January 13, 2016

PiTX QRP TX Shield for WSPR on 20M Now For Sale

Back in October 2015 we posted about a piece of software for the Raspberry Pi called PiTX. PiTX allows you to turn your Raspberry Pi into a fully functional RF transmitter. When combined with an RTL-SDR a full transceiver radio can be built using the QTCSDR software.

PiTX works by modulating the GPIO pins on the Pi in such a way that it is able to produce FM modulation. The major problem with using this method of producing radio is that it creates large amounts of harmonics and interference outside of the intended transmit frequency. Interference like this is illegal and could potentially disrupt life critical radio systems such as emergency services, cellphones and air traffic control.

In order to cleanly transmit with PiTX an output RF filter should be used. Recently, the team over at TAPR.org have released a 20M WSPR TX filter shield. WSPR is pronounced “Whisper” and is short for “Weak Signal Propagation Reporter Network“. It is a type of amateur radio signal that can be broadcast and received around the world by using very low transmit power. Radio amateurs use it to see how far their signal can travel when using very low power (QRP) and to investigate signal propagation conditions.

The 20M WSPR shield sells for $20 at www.tapr.org/kits_20M-wspr-pi.html.

The WSPR shield sitting on top of a Raspberry Pi.

Vote

January 11, 2016

Combining the bandwidth of multiple RTL-SDRs: Now working in GQRX!

A few days ago we posted how Oliver, an RTL-SDR experimenter, managed to (incoherently) combine the bandwidths of two RTL-SDR dongles to create a 4.4 MHz FFT display in GNU Radio. Now Oliver has taken this idea further and produced an updated version of his GNU Radio program.

Oliver’s GNU Radio program is now capable of combining four RTL-SDR dongles and is now also capable of piping the output via a FIFO to GQRX. With four RTL-SDR dongles you can get a total bandwidth of 8.4 MHz. He also writes that it is even possible to listen to analog signals that are in overlapping areas.

Four RTL-SDRs producing a total of 8.4 MHz of bandwidth in GQRX.

Vote

January 11, 2016

More talks from Defcon 23

Some more SDR and RF related talks from Defcon 23. See our previous posts [1][2] for other talks that we posted previously.

Colby Moore – Spread Spectrum Satcom Hacking

Recently there have been several highly publicized talks about satellite hacking. However, most only touch on the theoretical rather than demonstrate actual vulnerabilities and real world attack scenarios. This talk will demystify some of the technologies behind satellite communications and do what no one has done before – take the audience step-by-step from reverse engineering to exploitation of the GlobalStar simplex satcom protocol and demonstrate a full blown signals intelligence collection and spoofing capability. I will also demonstrate how an attacker might simulate critical conditions in satellite connected SCADA systems.

In recent years, Globalstar has gained popularity with the introduction of its consumer focused SPOT asset-tracking solutions. During the session, I’ll deconstruct the transmitters used in these (and commercial) solutions and reveal design and implementation flaws that result in the ability to intercept, spoof, falsify, and intelligently jam communications. Due to design tradeoffs these vulnerabilities are realistically unpatchable and put millions of devices, critical infrastructure, emergency services, and high value assets at risk.

DEF CON 23 - Colby Moore - Spread Spectrum Satcom Hacking

Watch this video on YouTube

DaKahuna and satanklawz – Introduction to SDR and the Wireless Village

In many circumstances, we all have to wear different hats when pursuing hobbies, jobs and research. This session will discuss the exploration and use of software defined radio from two perspectives; that of a security researcher and Ham Radio operator. We will cover common uses and abuses of hardware to make them work like transceivers that the Ham crowed is use too, as well as extending the same hardware for other research applications. Additionally we will highlight some of the application of this knowledge for use at The Wireless Village! Come and join this interactive session; audience participation is encouraged.

DEF CON 23 - DaKahuna and satanklawz - Introduction to SDR and the Wireless Village

Watch this video on YouTube

Lin Huang and Qing Yang – Low cost GPS simulator: GPS spoofing by SDR

It is known that GPS L1 signal is unencrypted so that someone can produce or replay the fake GPS signal to make GPS receivers get wrong positioning results. There are many companies provide commercial GPS emulators, which can be used for the GPS spoofing, but the commercial emulators are quite expensive, or at least not free. Now we found by integrating some open source projects related to GPS we can produce GPS signal through SDR tools, e.g. USRP / bladeRF. This makes the attack cost very low. It may influence all the civilian use GPS chipset. In this presentation, the basic GPS system principle, signal structure, mathematical models of pseudo-range and Doppler effect will be introduced. The useful open source projects on Internet will be shared with attendees.

DEF CON 23 - Lin Huang and Qing Yang - Low cost GPS simulator: GPS spoofing by SDR

Watch this video on YouTube

Vote

January 11, 2016

Investigating QRM from Powerline Ethernet Devices with a Funcube Dongle

Over on his blog Andrew has posted a good writeup where he determines the QRM (interference) effects of a PLT (power line transmission) device. PLTs are also known as ethernet/internet over powerline devices and they are devices that plug into an electricity socket and use household electricity wires to create a computer network, thus eliminating the need for ethernet cables or WiFi. However, many hams and radio hobbyists hate these devices because they believe that they can cause significant amount of radio interference, especially on HF.

In his investigation Andrew bought a pair of Netgear Powerline 500 PLTs. He then plugged the PLTs in and started streaming a movie over the powerline network connection to cause maximum radiation. Then using his Funcube dongle and SDR# he investigated ham bands to see if these devices brought any noise.

In his results Andrew writes that he barely saw any interference caused by these devices. Some interference was noticed at 17 meters and 12 meters, but he notes that the amateur portion was left relatively unaffected. Many hams believe these devices can completely wipe out HF, but it seems that this is untrue, at least for this particular PLT model.

Vote

January 8, 2016

Demonstrating the ARM Radio

Back in November 2015 we posted about the ARM Radio, a minimalist direct sampling software defined radio that runs almost entirely on an ARM processor on a STM32F429 discovery board. It can tune from about 8 kHz up to 900 kHz, which covers the VLF, LF and some of the MF bands.

Now over on YouTube amateur radio hobbyist W9RAN has uploaded a video where he demonstrates an ARM Radio that he built. He shows the radio in operation with it clearly receiving some NDB’s and some AM broadcast stations.

ARM Radio demo BY W9RAN

Watch this video on YouTube

Vote

January 8, 2016

Hamradioscience.com’s Review of the SDRplay

The author of hamradioscience.com has posted a review of his thoughts on the SDRplay RSP software defined radio. The SDRplay is a SDR that is a $150 USD software defined radio that can be considered as a next stage level up from the RTL-SDR dongle. We consider it somewhat of a competitor to the Airspy SDR ($199 USD).

The review goes over the marketed specs, what you get in the box, software, support and its real world performance. The review is positive and the author concludes:

At the $150 price point there just isn’t much to complain about. The SDRPlay represents an excellent value in a low cost wideband SDR receiver. If you are currently considering getting involved with SDR radio, or want to trade up from the RTL dongle world, then the SDR Play should definitely be on your short list.

If you are interested in mid level SDR’s like the SDRplay then keep an eye out for our own review on RTL-SDR.com coming out in the next few weeks. We will be doing an in depth review and comparison of the Airspy, SDRplay and HackRF.

Vote

January 8, 2016

Combining the bandwidth of two RTL-SDR dongles in GNU Radio

The maximum usable and stable bandwidth of an RTL-SDR is about 2.4 MHz. In order to get larger bandwidths it is possible to combine two or more dongles, although doing so comes with a big limitation – since the clocks and signal phases between separate dongles would not be synchronised, it would be impossible to decode a wideband signal this way. However, combining dongles for larger bandwidths is still useful for visualizing the spectrum through an FFT plot, or perhaps for decoding various separate narrowband signals. Although creating a wide band FFT plot with multiple dongles is fairly simple, we haven’t seen much software do this before.

However now RTL-SDR.com reader Oliver wrote in to show us the GNU Radio script he’s been using to combine the bandwidths of two RTL-SDR dongles together to get a 4.4 MHz FFT display. The script can be used to get a combined 4.4 MHz spectrum visualization without a center dip from roll off, or a 4.8 MHz spectrum with rolloff. Oliver writes:

I simply took two RTL-SDR dongles at their max. band width of 2.4 MHz, resampled the signals to 4.8 MHz, then shifted the first signal down by 1MHz, the other one 1 MHz up, added them together, divided the combined signal by 2 and finally feed it into a FFT plot.

At first, I tried shifting the signals by 1.2 MHz to get full 4.8 MHz, but I realized, that I had a notch in the center, so I reduced the frequency shift until I had no notch anymore.

Vote

January 6, 2016

Solving the Mystery of a Keyless Vehicle Entry RF Deadspot in a Carpark with a FUNcube Dongle

The Brisbane Times ran a story today that discussed an interesting RF phenomenon that was solved using a FUNcube dongle software defined radio. The Funcube dongle is a SDR similar to the RTL-SDR. The issue was that vehicle wireless entry keyfobs would not work at a particular location within an outdoor shopping centre car park.

The story goes like this – First a user on a local Brisbane subreddit message board posted about how he had noticed that his cars wireless entry keyfob would not work when he parked in a certain area of the shopping area car park. The user wrote:

I walked out to my car from Bunnings, and there was a new HSW Maloo parked in front of me with the owner staring at his key fob and shaking his head.

I said “let me guess, car won’t open?” and he said yeah, and he’d been trying for about 5 minutes. I said that I’d had the same thing happen to me a few months back in the same spot, and then went to open my car.

Nothing. No beep, door stayed locked. Looked around and there was another couple trying to get into their car as well (late model C Class).

It took about 5 minutes of me trying the door every 20 seconds or so before it opened. HSV owner was still there when I left. The only thing he and I could think of causing it was the mobile phone tower in front of Aldi.

After reading the post, user u/riumplus decided to go out to the same spot with his Funcube dongle SDR and see if there was any interference that might explain the issues. But he found no such interference. However, when he pressed the wireless entry on his own keyfob he noticed reflections from the main transmission that were coming from the buildings walls. He wrote:

So I pulled out my SDR and I did a complete frequency sweep from 100kHz to 2.2GHz and… also nothing. Everything completely normal. Nothing on that frequency, nor anything odd anywhere else on the spectrum. Couldn’t see any of the usual potential harmonics from RFID or standard WiFi gear. Here’s the output at 433.3MHz (forgot to grab a screenshot centred right at 433.92Mhz but it was also empty, as was 315MHz).

Here’s where it gets interesting – I noticed that that location is almost in the middle of the car park between the three buildings, and they all have large amounts of metal flashing on their fronts. On a whim I watched the output when I pressed my own keyfob. And what do you know, I could see distorted reflections from my own signal bouncing off these buildings right back at me. My guess is that this is what was causing you issues!

It may sound counter-intuitive, but next time it happens try cupping the keyfob in your hand to weaken the signal. It should still be strong enough to trigger your car to open, but then the reflections will be weak enough they won’t cause you trouble.

So it seems that the layout of the buildings caused a focal point for reflections at that particular location which affected some wireless keyfobs.

The location in the carpark of the deadzone.

Vote