Sigint & Cracking RF - James Stone

Hi everyone. Um I'm uh I'm James. I'm a uh uh engineering student and I'm working on um uh RF. That's kind of my my key interest and merges quite well with hacking. Uh so signals uh sig or signals intelligence is uh the um basically signals all around us analog and digital um information they contain what we can learn from them and then cracking breaking things you're not supposed to which is very much what cyber security is about. So uh uses are all RF we have uh communications so people talking to each other aircraft communicating um satellite internet um if anybody here as well Starink is apparently down at the minute uh there was a there was a

big crash so there's a major satellite internet provider um so navigation uh so DNSS which includes all of the major positioning system constellations that uses RF sends tiny signals down to earth. VUR which is an older one which is um essentially allows aircraft to uh navigate using kind of ground based radio beacons. Um I don't know what extent that's still used um astronomy so radio telescopy. So I'm sure you've heard of like James space telescope and seeing all those um absolutely massive satellite dishes. um especially scattered around United States. There's um and um like Hawaii and Australia, there's really big ones where they can look far into the cosmos and do whatever astronomers do. Um

imaging so medical uh medical imaging is particularly particularly useful. So things like MRI machines that uses um RF, CT scans, all of that. um and uh radar which stands for um radio um radio detection and ranging. So figuring out distance and speed of things essentially just bounce radio waves off things and that can tell you um a lot and uh both actively and passively and cooking. So you have microwave at home that is also RF. Some people split it into RF and microwave, but they're very much one on the same things. Spectrums are right next to each other. But um I I will tell you why cooking is not nearly as dangerous as cell towers

uh as part of the later latest later part of the talk if you were curious. So the first part of this is a bit of a physics lesson. U I'll keep it short and simple. You don't need much to be dangerous in radio. Um, and you you definitely don't need to do an engineering course to understand and uh uh practice a lot of the things that I'm going to teach you. Um, so in in uh radio you have frequency of signal. So kind of from from a couple of kilohz to many many gigahertz for like some of the latest and new technologies. Um, it's all RF. When you have a high frequency it is a low wavelength. So kind of just

what different ways of describing the same thing. So for example, a 100 megahertz signal, which is where you might hear your kind of driving radio, the standard FM, we'd uh call that for example the 2 m band because distance between the waves is 2 m. Um when you have a high frequency you can have smaller antenna which is why some of the high frequencies are very attractive to like cell phones uh and such like. Um and also you'll notice if you ever see like a big uh broadcast radio transmitting tower they have very very big uh like especially like AM radio very big transmitters. I think the biggest of which is the Batican radio station where they broadcast um Batican

interest radio channels all around the world with maximum coverage at absolutely incredible hours. Um so the signals themselves uh they can be characterized by the the frequency of them. So here we have a low low frequency on red and then blue frequency is twice that. So you can see there twice as many oscillations uh in the same period of time. Then amplitude. So a signal is uh blue one's taller. So that can be adjusted in the radio wave. And then phase. So kind of the offset between two signals as well. And essentially for all purposes of mod radio, those are the three things which you can adjust and will propagate through the air to transfer information

either in analog or digital methods. So, the radio spectrum. So, these are the these are the really low frequencies. So, um if you I'm not quite sure how big, but it would be absolutely massive. Probably um almost the length of a country. uh if you wanted a kind of a on the low end of that spectrum um uh radio setup. Um they mostly use that to talk to submarines for a bit of science cuz uh submarines being so far underwater it's quite hard to reach them with conventional radio signals. They haven't yet uh extended um 5G to bottom ocean um and it doesn't penetrate through water very well. Um then we get on to kind of the um low

and that's extremely low frequency, super low frequency, ultra low frequency, par frequency and then low frequency, medium frequency. And that's where kind of the first thing which you may have used comes in which is AM broadcast radio. So also known as like longwave radio uh gets very far across many countries. Um as well as some navigation medical and also RFID. So some RF cards like entry access cards you have to use that um due to some kind of trick. I don't know too much about how those antennas work. Um HF so that's where you get your kind of first um radio. So I don't know people know about CB radio. So it's like truckers in

movies truckers talking to each other. That's a American consumer band radio CB. And that's where some of the um and also quite an interesting kind of radar technology where you can bounce signals off of the off of the ionosphere and then um see um see things which are over the horizon. So which you can't see by light or any other um and that is still done. Uh VHF this is kind of the first like band of interest I'm going to be looking in more detail today and it's quite easy to work with. So that the the first thing in there is kind of your broadcast radio. So standard like 97.5 FM whatever that's that range um aircraft and air

traffic control also talk on those frequencies. Um some maritime and some some kind of walkie-talkies as well specifically kind of outdoor variety long range sites uh use things in that band. the main band interest which we're going to looking at today. So that's the ultra high frequency band um that contains cellular radar, microwaves, uh Bluetooth, Wi-Fi, basically most of the tech that we use at the minute. Um unless you're getting kind of like the higher band cellular and parts, uh which is super high frequency and that's all the one. It does extend a bit further, but that's really then just goes into the science again cuz we don't have particularly good technology for that. Um,

so and 330 GHz is used for some like high throughput microwave links uh for getting to um for like internet uplinks etc. Um and microwave relay an interesting technology often used by high frequency traders in kind of the financial sector to get information as fast as they can between exchanges. Um that was the traditional way. They're kind of getting to the laying their own fiber lines and things at the minute as well. Um and more radar and that's specifically like weather radar. So all kind of weather forecasts based on sending these uh high radio waves out east atmosphere. um and see how they reflect off like rain, clouds, moisture and so forth. Um one kind of the one last bit of science

which you should be aware of to kind of mess with radio is how how the engineers mark kind of gain and power resistant. Um so uh as you can see here we have a gains given in decibels dB and power gi uh dBm which stands for decibel mill or dbw less frequently used. Um so you can see it's kind of compressed scale. So the the most it's based on logarithms, but the most important thing to know is that when you add 3dB um you're multiplying by two. When you add 10 uh 10 dB, you're multiplying by 10. So it gives you quite a lot of kind of power and magnitude. You're a lot less accurate than that.

But when you're talking about signals and power ratings, very important. So for example in power while uh your your phone might be transmitting at 40 dBm to a cell tower your home microwave is running more like at um uh 70 dBm. So doesn't seem that far away the scale but that's a lot of power difference cuz that's uh like one watt versus 1,000 W. U relevant legislation. So the legislation a little bit dated on what you're allowed to do and not do um on radio. So you need licenses to transmit. Uh it's all regulated by offcom office communications. Technically listening also requires uh permission. You're not meant to listen to signal not intended for you. It is

technically an offense, but um there have been absolutely zero recorded cases, especially given how um how popular and common radio hardware has been over the last many years. uh for that case. A lot of those laws were ded from like original GSM uh cell phones where you could technically listen to people's phone calls and invade their directly invade their privacy just with a kind of basic handheld radio which is not the case anymore. Um, I feel like I should remind people technically an offense, you know, especially when you're doing doing things work, it's quite important. Play by the rules and in the UK, it's not necessarily the the Crown Prosecution Service who can take you to court for stuff. So uh and uh but

more importantly probably divulging information that you weren't meant to hear even if you're using the radio in a kind of a um perfectly legal way if you then go write about it online technically not allowed as well. It's quite dated and I think it's due to change fairly soon but um it's just it's just one of those things and then communications act. So offcom office communications they manage radio spectrum they uh investigate cases of interference there's some recently where people are interfering with air traffic control uh putting out things they're not meant to they absolutely will notice and care and take action to go take you to prison and steal probably mostly confiscate all your equipment if they do

find you breach some of these regulations. Um so kind of what is there to hit to be heard on um uh in the VHF UHF range which is sort of equipment that we'll look at later that you can you can um hear some of these analog there's air traffic control which is an amplitude modulated signal um there's the maritime communications band um uh offtheshelfies which you which you can just buy kind of anywhere. Uh so uh the kind of like blister pack talks which you can get talk on use license free that fall into a category called PM46 where technically the radio holds a license you don't need one um and uh businesses they they love using um um

analog radio things so things like weather spoons uh pop watch spoon you can you can sometimes here uh construction crews will be using analog radios. They are a lot cheaper than digital radios um but not necessarily always more secure but uh and yeah excuses for that digital radios kind of larger site. So if you had like a a a campus security they'd be they probably be using digital radios with a repeater. You can cover a larger area. You can do you can do fancy things and you can split people up into groups. So you don't need to lease massive amount of spectrum to run an entire site. Um the reason I put these in orange is cuz you

can't always hear these. So it really depends what kind of system they're using. But um um it is it is um eing is definitely harder on the digital side, but uh technology has advanced and caught up with it with some equipment that I'll show later. Um railways we're also a user of that. The reason it's orange not red is because I think technically you can snoop on map. It is scrambled but not encrypted. Um and um emergency services. So you might have heard of Tetra Airwave. It's kind of like a private 2G 3G network in some ways uh for for the police ambulance fire service of their their handheld radios and their car radios. that is

very encrypted and even though you might have heard some things about kind of burst and vulnerabilities and tetra that covers radios meant to export. So in in the in the handheld radio world there is quite a lot of espionage especially around what radios allowed to be exported out of the country because it's often felt that military should be be able to on these channels especially if they get into hands of kind of adversaries and so on. Um, so the tetra burst vulnerabilities were based around the kind of the lower tiers of Tetra systems which were allowed to be sold overseas and had an intentionally grip uh kind of crypto system. Um, as far as I know, there's no um

vulnerabilities in the Tetra Airway that would like actually disclose information to you unless you have one of the kind of pre-programmed handsets. And then really constant places so places which um uh need to be compliant like FIPS um and etc. and are actually audited based on like their site security. Um um I don't know it's not known too much about that but um you can get radios properly secure. So uh analog voice the um some of the interesting open channels and some places are using these by accident. So technically it as a business not meant to use PM46 which is like the commercial offtheshelf radios people do cuz they kind of just pick up whatever. So that's why I included cheap

skates in there as well. Um, but you were very likely to be listened to by people with just offtheshelf radios that they can pick up. They might also transmit over you, mess with you. I've definitely seen lots of cases of that. Um, and hikers kind of scout people, outdoor people to use radios like that. Um then there's kind of the business simple licensing um where you can um um where you you kind of pay a fix every year and there that opens up certain amount of channels which you're which you then licensed to use. Then you buy special radios which you can use this with. Um that's a bit more common for like your businesses.

Um and then site licenses when you want to have like a repeater access network um across campus. That's that's kind of critical at that point. And you can actually see those um people with site licenses and pointto-point radio licenses in offcom's online map which is actually really interesting. So this is kind of the offcom god view that they just published to the internet. So you can you can kind of look up by region. So I chose basis. So you can't really see the dots too much on this, but um you can see that the National Trust has a radio license. It lists all of their frequencies that they have that they're renting. So um uh the sports club um uh

the basic technology technology um and airwave as well which is that the police network that I talked about but that's so that they can link between sites and the case like power outage they can still keep the place police radios going between between different places um without without internet anything else. Um so that's quite an interesting page. You can kind of see um bit of a ocean where you can see who's using radios and where uh in your in your local area uh which is all free to publish information. So go on a bit to um uh more kind of um uh like um info security stuff. So if you have if you have a business you work with

businesses that are using kind of standard business radios it is probably unencrypted if they're just using off the shelf they don't have kind of a uh exceptionally competent kind of management team etc. So, no encryption, I'd say, is just the worst because people with kind of uh with radio scanners will just find your channels, listen to you, transmit over you, and generally mess with you in uh in ways they can. It happens quite frequently. Um not as much as it used to happen when before Netflix, let's say, when this was kind of a much more entertaining hobby. Um um and um basic pricing which Motorola offers is is free but it is a 16 bit XL

mask. It can be cracked and very very quickly if but then again it's kind of good to know what you do. So if you were buying like a digital radio scanner it probably wouldn't be able to do that. But with new techniques kind of SDRs it's it's easy as is. Um, enhanced privacy mode it's 40 bits. You're allowed to export that. You can crack that with good computers and bits if you know what you're doing. At least as far as I understand. Those aren't all security bits. I think um, and you have to pay £50 per radio. So, if you have a site of 500 radios, that's already quite a big ask for for a budget for these.

And then you get on to kind of the actual actual good radios. It's AEF privacy that Motorola offers. Um it's uh uh export control so you can't always take these out of the country. I think things like that are loosening up a bit now but um uh and that's also compliant. So if you have a a site which has those regulations and that's £300 per radio and this is in addition to radios that cost about £600 each. So that's uh that's quite a big spend but it's not a subscription. You pay that radio has the software key. you can use that forever. And then when you have the larger size base stations um the costs the cost for base stations

that support that repeater networks those go across the board as well. So having an actually a site as secure as your just your normal network is very very expensive for kind of a just a normal walkie-talkie talk radios whatever and a lot of the time you I'm not sure where this comes in kind of GDBR compliance if you have to transmit sensitive data between places but um because you have to use strong technical measures to make sure that personal information isn't divulge So technically it's a bit of a gray area. It might come out that you actually need AES encrypted radios if you're doing that. Um Balfame UV5R. So this is the first kind of piece of uh scanning equipment that

I'll talk about. So um it can do a lot of analog voice. Um so it has access to the 2 m and 70 cm bands which are another name for the VHF and UHF bands. Not all of them, but the points where some interesting things are, including some weather satellites, which you can which are continuously record images and then bring them back down at quite a um that you can then uh decode from the sound with an app on your phone, which is pretty cool in my opinion. Um you can also receive broadcast if wants to do that, but it's dead cheap. It's like £17. You can get them anywhere. Um these radios can transmit um but that is

for radio amateurs. So even if you were technically on a band which is more license free technically this radio doesn't come with a license for anything. So you need the license but then again it's um um this is kind of mainly for talk about listening on a single intelligence um but uh uh radio amateur radio is really good way to learn about the stuff without kind of going of doing a degree etc. Um then another radio which is a bit more enhanced has some frequencies but has some extra frequencies um and it can also receive air traffic control and airband um and has a much wider receiving frequencies for about £25. I don't know how they make these radios so

cheap. It's it really boils the mind. Um but um yeah onward. So the the next kind of band that I want to talk about is ISM bands uh which is instrumentation side of um which comprises kind of three bands across um UHF and up um which you'll be much more familiar with. So fourth of three A68 you have car keys. So, these are like when you unlock your car remotely, it has the rolling codes, which I've just uh there's rumors at the minute that there's a really really big vulnerability in some rolling code systems for modern cars that allow a single packet to be captured and then lock and unlock capability for your car is compromised technically. Um, but

that's unverified. Um, uh, like garage door openers, etc. Those have kind of long been discussed. So basic sending basic digital packets between each other. Um Laura which I think somebody else is doing which is what Meshtastic runs on. Uh it's kind of the low modulation um uh protocol that can be used at like really low powerful in things in kind especially across wide areas uh and smart meters. Um most um 2.4 Ziggp is quite an interesting one. You can listen to a fair amount of what goes on. Although the the content is encrypted, but it will tell you if somebody has a very fancy smart home. And if somebody has a very fancy smart home, you know, that's a intelligence in

itself. That that might be a person worth robbing, for example, maybe. Um um and so command and control. So when people have kind of DJI and other drones, the control link to that will usually be in that band, can be listened to. Some people buy big monitors that are insecure. I mean, wow. Uh, did they really not consider that? It seems like a fairly crisp part of it. Um, and a lot of those be listened to without encryption. I think nowadays it's more kind of Wi-Fi ones that you get. Um but the traditional ones same same system as cordless phones could just be listened to over the network and cordless phones still are they they run their own

protocols sometimes fairly encrypted. So you can still some uh listen to it's called depped the technology that those run on which is sometimes encrypted sometimes not. And microwave ovens they also run on 2.4 40 Hz, but they have that kind of mesh screen on the front desk. Um, and then the rest of things, so like Wi-Fi 5 GHz, CPG, um, presence detection. So like some places when you walk into a room and the lights will turn on, that will actually be um, 5 GHz waves bouncing off of you telling it that there's somebody in the room. And this is also quite common for first person video relay from drones which is very very interesting topic in signals

intelligence at the minute uh with the the war in Ukraine and everything that's happening. Um jamming video relay signals is a really big topic at the minute and it's is quite easy to do as well. Um um so they're looking at switching to like digital putting as many counter measures in they can and using fiber optic lines run the RF over instead um software defined radio. So this is um this is kind of the the best way. So the the previous ones I showed those are just kind of analog handheld FM receivers but these are these are the best you can do. Um, they capture they're basically like a sound card for radio for your computer if you're old

enough to remember what a separate sound card is for a computer. Um, and they're kind of like a like a external external modem as well. So, some some of them this is the kind of the most basic but pretty burst RTLSDR. Um, somebody just found some parts that they could kind of hack apart and build a soft radio out of. Um then very famous among hackers in the cyber security circles the hacker F um uh which is kind of a med mid-range SDR and very wide bandwidth can be used for a lot of things and that top is like a professional lab grade SDR um which costs a lot of money. Um so these these

capture uh radio waves and store them digital signals then this can be digitally processed on your computer. So if you're trying to um demodulate either an analog or digital signals it can all nowadays be done quite a bit better and with a lot less headache using software defined radio technologies I say but the drive hell. So um there but there is a solution to that later in the talk. Um yeah and on down on the left here you can see a spectral waterfall. So one of the big advantages of an SDR is that um you can see all the bandwidth at once that you're looking for. So whereas on like a handheld scanner you might have

to chew through things one by one um at very specific frequencies. You can see the entire bandwidth of your receiver all in one go and you can see kind of the trails of where the signal spikes were in frequency falling down the screen which is very useful for finding for finding things in local area. Uh Dragon OS so for those of you who know Ki Linux and so on Dragon OS is the Ki Linux of um uh for software defined radio really. So all of the radio tools, all of the radio drivers most importantly um are all included as well as hundreds of tools which you need for doing anything with an STR which can be

quite a challenge in some case. They actually also have some tools in there for self power security research and emulation which you can do with some of the professional grade STRs that I showed in the last slide. But uh yeah, really good available as ISOs. So um and you can run it in a VM, you can run wherever it's kind of a Debian based Carly clone just for SDRs. Um so this is some of the software which will be useful if you're getting started with SDRs. So there is GQRX is the mo basically the most basic. It will give you a spectrum of what you can see in a band. So, for example, you'd see like a

a digital signal kind of jumping up and down, for example, that you can see there's some very narrow band things in there. And you might see a like a an FM voice or a FM radio station. You see that kind of wiggling about cuz that's an analog signal. Um, so which can tell you a lot about the signals that you're looking at, their power levels relative to you, so how well you're receiving them, which will help you kind of set up antennas properly and so on. And that can also let you hear analog signals. So you can kind drag a slider onto a signal, demodulate it, listen to what it sounds like. Even if it's a digital

signal, you can still kind of down convert it to audio frequency and hear what it's doing. So kind of like how you'd hear like modem noise, something something like that. um you um you kind of just hear the beeps and words what's going on behind it and you might even learn to identify stuff based on that. Um and then the next one is SDR Angel. That's a really really powerful bit of software. Um it does have a memory leak I think so it crackes sometimes but um it's a you have full spectrum warfall but it can do digital signals as well. So if you're de modulating um you're listening to like a DMR station obviously one which you're

broadcasting license to receive um you can you can hear that decoded in there. It it works quite well for those not perfectly cuz of some reasons I'll get to on the next bit of software. Um and no no encrypted encrypted radio signals but it's generally quite a powerful bit of software very capable. It can also do transmitting. So like if you want to uh in a licensed way transmit some like Morse code and things has a whole variety of tools to do that. Um DFME Florida man edition. This is probably my favorite tool out of out of everything at the minute. So everything which you need for kind of digital digital radio. It will tell you all the packets it's

receiving. It will it can kind of tap into like large radio networks when you're listening to something there. Um, it has the motor related privacy keys built in so you can see everything that you can. And I reckon it could be used for enhanced privacy tracking, but that's obviously with some offsite compute cuz you need to crack that 40 bit key as well. Um, and the reason why this one's so much better as well is because they don't care about the proprietary codecs which um, a lot of radios use. So there's this thing called ambe and it's a very restrictively licensed codec for encoding voice. So a lot of implementations are very bad but they

just straight up included a stolen propriation in their source code and they don't seem to care. So it works really well and you'll hear everything with like crystal clear quality. Um this is a very good tool. Um RTLCR. So I covered this briefly. This is the best way to get started. In my opinion, if there's you just want to you just want to plug it in, get going, see some see some signals in the waterfall, adjust your antenna, and then kind of start start comparing and seeing um what's available to you. Um a lot of people when they have some cash to spend, they've gone and bought like a a RF and they just don't know what to do

with it. It's a fair expensive bit of kit and the learning code is so much higher for a lot of the more advanced things that an hacker is capable of compared to an RLSDR. So listening to local things, doing like uh basic amateur things, you can listen to like uh aircraft transponders and so on on this as well. It covers that really well. Um, and um, you can actually in SDR ranger, which I showed, you can have a a map of the area and bought aircraft on the map around you based on their um, ADSB transponder essentially. Um, perfect definitely. um and can also be used to perceive satellite satellite things as well like the Noah web map

images that I was talking about and some radio amateur um satellites have receive frequencies as well that can be seen um okay yeah radio site um uh so that's like really advanced software so if you really want to get into it. You're analyzing signals. You want to get into a bit more kind of the the science of trying to understand, extract some more information. It's it's very powerful, but um it is a massive learning curve. I'd say it's like you spend 100 hours and then you're kind of mostly getting to grips with what you do in it. Um and setting expectations is quite important cuz it's quite it's quite challenging to be digital signal processing software.

But there are some absolutely great resources out there to learn on it. The guy who created it, Michael Osman, he made a brilliant YouTube series basically going through every set using radio to make basic transmisses and receivers and so on. Um mostly kind of like receiving like car keys, de modulating those signals for example for some security research. That that's a good application of this device. does cost about £200 um for that which uh so sorry GNU radio is free obviously is GNU free software but then to make the most out of it I recommend at least a hack RF uh SR so you have some room to play with um any questions >> yes so when you talked about the motory

you said the 16 16 bit Xbox key and you said there's four bit security as well. Could you elaborate on that? >> Uh yes. I think I meant to say 16 different keys 16 key. Um so in four bits of security it's a little bit unclear how they do it and um but DSDF media software rock show has it all baked in. So they have all of the the keys listed out >> all 16. >> Yeah, I know it's a big big ass. Um but um the effect that you get in just putting a little bit of security on radio is massive in that people aren't going to try and like jam you and mess

mess with you so much, but uh pardon criminals and radio can probably still listen to what you're saying. So yeah, thank you. a seven years later. Um doing a community run [Music] event considering some sort of walkie uh for the people running and seeking secondhand debt. Would you go with that something else that real house? Um, I mean, yeah, that's that's to be that's a great idea. Nobody's going to do you with that. So, but uh if that's what you're worried about the most for the least money. >> Oh, right. Um, I mean, to be honest, I'd uh it it dep I'm not too sure about how decked phones would work in that in that situation cuz

you need base station fairly close. They're not meant to particularly high power. it won't get too far across plays wirelessly. But um so if that's not then like a PMR 446 you can get some like 16 channel PMR 446 radios quite cheap uh for like 10 12 13 a unit >> something like that. Yeah. Yeah. They might not sound nice but they'll work. Yeah. Yeah. Uh any other questions?

[Music] uh yeah absolutely so in kind of the digital handheld radio space there is uh Motorola uh Terror they're quite high terror sorry um uh they're they're another big player in that it's it is really a limited number of people who um who who can cater to that market and there's really any reason to get into it cuz usually when people have a good reason to pay for good radios um they're going Motorola or if they want to save a bit of money maybe High Terror um I think there there just aren't too many players there are a lot more kind of um cheaper alternative kind of white label radios that you can get that support

some of these things um there's a China has a lot of work on kind make very integrated chipsets for them uh and so on. Um >> they like >> encryption. No, but like the modulation and base talking. Yeah. So um at least not any of the higher maybe the maybe the actual one. I really don't know. >> You know anything about the new video? Yes, I actually have one as uh the Belfang 181 UV. Is that the one you're looking at or >> Okay. Yeah. But yeah, no, they're pretty good. So, their their initial stuff was quite was quite poor quality, but their newer things are getting better. If you want to put custom firmware on, just

make sure it's supported because they've been actually giving the same number uh giving the same kind of model number to radios with completely different chipsets. People have been by putting custom foam on because why not? Um the cracking is the software stream.

>> I think they have message authentication codes in it. It's it would all be in the best that's supposed to look like kind of the DMR standards and uh the DFME code base which is on GitHub. I can't answer that question directly really. Um but I'm very interested in the the kind of the actual uh day two and three of DMR radios. Okay. Uh any any final questions then? Okay. Uh, all good. I'll finish.