Software Defined Radio 101 workshop presented at BSidesMSP 2017 by @hardwaterhacker and @eapolsniper.

1. Software Defined Radio 101
Mike Saunders @hardwaterhacker
Tim Jensen @eapolsniper

2. About Mike
• Started IT in 1998
• Security since 2007
• Avid ice fisherman

3. Tim Jensen is a Senior Penetration Tester with
AppSec Consulting. He hails from Fargo, ND and has
extensive experience in all aspects of Penetration
Testing. Tim specializes in Network and Physical
Penetration Testing as well as conducting Security
Training.
Trivia: One of the things above made Tim grow Big.
Which one was it?

5. Signals Around Us
• Cell phones (900/1,800/1,900 MHz)
• Wifi (2.4 & 5 GHz)
• Bluetooth (2.4 GHz)
• Zigbee (2.4 GHz)
• Broadcast TV (54 - 900 MHz)
• Pagers (35/43/152/157/163/454/462/929
MHz)
• ADSB (978/1090 MHz)
• AIS (162 MHz)
• HAM radio (varied)
• Police & military comms (varied)
• Satellite comms (varied)
• Cordless phones (1.7/27/43-50/900 MHz,
1.9/2.4/5.8 GHz)
• Radar (varied)
• Car remotes (315 / 433 MHz)
• Garage door openers (310/315/390 MHz)
• TV remotes (varied)
• Wireless presenter remotes (varied)
• Etc. etc. etc.

8. What is SDR?
• Radios used to be implemented in hardware
• Software Defined Radio - software tunes receiver
hardware to desired frequency
• Additional software can decode transmission to reveal
data
• Signals can be transmitted with certain hardware

9. What You Need
• Hardware
• rtl, HackRF One, Ubertooth One, Yardstick,
Funcube, etc.
• Antenna
• Software
• GNU Radio, SDR#, GQRX, etc.

10. Getting Started - Hardware
• Generic RTL2832U / R820T(2)
• ≈ $15
• 25 - 1700 MHz
• RX only

11. Getting Started - Hardware
• HackRF One
• ≈ $330
• 10 MHz - 6GHz
• TX & RX
• 20M samples/second

13. Getting Started - Software
• Windows
• SDR#, HDSDR, SDR-RADIO.COM
• Mac & Linux
• GNU Radio, GQRX, Linrad
• Android
• SDR Touch, Wavesink Plus, RFAnalyzer

14. Getting Started - SDR#
• SDR# - www.airspy.com
• Quick start guide - http://www.rtl-sdr.com/rtl-sdr-
quick-start-guide/

15. Getting Started - Tuning
• Minneapolis area – 162.550 MHz
• http://www.nws.noaa.gov/nwr/coverage/station_listing
.html
• https://www.youtube.com/watch?v=gFXMbr1dgng

16. Getting Started - FM Radio

17. Common Problems
• Don’t forget to install Zadig driver with generic RTL
• Some USB 3.0 ports don’t work well
• Issues with USB passthrough in VMs
• Frequency drift due to temperature differences (non-
TCXO chipset)

18. SDR# Common Problems
• Slower processors = dropped samples, choppy audio
• Even an issue in VMs on more powerful hardware
• HDSDR is harder to use, but less overhead

19. SDR# Common Problems

20. More Common Problems

21. More Common Problems

22. ID an unknown signal
• Spend time sweeping through frequencies
• Search for known frequencies at radioreference.com
• Look up signal waterfall on sigidwiki.com

23. • Signal @ 152.480 Mhz

24. radioreference.com

25. FCC License Search

26. Search Results

27. Review Frequencies

28. Review Registration

29. Check SigIDWiki
Captured sample waterfall SigIDWiki Reference

30. Legal Disclaimer
• I am not a lawyer, this may or may not be illegal
• Research and decide for yourself
• 18 U.S.C § 2511
• 18 U.S.C § 2510

31. Decoding Pages
• Walk through:
• http://www.rtl-sdr.com/rtl-sdr-tutorial-pocsag-pager-decoding/
• You need:
• SDR#
• VBCable
• http://vb-audio.pagesperso-orange.fr/Cable/index.htm
• PDW
• http://www.discriminator.nl/pdw/index-en.html

32. Untrimmed whip

33. Untrimmed whip on soup can

34. 67mm whip on soup can

35. Coke cantenna

36. Flight Aware with 1090 notch

37. Next Steps
• Garage door hacking - http://samy.pl/opensesame/
• Ding Dong Ditch - http://samy.pl/dingdong/
• Decode a signal using GNU Radio

38. Resources
• http://www.rtl-sdr.com/rtl-sdr-quick-start-guide/
• http://www.radioreference.com/apps/db/
• http://www.sigidwiki.com/wiki/Database
• http://wireless2.fcc.gov/UlsApp/UlsSearch/searchAdv
anced.jsp
• Noise Floor - @0xabad1dea -
https://www.youtube.com/watch?v=5N1C3WB8c0o

39. Resources
• https://www.trendmicro.de/cloud-content/us/pdfs/security-
intelligence/white-papers/wp-leaking-beeps-healthcare.pdf
• https://www.trendmicro.de/cloud-content/us/pdfs/security-
intelligence/white-papers/wp_leaking-beeps-industrial.pdf
• http://www.fieldxp.com/ - Book series on SDR & GNURadio
• https://www.blackhat.com/docs/us-14/materials/us-14-
Picod-Bringing-Software-Defined-Radio-To-The-
Penetration-Testing-Community.pdf

40. Resources
• http://gnuradio.org/redmine/projects/gnuradio/wiki/Gu
ided_Tutorial_Introduction

41. Questions?
• mike@hardwatersecurity.com
• https://hardwatersec.blogspot.com
• @hardwaterhacker
• @eapolsniper