Tagged: iridium

Talk: Decoding Data from Iridium Satellites

At this year’s hacker themed Eleventh Hope conference, Stefan “Sec” Zehl and Schneider gave a talk which discusses their latest work on decoding data from Iridium satellites using SDR’s. Iridium is a truly global satellite service which provides various services such as global paging, satellite phones, tracking and fleet management services, as well as services for emergency, aircraft, maritime and covert operations too. There are currently 72 operational satellites operating.

In their talk they discuss how Iridium security is moderate to relaxed, pointing out that Iridium claims that the majority of ‘security’ comes from the complexity of the system, rather than actual security implementations. They then go on to discuss how the Iridium system works, how to receive it with an RTL-SDR or HackRF/Rad1o, how the gr-iridium decoder implementation works, and how to use it to actually decode the data. Later in the presentation they show some interesting examples such as an intercepted Iridium satellite phone call to a C-37 aircraft.

Iridium Satellite Hacking – HOPE XI 2016

Modifying the Outernet LNA for Iridium Reception

A few days ago we posted a review on the Outernet LNA which can can be used to help receive their new L-band service signal. Their LNA uses a filter which restricts the frequency range from 1525 – 1559 MHz as this is the range in which the Outernet signals are located.

By default this LNA cannot be used to receive Iridium because the pass band on the default SAW filter does not cover the Irdidium frequency band of 1616 – 1626.5 MHz. Over on Reddit, devnulling decided to experiment with one of these LNA’s and see if he could replace the default SAW filter to enable Iridium reception. In his post he shows how he removes the default SAW filter, and replaces it with a Murata SF2250E SAW filter, which is the same size, but has a center frequency of 1615 MHz and a bandwidth of 20 MHz. Iridium is used for data services like satellite pagers, and with the right tools can be decoded.

We are also curious to see if this LNA could be modified to be used with GOES reception, which occurs at 1692 MHz.

Note: For those who had trouble with obtaining international shipping on these LNA’s the Outernet store now supports USPS international shipping, and NooElec appear to now be selling them on their site directly. Their products can also still be obtained on Amazon for US customers.

Additional Note Regarding the Downconverter: Also, it appears that the Outernet downconverter prototype that we posted about back in May has unfortunately been discontinued indefinitely and will not enter mass production. For now the LNA is the best option for receiving their signal.

Outernet LNA Modified for Iridium Reception
Outernet LNA Modified for Iridium Reception

Receiving Iridium Satellites with a HackRF Portapack and Cheap Antenna

Recently Jared Boone, creator of the HackRF portapack posted on his blog about his experience with trying to receive Iridium satellite signals. The HackRF is 8-bit, ~0 – 6 GHz, RX/TX capable SDR, and the Portapack is a kit that allows the HackRF to go portable, by adding an LCD screen, battery pack and control wheel. Iridium is an L-band satellite service that provides products such as satellite phones and pagers. Back in December 2014 we posted how it was found that Iridium pager messages could be decoded.

To receive Iridium Jared used a simple ceramic patch antenna mounted on a piece of cheap copper clad fibreglass. This simple antenna was good enough to receive the Iridium signals with good strength. With this set up Jared was able to easily go outside and receive some packets and record them. He writes his next steps are to try and run the Iridium pager decoder on them and see what packets he captured.

Iridium Antenna + HackRF Portapack.
Iridium Antenna + HackRF Portapack.

 

Chaos Communications Congress Talks – Iridium Pager Hacking

A few days ago the Chaos Communications Congress (a technology and hacking focused conference) commenced. Amongst the talks there was one about reverse engineering the Iridium satellite paging system using software defined radio. Iridium satellites provide global communications via special satellite phones, pagers and other transceivers.

In the talk the speaker shows how they used a USRP radio together with a cheap active iridium antenna, a bandpass filter and an LNA to receive the Iridium satellite signals. They also mention that an E4000 RTL-SDR together with an LNA and appropriate home made antenna for frequencies in the ~1.6 GHz region can also be sufficient. Once they were able to receive signals they were then able to reverse engineer the signal and create several pieces of software to decode the pager messages. The code is available on their GitHub at https://github.com/muccc/iridium-toolkit.

http://www.youtube.com/watch?v=xCf5JFpOkDs