Category: SDR

drwxr participa do I Security Weekend na FATEC Ourinhos

No dia 08 de Abril 2017 tivemos a honra de participar do I Security Weekend realizado na FATEC em Ourinhos/SP, uma das melhores faculdades públicas do Brasil (veja aqui).

Após contato via oficina de SDR no Roadsec 2016 com os alunos da instituição, recebemos convite do Prof. Paulo Galego e assim pudemos conversar com os alunos de Graduação e Pós Graduação em Desenvolvimento de Sistemas e Segurança da Informação.


Neste encontro, com a palestra “Contexto de Segurança em SDR e Internet das Coisas”, foi apresentado o contexto de Internet das Coisas (Internet of Things – IoT) e os desafios que o aumento dos dispositivos conectados estão impondo para questões de segurança.

Complementando o cenário de IoT, foi apresentado os conceitos de Software Defined Radio (SDR) sendo apresentado como uma ferramenta no processo de avaliação de segurança para dispositivos que conversam via radiofrequência, vindo de encontro com o cenário de expansão das tecnologias e dispositivos IoT.

Nota-se que a evolução do profissional de Segurança da Informação requer que ele conheça as possíveis vulnerabilidades que podem surgir com novos produtos conectados e assim terem subsídios para futuras avaliações em que sejam envolvidos ou então durante a fase de desenvolvimento, conhecendo os riscos que o “sistema conectado” pode estar sujeito caso não considerem aspectos de segurança durante o desenvolvimento.

Vale notar que desde 2013 o Kali Linux inclui entre suas ferramentas as ferramentas relacionadas a Software Defined Radio (SDR). [Veja aqui]

Até a próxima!

Tags : , , ,

Instalar e usar o RTL-SDR no Windows

Para uso do RTL-SDR no Windows, recomendamos o uso de um pacote SDR disponibilizado pela Airspy (clique aqui)

RTL-SDR no Windows

Neste post estamos usando o “SDR Software Package” que inclui:
– SDR# rev 1500
– Airspy Calibration Tool
– ADSB Spy rev 37 (Decodificador de sinais ADSB)
– Spectrum Spy (Analisador de Espectro)
– Astro.Spy – Utilitário para astronomia

Se desejar, baixe aqui: sdrsharp-x86

Ao descompactar o arquivo sdrsharp-x86.zip, deve-se estar conectado na internet e executar o seguinte arquivo (install-rtlsdr.bat):

Install RTL-SDR batch

Este arquivo irá se conectar ao servidor da OSMOCOM e baixar o driver para o RTL-SDR e também fará o download do Zadig, responsável por instalar o driver do RTL-SDR.
* Neste instante, plugue seu dongle do RTL-SDR e não instale nada que o Windows venha a propor de forma automática.

Na pasta criada a partir do sdrsharp-x86.zip, execute o arquivo zadig.exe como administrador:

Zadig as Admin
Dentro do Zadig, selecione no menu Options > List All Devices de forma a deixar a opção selecionada:
Zadig All Devices
Conforme exemplo acima, ele já encontrou 6 dispositivos (vide barra inferior).
* Neste caso, o Zadig já encontrou o driver referente ao RTL-SDR, na figura abaixo como “RTL2838UHIDIR”, no entanto, conforme Quick Start Guide usado de referência, pode ser o caso que o driver não faça referência direta ao RTL e pode aparecer algo como “Bulk-In, Interface (Interface 0)”.

Garanta que a seta esteja apontando para WinUSB e clique em “Replace Driver”

Zadig Replace DriverZadig Driver Installed
Em seguida podemos verificar (na pasta criada a partir do sdrsharp-x86.zip) os seguintes aplicativos já mencionados:
SDR Apps
Execute o SDRSharp.exe e já defina como “Source” o RTL-SDR (USB):
SDR# Source
Em seguida clique em “Play” e o SDR# já irá iniciar a captura:
SDR# Capture
* Importante! Lembrar de ajustar o ganho RF. Um ganho de “zero” só irá captar sinais muito forte por isso é necessário ajustar o ganho até aparecer o sinal desejado (no exemplo acima nenhum sinal está sendo captado). Para ajustar o ganho, clique em configurações e em seguida ajuste o “RF Gain”:

SDR# Configure drwxr
drwxr SDR# Running

A partir de agora, seu RTL-SDR está configurado no Windows! Agora é procurar projetos para praticar e começar a fuçar com o RTL-SDR.
Qualquer dúvida, use o espaço de perguntas ou entre em contato.
* Post elaborado usando o Windows 10

Tags : , , , ,

Oficina de radiofrequência – Roadsec SP 2016

O Roadsec é um evento itinerante que percorre diversos estados brasileiros levando uma mistura única de palestras, atividades e campeonatos, integrando estudantes, profissionais e comunidades em torno da celebração da cultura hacker em todas as suas vertentes: segurança, desenvolvimento, makers e ativistas.

Esse giro acaba em São Paulo num dos maiores festivais do gênero no planeta, misturando conhecimento, atividades, cultura, gastronomia, música e muito networking com a nata do hacking brasileiro!

 

O drwxr irá ministrar oficinas durante todo o dia explicando o conceito da radiofrequência e realizando “hands on” para explicar a utilização do rtl-sdr na prática.

Também serão abordados softwares utilizados para realizar capturas, análises e ads-b decoder.

drwxr oficina sdr

(Folder – oficina de SDR)

Para realizar o download da apostila que iremos abordar na oficina (Introdução ao RTL-SDR e Radiofrequência) no Roadsec SP, clique no link abaixo:

Apostila

Para maiores informações do evento: Roadsec-SP

 

Tags : , , , , , , , ,

Installing RTL-SDR (RTL2832U) driver

This content is a piece of our initiative to explain how to start your studies with RTL-SDR.

In this post we’ll explain about how to install the rtl-sdr driver.

To install the RTL-SDR device on a Linux computer is relatively quick and easy.

These instructions are designed to run on Linux distributions based on Debian or Ubuntu.

 

Installing the drivers:

1. Open the terminal and make sure you are in the home directory.

 

2. Update your Linux distribution:

sudo apt-get update

 

3. Install the necessary tools such as: git, cmake, build-essential

sudo apt-get install git

sudo apt-get install cmake

sudo apt-get install build-essential

 

4. Install the library called “libusb-1.0-0-dev” which provides access to USB devices.

sudo apt-get install libusb-1.0-0-dev

 

5. Download and install the RTL2832U from vendor site:

git clone git://git.osmocom.org/rtl-sdr.git

cd rtl-sdr/

mkdir build

cd build

cmake ../ -DINSTALL_UDEV_RULES=ON

make

sudo make install

sudo ldconfig

sudo cp ../rtl-sdr.rules /etc/udev/rules.d/

 

6. Create a “blacklist” to the default driver which loads automatically using the RTL-SDR device as a TV receiver, because this isn’t the functionality we want to use (tv receiver).

A. Access as administrator the directory: /etc/modprobe.d

B. Create a new file called “blacklist-rtl.conf” and add the following line in the file:

blacklist dvb_usb_rtl28xxu

blacklist rtl2832

blacklist rtl2830

C. Save the file and reboot the machine.

 

7. After reboot the machine, test if the device is actually running. To test type the follow command in the terminal:

rtl_test -t

 

drwxr - rtl-sdr driver, radio

(rtl_test -t, command)

 

Don’t worry with the follow messages:

“PLL not locked”

“No E4000 tuner found, aborting”.

If you see these messages above it is a sign that your driver and your device is working properly and you are ready to install some applications like GQRX, Dump1090, CubicSDR and others…

 

Tags : , , , , ,

FM transmitter through a Raspberry pi

In this post we’ll turn the Raspberry Pi into an FM transmitter in a few steps.

ATTENTION: remember that in some countries the radio transmissions of any kind are subject to federal laws and regulations.

This is a simple and very interesting article.

 

To turn your raspberry pi in FM transmitter we will use the rpitx of F5OEO (https://github.com/F5OEO/rpitx) , rpitx is a radio transmitter for Raspberry Pi (B, B+, PI2, PI3 and PI zero) that transmits RF directly to GPIO. It can handle frequencies from 5 KHz up to 500 MHz.

 

For installing do the following:

git clone https://github.com/F5OEO/rpitx

cd ./rpitx

sudo ./install.sh

The install script (install.sh) will download and install all the needed dependencies. This takes a while.

 

We gonna  connect a ~20cm or so plain wire to GPIO 18 (which is pin 12 on header P2) to act as an antenna, and tune an FM radio.

The optimal length of the wire depends the frequency you will want to transmit.

GPIO pins (General Purpose Input/Output) are ports (pins) programmable that can be used to input and/or output data. They are mainly used to communicate with external devices like microcontroller or microprocessor.

 

drwxr,GPIO, raspberrypi

(GPIO Raspberry pi)

 

2-raspberrypi

(Raspberry pi with antenna)

In this article we going to transmit FM, so we gonna use the pifm.

Pifm converts an audio file (Wav, 48KHz, 1 channel, pcm_s16le codec) to Narrow band FM (12.5khz excursion) and outputs it to a .ft file. Assuming your audio file is in your current working directory.

./pifm gunsnroses.wav fm.ft

Then after execute the command that created the fm.ft, lets execute the command bellow that will transmit the audio at 92.0MHz (you can change).

sudo ./rpitx -m RF -i fm.ft -f 92000 -l

Video:

 

Tags : , , , , , , , ,

Automatic Dependent Surveillance-Broadcast – ADS-B (Part I)

This content is a piece of our initiative to study security in aviation. All experiences and content developed by us will be available here on right moment. To start, we will understand a little about ADS-B.

ADS-B is one of technologies from NextGen Platform (Next Generation Air Transportation). NextGen is a initiative from FAA (Federal Aviation Administration) for enhance the current Air Traffic Control. The proposal promises a great operational gains, security and financial support for the entire chain of stakeholders involved in air transportation.

ADS-B technology is responsible for communication between aircrafts and between aircraft and air traffic control. This technology has been widely used in aircrafts and it will be mandatory adoption in the coming years (from 2020 US / Europe 2017).

This is a cooperative surveillance technology for tracking aircraft. Each aircraft determine your position via GPS. Every aircraft equipped with ADS-B will periodically send your location information, speed, altitude, identification and other details to ground stations and others aircrafts also equipped with ADS-B present in that area.

This technology will replace the radar as the primary method of surveillance to detect the position of aircraft worldwide.

Supposedly the ADS-B technology should increase safety in aviation by making visible aircraft in real time, exchanging information such as position and velocity, transmitted every second, but the current technology of ADS-B make use of broadcast transmission, in clear text ( without encryption or other security measures) using radio frequency (1090MHz – Modulation PPM).

ADS-B technology consists of two different systems that are ADS-B In and Out.

 

ADS-B Out

It is the basic level of ADS-B functionality. It’s basically all communication that is issued by the ADS-B aircraft.

 

ADS-B IN

The information reported by ADS-B Out (other aircraft) will be received by aircraft equipped with ADS-B In system. This functionality is intended to alert the crew about the traffic around you.

 

Understood the basics, let’s look under security optical…

First, we have the situation where the plane is sending uncontrolled information concerning that flight. This set of information is sent in broadcast, or for everyone. It does not require authentication and is not made any kind of control of the recipient and sender.

The signal sent by the ADS-B uses the 1090MHz frequency modulation Digital Pulse Position modulation (PPM) and Manchester code where a ZERO bit is encoded 01 and the ONE bit is encoded 10.

 

An ADS-B message contains 112 bits, for example:

Example message in BINARY format:

10001101010010000100000011010110001000000010110011000011
01110001110000110010110011100000010101110110000010011000

 

The same example in HEX format:

8D4840D6202CC371C32CE0576098

 

The table below shows the bit organization of the message.

drwxr radio ads-b format

(img from: http://adsb-decode-guide.readthedocs.io/)

 

In a future opportunity we will detail every message part….

So far we understood that ADS-B from every airplane will be emitting the bit sequence shown above approximately 2 times per second.

Sites like FlightRadar and FlightAware uses radio receivers around the world, collaboratively, to capture the ADS-B information of the aircrafts and centered in a friendly way on the map showing the vast majority of flights flown in the world.

 

Illustrating how the tracking sites of ADS-B aircraft:

drwxr radio ads-b flow

(Flight radar flow)

 

The ADS-B waveform can be observed in following images:

drwxr radio ads-b waveform

(Waveform ADS-B OUT and Transmit Channel)

 

drwxr radio ads-b waveform decoded

(Waveforms of decoded block).

This is the first content, introduction to ADS-B technology. In the next content we will discuss more about the decoding and show how you can capture the information of the aircraft in its viewing area. Only after that we can have a view of the risks of ADS-B technology…

Think how dangerous a Replay Attack could be in aviation scenario.

to be continued…

Tags : , , , , , , , ,

Replay Attack – Doorbell

Recently I bought a low cost wireless doorbell so I decided to analyze the RF communication and reproduce a replay attack.

To accomplish the attack I used an Ettus USRP2 N210 SDR (Software Defined Radio), a Voye wireless doorbell and GNU Radio.

The replay attack (also called as playback attack) is simple and very interesting attack, it works by simply recording a signal and then rebroadcasting it once it used a “fix code” signal to activate the doorbell.

(Ettus USRP2 N210 SDR (Software Defined Radio)

Voye DoorBell

(Voye wireless doorbell)

GNU Radio

GNU Radio Companion (GRC) is a graphical tool for creating signal flow graphs and generating flow-graph source code.

More info: http://gnuradio.org/redmine/projects/gnuradio/wiki/GNURadioCompanion

 

Identifying the signal

Usually doorbells operates at frequencies of 433Mhz (Europe) or 315Mhz (America), it was first noticed the frequency of 433Mhz in order to get signal but nothing was found. Analyzing the 315MHz frequency we found the signal from the doorbell transmitter.

We used GQRX to clearly identify the frequency:

GQRX

(GQRX – identify the frequency)

Capturing the signal

We recorded the signal from the doorbell transmitter in GNU Radio into a RAW file.

We’re using 2e6 (2M) as Sample Rate and this value should be used in every step.

GnuRadio-Receive

(flow-graph capturing the signal)

 

Opening this up in AUDACITY we can see groups of pulses making up a single button press and we can identify this is a OOK (On-Off Keying) Signal.

Audacity1

(Audacity – Raw File)

On zooming in to a button press, we can see these button presses are made up of similar looking groups.

Audacity2

(Audacity – Raw File – Zoom in)

 

Isolating the signal

Now we are going to export this slice of signal (4 sequences):

Audacity3

(Audacity – Isolating the signal)

Notice that we’ve exported 4 sequences because the receiver has a error rate and it needs to receive more than 1 package of bits.

We gonna export using the following configuration:

Audacity4

(Audacity – Export Configuration)

Transmitting the signal

Finally, the last step was to create a flow graph to transmit the raw signal isolated.

GnuRadio2

(flow-graph transmitting the signal)

After executing the doorbell will ring…

Video of replay attack:

 

 

Tags : , , , , , , , , ,