A Video Introduction to Broadband Surveillance with RTL_POWER

Over on YouTube "Mount Lethe Hellfire" has recently uploaded a video showing a deep dive into the rtl_power tool. rtl_power enables users to generate wide-spectrum displays by rapidly sweeping the RTL-SDR’s center frequency across the desired frequency range.

In this video I do a deep-dive into the command line tool, rtl_power, which is a purpose built headless RF broadband spectrum scanner. I dive into the command line, its use cases as it pertains to SIGINT (COMINT, ELINT), and finally do a live demo. Additionally, I provide some other ways to access your DragonOS running on Raspberry Pi with VSCode as well as troubleshooting issues with USB claims on Linux.

In a second video, Mount Lethe Hellfire continues this topic and goes on to show how rtl_power can be combined with visualization and scripting for powerful RF spectrum analysis.

In this video I walk you through how to use a Python script (running on DragonOS, or otherwise) that will process rtl_power SSV outputs, normalize the data points, and assist you in visualization as well as local analysis using Structure Query Language (SQL) with DuckDB. The SQL analysis is to pull out the Top 10 frequencies sorted by dBm, nothing too crazy but enough to inform you on further ELINT and COMINT collection, processing, exploitation, and analysis efforts.

TEMPEST-LoRa: Emitting LoRa Packets from VGA or HDMI Cables

University researchers from China have recently shown in a research paper that it is possible to maliciously cause a VGA or HDMI cable to emit LoRa compatible packets by simply displaying a full-screen image or video. This has potential security implications as a malicious program could be used to leak sensitive information over the air, completely bypassing any internet or air-gap security systems.

In the past, we have demonstrated that TEMPEST techniques can be used to spy on monitors and security cameras by analyzing the unintentional signals they emit. This research takes the idea a step further by determining what particular images need to be displayed to create a LoRa packet with data. 

In the paper, the researchers mention using either off-the-shelf LoRa devices or low-cost SDRs such as the HackRF to receive the packets. The advantage of the SDR method is that it allows for customization of the frequency and the use of LoRa-like packets, which can achieve even longer ranges and higher data rates. The team show that they were able to achieve a receive range of up to 132 meters and up to 180 kbps of data rate.

TEMPEST-LoRa Test Setup
TEMPEST-LoRa Test Setup

NOAA 15 and 19 To Be Decommissioned Within the Next Two Weeks

The National Oceanic and Atmospheric Administration (NOAA) have recently announced that they are planning to decommission NOAA 15 and NOAA 19 on August 12, 2025 and August 19, 2025 respectively.

Update #7: NOAA has completed End of Life (EOL) testing activities for NOAA-15 and NOAA-19 and will commence the decommission process shortly. These two remaining satellites in the NOAA Polar Operational Environmental Satellites (POES) Constellation are far beyond their primary mission design life. All have incurred subsystem and instrument degradation or failures and have entered a "twilight phase" where failure modes are increasingly likely. As a reminder, NOAA-18 was decommissioned on June 6, 2025 at 1740 UTC due to an unrecoverable failure to the S-Band transmitter. The remaining satellites in the legacy POES constellation will be decommissioned as follows: NOAA-15 on August 12, 2025 and NOAA-19 on August 19, 2025.

NOAA-15, NOAA-18, and NOAA-19 have long been core satellites for RTL-SDR users. For many of us, one of these would have been the first satellite from which we received weather data via the 137 MHz APT signal.

These NOAA satellites were marked end-of-life (EOL) back on June 16, 2025. However, EOL status still meant that transmissions would continue as normal. The EOL status simply marked that the satellites should no longer be used for mission-critical services, and that no attempts at repair or recovery would be made if needed.

On June 06, 2025, just before the EOL status officially went into effect, NOAA-18 was decommissioned and shut down due to a prior transmitter failure that left ground control in danger of being unable to control the satellite in the future. 

While nothing critical appears to have happened to the remaining NOAA-15 and NOAA-19 satellites as of yet, these are ageing satellites with various ongoing issues. NOAA-15 was launched in 1998, and NOAA-19 in 2009. They have long exceeded their design life.

As with NOAA-18's decommissioning, it does not appear that NOAA will deorbit the satellites. Instead, they will be left in orbit and put into a safe electrical state, with the transmitters shut down.

You can find more information about the decommissioning over on Carl Reinmann's usradioguy blog.

A Drawing of NOAA-19
A Drawing of NOAA-19

ARPS.Chat – Send and Receive APRS Messages Globally

Thank you to Sarah Rose Giddings (aka Signals Everywhere) for submitting to us her latest project called aprs.chat. This is a web service that allows ham radio operators to have all of their incoming APRS (Automatic Packet Reporting System) messages (regardless of SSID) saved in history on the web platform. This will enable operators to never miss a message, even when their radios are turned off. The service works over the APRS-IS (APRS Internet Service) network, which bidirectionally connects APRS radios to the internet.

Sarah notes that the service currently works through the website, but an Android app is planned for release in the near future. Patreons of Sarah/Signals Everywhere can get early access to the Android app on request.

More information about the service can be found on this post on the Signals Everywhere blog.

aprs.chat website
aprs.chat website

KISS_LoRa_TAK – Integrating ESP32 LoRa with TAK

Thank you to YD1RUH for writing in and sharing his open-source KISS_LoRa_TAK project with us. YD1RUH writes:

I’d like to share a small open-source project that I believe could be valuable for the RTL-SDR and tactical radio communities: KISS_LoRa_TAK, a minimalistic approach to integrate ESP32-based LoRa modules with ATAK (Android Team Awareness Kit) using a simple web-based configuration and KISS principles (Keep It Simple, Stupid).

The project is documented here:
📎 GitHub: https://github.com/YD1RUH/KISS_LoRa_TAK

It includes a web UI for setting LoRa parameters directly from a browser, turns the ESP32 into a configurable CoT forwarder over LoRa, and allows ATAK users to operate in disconnected environments — all from a low-cost module like the TTGO LoRa32-OLED.

  • The documentation covers:
  • How to flash the firmware and get started
  • Web interface preview
  • ATAK connection instructions
  • Recommended LoRa settings for various terrains
  • Screenshots of the system in use

ESP32 Tak LoRa Hardware
ESP32 Tak LoRa Hardware

Michael Ossmann Gives A First Look at the HackRF Pro in YouTube Video

Recently, Great Scott Gadgets announced the upcoming September release of their HackRF Pro, an upgrade to their popular HackRF software-defined radio. 

On YouTube, Michael Ossmann, the founder of Great Scott Gadgets, has just uploaded a video explaining the improvements that the HackRF Pro will bring. Apart from the change from microUSB to USB-C, Michael demonstrates how the HackRF Pro has achieved improved performance by eliminating the DC spike and reducing the number of strong signal mirror images.

Saveitforparts: Tracking US Government Spy Planes over your Neighbourhood

In his latest YouTube video, Gabe from the saveitforparts channel has uploaded an interesting video detailing how he's tracking government spy planes over his neighbourhood using SDRs to monitor ADS-B data, and Orbic hotspots to detect Stingray activity (fake cell tower basestations).

In the video, Gabe highlights how he detects and follows a suspicious aircraft, concluding that it is most likely a DEA surveillance plane. This conclusion is supported by the fact that the ADS-B data is censored on FlightRadar24, something which normally only happens with law enforcement aircraft, as well as private jets. Upon zooming in on the aircraft with a camera, various antennas and cameras are also visible on the belly. Finally, Gabe found that the plane's registration number is linked to a Texas-based shell company with connections to the DEA.

In the video Gabe also tests out the RayHunter custom firmware for Orbic mobile internet to WiFi hotspot devices. This custom firmware turns these devices into Stingray detectors. A Stingray is a fake cellular base station that is often used by law enforcement to spy on cell phone activity.

TechMinds: A Review of the HydraSDR RFOne

Over on the Tech Minds YouTube channel, Matt has uploaded a review video of the HydraSDR RFOne. The HydraSDR RFOne is a new software-defined radio, made in the USA. The design is heavily based on the Airspy R2, and the creator of HydraSDR worked on the Airspy product design in the past. In a previous post, we also reviewed the HydraSDR, comparing it against the Airspy R2.

In the video, Matt goes over the specs of the HydraSDR, and then unboxes and disassembles the enclosure, showing the PCB. He goes on to update the firmware and then test its operation in SDR++, noting generally good performance.