BSIDES CPT 2019 - Hacking satellites with Software Defined Radio (SDR) - Gerard de Jong
Vložit
- čas přidán 28. 05. 2024
- Title: Hacking satellites with Software Defined Radio (SDR)
Abstract:
In this no holds barred down introduction to Software Defined Radio (SDR) you’ll learn how you can write software to hack remote control security gates, track ships at sea, code your own aircraft radar, and ultimately how to download data directly from various satellites in low earth orbit with nothing more than a cheap USB dongle and a makeshift antenna.
Speaker: Gerard de Jong
Twitter: @GDdeJong
Speaker Bio:
Software developer and consultant with over a decade’s experience building information systems. Holds a Master’s Degree in IT from the University of Pretoria and is a member of Mensa. Speaker at software development conferences such DevConf, Java Africa, LinuxConf[ZA] etc. - Věda a technologie
One of the most engaging talks on a tech subject ive come across in a while. Awesome! Thanks for sharing. Rekindled my love for radio electronics..techlove to you Gerard!
Glad you liked it.
I'll say it here because pretty sure most of this crowd would agree: This is what CZcams was designed for. Man what a video!
Totally agree
Well said
That was many things...literally the definition of cool !!!
Is this illegal though?
@@chobai9996 shhhh 🤣😂😁
What a great delivery, not a single boring moment. Hope this man never gets corrupted by Powerpoint.
tons of blablabla and lame jokes for very little information
We glad you like it. Its a great talk that touches on many points. Gives people something to think about.
42:45 that qualifying statement for a speaking event in March 2020 was more warranted than we knew
Engaging and illuminates one of the things I think most surprised me when I started getting into sdr -- Just how much "secret" information is buzzing about us at all times. Such a fun way to interact with our world. Thanks!
Such a smooth and well put talk: Even a beginner like me was able to follow it, and never felt it was too fast or too slow - rather it was spot on. Many thanks for all your time and hard work.
it‘s only for beginners. for everyone else is just a lot of hot steam for very little information
@35:00, the correct frequency to listen to for amateur radio communications via the ISS you want to tune to 437.800 MHz for the downlink, the 2M 145.800 is the uplink and you will only hear those amateurs nearby you within line of sight reception.
That airport was Amsterdam Schiphol, hence all the KLM flights coming in for rwy 06. You could see the VOR beacon SPL (at Schiphol Airport) en the VOR PAM (Pampus at the south shore of the IJ-meer lake, named after the small island Pampus in the same lake). Nice to see the NOAA and Meteor satellites are still transmitting on 137 MHz in analog APT mode. Years ago I received them with a kit build receiver and a pc with special interface modem, and I could see the image build line by line while receiving. The Russian Meteors had better quality images. But both have a digital mode now on a higher frequency I think somewhere around 1600 MHz. You need a dish that can follow the sats in azimuth and elevation.
1700. i built my own tracker with NEMA 23 motors and some 3d printed gears. the great thing with SDR is that you can easily receive this. Also GOES if you're in the americas.
I love observing EHAM, because their ground vehicles also show up on popular ADS-B apps. Recently they stopped all air traffic and their 'bird control vehicles' formed sort of a path for a Lifeline helicopter. I don't know how often that happens, but I felt pretty good about catching it live. Hope the patient is well.
My other favorite is tracking USAF tanker aircraft, because they regularly use our VOR as an anchor point. That distinct rumbling of jet engines in the distance is just awesome.
After this talk I really want to set up my own antenna and see what kind of fun I could have with it (without risking jail of course).
i love how he calculates dipol length :) He goes "I want to listen to the 2m wavelength" and so ge goes on with this 468/ freq etc etc and ends up calculating that the half wavelength of 2m is 1m so you should have 0.5 - 0.5m ends :)
I'm so so so amazed. That satellite imagery blew my mind up. Definitely gonna try this. Thanks for sharing!! Awesome 👏👏👏😍
what a perfect delivery of knowledge :O
engaging, full of information and not a single dull moment - kudos to Gerard the Jong.. hope you use those skills to teach :D
Thank you for this. I am still very new with software defined radio, and there were quite a few things that he explained in ways that finally made it click for me.
This was an awesome talk. Would love to know when the next one will be.
Nice try FBI
bsidescapetown.co.za/bsides-2021-conf/
@@BSidesCapeTown thank you!
73 to your dad's memory! I likely have spoken to him. Ham (and prof radio systems engr) here and enjoyed your talk. Kudu's from me. Best wishes WA2KBZ.
Haha awesome talk. I wish I could be that funny and informative at the same time on my next tech talk.
i usually hate this kind of video, but maybe because i have interest in the topic, so that makes me watch this video, and i think i love this video. Thank you !
Awesome talk, also he entertained us so that we won't feel bored, thanks
Such an awesome tech talk! It takes a lot of skill to cram so much info into a presentation while keeping it so engaging. Gotta see if I can find more of his talks.
Just getting into SDR and wanted to say this guy was very engaging. Ta for the upload!
Ridiculously good. CZcams gold. Thank you sir.
Super nice overview. i will show this talk to people i want to get into sdr.
Love your talk, so interesting, very well spoken. Didn’t fall asleep once 😂
Super awesome 👍👍👍
I'm software guy
This was line made
frequency connect 😂😂😂
Really very interesting
CZcams should award for this stuff
For those curious about where he got the visual of the ATC at 22:09 that is the android game called Endless ATC.
Not all squawk codes starting with 7 are bad.
There are three which indicate an issue.
7500 - Unlawful interference with the safe conduct of the flight (hijack)
7600 - Radio problems.
7700 - General emergency.
In the UK (and some other places), 7000 is the general VFR conspicuity squawk. If, for example, I am talking to Scottish Information and they have given me 7401 (which is usual for Scottish information) and I want to change to the frequency of my destination airport, I will be told to “squawk conspicuity and freecall xxxx” (where xxxx is the destination airport). At that point, I will change my squawk code to 7000 (as I am flying VFR) and change the radio to the frequency of my destination airport.
Squawk codes are changed en-route and not always assigned prior to takeoff. I will generally depart my home airport on 7000, change to Scottish Information where I will usually be given 7401. If, during my journey, I want to transit Edinburgh’s controlled airspace, I will change to Edinburgh Radar’s frequency and will be given a different squawk code (usually 043… something - they have a bank of squawk codes that they issue, starting at 0430). After completing my transit I will return to Scottish Information and will be told to squawk 7401 again.
This guy’s knowledge of transponders is somewhat faulty, but that can be forgiven as he’s not involved in the world of aviation.
Seven six - I hear nix
Seven five - Man with knife
Seven Seven - Way to heaven
@@BackSledge_Berlin - The mnemonics I use are:
75 - Taken alive
76 - My mic sticks
77 - Going to heaven
... use whatever works for you, of course - nothing wrong with remembering several mnemonics as long as they are all consistent in their meanings.
Great info, I learned a lot in a short amount of time.
I had one of these in 1999 then a C-Pen. I used both of them with Psion 5 to capture abstracts of scientific pages for my studies. There was a LOT of manual corrections required.
Alot of useful simple clear informations in this video
Good stuff, learned a lot really quickly
Love it. Brilliant speaker.
Super cool! I appreciate you sharing
Good talk, very much enjoyed
This was very informative, thank you.
This was an excellent presentation. I did like the question about QO-100. Hope Gerard is QRV on the bird after getting his license :)
Probably the second most amazing thing given to the amateur community after spectrum.
Very well done talk. Thanks.
Even 3 years ago, the USB SDR dongles were under $50USD. In 2023, they're now about $15USD. Slightly more for some versions. Paired with a $10 Pi Zero 2W and a cheap USB port adapter and a whole SDR kit that fits in your pocket is under $30USD.
Very Informative Thank You Sir
Erg leuk en interessant Gerard!
Awesome talk, thank you :)
21:11 The aircraft knows where it is at all times. It knows this because it knows where is isn't.
By subtracting where it is from where it isn't, or where it isn't from where it is (whichever is greater), it obtains a difference, or deviation. The guidance subsystem uses deviations to generate corrective commands to maneuver the aircraft from a position where it is to a position where it isn't, and arriving at a position where it wasn't, it now is. Consequently, the position where it is, is now the position that it wasn't, and it follows that the position that it was, is now the position that it isn't.
Ayy where this is from I forgot lmao is this from bonsian ape society
@@prakharmishra3000 search for "Missile Guidance for Dummies"
thoroughly based
Great vid, but at 15:18 shouldn't one of the vectors be the magnetic component of the EM wave?
Good video.
Small point, the SI unit prefix for kilo, the 10 to the 3rd power multiplier is a lower case 'k', not an upper case 'K' as was used in a few places. This is commonly mixed up by laypersons and engineers as well, but since he mentioned the SI and therefore has some familiarity with it, I figured that was worth pointing out.
22:00 a small mistake Sqwack codes are Status Codes among those the very important Emergency codes. All the ADB-s transponders have Unique Identifiers that are linked to each individual transponder and obviously airplane. Those are the codes that will show up on the ADB-S monitors, not sqwack codes. I mean sqwack codes can also be shown ... but the ADB-S identifiers are unique and Not attributed by Air Traffic control.
Commercial pilot here, this isn't actually true. Well, what you say is correct about ADS-B having unique identifiers, it also has a programmable callsign if you want. But squawk codes are still used and assigned by ATC. There are 4 "special" codes, which are 1200 (all VFR aircraft not currently talking to ATC), 7600 (a status code indicating the aircraft has had a radio failure), 7700 (a status code indicating the aircraft is experiencing a general emergency) and of course 7500 (a status code indicating the aircraft is being hijacked.)
Honestly, I am not sure WHY ATC still assigns discrete codes to aircraft, especially since there are not that many numbers available (only 8*8*8*8) when the transponder (which ALL are supposed to have ADS-B output by now) also transmit the unique identifier and callsign, but it is probably just for backwards compatiality or something.
Basically, what I am saying is everytime I talk to ATC for the first time either getting a clearance on the ground if I am IFR or in the air if I am VFR they still give me a discrete code I am to squawk.
@@SpiraSpiraSpira - from what you’ve said, i suspect that you fly in the USA and rarely outside of the States (and almost certainly not VFR in the UK).
In the UK (and, as far as I understand, some other places, too) the VFR conspicuity squawk is 7000, not 1200. It’s 1200 in the States but that is not true of all countries.
The unique number you mention is the aircraft’s ICAO identifier. This number is programmed into the transponder at installation and also programmed into any additional electronic conspicuity equipment which may be fitted or carried on-board (ADS-B or otherwise).
ADS-B is not mandatory for non-commercial aircraft (actually, nor are transponders). I understand that the US has made it mandatory to have ADS-B Out to enter certain classes of airspace but again, this is not the case in other parts of the world.
From what I understand, in the UK, our ATC don’t even see ADS-B (apart from one in the North of Scotland - Aberdeen, I think it is).
Squawk codes tell “ATC” who is working any particular aircraft. So, if I am approaching Edinburgh’s CTR and their display shows that I am squawking 7401, then they know that I am talking to Scottish Information. If 7000, that I am essentially talking to no-one. If I am squawking a code beginning with 043, then I am talking to Edinburgh (they have a bank of codes that they issue to VFR traffic, starting from 0430). It is certainly not the case that every aircraft is given a discrete code which pertains only to that aircraft for the duration but, as you say, they are four-digit octal codes.
@@halfrhovsquared The unique identifier in ADS-B is not the aircraft ICAO identifier, it is a globally unique identifier assigned to the particular ADS-B transceiver/transponder assigned at manufacture. The ICAO identifier is programmed in and can be changed by the operator/pilot in configuration settings. And yes, I was discussing from a US perspective as it is mandatory here. I have flown globally, including being one of only a few foreign pilots to land in the so-called Democratic People’s Republic of Korea when I was working for a company chartered by the UN, but these days I do most of my flying in the USA. But I have flown in and out of the EU and the UK, but only on US registered aircraft. I have a Mexican pilot’s certificate (Capitana de metroliner dos), my primary US certificate as well as one from the People’s Republic of China as I worked there as a contract pilot also.
that said, I have never once flew VFR anywhere except the USA.
@@SpiraSpiraSpira - Ah. I wasn’t aware that ADS-B kit had its own unique identifier. When I added EC to my aircraft, I had to program in my aircraft’s ICAO identifier. Thanks for that info.
Is ADS-B Out mandatory for non-commercial aircraft in Class G airspace in the USA? I thought they’d only made it mandatory for Classes C, B, and A.
To be honest, given that there are some fairly effective Electronic Conspicuity units available on the market at very reasonable prices, I’m somewhat in favour of it being mandatory in the UK. The CAA have been offering rebates to pilots who fit Mode S transponders and other EC kit to their aircraft (half the cost up to £250) to encourage uptake. It’s made a huge difference and has really increased the number of GA aircraft with EC but there are still far too many out there running Mode C at best.
I’ve had it confirmed (twice) that my EC is seen by TCAS - That’s fairly reassuring because what I fly is a tiny rotorcraft which is next to invisible unless in very close proximity.
@@halfrhovsquared It is not mandatory in uncontrolled airspace, it isn’t even required in class E airspace unless you’re above 10,000ft MSL. But it is required in A, B, C and I think even in D airspace now, although I’m not 100% on that. If you have an old supercub or something in a uncontrolled field you could still fly it VFR with an old transponder but you can’t take it in or near any large airport in the USA. Even the old transponders work with TCAS as I have had a TCAS II resolution advisory when flying in an airliner versus a Cessna years ago before ADS-B came out.
I’m not sure if the US government offered any kind of incentives on changing out transponders. My guess based on how well (or rather how poorly) the US government functions is no, though.
Best RX amplifier will be GaAsFET devices. Old versions that have a good noise figure, is the MGF-1302, single gate device, easy to design with.
Single power supply.
What an informative video🔥
nice stuff, didn't know RPI can tx
I didn't know it either until I saw a video of null byte hijacking radio stations with it XD
Ancient book I read said to reduce the dipole antenna length by 5% to deal with capacitive coupling to the air.
Good to know! Thanks!
Fantastic talk.
I have done this kind of all experiements to find something (from last 2016 to 2020) looks interesting to match to produce 5g collaboration nodes...still practical
Great talk !!! very helpful
maybe you could write some shell scripts to automate the process of recording signals and processing. maybe possible to do it in real-time?
Awesome talk!
where did you get the dip switch from?
Good work man ..
Thanks for sharing
Great manual on how to get behind bars
Nice talk!
With more and more MLAT systems, spoofing ADS-B is getting harder ;)
Not that much harder.. those systems are still behind current security by a decade
@@campandcook3118 Of course, Mode A/C was invented very long ago and it is still used in some transponders. Security/encryption is no part of this. They still struggle to have new aircrafts equiped with proper Mode S Transponders...
But MLAT can check if a Mode S (Ads-b) signal is actually send form where it claims to be.
@@madmushroom8639 MLAT has 6-10s latency and can barely check that for a normal amount of signals, it's often only used near airports and needs 4-6 stations to receive the same ADSB packet - which means 200W beaches on the largest aircraft. Even then, it can only check if a packet was sent from within a few hundred meters up to a km2.
With a higher amount of contacts, MLAT latency would be over 15s or higher, sooner or later, disabling that system. If an ADSB ID is cloned to a nearby position, the system can't really Check which packet is valid. Especially not for smaller planes. And it's unable to deal with the amount of bout, because sending enough ADSB packets, takes 2-3s, about 5-10times less than invalidating them.
A system with authentification for the sender is needed to work reliably.
@@campandcook3118 Don't know why it would take 6-10 seconds. For Ads-B systems eurocontrol specifies the max allowed latency of an ASTERIX output to air traffic controllers as 1,5 seconds.
For anti spoofing you could receive the adsb signal at lets say 2 ground stations (at the speed of light) and can do a quick sanity check of the intersections of the hyperboloids of the TDOAs. Of course it depends on the geometry set be the positions of the ground stations and the accuracy of the clock synchronization.
Thank you!
This is well delivered. And this man knows how keep his audience interested and let's face it with the way our world is today this information is a valuable asset to your bug out kit if ever needed I totally enjoyed learning from this video everyone enjoy and be thankful for the information he has given us its very possible we might need this within the next few years. Peace to everyone stay healthy and stay smart folks
I have a SDR Play RSP DX, Works much better than the Cheap Chinese Made SDR Dongles! I'm also a Licensed Ham Radio Operaters to, I have a Yeasu FT817 it's a whole Ham Radio Shack because it have HF, VHF, and UHF, All modes, I use SDR Angel Software and SDR Uno for My SDR Play RSP DX!
sdr is really cheap nowdays. you can get started for under $50 or 75 bucks. interesting vid on some things you can get in to (incl trouble lol) using these devices
How can CB radio or Ham radio communication be achieved with SDR and a laptop?
Is this presentation in Africa? Because the currency is in ZAR.
edit: nvm i did a dumb yes it's in africa i just can't read for some reason.
protect your ears at @38:45, great talk tho. Still trying to figure out antenna design...
thanks
Very interesting video, I’m a NASA engineering consultant and currently working on JPSS2 (which will eventually be NOAA-21) as well as J-3 and J-4.
No you're not. You work at Family Motors selling cars.
Very Cool!
2019: "Next year at DefCon :D"
Anybody know what mouse/presentation device he's using?
Great vid
Transponder code 7000 is no emergency code, it is a general VFR code around here.
You normally set squawk to 7000 before atc has given you a squawk code to enter into your transponder
Seen that done that in the 80's
What are rands? I know bucks are antelopes, Excellent video but its hard to get a handle on the prices from here in Europe.😂
Lovely talk thanks. Now if only we can get hold of these SDR's in SA.. :( no one has stock..
Same here in India, I tried ebay but the transactions won't go through, even with an international credit card and paypal :(
ZA
Hello sir
i need to get GSM voice and location track i have rtl sdr
nice one
can we listen pulsars? or any special "universe transponder"?
with a SDR you can tune to the hydrogen line frequency as SETI did
i love how my next recommendation is dont talk to cops like the universe is cheering me on
A lot of people have dishes on their roofs. Can you get into their networks through them?
Cool!
man, it is the best thing I have seen in a while. I will try to hack a satellite
This is absolutely true the reason why CZcams was created for.
To everyone who loved this video, submit your own talks. Open globally with live streaming to Cape Town & youtube. Otherwise come and join us for an amazing event: bsidescapetown.co.za/bsides-2021-conf/call-for-papers-2021/
would you be kind enough to share the data of signal frequencies at 8 mins approx?
Not sure if right place to ask. I seen these USB SDR with few small antennas. Think they only receive. Not able to broadcast. Must one have an license to buy one ? Wanna use for generic radio listen and maybe weather channels and astronomy. I have no need to be able to speak 2way like a normal 2way radio.
For most countries you dont need a license for just listening.
Even if you do needed a license to listen, how will they ever find out?
How did I end up on this watch list?
9:47 *Raspberry Pi TX pin is GPIO 4 Pin 7 (Not GPIO 7).*
I recommend watching this at 3/4 speed if you're not South African or Kiwi.
I think the Waterfall is called a "Spectrum Analyzer" In audio production, but this is Audio Reading, of Radio bands, so I guess it's now a waterfall! lol.
It's called "waterfall" because of the way it looks on your screen while it's displaying the scan. Really just a catchy slang term.
Not quite. A waterfall is ONE way of displaying the output from a spectrum analyser. A spectrum analyser can display output in many different formats. I have one on my desk at work at the moment and if you were to see the plot on the screen, you’d probably not recognise it as a spectrum analyser because it is displaying a constellation plot of a QAM signal and it looks nothing like the typical displays most people think of when they discuss spectrum analysers.
KA9UCE. 144.200/144.250, 432.100 USB, 146.52/550 FM.
SSB IS QRP.
FM UP TO 50 WATTS.
Dell P991 on 1:51, nice
Good video on not how to present any information, but good that you addressed that. You knew what you did wrong throwing a presentation together. you might need to stick to presenting anything on stuff you actually can.
Mrs Richards: "I paid for a room with a view !"
Basil: (pointing to the lovely view) "That is Torquay, Madam."
Mrs Richards: "It's not good enough!"
Basil: "May I ask what you were expecting to see out of a Torquay hotel bedroom window? Sydney Opera House, perhaps? the Hanging Gardens of Babylon? Herds of wildebeest sweeping majestically past?..."
Mrs Richards: "Don't be silly! I expect to be able to see the sea!"
Basil: "You can see the sea, it's over there between the land and the sky."
Mrs Richards: "I'm not satisfied. But I shall stay. But I expect a reduction."
Basil: "Why?! Because Krakatoa's not erupting at the moment?
Hertz doesn't have an 's' in the name, and isn't the only SI derived unit to use s^-1
So much signal processing, but need to put a compressor on your audio to bring down that dynamic range haha
You can do that yourself as well.
This guy and squawk codes. Not all 7xxx codes are special but many are. The ones that all pilots pretty much all know about are 7500 (hijacked) 7600 (lost comms) and 7700 (emergency).
Also the transponders send altitude information. ADS-B is nice but ATC uses secondary radar (transponder interrogation of aircraft giving squawk code and altitude) along with primary radar (radar reflection which gives position only)
Hacking? Or just receiving information from satellite?
Robert you didn't show it hooked up to the antenna. Your point about atmospheric energy was not shown experimentally in the video. A little disappointed.
Windows? Apple? What a hacker (:
Take note that APPLE is a CORPORATION
and Apple is a fruit/
You are totally confused and do not yet know the difference.
CORPORATE names are always ALL CAPS for a specific reason
that is beyond your level of knowledge and understanding.
Thou does not even know the difference between ON and on
So go and take a look at what is written on SWITCHES, and be
sure to have both eyes open.
Yes
@ 17:26 There is always a correction to the length of the antenna of approx 3 %
is that what the audience said?
@@tljstewart That is what he was getting at. The 3% correction is specific to copper. What you are correcting for is the speed of light through the antenna material (normally copper). The correction is called the velocity factor. This is also important with different types of coax (even from different manufactures) as the velocity factor of a specific coax is highly dependent on its construction. The velocity factor for different coax types ranges from around 0.60 to 0.95-ish. This is a large range!
Here is the wiki on it. Sorry if you already knew all of this.
en.wikipedia.org/wiki/Velocity_factor
@@joboring8397 ah, very nice Jo, thank you for the info, your comment was very helpful. What I’ve realized from your comment by example; for an antenna receiving 433MHz, 1/2 lambda would give us a 34.6cm antenna. However, to account for the velocity factor of an unshielded copper wire we must use something like 34.6cm*0.97. Which gives us an antenna length of ~33.6cm.
@@tljstewart You are very welcome. I am glad that you found my comment helpful!
@@joboring8397 Man thank you for this clarification and REAL CLARIFICATION... I am new to RF and that was an awesome info to dig for more info! Thank you! For real