Tagged: bladerf

bladeRF 2.0 micro: New 47 MHz – 6 GHz, 56 MHz bandwidth, 2×2 MIMO SDR for $480

Nuand have recently released their new bladeRF 2.0 micro software defined radio. The SDR has a frequency range of 47 MHz to 6 GHz on TX and 70 MHz to 6 GHz on RX, a bandwidth of up to 56 MHz, a 12-bit ADC and has 2 RX and 2 TX radios.

There are two options for sale, the US$480 xA4 version and the US$720 xA9 version. The differences between the two appear to be entirely in the FPGA, with the more expensive version having an FPGA that contains many more logic elements which means that more DSP hardware can be synthesized on it. The RF transceiver chip used is the AD9361, which is the chip used on most high end SDRs like USRP's.

The bladeRF 2.0 micro is the next-generation 2x2 MIMO, 47MHz to 6GHz frequency range, off-the-shelf USB 3.0 Software Defined Radio (SDR) that is easy and affordable for students and RF enthusiasts to explore wireless communications, yet provides a powerful waveform development platform expected by industry professionals.

Support is available for Linux, macOS, and Windows. The bladeRF libraries, utilities, firmware, and platform HDL are released under open source licenses, and schematics are available online. The FPGA and USB 3.0 peripheral controller are programmable using vendor-supplied tools and SDKs that are available online, free of charge.

The bladeRF 2.0 micro features support for: GNU Radio via gr-osmosdr, Pothos via SoapySDR, SDRange, SDR Console, SDR # via sdrsharp-bladeRF, YateBTS, OpenAirInterface, srsUE & srsLTE, MathWorks MATLAB® & Simulink® via libbladeRF bindings.

The bladeRF 2.0 micro
The bladeRF 2.0 micro

Upcoming Book “Inside Radio: An Attack and Defense Guide”

Unicorn team are information security researchers who often also dabble with wireless security research. Recently they have been promoting their upcoming text book titled "Inside Radio: An Attack and Defense Guide".

Judging from the blurb and released contents the book will be an excellent introduction to anyone interested in today's wireless security issues. They cover topics such as RFID, Bluetooh, ZigBee, GSM, LTE and GPS. In regards to SDRs, the book specifically covers SDRs like the RTL-SDR, HackRF, bladeRF and LimeSDR and their role in wireless security research. They also probably reference and show how to use those SDRs in the  chapters about replay attacks, ADS-B security risks, and GSM security.

The book is yet to be released and is currently available for pre-order on Amazon or Springer for US$59.99. The expected release date is May 9, 2018, and copies will also be for sale at the HITB SECCONF 2018 conference during 9 - 13 April in Amsterdam.

The blurb and released contents are pasted below. See their promo page for the full contents list:

This book discusses the security issues in a wide range of wireless devices and systems, such as RFID, Bluetooth, ZigBee, GSM, LTE, and GPS. It collects the findings of recent research by the UnicornTeam at 360 Technology, and reviews the state-of-the-art literature on wireless security. The book also offers detailed case studies and theoretical treatments – specifically it lists numerous laboratory procedures, results, plots, commands and screenshots from real-world experiments. It is a valuable reference guide for practitioners and researchers who want to learn more about the advanced research findings and use the off-the-shelf tools to explore the wireless world.

Authors:
Qing YANG is the founder of UnicornTeam & the head of the Radio Security Research Department at 360 Technology. He has vast experience in information security area. He has presented at Black Hat, DEFCON, CanSecWest, HITB, Ruxcon, POC, XCon, China ISC etc.

Lin HUANG is a senior wireless security researcher and SDR technology expert at 360 Technology. Her interests include security issues in wireless communication, especially cellular network security. She was a speaker at Black Hat, DEFCON, and HITB security conferences. She is 360 Technology’s 3GPP SA3 delegate.

This book is a joint effort by the entire UnicornTeam, including Qiren GU, Jun LI, Haoqi SHAN, Yingtao ZENG, and Wanqiao ZHANG etc.

 
 

Leif (SM5BSZ) Compares Several HF Receivers

Over on YouTube well known SDR tester Leif (SM5BSZ) has uploaded a video that compares the performance of several HF receivers with two tone tests and real antennas. He compares a Perseus, Airspy + SpyVerter, BladeRF + B200, BladeRF with direct ADC input, Soft66RTL and finally a ham-it-up + RTLSDR. The Perseus is a $900 USD high end HF receiver, whilst the other receivers are more affordable multi purpose SDRs.

If you are interested in only the discussion and results then you can skip to the following points:

24:06 – Two tone test @ 20 kHz. These test for dynamic range. The ranking from best to worst is Perseus, Airspy + SpyVerter, Ham-it-up + RTLSDR, Soft66RTL, BladeRF ADC, BladeRF + B200. The Perseus is shown to be significantly better than all the other radios in terms of dynamic range. However Leif notes that dynamic range on HF is no longer as important as it once was in the past, as 1) the average noise floor is now about 10dB higher due to many modern electronic interferers, and 2) there has been a reduction in the number of very strong transmitters due to reduced interest in HF. Thus even though the Perseus is significantly better, the other receivers are still not useless as dynamic range requirements have reduced by about 20dB overall.

33:30 – Two tone test @ 200 kHz. Now the ranking is Perseus, Airspy + SpyVerter, Soft66RTL, BladeRF+B200, Ham-it-up + RTLSDR, BladeRF ADC.

38:30 – Two tone test @ 1 MHz. The ranking is Perseus, Airspy + SpyVerter, BladeRF + B200, ham-it-up + RTLSDR, Soft66RTL, bladeRF ADC. 

50:40 – Real antenna night time SNR test @ 14 MHz. Since the Perseus is know to be the best, here Leif uses it as the reference and compares it against the other receivers. The ranking from best to worst is Airspy + SpyVerter, ham-it-up + RTLSDR, BladeRF B200, Soft66RTL, BladeRF ADC. The top three units have similar performance. Leif notes that the upconverter in the Soft66RTL seems to saturate easily in the presence of strong signals.

1:13:30 – Real antenna SNR ranking for Day and Night tests @ 14 MHz. Again with the Perseus as the reference. Ranking is the same as in 3).

rx1compare

In a previous video Leif also uploaded a quick video showing why he has excluded the DX patrol receiver from his comparisons. He writes that the DX patrol suffers from high levels of USB noise.

DXpatrol

Building your own Rogue GSM Basestation with a BladeRF

Over on his blog author Simone Margaritelli has added a tutorial that shows how to set up a bladeRF to act as a GSM basestation (cell tower). Having your own GSM basestation allows you to create your own private and free GSM network, or for more malicious illegal users it can allow you to create a system for intercepting peoples calls and data. Simone stresses that it is well known that GSM security is broken (and is probably broken by design), and now it is about time that these flaws were fixed.

In his tutorial he uses a single bladeRF x40 and a Raspberry Pi 3 as the processing hardware. The bladeRF is a $420 transmit and receive capable software defined radio with a tuning range of 300 MHz – 3.8 GHz and 12-bit ADC. He also uses a battery pack which makes the whole thing portable. The software used is Yate and YateBTS which is open source GSM basestation software. Installation as shown in the tutorial is as simple as doing a git clone, running a few compilation lines and doing some simple text configuration. Once set up mobile phones will automatically connect to the basestation due to the design of GSM.

Once setup you can go further and create your own private GSM network, or make the whole thing act as a “man-in-the-middle” proxy to a legitimate GSM USB dongle, which would allow you to sniff the traffic on anyone who unknowingly connects to your basestation. This is similar to how a “Stingray” operates, which is a IMSI-catcher device used by law enforcement to intercept and track GSM communications. More information on using the bladeRF as an IMSI catcher with YateBTS can be found in this white paper.

bladeRF x40, Raspberry Pi 3 and a battery pack. Running a GSM basestation.
bladeRF x40, Raspberry Pi 3 and a battery pack. Running a GSM basestation.

YouTube Tutorial about using the BladeRF for Several Experiments

On YouTube user CrazyDanishHacker has been uploading some tutorial videos showing how to perform several experiments with the BladeRF. Some things he shows are GPS spoofing, broadcasting digital TV, getting 124 MHz bandwidth, using spectrum painter and how to use the BladeRF on Windows 10, Kali Linux and Ubuntu.

You might remember CrazyDanishHacker from our previous post where we posted about his in depth YouTube tutorial on GSM sniffing and cracking. That series now appears to be complete ending on episode #16 of his software defined radio series. The BladeRF tutorials start on episode #17.

The bladeRF is a $420 software defined radio which is capable of transmit and receive. It uses a LimeMicro LMS6002D chip, which has a 12-bit ADC and a tuning range of 300 MHz – 3.8 GHz. Along with the HackRF we eventually expect that it will be superseded by the upcoming LimeSDR.

BladeRF + SDR# on Windows 10 – Software Defined Radio Series #17

rx_tools: RTL-SDR Command Line Tools (rtl_power, rtl_fm, rtl_sdr) Now Compatible With Almost Any SDR

Developer R. X. Seger has recently released rx_tools which provides SDR independent ports for the popular command line RTL-SDR tools rtl_power, rtl_fm and rtl_sdr. This means that these tools can now be used on almost any SDR, such as the bladeRF, HackRF, SDRplay, Airspy and LimeSDR. If you don’t know what the tools do, then here is a quick break down:

rtl_fm / rx_fm: Allows you to decode and listen to FM/AM/SSB radio.
rtl_sdr / rx_sdr: Allows you to record raw samples for future processing.
rtl_power / rx_power: Allows you to do wideband scans over arbitrarily wide swaths of bandwidth by hopping over and recording signal power levels over multiple chunks of spectrum.

rx_tools is based on SoapySDR which is an SDR abstraction layer. If software is developed with SoapySDR, then the software can be more easily used with any SDR, assuming a Soapy plugin for that particular SDR is written. This stops the need for software to be re-written many times for different SDR’s as instead the plugin only needs to be written once.

rx_power scan with the HackRF at 5 GHz over 9 hours.
rx_power scan with the HackRF at 5 GHz over 9 hours.

50 Units of a $199 Nuand bladeRF x40 for Sale: 1-Day Only

Nuand is the company responsible for the bladeRF software defined radio. The bladeRF x40 is a SDR that usually costs $420. It uses a LimeMicro LMS6002D chip, which has a 12-bit ADC and a tuning range of 300MHz – 3.8GHz.

For one day only they have released a special price for the bladeRF x40 of $199 USD, for the first 50 customers only. At the time of this post the deal still seems to be active, and the coupon code of “MHZ” is still working. Of note is that the recently successfully crowdfunded LimeSDR uses the newer and better LimeMicro LMS7002M chip, so Nuand may be testing the waters for a lower price point on their bladeRF. However, one thing to note is that the bladeRF is proven hardware with active software applications, whereas the LimeSDR is not yet proven. 

Nuand also recently released an update which saw the source released for an ADS-B decoder that can be run on the bladeRF’s onboard FPGA, and also an update which allows the bladeRF to display up to 124 MHz of bandwidth at any one time. The large bandwidth display appears to work in a similar way to rtl_power or SpectrumSpy for the Airspy, by quickly switching between multiple chunks of frequency. The difference is that the bladeRF can do this by using onboard HDL accelerators which allow it retune extremely fast at several thousand times a second.

bladeRF displaying 96 MHz.
bladeRF displaying 96 MHz.

Stealing a Drone with Software Defined Radio

PHDays (Positive Hack Days) is a yearly forum with a focus on ethical hacking and security. During this years forum which took place in June, the organizers set up a competition where the goal was to “steal” or take control of a Syma X8C quadcopter drone. The drone runs on the nRF24L01 module, which from previous posts we have seen can easily be sniffed and decoded with an RTL-SDR or other SDR.

To reverse engineer the drones wireless communications system the teams used software defined radios like the HackRF and BladeRF, and also an alternative method involving just using an Arduino and nRF24L01+ receiver chip. Once the signal was received, they used GNU Radio to decode the signal into packets of data. After analyzing the data they found that the data bytes were easily reverse engineered and then were able to transmit their own data packets to control the drone. The post goes into further detail on the specifics of the reverse engineering.

The Syma X8C drone to be stolen in the competition.
The Syma X8C drone to be stolen in the competition.