Tagged: webusb

Using a HackRF and JavaScript Browser App to Perform Rolljam Replay Attacks on a Car

Over on her website, Charlie Gerard has uploaded a page showing how she was able to perform a replay attack on a car's wireless entry system using a HackRF and a JavaScript browser app she wrote.

Previously, Charlie had already written a JavaScript browser app for ADS-B tracking with an RTL-SDR. To achieve this she used the WebUSB API, which allows USB devices to connect to JavaScript apps in a web browser.

Having recently purchased a HackRF she wanted to see if something similar was possible with the HackRF. In her post, Charlie shows and explains the JavaScript code required to connect to the HackRF from a Chrome browser, and how settings like gain, frequency and sample rate can be adjusted. She then shows how to use the Canvas API to visualize the received data. Finally, she shows how to use the File System Web API to record data, and ultimately retransmit the recorded data with the HackRF.

The replay attack itself is based on the rolljam idea. She uses two HackRF's, with one sitting closer to the car's receiver and jamming it, and another recording the car's keyfob. This prevents the car from incrementing the keyfob's rolling code, allowing it to be recorded and used again at a later time.

Charlie has also posted a video of her tests, which we embedded below.

Hacking my friend's car using JavaScript

A WebUSB Based RTL-SDR Aircraft ADS-B Decoder

Over on GitHub @devdevcharlie has uploaded open source Javascript code for creating an ADS-B Aircraft Radar system entirely within a web browser. The code makes use of the Web USB API, which enables USB devices like RTL-SDR dongles to connect directly to the code running in the web browser.

In her blog post, Charlie explains her code in greater detail, noting that it draws inspiration from AirplaneJS and rtlsdr.js. She explains how the Web USB API works, how to process the raw ADS-B data, and what her final setup looks like.

A demo site that you can use to directly connect to your RTL-SDR is available here.

In the past we've seen other WebUSB projects, like "aprs-sdr" which creates an APRS repeater system using a HackRF.

An APRS Tracker with HackRF, WebUSB and WASM

Thank you to Radoslav Gerganov for writing in and submitting news about the release of his open source web-based APRS tracker named "aprs-sdr". The web based software turns a HackRF device into a mobile APRS beacon.

Most interestingly the software works via the WebUSB interface, which allows for USB devices like a HackRF SDR to connect directly to the software through USB via the Chrome web browser. So no external app or software needs to be downloaded, all you need to do to run the code is open the hosted aprs-sdr page at https://xakcop.com/aprs-sdr with a Chrome browser, and connect the HackRF to your device.

Radoslav writes further:

The tracker is using the HTML Geolocation API to fetch the device’s location and WebUSB to talk with the SDR. The code which generates the packets is written in C++ and compiled to WASM. You can find the source at https://github.com/rgerganov/aprs-sdr.

And now to some results. I have successfully transmitted packets from my home to LZ0DOE (15km away!) using my Pixel phone, HackRF and ANT500. I find it amazing given the low TX power of HackRF.

Radoslav also notes that in the future he hopes to add other SDRs as well. He also notes that the script seems to work best on desktop Chrome. On mobile Chrome there may be a bug which stops transmission after a few packets.

Using the aprs-sdr WebUSB application.