Tagged: GPS

RTL-SDR Blog Active L-Band Patch Antenna for Inmarsat, Iridium, GPS Back in Stock

Just a quick note to say that the second batch of our Active L-Band Patch Antenna for receiving Inmarsat, Iridium and other L-Band satellites is now in stock, available to be shipped from our warehouse in China from early next week. Amazon will be stocked within the next 1-2 months as the freighter will take time to arrive.

Please see our store for ordering details.

Apologies as we've had to temporarily suspend sales of this product as a manufacturing defect has been discovered in this batch. The defect is that on a number of units the plastic around the screws is cracking, and this was caused by a factory worker over torqueing a pneumatic screwdriver.

The antenna itself will work fine, and it probably won't even affect weather tightness, but it is certainly a defect. If your unit already shipped out and your unit has these cracks, please let us know at [email protected] and we will get the factory to ship you a replacement enclosure. For unshipped units we will be issuing a refund within the next few days.

Pricing remains the same at US$49.95 including free worldwide shipping to most countries. A reminder to EU customers: please order from our Aliexpress or eBay stores as due to the new IOSS laws we need to now use those marketplaces to collect and remit VAT upon your purchase, instead of upon import at the border.

This second batch comes in a gray color as feedback from the previous batch indicated that a lighter color is preferred to avoid excess heating from the sun.

If you are hearing about this patch antenna for the first time, please see our original release post for more information. In short this is an amplified patch antenna designed to be used with bias tee capable SDRs that can provide 3.3V - 5V power, such as our RTL-SDR Blog V3 dongle, Airspy, SDRplay or HackRF.

The antenna allows for reception of L-band satellites that transmit between 1525 - 1660 MHz, such as Inmarsat, Iridium and GPS. Please note it is *not* for receiving weaker signals like HRPT and GOES which require a dish antenna.

The patch comes with useful mounting accessories including a window suction cup, bendable tripod and 3M RG174 coax cable. The patch and active circuitry is enclosed in a weather proof enclosure.

What can you do with this antenna?

TechMinds: Decoding GPS with an RTL-SDR

Over on his YouTube channel Tech Minds has uploaded a video showing how it's possible to receive and decode GPS signals with an RTL-SDR. To do this he uses one of our RTL-SDR Blog V3 dongles and a GPS patch antenna which is powered via the bias tee on the dongle.

On the software side he uses GNSS-SDRLIB and RTKLIB to decode the GPS signal. The result of the two programs is your current GPS coordinates which can be plotted on a map. Unfortunately in the video Tech Minds was unable to get the Google Maps display to work, but you can easily type the coordinates into Google maps yourself.

Decoding GPS using an RTL SDR Receiver

 

Increasing L-Band Active Patch SNR by using it as a Feed for a Satellite Dish

Recently RTL-SDR.COM reader Bert has been experimenting with our active L-band patch antenna product. He's written in to share that he's found that using it as a feed for a satellite dish works well to improve SNR on those weaker 10500 AERO signals which Bert found that he could not decode from his location due to insufficient SNR. Our active L-band patch antenna receives signals from 1525 - 1637 MHz and can be used for signals from Inmarsat, Iridium and GPS satellites.

To use the patch as a feed Bert used a 40mm drain pipe and mounted the antenna on the end of the pipe. The drain pipe fits perfectly into the LNB holder, and once mounted the distance and polarization rotation can easily be adjusted for best SNR. He also found that adding a secondary sub-reflector about 17x17cm in size helped to boost SNR by about 3-5 dB too.

Build steps to use the Active L-band Patch with a Satellite Dish
Build steps to use the Active L-band Patch with a Satellite Dish

Bert has tested the active L-band patch as a feed on a 65cm satellite dish and a smaller 40cm dish, both with good results.

SNR Results
SNR Results

Using a HackRF for GPS Spoofing on Windows

Over on the TechMinds YouTube channel a new video titled "GPS Spoofing With The HackRF On Windows" has been uploaded. In the video TechMinds uses the GPS-SDR-SIM software with his HackRF to create a fake GPS signal in order to trick his Android phone into believing that it is in Kansas city.

In the past we've seen GPS Spoofing used in various experiments by security researchers. For example, it has been used to make a Tesla 3 running on autopilot run off the road and to cheat at Pokemon Go. GPS spoofing has also been used widely by Russia in order to protect VIPs and facilities from drones.

GPS Spoofing With The HackRF On Windows

Using an RTL-SDR to Investigate GPS Interference Problems on Drones Caused By HD Cameras

Over on YouTube Drone and Model Aircraft enthusiast channel Paweł Spychalski has uploaded a video showing how he determined that cheap HD cameras that are commonly used on hobbyist drones can cause locking issues with the on board GPS. He writes:

You might believe it or not (today I will prove it, however) that HD cameras, especially cheap ones, can be responsible for GPS problems on your drones and model airplanes. The majority of HD cameras (RunCam Split, Runcam Split Mini, Foxeer Mix, Caddx Tarsier) generate RF noise on different frequencies. Some of them on 433MHz, some on 900MHz, but most of them also at around 1GHz. Just where one of the frequencies used by GPS signal sits. As a result, many GPS modules are reported to have problems getting a fix when the HD camera is running.

In the video he uses an RTL-SDR and SDR# to demonstrate the interference that shows up when a cheap HD camera is turned on. He shows how the interference is present at almost all frequencies from the ISM band frequencies commonly used for control and telemetry to the 1.5 GHz GPS frequencies.

GPS vs HD cameras - it's all about RF noise

Investigating the Galileo Satellite Navigation System Outage with a LimeSDR

Galileo is a European Union owned satellite navigation system. Galileo was created so that the EU does not need to rely on the US GPS or the Russian GLONASS satellites, as there is no guarantee that these systems won't be purposely turned off or degraded by their governments at any time.

Unfortunately since July 11 the Galileo system has been out of service. Not much information about the outage has been provided, but it appears to be related to problems with the Italian ground based Precise Timing Facility which consists of two ultra high precision atomic clocks that keep the Galileo systems' reference time. (We note that recently within the last few hours of this post, most satellites seem to have come back into operational status, but the EGSA website still reports an outage.)

Over on his blog, Daniel Estevez has been using his LimeSDR and a small patch antenna to gather some more information about the outage directly from the Galileo satellites. His investigations found that the modulation and signal itself are still working correctly. However, by using the GNSS-SDR software to investigate the signal data he was able to obtain the ephemeris, and see that the ephemeris is stuck in the past. The ephemeris data is used to calculate compensations for orbital drift and without frequent ephermis updates, orbital errors add up within hours resulting in poor positioning accuracy. In order to generate the ephermis, the Precise Timing Facility must be operational.

Daniel's post goes into further technical details about the information he's collected, and it's definitely an interesting read. One interesting bit of information that you can read from his post explains why the service has gone from initially just heavily degraded accuracy from July 11, to completely nonsense results from July 15 onwards.

Running a Tesla Model 3 on Autopilot off the Road with GPS Spoofing

Regulus is a company that deals with sensor security issues. In one of their latest experiments they've performed GPS spoofing with several SDRs to show how easy it is to divert a Tesla Model 3 driving on autopilot away from it's intended path. Autopilot is Tesla's semi-autonomous driving feature, which allows the car to decide it's own turns and lane changes using information from the car's cameras, Google Maps and it's Global Navigation Satellite System (GNSS) sensors. Previously drivers had to confirm upcoming lane changes manually, but a recent update allows this confirmation to be waived.

The Regulus researchers noted that the Tesla is highly dependent on GNSS reliability, and thus were able to use an SDR to spoof GNSS signals causing the Model 3 to perform dangerous maneuvers like "extreme deceleration and acceleration, rapid lane changing suggestions, unnecessary signaling, multiple attempts to exit the highway at incorrect locations and extreme driving instability". Regarding exiting at the wrong location they write:

Although the car was a few miles away from the planned exit when the spoofing attack began, the car reacted as if the exit was just 500 feet away— slowing down from 60 MPH to 24 KPH, activating the right turn signal, and making a right turn off the main road into the emergency pit stop. During the sudden turn the driver was with his hands on his lap since he was not prepared for this turn to happen so fast and by the time he grabbed the wheel and regained manual control, it was too late to attempt to maneuver back to the highway safely.

In addition, they also tested spoofing on a Model S and found there to be a link between the car's navigation system and the automatically adjustable air suspension system. It appears that the Tesla adjusts it's suspension depending on the type of road it's on which is recorded in it's map database.

In their work they used a ADALM PLUTO SDR ($150) for their jamming tests, and a bladeRF SDR ($400) for their spoofing tests. Their photos also show a HackRF.

Regulus are also advertising that they are hosting a Webinar on July 11, 2019 at 09:00PM Jerusalen time. During the webinar they plan to talk about their Tesla 3 spoofing work and release previously unseen footage.

GPS/GNSS spoofing is not a new technique. In the past we've posted several times about it, including stories about using GPS spoofing to cheat at Pokémon Go, misdirect drivers using Google Maps for navigation, and even a story about how the Russian government uses GPS spoofing extensively.

Some SDR tools used to spoof the Tesla Model 3.
Some SDR tools used to spoof the Tesla Model 3.

Receiving and Decoding the NAVIC (Indian GPS) Satellites

NAVigation with Indian Constellation (NavIC) (previously known as IRNSS) is an Indian navigation system consisting of 7 satellites in geosynchronous and geostationary orbits above India. It is intended for both public and military use, with a public resolution of up to 20m, and military resolution of up to 1m. After a few set backs, the satellite constellation was completed in April 2018.

Over on his blog Radiojitter, Priyasloka has put up a post showing how he was able to receive and decode the IRNSS/NAVIC satellites. To do this he uses an RTL-SDR with a GNSS antenna connected, and a modified version of the MATLAB GPS code found in this previous post, and in SoftGNSS. His post first goes through how he was able to decode and receive GPS, then goes over the technical details of the NAVIC signal, and then shows some result screenshots where he was able to determine his location with both GPS and NAVIC.

Priyasloka writes that he hasn't uploaded the modified code yet, but he plans to do so soon.

NavIC positioning results received with an RTL-SDR
NavIC positioning results received with an RTL-SDR