In his latest YouTube video, Gabe from the saveitforparts channel has uploaded an interesting video detailing how he's tracking government spy planes over his neighbourhood using SDRs to monitor ADS-B data, and Orbic hotspots to detect Stingray activity (fake cell tower basestations).
In the video, Gabe highlights how he detects and follows a suspicious aircraft, concluding that it is most likely a DEA surveillance plane. This conclusion is supported by the fact that the ADS-B data is censored on FlightRadar24, something which normally only happens with law enforcement aircraft, as well as private jets. Upon zooming in on the aircraft with a camera, various antennas and cameras are also visible on the belly. Finally, Gabe found that the plane's registration number is linked to a Texas-based shell company with connections to the DEA.
In the video Gabe also tests out the RayHunter custom firmware for Orbic mobile internet to WiFi hotspot devices. This custom firmware turns these devices into Stingray detectors. A Stingray is a fake cellular base station that is often used by law enforcement to spy on cell phone activity.
Is That Really A Government Spy Plane Over My Neighborhood?
Discovery Drive is an automatic antenna rotator that is designed to be used with our Discovery Dish product, as well as similarly sized antennas such as Wi-Fi grid and Yagi antennas.
Discovery Drive with Discovery Dish Mounted
A motorized rotator allows you to use a satellite dish or directional antenna to track and receive signals from polar orbiting satellites, which quickly move across the sky. It also lets you switch swiftly between geostationary satellites without manually realigning the dish.
Examples of polar-orbiting weather satellites that you can track include NOAA POES, METEOR-M2, METOP, and FENGYUN. Depending on your location, you may also have access to other interesting satellites that dump data over specific regions. Amateur radio operators can also use Discovery Drive to track amateur radio satellites with Yagi antennas.
Discovery Drive
Discovery Dish is designed to be easy to set up and use. Unlike many other rotators on the market, no external controllers are required. Discovery Drive has a built-in ESP32 controller, and control can be commanded over WiFi or serial from rotctl-compatible software such as SatDump, GPredict, and Look4Sat on Android.
Features and Specifications
Up to 125 kgcm (12.25 Nm) of torque
ESP32 control board
± 1.5° of accuracy
-360° to +360° Azimuth range, 0° - 90° elevation range
1.5 RPM Azimuth speed, 0.25 RPM elevation speed
12 V power input (either barrel jack or USB Type-C Power Delivery)
Wi-Fi connectivity with browser-based web UI
Serial over USB data connectivity or Wi-Fi data connectivity
Low power draw (< 10 W, can be powered with PoE+ supplies and still have power left over for powering a single board computer and RTL-SDR)
Robust worm gear-locked output drives
Direct rotctl compatibility over Wi-Fi (compatible with programs that implement the rotctl protocol, such as SatDump, GPredict, and Look4Sat on Android)
A recently published CVE (Common Vulnerabilities and Exposures) states that a software-defined radio can be used to remotely send a brake command signal to the End-Of-Train wirelessly linked control box.
Security researcher Neil Smith reported the vulnerability. Neil explains more in X, explicitly noting that he has been trying to get this published for 12 years and how no one from the American Association of Railroads (AAR) seems to consider this vulnerability a significant issue.
US trains use wireless RF communications devices, called "End-of-Train" (EoT) and "Head-of-Train" (HoT), to enable data communication between the head and end of the train. The two systems interface with the train's braking and control system, allowing the engineer to view information from both sides of the train, and command systems at ends of a long train instantaneously. Such signals can easily be received with an RTL-SDR and the softEOT decoder, or the PyEOT decoder.
The vulnerability stems from the fact that a software-defined radio can easily be used to replicate an EoT RF signal that can command braking. The signal could be transmitted over a long distance with an appropriate amplifier and antenna. Unexpected braking could cause derailment, amongst other problems.
As of right now, the vulnerability is still unpatched, but AAR have noted that they intend to replace the system with the 802.16t standard. However, in the X thread, Neil notes that this replacement won't be in place until 2027 in the best-case scenario.
Thank you to Lincoln Boggs (KF8DPW) for submitting his open source RTL-SDR Blog V3 shield footprint PCB design, which is available on GitHub.
This PCB serves as a bare-bones starter design that precisely matches the footprint of the RTL-SDR Blog V3, allowing you to develop custom addon boards. The current layout provides connections to GPIO, I2C, CLK, and several other pins on the RTL-SDR Blog V3 that are exposed for experimental and bespoke projects. As Lincoln explains:
Recently in my spare time I have been looking into developing an open-source project for the RTL-SDR blog dongles, more specifically an addon board system similar to RPi hats and arduino shields through the I2C pins.
So far, I've gotten a board footprint published on GitHub for the V3's pins.
The idea is to allow easy addition of modules like external clocks, sensors, controller boards, or even something like a LoRa chip all with minimal soldering and easy swap-ability. I also plan to design 3D models of cases for the SDR to allow it to look cleaner or be more portable in different senses.
Thank you to Nagy István for writing in and sharing with us his video showing how he uses a home-made backfire helix antenna and the JAERO software to receive and decode Inmarsat Aero at 1545 MHz. AERO messages are a form of satellite ACARS, typically containing short messages from aircraft, and some channels also support digital voice communications.
The backfire helix is an antenna design that consists of a helically wound wire, typically wound around a 3D-printed frame, attached to a large backplane. Recently, a similar design called a 'heliocone' has become popular for use with 1.7 GHz polar orbiting satellites.
In the video, Nagy shows two designs, one of his own and the other by Digitalelektro, and the good SNR that he's achieved with them in JAERO.
Inmarsat Aero 1545Mhz decoding with Backfire helix / JAERO software
Thank yoy to Viol Tailer for submitting news about the release of his new software called "uAVD - Analog Video Decoder". uAVD is capable of demodulating the following:
AM (broadcast analog television - NTSC, PAL, SECAM)
FM (FPV drone video links)
RAW (composite output from VHS, camcorders, game consoles)
The software uses the uSDR software as a host, and it passes the IQ passband stream to the uAVD via a uSDR-TCP link. uSDR is a lightweight general purpose multimode software defined radio receiver Windows application that we have posted about on the blog in the past. Currently, it supports RTL-SDR, AirSpy, BladeRF, HackRF, FobosSDR, and LimeSDR devices.
The software supports full color and grayscale modes. With a wideband receiver, it will be possible to receive full-color video. With the reduced bandwidth available with an RTL-SDR, only grayscale will be available.
The image below shows it being used to receive video from a camcorder composite video output. A FobosSDR used in direct sampling mode is used to receive the signal.
uAVD Receiving Camcorder Composite Video via the Direct Sampling Input in FobosSDR
Below is a video from a user of the software demonstrating it in action.
Thank you to Craig Giles for writing in and sharing with us news about a club for teens that he's organizing called "Waveband Hack Club YSWS" for RTL-SDR dongles. Craig writes in his email:
Hack Club is a 501(c)(3) nonprofit that aims to teach teenagers how to code by building projects. Hack Club runs a variety of programs called YSWSs, or “You Ship, We Ships”, which are programs in which a teen works on a themed project and gets rewarded with a prize following the theme.
Waveband is a YSWS about RTL-SDR dongles, where teens make a computer program that uses an RTL-SDR dongle, and they get a V4 dongle and antenna kit in return. We are aiming to get more teens involved in SDR and give them the hardware to do so through this program.
The club has a clever interactive website that interested teens can go to to learn more. Currently, it appears that the club is running the program for a limited time from June 11 to July 11. During this time, teens can log on to the website and get a free RTL-SDR dongle if they submit a program they've written that uses an RTL-SDR in a unique way.
Thank you to Alexandre Gellibert for writing in and sharing his new Android App, "SDR ProTrack." SDR ProTrack is a radio direction-finding app that uses an RTL-SDR and directional antenna to determine a bearing towards a transmitter.
Interestingly, Alexandre notes that this app was initially developed to track Asian hornets, a bee-killing pest. With hornet tracking, a miniature RF transmitter is attached to a caught hornet, and the hornet brings it back to the nest. RF tracking techniques can then be used to find the nest.
It's possible to determine the bearing toward a transmitter by using a receiver such as an RTL-SDR paired with a directional antenna like a Yagi. Directional antennas have high sensitivity in one primary direction and significantly lower sensitivity in all others. By rotating the antenna until the strongest signal is identified, you can establish the precise bearing angle. Typically, following this bearing will guide you directly toward the signal's origin.
Alexandre wrote in an email to us the following:
Just to let you know we just launched a new Android app compatible with RTL-SDR dongles (though mostly tested on RTL-SDR v4).
App is free to use. Advanced features (like Compass to point the signal potential source) are for premium users.
It's plug and play, easy to use, much more user friendly than SDR++.
Any feedback is really appreciated :)
If you want to know more about the project or the 2 developers behind it (we develop it in France to be able to track asian hornets that kill all the bees), please feel free to contact us.
And the Android page describes SDR ProTrack in the following way:
Unlock the power of radio tracking with SDR ProTrack! Transform your Android smartphone into a signal-tracking powerhouse using an RTL-SDR dongle and a directional antenna. Affordable, versatile, and perfect for enthusiasts, researchers, pros or anyone tracking signals—like Asian hornets or wildlife.
★ Key Features ★
• Automatic RTL-SDR dongle recognition and connection (free) • Spectrum Visualization (Free): View signal shapes in the frequency domain effortlessly. • Compass (Premium): Pinpoint the strongest signal direction with precision. • Signal Strength Display (Premium): Monitor signal power with an intuitive interface. • Custom Settings (Premium): Adjust bitrate, sample rate, and frequency sensitivity to your liking.
★ Requirements ★
• Requires an external RTL-SDR device. • Check compatibility: https://osmocom.org/projects/rtl-sdr/wiki
Need an RTL-SDR dongle, emitters, receptors, or antennas? Visit our website: https://www.intuite.fr/en_GB/pricing
★ About Us ★
Intuite is a company specialized in locating Asian hornet nests. We developed SDR ProTrack to provide a robust, cost-effective solution for radio signal tracking, combining innovative technology with our expertise in signal detection.
★ Open Source Community ★
Join our mission to advance radio tracking! Our open-source library, RTL-SDR Bridge Android Lib, powers SDR Pro Track. Contribute to development, report issues, or explore the code at https://github.com/alexandreGellibert/RTL-SDR-Bridge-Android-Lib. Support our work and help shape the future of signal tracking!
Download SDR ProTrack today and start tracking signals like a pro!
