Tagged: security

Brute Force Unlocking a Car with a USRP Software Defined Radio

Wired.com has posted an article showing how security researcher Cesare was able to use his USRP software defined radio to unlock a car with wireless entry. Essentially his hack involves brute forcing the rolling security code used by the wireless unlocking security protocol. Even with just a brute force attack he was able to unlock his car in just a few minutes. While this hack probably won’t work with newer cars which disable unlocking for a few minutes after a number of failed code attempts, Cesare notes that the hack will probably work for many similar cars of the 10 years or older generation.

This article goes along with their previous one discussing how thieves could hack into a home alarm system using a software defined radio.

The USRP is an advanced software defined radio that sells for around a thousand dollars but we note that the same attack could be performed with the cheaper and almost available HackRF SDR.

Reverse Engineering NSA Spy ‘Retro Reflector’ Gadgets with the HackRF

In 2013 whistleblower Edward Snowden leaked (along with other documents) some information about the American National Security Agencies (NSA) spy tools. One such group of tools named ‘retro reflectors’ has recently been investigated and reverse engineered by Micheal Ossmann, the security researcher behind the recently available for preorder HackRF software defined radio. The HackRF is a SDR similar to the RTL-SDR, but with better performance and transmit capabilities.

Newscientist Magazine has written an article about Ossmann’s work here. From their article a retro reflectors are described in the following quote.

One reflector, which the NSA called Ragemaster, can be fixed to a computer’s monitor cable to pick up on-screen images. Another, Surlyspawn, sits on the keyboard cable and harvests keystrokes. After a lot of trial and error, Ossmann found these bugs can be remarkably simple devices – little more than a tiny transistor and a 2-centimetre-long wire acting as an antenna.

The HackRF comes in to play in the following quote

Ossmann found that using the radio [HackRF] to emit a high-power radar signal causes a reflector to wirelessly transmit the data from keystrokes, say, to an attacker. The set-up is akin to a large-scale RFID- chip system. Since the signals returned from the reflectors are noisy and often scattered across different bands, SDR’s versatility is handy, says Robin Heydon at Cambridge Silicon Radio in the UK.

Ossmann will present his work at this years Defcon conference in August.

retro-reflector-surlyspawn     retro-relector    retro-reflector-ragemaster

 

Pytacle – A GSM Decoding/Decrypting Tool Now Supports RTL-SDR

Pytacle, a Linux tool used for automating GSM sniffing has been updated to alpha2, and now supports the RTL-SDR dongle with this update.

According to the website pytacle is

a tool inspired by tentacle. It automates the task of sniffing GSM frames of the air, extracting the key exchange, feeding kraken with the key material and finally decode/decrypt the voice data. All You need is a USRP (or similar – [RTL-SDR]) to capture the GSM band and a kraken instance with the berlin tables (only about 2TB ;) )

True Random Numbers with RTL-Entropy

RTL-Entropy is a Linux based entropy generator which uses the RTL-SDR as the entropy source. It works by using the RTL-SDR to sample atmospheric noise and then using that noise to create randomly generated numbers.

This is useful as computers are only capable of generating pseudo-random numbers, which may look random, but are not truly random. For cryptography and security, it is desirable to use true random numbers, as pseudo-random numbers can possibly be predicted. Combining this RTL-SDR based entropy source with other entropy sources may help improve security.

Exploring Unintended Radio Emissions with the RTL-SDR – Talk now available on YouTube

A few weeks back we posted about some slides from the Defcon conference by information security researcher Melissa Elliot which detailed how she used an RTL-SDR to explore the world of unintended radio emissions.

The talk to go with the slides is now available on YouTube

DEF CON 21 - Melissa Elliott - Noise Floor Exploring Unintentional Radio Emissions

Potential Major Security Flaw on HP Laptop Discovered with RTL-SDR

Over on Reddit, user cronek discovered by using his RTL-SDR that the microphone on his HP EliteBook 8460p laptop computer was continuously and unintentionally transmitting the audio from the built in microphone at 24 MHz in FM modulation. He found that the only requirement needed for the microphone to transmit was that the laptop needed to be turned on – even muting the microphone did nothing to stop the transmission.

Click here to read the original post.

I accidentally stumbled upon a signal in the 24MHz range, appearing to be 4 carriers. I tuned to it and heard silence, then someone came into my office and started talking and I could hear them speak. The signal appeared to be coming from my other laptop (not the one running the SDR) and was pretty weak (my antenna, the crappy one that comes with the dongle, stuck to a metal stapler was right next to the HP laptop).

This is of potential concern as as the US Military is apparently transitioning to this particular laptop. However, this may be an isolated incident, as in the thread cronek explains that other laptops he tested did not display this behavior.

HP Laptop Microphone Leak at 24 MHz

Exploring Unintentional Radio Emissions with the RTL-SDR

Melissa Elliot (0xABAD1DEA), an infosec security researcher has uploaded slides on the topic of investigating unintentional radio emissions from various electronic devices, and the security issues these emissions can cause. She used the RTL-SDR as the radio receiver to show that sophisticated equipment isn’t needed. One interesting experiment she performed was trying to recover a checkerboard image displayed on an LCD screen entirely via its unintentional radio emissions received with the RTL-SDR. She got close, as you can sort of make out the checkerboard pattern on the recovered image below. Update: Tomsguide have written an article on Melissa’s talk.

LCD Recover from Unintentional Radio Emissions