BSIDES CPT 2019 - Hacking satellites with Software Defined Radio (SDR) - Gerard de Jong
ฝัง
- เผยแพร่เมื่อ 20 พ.ค. 2024
- Title: Hacking satellites with Software Defined Radio (SDR)
Abstract:
In this no holds barred down introduction to Software Defined Radio (SDR) you’ll learn how you can write software to hack remote control security gates, track ships at sea, code your own aircraft radar, and ultimately how to download data directly from various satellites in low earth orbit with nothing more than a cheap USB dongle and a makeshift antenna.
Speaker: Gerard de Jong
Twitter: @GDdeJong
Speaker Bio:
Software developer and consultant with over a decade’s experience building information systems. Holds a Master’s Degree in IT from the University of Pretoria and is a member of Mensa. Speaker at software development conferences such DevConf, Java Africa, LinuxConf[ZA] etc. - วิทยาศาสตร์และเทคโนโลยี
![[TH] 2024 PMSL SEA W2D5 | Summer | วันอาทิตย์ จะขิตหรือจะรอด!](http://i.ytimg.com/vi/-4JLNwQRK-Y/mqdefault.jpg)
One of the most engaging talks on a tech subject ive come across in a while. Awesome! Thanks for sharing. Rekindled my love for radio electronics..techlove to you Gerard!
Glad you liked it.
I'll say it here because pretty sure most of this crowd would agree: This is what TH-cam was designed for. Man what a video!
Totally agree
Well said
That was many things...literally the definition of cool !!!
Is this illegal though?
@@chobai9996 shhhh 🤣😂😁
What a great delivery, not a single boring moment. Hope this man never gets corrupted by Powerpoint.
tons of blablabla and lame jokes for very little information
We glad you like it. Its a great talk that touches on many points. Gives people something to think about.
Such a smooth and well put talk: Even a beginner like me was able to follow it, and never felt it was too fast or too slow - rather it was spot on. Many thanks for all your time and hard work.
it‘s only for beginners. for everyone else is just a lot of hot steam for very little information
42:45 that qualifying statement for a speaking event in March 2020 was more warranted than we knew
Engaging and illuminates one of the things I think most surprised me when I started getting into sdr -- Just how much "secret" information is buzzing about us at all times. Such a fun way to interact with our world. Thanks!
I'm so so so amazed. That satellite imagery blew my mind up. Definitely gonna try this. Thanks for sharing!! Awesome 👏👏👏😍
Thank you for this. I am still very new with software defined radio, and there were quite a few things that he explained in ways that finally made it click for me.
what a perfect delivery of knowledge :O
engaging, full of information and not a single dull moment - kudos to Gerard the Jong.. hope you use those skills to teach :D
Awesome talk, also he entertained us so that we won't feel bored, thanks
That airport was Amsterdam Schiphol, hence all the KLM flights coming in for rwy 06. You could see the VOR beacon SPL (at Schiphol Airport) en the VOR PAM (Pampus at the south shore of the IJ-meer lake, named after the small island Pampus in the same lake). Nice to see the NOAA and Meteor satellites are still transmitting on 137 MHz in analog APT mode. Years ago I received them with a kit build receiver and a pc with special interface modem, and I could see the image build line by line while receiving. The Russian Meteors had better quality images. But both have a digital mode now on a higher frequency I think somewhere around 1600 MHz. You need a dish that can follow the sats in azimuth and elevation.
1700. i built my own tracker with NEMA 23 motors and some 3d printed gears. the great thing with SDR is that you can easily receive this. Also GOES if you're in the americas.
I love observing EHAM, because their ground vehicles also show up on popular ADS-B apps. Recently they stopped all air traffic and their 'bird control vehicles' formed sort of a path for a Lifeline helicopter. I don't know how often that happens, but I felt pretty good about catching it live. Hope the patient is well.
My other favorite is tracking USAF tanker aircraft, because they regularly use our VOR as an anchor point. That distinct rumbling of jet engines in the distance is just awesome.
After this talk I really want to set up my own antenna and see what kind of fun I could have with it (without risking jail of course).
@35:00, the correct frequency to listen to for amateur radio communications via the ISS you want to tune to 437.800 MHz for the downlink, the 2M 145.800 is the uplink and you will only hear those amateurs nearby you within line of sight reception.
Just getting into SDR and wanted to say this guy was very engaging. Ta for the upload!
This was an awesome talk. Would love to know when the next one will be.
Nice try FBI
bsidescapetown.co.za/bsides-2021-conf/
@@BSidesCapeTown thank you!
Ridiculously good. TH-cam gold. Thank you sir.
Such an awesome tech talk! It takes a lot of skill to cram so much info into a presentation while keeping it so engaging. Gotta see if I can find more of his talks.
i usually hate this kind of video, but maybe because i have interest in the topic, so that makes me watch this video, and i think i love this video. Thank you !
Love it. Brilliant speaker.
Super nice overview. i will show this talk to people i want to get into sdr.
Haha awesome talk. I wish I could be that funny and informative at the same time on my next tech talk.
i love how he calculates dipol length :) He goes "I want to listen to the 2m wavelength" and so ge goes on with this 468/ freq etc etc and ends up calculating that the half wavelength of 2m is 1m so you should have 0.5 - 0.5m ends :)
Great info, I learned a lot in a short amount of time.
Super awesome 👍👍👍
I'm software guy
This was line made
frequency connect 😂😂😂
Really very interesting
TH-cam should award for this stuff
73 to your dad's memory! I likely have spoken to him. Ham (and prof radio systems engr) here and enjoyed your talk. Kudu's from me. Best wishes WA2KBZ.
Erg leuk en interessant Gerard!
Not all squawk codes starting with 7 are bad.
There are three which indicate an issue.
7500 - Unlawful interference with the safe conduct of the flight (hijack)
7600 - Radio problems.
7700 - General emergency.
In the UK (and some other places), 7000 is the general VFR conspicuity squawk. If, for example, I am talking to Scottish Information and they have given me 7401 (which is usual for Scottish information) and I want to change to the frequency of my destination airport, I will be told to “squawk conspicuity and freecall xxxx” (where xxxx is the destination airport). At that point, I will change my squawk code to 7000 (as I am flying VFR) and change the radio to the frequency of my destination airport.
Squawk codes are changed en-route and not always assigned prior to takeoff. I will generally depart my home airport on 7000, change to Scottish Information where I will usually be given 7401. If, during my journey, I want to transit Edinburgh’s controlled airspace, I will change to Edinburgh Radar’s frequency and will be given a different squawk code (usually 043… something - they have a bank of squawk codes that they issue, starting at 0430). After completing my transit I will return to Scottish Information and will be told to squawk 7401 again.
This guy’s knowledge of transponders is somewhat faulty, but that can be forgiven as he’s not involved in the world of aviation.
Seven six - I hear nix
Seven five - Man with knife
Seven Seven - Way to heaven
@@BackSledge_Berlin - The mnemonics I use are:
75 - Taken alive
76 - My mic sticks
77 - Going to heaven
... use whatever works for you, of course - nothing wrong with remembering several mnemonics as long as they are all consistent in their meanings.
This was very informative, thank you.
Love your talk, so interesting, very well spoken. Didn’t fall asleep once 😂
Very well done talk. Thanks.
Good stuff, learned a lot really quickly
Alot of useful simple clear informations in this video
What an informative video🔥
Good talk, very much enjoyed
Good work man ..
Very Informative Thank You Sir
Great talk !!! very helpful
Fantastic talk.
Very Cool!
Super cool! I appreciate you sharing
Best RX amplifier will be GaAsFET devices. Old versions that have a good noise figure, is the MGF-1302, single gate device, easy to design with.
Single power supply.
Thanks for sharing
Awesome talk, thank you :)
I had one of these in 1999 then a C-Pen. I used both of them with Psion 5 to capture abstracts of scientific pages for my studies. There was a LOT of manual corrections required.
Awesome talk!
This was an excellent presentation. I did like the question about QO-100. Hope Gerard is QRV on the bird after getting his license :)
Probably the second most amazing thing given to the amateur community after spectrum.
Even 3 years ago, the USB SDR dongles were under $50USD. In 2023, they're now about $15USD. Slightly more for some versions. Paired with a $10 Pi Zero 2W and a cheap USB port adapter and a whole SDR kit that fits in your pocket is under $30USD.
For those curious about where he got the visual of the ATC at 22:09 that is the android game called Endless ATC.
Great vid, but at 15:18 shouldn't one of the vectors be the magnetic component of the EM wave?
Thank you!
Good video.
Small point, the SI unit prefix for kilo, the 10 to the 3rd power multiplier is a lower case 'k', not an upper case 'K' as was used in a few places. This is commonly mixed up by laypersons and engineers as well, but since he mentioned the SI and therefore has some familiarity with it, I figured that was worth pointing out.
maybe you could write some shell scripts to automate the process of recording signals and processing. maybe possible to do it in real-time?
22:00 a small mistake Sqwack codes are Status Codes among those the very important Emergency codes. All the ADB-s transponders have Unique Identifiers that are linked to each individual transponder and obviously airplane. Those are the codes that will show up on the ADB-S monitors, not sqwack codes. I mean sqwack codes can also be shown ... but the ADB-S identifiers are unique and Not attributed by Air Traffic control.
Commercial pilot here, this isn't actually true. Well, what you say is correct about ADS-B having unique identifiers, it also has a programmable callsign if you want. But squawk codes are still used and assigned by ATC. There are 4 "special" codes, which are 1200 (all VFR aircraft not currently talking to ATC), 7600 (a status code indicating the aircraft has had a radio failure), 7700 (a status code indicating the aircraft is experiencing a general emergency) and of course 7500 (a status code indicating the aircraft is being hijacked.)
Honestly, I am not sure WHY ATC still assigns discrete codes to aircraft, especially since there are not that many numbers available (only 8*8*8*8) when the transponder (which ALL are supposed to have ADS-B output by now) also transmit the unique identifier and callsign, but it is probably just for backwards compatiality or something.
Basically, what I am saying is everytime I talk to ATC for the first time either getting a clearance on the ground if I am IFR or in the air if I am VFR they still give me a discrete code I am to squawk.
@@SpiraSpiraSpira - from what you’ve said, i suspect that you fly in the USA and rarely outside of the States (and almost certainly not VFR in the UK).
In the UK (and, as far as I understand, some other places, too) the VFR conspicuity squawk is 7000, not 1200. It’s 1200 in the States but that is not true of all countries.
The unique number you mention is the aircraft’s ICAO identifier. This number is programmed into the transponder at installation and also programmed into any additional electronic conspicuity equipment which may be fitted or carried on-board (ADS-B or otherwise).
ADS-B is not mandatory for non-commercial aircraft (actually, nor are transponders). I understand that the US has made it mandatory to have ADS-B Out to enter certain classes of airspace but again, this is not the case in other parts of the world.
From what I understand, in the UK, our ATC don’t even see ADS-B (apart from one in the North of Scotland - Aberdeen, I think it is).
Squawk codes tell “ATC” who is working any particular aircraft. So, if I am approaching Edinburgh’s CTR and their display shows that I am squawking 7401, then they know that I am talking to Scottish Information. If 7000, that I am essentially talking to no-one. If I am squawking a code beginning with 043, then I am talking to Edinburgh (they have a bank of codes that they issue to VFR traffic, starting from 0430). It is certainly not the case that every aircraft is given a discrete code which pertains only to that aircraft for the duration but, as you say, they are four-digit octal codes.
@@halfrhovsquared The unique identifier in ADS-B is not the aircraft ICAO identifier, it is a globally unique identifier assigned to the particular ADS-B transceiver/transponder assigned at manufacture. The ICAO identifier is programmed in and can be changed by the operator/pilot in configuration settings. And yes, I was discussing from a US perspective as it is mandatory here. I have flown globally, including being one of only a few foreign pilots to land in the so-called Democratic People’s Republic of Korea when I was working for a company chartered by the UN, but these days I do most of my flying in the USA. But I have flown in and out of the EU and the UK, but only on US registered aircraft. I have a Mexican pilot’s certificate (Capitana de metroliner dos), my primary US certificate as well as one from the People’s Republic of China as I worked there as a contract pilot also.
that said, I have never once flew VFR anywhere except the USA.
@@SpiraSpiraSpira - Ah. I wasn’t aware that ADS-B kit had its own unique identifier. When I added EC to my aircraft, I had to program in my aircraft’s ICAO identifier. Thanks for that info.
Is ADS-B Out mandatory for non-commercial aircraft in Class G airspace in the USA? I thought they’d only made it mandatory for Classes C, B, and A.
To be honest, given that there are some fairly effective Electronic Conspicuity units available on the market at very reasonable prices, I’m somewhat in favour of it being mandatory in the UK. The CAA have been offering rebates to pilots who fit Mode S transponders and other EC kit to their aircraft (half the cost up to £250) to encourage uptake. It’s made a huge difference and has really increased the number of GA aircraft with EC but there are still far too many out there running Mode C at best.
I’ve had it confirmed (twice) that my EC is seen by TCAS - That’s fairly reassuring because what I fly is a tiny rotorcraft which is next to invisible unless in very close proximity.
@@halfrhovsquared It is not mandatory in uncontrolled airspace, it isn’t even required in class E airspace unless you’re above 10,000ft MSL. But it is required in A, B, C and I think even in D airspace now, although I’m not 100% on that. If you have an old supercub or something in a uncontrolled field you could still fly it VFR with an old transponder but you can’t take it in or near any large airport in the USA. Even the old transponders work with TCAS as I have had a TCAS II resolution advisory when flying in an airliner versus a Cessna years ago before ADS-B came out.
I’m not sure if the US government offered any kind of incentives on changing out transponders. My guess based on how well (or rather how poorly) the US government functions is no, though.
sdr is really cheap nowdays. you can get started for under $50 or 75 bucks. interesting vid on some things you can get in to (incl trouble lol) using these devices
nice stuff, didn't know RPI can tx
I didn't know it either until I saw a video of null byte hijacking radio stations with it XD
Ancient book I read said to reduce the dipole antenna length by 5% to deal with capacitive coupling to the air.
Good to know! Thanks!
Great vid
This is well delivered. And this man knows how keep his audience interested and let's face it with the way our world is today this information is a valuable asset to your bug out kit if ever needed I totally enjoyed learning from this video everyone enjoy and be thankful for the information he has given us its very possible we might need this within the next few years. Peace to everyone stay healthy and stay smart folks
nice one
21:11 The aircraft knows where it is at all times. It knows this because it knows where is isn't.
By subtracting where it is from where it isn't, or where it isn't from where it is (whichever is greater), it obtains a difference, or deviation. The guidance subsystem uses deviations to generate corrective commands to maneuver the aircraft from a position where it is to a position where it isn't, and arriving at a position where it wasn't, it now is. Consequently, the position where it is, is now the position that it wasn't, and it follows that the position that it was, is now the position that it isn't.
Ayy where this is from I forgot lmao is this from bonsian ape society
@@prakharmishra3000 search for "Missile Guidance for Dummies"
thoroughly based
I have a SDR Play RSP DX, Works much better than the Cheap Chinese Made SDR Dongles! I'm also a Licensed Ham Radio Operaters to, I have a Yeasu FT817 it's a whole Ham Radio Shack because it have HF, VHF, and UHF, All modes, I use SDR Angel Software and SDR Uno for My SDR Play RSP DX!
I have done this kind of all experiements to find something (from last 2016 to 2020) looks interesting to match to produce 5g collaboration nodes...still practical
Nice talk!
With more and more MLAT systems, spoofing ADS-B is getting harder ;)
Not that much harder.. those systems are still behind current security by a decade
@@campandcook3118 Of course, Mode A/C was invented very long ago and it is still used in some transponders. Security/encryption is no part of this. They still struggle to have new aircrafts equiped with proper Mode S Transponders...
But MLAT can check if a Mode S (Ads-b) signal is actually send form where it claims to be.
@@madmushroom8639 MLAT has 6-10s latency and can barely check that for a normal amount of signals, it's often only used near airports and needs 4-6 stations to receive the same ADSB packet - which means 200W beaches on the largest aircraft. Even then, it can only check if a packet was sent from within a few hundred meters up to a km2.
With a higher amount of contacts, MLAT latency would be over 15s or higher, sooner or later, disabling that system. If an ADSB ID is cloned to a nearby position, the system can't really Check which packet is valid. Especially not for smaller planes. And it's unable to deal with the amount of bout, because sending enough ADSB packets, takes 2-3s, about 5-10times less than invalidating them.
A system with authentification for the sender is needed to work reliably.
@@campandcook3118 Don't know why it would take 6-10 seconds. For Ads-B systems eurocontrol specifies the max allowed latency of an ASTERIX output to air traffic controllers as 1,5 seconds.
For anti spoofing you could receive the adsb signal at lets say 2 ground stations (at the speed of light) and can do a quick sanity check of the intersections of the hyperboloids of the TDOAs. Of course it depends on the geometry set be the positions of the ground stations and the accuracy of the clock synchronization.
Transponder code 7000 is no emergency code, it is a general VFR code around here.
How can CB radio or Ham radio communication be achieved with SDR and a laptop?
Cool!
man, it is the best thing I have seen in a while. I will try to hack a satellite
where did you get the dip switch from?
KA9UCE. 144.200/144.250, 432.100 USB, 146.52/550 FM.
SSB IS QRP.
FM UP TO 50 WATTS.
What are rands? I know bucks are antelopes, Excellent video but its hard to get a handle on the prices from here in Europe.😂
I recommend watching this at 3/4 speed if you're not South African or Kiwi.
Seen that done that in the 80's
Is this presentation in Africa? Because the currency is in ZAR.
edit: nvm i did a dumb yes it's in africa i just can't read for some reason.
Very interesting video, I’m a NASA engineering consultant and currently working on JPSS2 (which will eventually be NOAA-21) as well as J-3 and J-4.
No you're not. You work at Family Motors selling cars.
9:47 *Raspberry Pi TX pin is GPIO 4 Pin 7 (Not GPIO 7).*
You normally set squawk to 7000 before atc has given you a squawk code to enter into your transponder
"hacking" not really mate, continuous unencrypted transmission.
2019: "Next year at DefCon :D"
Anybody know what mouse/presentation device he's using?
Robert you didn't show it hooked up to the antenna. Your point about atmospheric energy was not shown experimentally in the video. A little disappointed.
Great manual on how to get behind bars
Neat
Hello sir
i need to get GSM voice and location track i have rtl sdr
protect your ears at @38:45, great talk tho. Still trying to figure out antenna design...
thanks
I want a radio receiver like RTL, with the difference that the range is up to 6 GHz. Thank you, if you know a device, let me know.
I want to emphasize that I want a device that is only a receiver. I don't want a device like HackRF with both transmitter and receiver.
Hertz doesn't have an 's' in the name, and isn't the only SI derived unit to use s^-1
Lovely talk thanks. Now if only we can get hold of these SDR's in SA.. :( no one has stock..
Same here in India, I tried ebay but the transactions won't go through, even with an international credit card and paypal :(
ZA
Mrs Richards: "I paid for a room with a view !"
Basil: (pointing to the lovely view) "That is Torquay, Madam."
Mrs Richards: "It's not good enough!"
Basil: "May I ask what you were expecting to see out of a Torquay hotel bedroom window? Sydney Opera House, perhaps? the Hanging Gardens of Babylon? Herds of wildebeest sweeping majestically past?..."
Mrs Richards: "Don't be silly! I expect to be able to see the sea!"
Basil: "You can see the sea, it's over there between the land and the sky."
Mrs Richards: "I'm not satisfied. But I shall stay. But I expect a reduction."
Basil: "Why?! Because Krakatoa's not erupting at the moment?
Can someone give an idea on how to transfer text from one place to another using satellite communication. For my Engineering project anyone got a thing?
A lot of people have dishes on their roofs. Can you get into their networks through them?
Good video on not how to present any information, but good that you addressed that. You knew what you did wrong throwing a presentation together. you might need to stick to presenting anything on stuff you actually can.
To everyone who loved this video, submit your own talks. Open globally with live streaming to Cape Town & youtube. Otherwise come and join us for an amazing event: bsidescapetown.co.za/bsides-2021-conf/call-for-papers-2021/
would you be kind enough to share the data of signal frequencies at 8 mins approx?
HOWZIT Very Interesting
Not sure if right place to ask. I seen these USB SDR with few small antennas. Think they only receive. Not able to broadcast. Must one have an license to buy one ? Wanna use for generic radio listen and maybe weather channels and astronomy. I have no need to be able to speak 2way like a normal 2way radio.
For most countries you dont need a license for just listening.
Even if you do needed a license to listen, how will they ever find out?
can we listen pulsars? or any special "universe transponder"?
with a SDR you can tune to the hydrogen line frequency as SETI did
Yes
This is absolutely true the reason why TH-cam was created for.
I can you help me install I new to this I used to work in sound software years ago . Can you help me setup a rtl-sdr v3 I have a old windows 7 labtop I bought the kit from Amazon with the ants I am also super excited about learning how to make cooler stuff with a raspberry I do you have any tips or advice it would be greatly appreciated I can do a zoom message call or whatever s more helpful. Man I m a big fan I listen to you videos on TH-cam I got a lot of respect you have a cool ability to speak you would most definitely be as I tell my friends the top interesting people to hangout with for a day. If you have the chance time it would be cool to meet you . Either way man please keep doing more videos and audio casts !
Chris
How did I end up on this watch list?
It seems like the fake ADSB broadcast problem could be solved if a unique time limited code was appended. Similar to how one time passwords and authenticator apps work. If the unit is registered or the secret key is issued by an airport prior to take off, it could help determine the legitimacy of the broadcast. The only issue it the requirement of legacy support. Otherwise it's a good reason not to completely get rid of conventional radar from airports.
Lekker