Using the Don’t Look Up Tool to Eavesdrop on Insecure Private Satellite Communications

Over on YouTube, Rob VK8FOES has uploaded a video showing how to install and use the "dontlookup" open-source Linux Python research tool for evaluating satellite IP link security. Back in October, we posted about a new Wired article that discussed how many geostationary satellites are broadcasting sensitive, unencrypted data in the clear and how a cheap DVB-S2 receiver and satellite dish can be used to eavesdrop on them.

In the video, Rob discusses the new dontlookup tool, which is an excellent one-stop shop open-source tool for parsing IP data from these satellites. He goes on to show the full steps on how to install and use the tool in Linux. The end result is private internet satellite data being visible in Wireshark (blurred in the video for legal reasons). In the video description, Rob writes:

I thought I would make a video showcasing this new open-source Python tool for Linux. 'Don't look up' is the result of a research campaign conducted by a group of cyber security researchers from the USA for decoding DVB-S2 satellite data transponders.

Geostationary communications satellites are somewhat of a 'perfect target' to malicious threat actors, due to their downlink signals covering large portions of earth surface. This gives attackers are large attack surface to intercept IP traffic being transmitted from space. To most peoples surprise, little-to-no security, such as encryption, are being used on these data transponders!

This is all old news to myself, and the fans of my YouTube channel that have been following my TV-satellite hobby for the past couple of years. Most of this was already possible with consumer-grade satellite equipment and a Python application called GSExtract. However, the scope of GSExtract was a lot more narrower than that of DontLookUp, with the developers claiming to have achieved an exponential packet recovery rate compared to GSExtract.

Join me in this video today where I will be showing my users how to patch and build the TBS5927 USB satellite receiver drivers for RAW data capturing. I'll also be showcasing the software application called 'DVBV5-Zap' which interfaces with our satellite receiver to capture RAW data from a satellite. And finally, I will finish-off the video by demonstrating the actual usage of DontLookUp itself. To make the tutorial as accessible as possible, I'm doing the entire process inside a Linux virtual machine!

This tutorial will probably only work in DragonOS FocalX R37 Linux by the wonderful @cemaxecuter. You are welcome to try on other Linux distributions, but your mileage will vary! Also, due to the TBS5927 using something called a 'Isochronous Endpoint', it's only possible to use this satellite receiver via USB Passthrough in VMWare versions 17.5 and above. VirtualBox does not support Isochronous USB Endpoints in any version. It's always best to run Linux on 'bare-metal' by installing it directly to your PC's internal SSD, or running it from a bootable USB thumb drive.

Please understand that if you own an internal PCI-E satellite receiver card from TBS, it is not possible to 'pass it through' to Linux running inside in a Type-2 Hypervisor (VMware, VirtualBox etc.) Installing Linux on bare-metal is the only hope for PCI-E card owners. Thanks very much for watching!

HARDWARE:
TBS5927 USB Satellite Receiver
90cm 'Foxtel' Satellite Dish
Golden Media GM202+ LNB
Hills RG-6 Coaxial Cable (F-Type Connectors, 75 Ohm)

SOFTWARE:
VMWare Workstation 17.6.2
DragonOS FocalX R37 Linux
TBS 'Linux_Media' Drivers
'RAW Data Handling' Patch
DVBV5-Zap
DontLookUp

If you're interested in this topic, Rob's YouTube channel has many videos on this topic that are worth checking out.

Don't Look Up (No, Not The Movie): A New Research Tool To Evaluate Satellite IP Link Security!

Tweet
Share
Reddit
Vote
Email

halow_scanner: An RTL-SDR Based 802.11aH HaLow Channel Scanner

Over on GitHub we've recently noticed the release of halow_scanner, a Python script that uses an RTL-SDR to scan the 802.11ah (WiFi HaLow) channels in the sub-GHz spectrum to determined which channels have the least noise/interference.

Unlike standard WiFi, which operates outside of the RTL-SDRs range at 2.4 GHz+, 802.11ah operates in the sub-GHz ISM bands, which RTL-SDRs can easily receive.

Use of these lower frequencies gives 802.11ah HaLow excellent signal penetration, making it useful for long-range, low-power IoT devices. With 802.11ah HaLow links, several kilometers can be achieved.

The software's features include:

  • πŸ” Scans all 802.11ah HaLow channels in the US 902-928 MHz band
  • πŸ“Š Supports multiple channel bandwidths: 1, 2, 4, and 8 MHz
  • πŸ“‘ Uses RTL-SDR for spectrum analysis
  • 🎯 Identifies the cleanest channel with lowest noise floor
  • πŸ“ˆ Provides detailed power spectrum measurements
  • ⚑ Fast scanning with averaging for accuracy
Comparison Between regular WiFi and 802.11ah HaLow. Source: https://www.gateworks.com/802-11ah-halow-long-range-low-power-wireless-for-iot/
Comparison Between regular WiFi and 802.11ah HaLow. Source: https://www.gateworks.com/802-11ah-halow-long-range-low-power-wireless-for-iot
Β 
Tweet
Share
Reddit
Vote
Email

Software Defined Toolkit: A DIY Radio Reconnaissance Device with RTL-SDR and EvilCrow RF Inside

Thank you to "p3rp0ul" for writing in and sharing his neat-looking build of a "Software Defined Toolkit," which consists of two RTL-SDRs, EvilCrow RF, and other RF signal conditioning hardware, all in a ruggedized metal enclosure. He writes:

It’s a compact, field-ready SDR platform that consolidates two RTL-SDR receivers (one acquired via your site), a GPS timing/position module, an LNA with adjustable biasing, and an integrated ESP32-based ISM-band transceiver subsystem into a single rugged enclosure. The project explores how far low-cost SDR hardware can be pushed when carefully packaged, powered, filtered, and shielded as a coherent tool rather than a loose bench setup.

The design focuses on field usability: modular power distribution, fully externalized RF and antenna connectivity, thermal management for the dongles, and internal coax routing optimized with ferrite suppression. The addition of the ESP32 subsystem brings replay, sniffing, jamming, and remote-operation capabilities, extending the utility of RTL-SDR hardware in practical RF reconnaissance and experimentation.

P3rp0ul has shared full details about his build on both Hackaday.io and Hackster.io.

P3rp0ul's DIY Software Defined Toolkit
P3rp0ul's DIY Software Defined Toolkit
Inside the Enclosure
Inside the Enclosure
Tweet
Share
Reddit
Vote
Email

Talking Sasquach Reviews the uConsole and RTL-SDR Antenna Board Expansion

The uConsole is a portable computer system based on the Raspberry Pi CM5 module. It adds a screen, battery, and complete hardware keyboard with a mouse trackball to the CM5, while allowing for various expansion boards.

One such expansion board of interest to us is the RTL-SDR AIO V2 module, which adds an RTL-SDR, as well as adding capabilities such as LoRa, GPS, RTC, USB Hub, USB 3.0, and RJ45 Ethernet. We currently have one on order for our own review, but it is currently in pre-order status, and the V1 module has been out of stock for a long time.

Over on YouTube, Talking Sasquatch has managed to get his hands on one and has created a video about it. In the video, he shows the assembly of the uConsole and RTL-SDR AIO and how to flash the DragonOS Linux distribution, which contains many pre-installed RTL-SDR programs.

He goes on to show the system running SDR++ and receiving an FM station, as well as showing how it can connect with a Flipper Zero.

This uConsole HACK is a Game Changer

Tweet
Share
Reddit
Vote
Email

NSA GENESIS: How NSA Spies Snooped on Local RF Bands using Modified Cell Phones with a Built-in SDR

Over on YouTube, the "Spy Collection" channel has recently uploaded a video detailing the US National Security Agency's (NSA) GENESIS spy gadget. GENSIS was a modified Motorola cell phone that contained a full software-defined radio system within. This system allowed NSA agents to discreetly record the local RF spectrum for later analysis. For example, an agent may have been able to record the frequencies and RF protocols used at particular facilities of interest for use in later operations.Β 

Details about the NSA GENESIS were revealed when the NSA's Advanced Network Technologies (ANT) catalogue was publicly leaked back in 2013. Originally, project GENESIS was due to be declassified in 2032.

Spy Collection also notes that the leaked documents indicate it is possible the phone was also used, or intended to be used, as a "finishing tool". In other words, a remotely detonated explosive phone, that could be given to persons on the US terrorist list.Β 

NSA's Leaked Secret GENESIS Cell Phone

Tweet
Share
Reddit
Vote
Email

Creating a Homemade Portable Raspberry Pi Based RTL-SDR System

Thank you to Giuseppe (IT9YBG) for writing in and sharing with us his homemade portable RTL-SDR system made out of a Raspberry Pi 3, RTL-SDR Blog V3, 5-inch LCD screen, and a Bluetooth keyboard. Giuseppe notes that when running the system from a cell phone power bank, he only got about an hour's worth of battery life. So instead, he runs it from his motorcycle starter battery, which gives a much longer usable battery life.

Of course, if you wanted a more turn-key portable RTL-SDR system, you could look into the Vivid Unit GPSDR (which we reviewed here), or the AIO V2 module for the uConsole.

Giuseppe's Portable RTL-SDR System
Giuseppe's Portable RTL-SDR System
Tweet
Share
Reddit
Vote
Email

Tech Minds: A Review of the Vivid Unit with GPSDR RTL-SDR Module

The Vivid Unit is a single-board computer with a built-in LCD touch screen. There is an optional module called the "GPSDR," which is an RTL-SDR, upconverter, and GPSDO module that, when combined with the Vivid Unit, creates a handheld, portable SDR.Β  Last month, we reviewed the Vivid Unit and its "GPSDR" RTL-SDR add-on module on our blog.

Recently, Matt from the Tech Minds YouTube channel has also uploaded a review video of the Vivid Unit and GPSDR. In the video, Matt shows the hardware and demonstrates it in action, receiving various signals, including ADS-B and HF signals. He notes that he gets a good reception on HF even with just a telescopic antenna; however, the built-in speaker is tinny, and better audio is obtained by connecting it to a Bluetooth speaker. Matt also tests rtl_433, confirming that other RTL-SDR software works on the Vivid Unit too.

Matt also notes that you can use the code "TECHMINDS" if ordering from the UUGear site directly, and you'll get 5 Euros off each GPSDR that you order.

GPS Assisted RTL-SDR For The Vivid Unit - Runs Debian 11!

Tweet
Share
Reddit
Vote
Email

Demonstrating a Rollback Attack on a Honda via HackRF Portapack and an Aftermarket Security Solution

Over on YouTube "Obsessive Vehicle Security" has uploaded a video demonstrating a rollback attack against a Honda vehicle using a HackRF Portapack and the "Remote" function on the Mayhem firmware. His recent blog post also succinctly explains the various types of keyless vehicle theft used by modern thieves, including Roll-Jam, Relay Amplification and Rollback attacks. Regarding rollback attacks he explains:

A Rollback Attack works by capturing remote signals and replaying them. In theory this should not be possible with a rolling code remote system, however, a large number of vehicles are vulnerable to it. Including my 2015 Honda Vezel!

For it to work on the Honda I need to capture 5 consecutive remote signals. It does not matter if the car has seen these or not, when I replay them it re-syncs and unlocks the car. I have tested this and can replay the sequence as many times as I like. It always works.

He also mentions in the video how an aftermarket security system can partially mitigate these attacks.

In the past we also posted about Flipper Zero based rollback attacks.

Rollback Attack on Honda - HackRF One Bypasses Rolling Code Security

Tweet
Share
Reddit
Vote
Email