and run a coax cable inside. The LNA should help overcome the coax cable loss which can be quite high at the L-band Outernet frequency of 1.5 GHz.
Outernet has provided us with a sample of this kit, and we plan to release a full review of the unit within the next few weeks.
Outernet active ceramic patch antenna (Front)Outernet active ceramic patch antenna (Rear)
Over on his YouTube channel GusGorman402 has uploaded a tutorial which shows how he monitors ATCS (Advanced Train Control System) signals from trains. ATCS signals are found in the USA, and is used for things like communications between trains, rail configuration data, train location data, speed enforcement, fuel monitoring, train diagnostics and general instructions and messages.
In the video he first shows how to determine the frequency of trains signals in your area by using the US FCC database. He then shows how to download and install the ATCSMonitor software which is used for decoding the signals, and then walks us through configuring the correct settings within the software. The train signal audio is piped from SDR# to ATCSMonitor via VBCable, and received with an RTL-SDR and simple whip antenna.
Later in the video he shows how to fully set up the software with train databases so that the actual spotted train names show up. He also shows how to set up the dispatcher display which visually shows the current train locations and track configurations.
GusGorman402 has uploaded the tutorial in two videos. The first shows the full tutorial, configuration and demo for trains in the BNSF fleet. The second video shows how to monitor the Union Pacific fleet which uses a different protocol, which requires a slightly different set up in ATCSMonitor.
Nullcon is a yearly security conference which was held this year during early March. Recently videos of some of the presentations have been uploaded. One presentation of interest is Arthur Garipov’s presentation on “Drone Hijacking And Other IoT Hacking With GNU Radio And SDR”. In his talk he explains how he uses software defined radios and GNU Radio to hack various IoT devices based on the nRF, and even a drone. The talk blurb reads:
Internet of things is surrounding us. Is it secure? Or does its security stand on (deemed) invisibility? SDR (Software-defined radio) and GNU Radio can answer these questions. In this presentation, we will play some modern wireless devices. They have similar protocols, and none of them encrypts its traffic.
We will show how easy it is to find them using SDR and proprietary chipsets, and how to sniff/intercept/fuzz these devices using a small python script and GNU Radio.
As an example we will show a Mousejack attack to wireless dongles, wireless keyboard keylogger and even a drone hijacking.
Speaker Bio Senior Specialist, Network Application Security Team, Positive Technologies Artur was born in 1987. He is a graduate of the Ufa State Aviation Technical University, was a software developer at OZNA and an independent security researcher. He started his career at Positive Technologies in 2014. Now he is engaged in security research of wireless technologies, mobile systems, and IoT. He is also an organizer of the MiTM Mobile contest and hands-on lab at PHDays V and PHDays VI.
The talk slides can be downloaded from their archives.
nullcon Goa 2017 - Drone Hijacking And Other IoT Hacking With GNU Radio And SDR by Arthur Garipov
Thanks to Manuel aka Tysonpower for submitting to us his extremely cheap ADS-B antenna build. Manuels ADS-B antenna consists of a simple SMA connector with flange and some wires cut to the correct resonant length for 1090 MHz ADS-B. This ground plane design has been around for years on the internet with atouk’s guide being the most commonly used, although atouk’s design uses a larger SO-239 connector instead. Manuel takes the design one step cheaper by using cheap single core copper wire for the elements, and a low cost SMA connector. The wires are soldered onto the SMA connector flange so you will need to know how to solder to complete the antenna.
Manuel has uploaded a video which shows the build steps for his cheap antenna in a step by step guide. We note that the video is narrated in German, but there are English subtitles.
Over on YouTube user Kevin Loughin has recently uploaded a video that shows a step by step guide on how to set up an SDRplay RSP2 in Linux. Setting up the RSP2 in Linux is not a simple task, but Kevin’s video walks us through the entire process step by step. At the end of the process you’ll be set up with the SoapySDR framework which is the glue software that sits between the hardware driver and SDR software. You’ll also have the CubicSDR software installed which is what you use for general browsing and listening. CubicSDR is similar to SDRuno, SDR#, HDSDR etc.
Over on YouTube user Corrosive has been uploading some videos that explore cordless phone security with a HackRF. In his first video Corrosive shows how he’s able to use a HackRF to capture and then replay the pager tones (handset finding feature) for a very cheap VTech 5.8 Gigahertz cordless phone. He uses the Universal Radio Hacker software in Windows.
In the second video corrosive shows how bad the voice security on the VTech 5.8 GHz phone can be. It turns out that while advertised as a 5.8 GHz phone and the handset does transmit at 5.8 GHz, the VTech basestation actually transmits voice in clear NFM at around 900 MHz. Cordless phones advertised as 5.8 GHz are typically considered as more secure due to their high frequency which is inaccessible to most scanner radios. In the video he also shows some of the digital pairing signals that the phone and basestation transmits.
Over on YouTube user Goat Industries has uploaded a video that shows him successfully using his LimeSDR as a 4G repeater. More information about his project to build a cell phone signal repeater can be found on his hackaday.io page, and he describes the project as follows:
In more remote areas it is often not financially viable for the cell network operator to build extra base stations for a small number of people and their phones/modems etc. Fortunately, this is not the end of the road as we can, in theory, build our own base stations and even create our own cells.
There are currently available two groups of devices that already claim to do this, one of which is reassuringly expensive and the other is just plain illegal! This project aims to democratise the situation enabling cost effective, hackable devices to be built that not only work properly but also conform to the telecoms regulations.
In his video he shows the repeater running on his LimeSDR. For software he uses Pothos to create the receiver and LimeSuite to control the LimeSDR settings.
The LimeSDR is advertised as a full duplex RX/TX capable SDR with a 100 kHz – 3.8 GHz frequency range, 12-bit ADC and up to 80 MHz of bandwidth. Back in June 2016 they surpassed their $500k goal, raising over $800k on the crowdfunding site Crowdsupply, and today it’s now up to over $1.1 million. Most crowdfunding backers have now received their units in the mail, but some are still waiting. We paid $199 USD for an early bird unit, and currently a preorder unit costs $289 USD on Crowd Supply.
![[EN subs] ADSB Antenne für 2€ - DIY](https://www.rtl-sdr.com/wp-content/plugins/wp-youtube-lyte/lyteCache.php?origThumbUrl=https%3A%2F%2Fi.ytimg.com%2Fvi%2FU6ae4E75ICY%2F0.jpg)
