breaking into software defined radio · breaking into software defined radio presented by kelly...
TRANSCRIPT
![Page 1: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/1.jpg)
BREAKING INTO SOFTWARE DEFINED RADIO
Presented by Kelly Albrink
![Page 2: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/2.jpg)
WHOAMIKelly Albrink
• Pentester at Bishop Fox
• Specialize in network, wireless, and hardware security
• Member of Noisebridge Hackerspace in San Francisco
• Loves 3D printing, science fiction, and reading your emails
@Justified_Salt
![Page 3: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/3.jpg)
QUESTIONIt’s pretty
much useless
WHY SHOULDYOU CARE?
![Page 4: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/4.jpg)
RF IS MAGIC
https://creativemarket.com/yami.leth
![Page 5: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/5.jpg)
1. Radio basics
2. Software Defined Radio (SDR) Hardware and Software
3. How hackers use SDR
Disclaimer: We’re not going to talk specifically or in depth about Ham radio hacking.
AGENDA
![Page 6: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/6.jpg)
• You get transmit privilegeson amateur bands
• Three levels of ham licenses:
Technician, General, Extra
• Each license level allows additional frequencies & privileges
• Contests, fox hunting, DXing, collecting QSL cards
• Communicate with the ISS
• Packet radio, Echolink
BECOMINGA HAM
![Page 7: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/7.jpg)
QUESTIONWHAT ISRF?
![Page 8: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/8.jpg)
Wavelength and Frequency
TERMINOLOGY
WAVELENGTH
• Long wavelength
• Low frequency
• Low energy
• Short wavelength
• High frequency
• High energy
WAVELENGTH:
The actual distance between the peaks of 2 waves.
FREQUENCY:
How many waves pass per second.
ONE SECOND ONE SECOND
![Page 9: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/9.jpg)
You’re telling me the files are in the wave?
ANALOG MODULATION
OOKPulse Modulation or On Off Keying
AMAmplitude Modulation
FMFrequency Modulation
PMPhase Modulation
![Page 10: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/10.jpg)
You’re telling me the files are in the wave?
DIGITAL MODULATION
ASKAmplitude Shift Keying
FSKFrequency Shift Keying
PSKPhase Shift Keying
![Page 11: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/11.jpg)
RF BANDS
VLF
ELF
Very or Extremely
Low Frequency
MF
Medium
Frequency
HF
High
Frequency
VHF
Very High
Frequency
UHF
Ultra High
Frequency
SHF
Super High
Frequency
EHF
Extremely High
Frequency
LF
Low
Frequency
300KHz-3MHz 3MHz-30MHz 30MHz-300MHz 300MHz-3GHz 3GHz-30GHz 30GHz-300GHz3-30KHz 30-300KHz
![Page 12: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/12.jpg)
RF BANDSVLF-ELF-LF
VLF
ELF
Very or Extremely
Low Frequency
MF
Medium
Frequency
HF
High
Frequency
VHF
Very High
Frequency
UHF
Ultra High
Frequency
SHF
Super High
Frequency
EHF
Extremely High
Frequency
Low
Frequency
3-30 KHz
LF
30-300KHz
• Mostly government use
• Maritime radio navigation
• Submarines
![Page 13: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/13.jpg)
RF BANDSMF
VLF
ELF
Very or Extremely
Low Frequency
MF
Medium
Frequency
HF
High
Frequency
VHF
Very High
Frequency
UHF
Ultra High
Frequency
SHF
Super High
Frequency
EHF
Extremely High
Frequency
Low
Frequency
LF
• AM Radio
• Aviation Radio
300KHz-3MHz
![Page 14: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/14.jpg)
RF BANDSHF
VLF
ELF
Very or Extremely
Low Frequency
MF
Medium
Frequency
HF
High
Frequency
VHF
Very High
Frequency
UHF
Ultra High
Frequency
SHF
Super High
Frequency
EHF
Extremely High
Frequency
Low
Frequency
LF
• Amateur Radio
• “short wave”
• NFC/RFID
• Weather Broadcast
3MHz-30MHz
![Page 15: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/15.jpg)
RF BANDSVHF
VLF
ELF
Very or Extremely
Low Frequency
MF
Medium
Frequency
HF
High
Frequency
VHF
Very High
Frequency
UHF
Ultra High
Frequency
SHF
Super High
Frequency
EHF
Extremely High
Frequency
Low
Frequency
LF
• FM Radio
• VHF Television
30MHz-300MHz
![Page 16: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/16.jpg)
RF BANDSUHF
VLF
ELF
Very or Extremely
Low Frequency
MF
Medium
Frequency
HF
High
Frequency
VHF
Very High
Frequency
UHF
Ultra High
Frequency
SHF
Super High
Frequency
EHF
Extremely High
Frequency
Low
Frequency
LF
Most Modern RF Tech:• Wi-Fi• UHF television• Microwaves• GPS
300MHz-3GHz
• Mobile/4G
• Car keys
• RC toys
![Page 17: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/17.jpg)
RF BANDSSHF
VLF
ELF
Very or Extremely
Low Frequency
MF
Medium
Frequency
HF
High
Frequency
VHF
Very High
Frequency
UHF
Ultra High
Frequency
SHF
Super High
Frequency
EHF
Extremely High
Frequency
Low
Frequency
LF
• Wi-Fi
• Satellite Communications
3GHz-30GHz
![Page 18: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/18.jpg)
RF BANDSEHF
VLF
ELF
Very or Extremely
Low Frequency
MF
Medium
Frequency
HF
High
Frequency
VHF
Very High
Frequency
UHF
Ultra High
Frequency
SHF
Super High
Frequency
EHF
Extremely High
Frequency
Low
Frequency
LF
• Radio Astronomy
• More Satellites
30GHz-300GHz
![Page 19: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/19.jpg)
QUESTIONSO, WHAT ISSOFTWARE
DEFINED RADIO?
![Page 20: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/20.jpg)
• Antenna
• Transmitter
• Receiver
• Amplifiers
• Filters
• Modulators/Demodulators
Modulator Amplifier
Microphone Antenna
Amplifier Demodulator
Antenna
AudioAmplifier
Loud Speaker
TRANSMITTER
RECEIVER
RADIO HARWARECOMPONENTS:
![Page 21: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/21.jpg)
![Page 22: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/22.jpg)
REQUIREDHARDWARE
![Page 23: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/23.jpg)
CHOOSING AN SDR
TUNER RANGEThe range of frequencies the radio can see
TRANSMIT CAPABILITYSome platforms are receive only
SAMPLE RATELimits the max observable bandwidth at one time
DYNAMIC RANGE / ADC RESOLUTION Bits per sample value
![Page 24: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/24.jpg)
Hardware Platform Tuner RangeTransmit
Capability
Max Sample
RateADC Cost
RTL-SDR ~50MHz - 1.7GHz Receive Only 3.2 MSPS 8 bits $25
HackRF 10MHz - 6GHz Half Duplex 20 MSPS 8 bits $330
LimeSDR 100kHz - 3.8GHzFull Duplex
(4ch)61.44 MSPS 12 bits $299
LimeSDR mini 10MHz- 3.5GHzFull Duplex
(2ch) 30.72 MSPS 12 bits $159
BladeRF 300MHz - 3.8GHzFull Duplex
(4ch) 40 MSPS 12 bits $420
POPULAR SDR PLATFORMS
![Page 25: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/25.jpg)
ANTENNAS
Basic Indoor Antennas
Outdoor Antennas
DIY Antenna
![Page 26: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/26.jpg)
STEP 1
Find the signal
STEP 2
Capture the signal
STEP 3
Analyze the signal
GOALSIdentify the following:
• Frequency
• Bandwidth
• Modulation
• Symbol rate/ Data rate/ Baud rate
• Packet structure elements (Preamble, Sync Word, CRC, Fields, Field sizes)
SIGNAL REVERSE ENGINEERINGWORKFLOW:
![Page 27: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/27.jpg)
In these examples we’re going to be looking at some car key fobs
STEP 1FIND THE SIGNAL
![Page 28: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/28.jpg)
Use the FCC ID to quickly identify the frequency/bandwidth
STEP 1FIND THE SIGNAL
![Page 29: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/29.jpg)
Use the FCC ID to quickly identify the frequency/bandwidth
STEP 1FIND THE SIGNAL
![Page 30: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/30.jpg)
Confirm the frequency & bandwidth
with a tool like GQRX, SDR#, or Baudline
Watch in action: https://youtu.be/RAoWL7dLnME
STEP 1FIND THE SIGNAL
![Page 31: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/31.jpg)
• Frequency
• Sample rate / bandwidth
• # of Samples to read
• Gain (usually optional)
• Output file name/type:
• .cfile
• .cu8
• .cs8
• .cs16
STEP 2CAPTURE THE SIGNAL
![Page 32: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/32.jpg)
GOALGo from signal to bits:
• Identify modulation type
• Symbol rate/baud rate/data rate/
• Identify protocol elements:
• Preamble & Sync Word
• Packet structure
Tools• Inspectrum
• DspectrumGUI
• Universal Radio Hacker
STEP 3ANALYZE THE SIGNAL
![Page 35: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/35.jpg)
JEROD MACDONALD-EVOY
@jerodmacevoy
SAM RICHARDS
@minneapolisam
JASON HERNANDEZ
@jason_nstar
JOHN WISEMAN*
@lemonodor
SPIES IN THE SKIESDEFCON25
![Page 36: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/36.jpg)
8-12 bit code
~2ms per bit + ~2ms delay
5 signals per transmission
(((2**12)*12) +
((2**11)*11) +
((2**10)*10) +
((2**9)*9) +
((2**8))*8)) = 88576 bits
88576 bits * (2ms signal + 2ms delay) * 5 transmissions
= 1771520ms = 1771 secs = 29.5 minutes
DRIVE IT LIKE YOU HACKED IT DEFCON23
SAMY
KAMKAR
@samykamkar
Where does one code
end and the other begin?Fixed Code Garages De Bruijn Sequence
For every 8 to 12 bit
garage code
((2**12)+11)*
4ms / 2 =
8214ms =
8.214 seconds
![Page 37: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/37.jpg)
BALINT SEEBER@minneapolisam
Rick Rolls San Francisco with emergency broadcast towers
With “All Your RFz Are Belong to Me” Defcon 21
KRISTIN PAGET@KristinPaget
GSM hacks with “Practical Cellphone SpyingDefcon18
OTHER COOL HACKS
![Page 38: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/38.jpg)
TOOLS WE COVERED• GnuRadio-companion
• GQRX
• Baudline
• SDR#
• Inspectrum
• DspectrumGUI
• Universal Radio Hacker (urh)
![Page 39: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/39.jpg)
QUESTIONS?
![Page 40: BREAKING INTO SOFTWARE DEFINED RADIO · BREAKING INTO SOFTWARE DEFINED RADIO Presented by Kelly Albrink. WHOAMI Kelly Albrink •Pentester at Bishop Fox ... Disclaimer: We’re not](https://reader034.vdocument.in/reader034/viewer/2022042803/5f4f59232afa395c63034f82/html5/thumbnails/40.jpg)
THANKYOU