1 00:00:06,580 --> 00:00:09,500 Welcome to Software Defined Radios for Aerospace Cyber. 2 00:00:09,500 --> 00:00:16,360 This is an introductory talk that will get you going with learning about radio frequencies and the use of SDRs. 3 00:00:20,960 --> 00:00:27,820 Software Defined Radios are relatively inexpensive and a great way to learn about the radio frequency world and data communications. 4 00:00:28,040 --> 00:00:31,400 In a short period, you can be receiving signals from aircraft. 5 00:00:31,400 --> 00:00:35,780 And with a little bit more work, you can be receiving signals from satellites as well. 6 00:00:38,480 --> 00:00:45,620 We want to thank our sponsors, Capital Technology University, APS Global LLC, and the Maser Makerspace. 7 00:00:45,620 --> 00:00:53,960 We want to give a special shout out to Dan Allen, who engineered and built the badges, and Steve Lozinski, who brought all this together. 8 00:00:54,140 --> 00:01:03,980 Our students Zach, Charisse, and Ryan, who helped with the video, and especially everyone who bought a badge to support the village and our project. 9 00:01:07,230 --> 00:01:08,230 What you'll learn. 10 00:01:08,230 --> 00:01:10,170 The basics of how to use an SDR. 11 00:01:10,170 --> 00:01:14,610 Basic radio frequency concepts include frequency, bandwidth, and modulation. 12 00:01:14,610 --> 00:01:19,450 And how an SDR converts millions of samples per second into binary data. 13 00:01:19,830 --> 00:01:30,530 Software Defined Radios are connected to antennas that collect raw, analog, RF information, and then decode them into binary data that your computer can use. 14 00:01:32,210 --> 00:01:36,070 Explore the RF spectrum with your Aerospace Village badge. 15 00:01:36,070 --> 00:01:44,170 The badge has an integrated dipole antenna tuned to 1090 MHz, which is the frequency used by ADS-B. 16 00:01:44,170 --> 00:01:55,490 In addition, the badge has two terminal blocks connected to the SMA connector, which can be used to connect custom-cut wire lengths tuned to the frequency of interest. 17 00:01:56,210 --> 00:02:06,650 Connect the wires and the correct SMA to your SDR, or connect to the other SMA and use the integrated ADS-B antenna, and you're ready to go. 18 00:02:07,590 --> 00:02:10,250 This is a lot of fun and very straightforward. 19 00:02:10,250 --> 00:02:15,190 You already understand how to install software packages and connect devices to your USB board. 20 00:02:15,250 --> 00:02:26,470 Once you learn the fundamentals of RF communications, you'll be able to look at a number of digital signals, understand their protocols, and figure out any vulnerabilities which need to be patched. 21 00:02:26,470 --> 00:02:33,390 It's a lot of fun, and all you need is an SDR, some free software, and a couple pieces of wire to get started. 22 00:02:36,540 --> 00:02:39,340 You're going to be using the SDR Sharp program. 23 00:02:39,340 --> 00:02:40,660 It's free. 24 00:02:40,660 --> 00:02:44,740 You plug in your SDR into the USB port. 25 00:02:44,740 --> 00:02:52,260 Start up SDR Sharp, push the play button at the upper left, and you can start listening to radio signals and analyzing them immediately. 26 00:02:55,430 --> 00:03:00,830 This slide shows some of the terms and how you use the SDR Sharp program. 27 00:03:00,830 --> 00:03:03,270 There's a play button that starts receiving. 28 00:03:03,330 --> 00:03:11,270 You put in the frequency of the signal you're looking for, and you can push on the top of a number to go up and the bottom of a number to go down in frequency. 29 00:03:11,470 --> 00:03:22,970 The display shows the strength of the signals by frequency at this moment, and underneath is a waterfall which shows the strength and frequency over time. 30 00:03:22,970 --> 00:03:32,290 On the left side, you've got something called modulation, which is the mathematical operations needed to extract information from the signal, and the bandwidth. 31 00:03:32,530 --> 00:03:35,550 On the next screen, we'll be showing a live FM signal. 32 00:03:35,550 --> 00:03:40,010 Please pay attention to how the different graphs move over time. 33 00:03:40,010 --> 00:03:42,510 That will give you an idea of how the signal is being processed. 34 00:04:25,380 --> 00:04:33,800 By watching how the sound moves, how the signal strength grows and decreases over time, it gives you an idea of what's happening with the signal. 35 00:04:33,800 --> 00:04:38,360 Now on our next slide, you're going to hear a digital signal and see it in operation. 36 00:04:38,580 --> 00:04:40,480 You can't decode it with the human ear. 37 00:04:40,480 --> 00:04:41,680 You need a computer for this. 38 00:04:41,680 --> 00:04:45,920 You'll notice the digital signals have a distinctive sound. 39 00:05:12,260 --> 00:05:15,480 ACARS is essentially text messaging for airplanes. 40 00:05:15,760 --> 00:05:19,880 It's a very simple format, uses a few VHF frequencies. 41 00:05:20,260 --> 00:05:22,580 It's vulnerable to spoofing. 42 00:05:22,620 --> 00:05:27,140 There's no independent authentication such as a digital signature on them. 43 00:05:27,140 --> 00:05:36,060 The software is pretty easy to use and the messages can be dumped into a HEX format so you can examine the protocols and even build your own compliant messages. 44 00:05:36,060 --> 00:05:40,900 Here are a couple of ACARS messages. 45 00:05:40,900 --> 00:05:46,340 You can see the type of aircraft, the flight number if it's available, and other information. 46 00:05:46,360 --> 00:05:59,380 These messages can be passed through a further layer of decoding so you can see the contents such as temperature, flight level, fuel remaining, number of passengers, etc. 47 00:06:00,200 --> 00:06:06,640 You can dump this into text and you can do even further examination on it. 48 00:06:07,260 --> 00:06:11,280 ACARS is pretty cool. 49 00:06:11,280 --> 00:06:15,060 It uses a channel normally meant for voice communications to send data. 50 00:06:15,660 --> 00:06:20,020 If you see the tall peak at the center, that's the carrier on an AM signal. 51 00:06:20,020 --> 00:06:26,040 And they use a device much like a modem used for an old school telephone line to convert digital data to tones. 52 00:06:26,040 --> 00:06:28,380 Those are the smaller peaks you see off to the side. 53 00:06:28,380 --> 00:06:34,180 Then at the other end, those peaks and those tones are converted back into digital data. 54 00:06:41,530 --> 00:06:43,990 ADS-B is very serious business. 55 00:06:43,990 --> 00:06:46,450 It's used to manage the airspace. 56 00:06:46,450 --> 00:06:53,270 It shows the direction, altitude, speed, and other information needed to keep the airways safe. 57 00:06:53,270 --> 00:06:56,130 There's very little verification of these signals. 58 00:06:56,130 --> 00:06:58,430 They're vulnerable to spoofing and other attacks. 59 00:06:58,730 --> 00:07:03,830 And we need more cyber professionals looking at this to provide the security it deserves. 60 00:07:09,650 --> 00:07:12,530 Here is the virtual radar software. 61 00:07:12,530 --> 00:07:19,270 This takes the ADS-B output and plots on a map so you can see where aircraft are in relation to you and to each other. 62 00:07:19,270 --> 00:07:24,390 There's a lot of information that can be expanded by clicking on a particular aircraft. 63 00:07:24,390 --> 00:07:27,450 If you're connected to the internet, you can even bring back pictures. 64 00:07:27,710 --> 00:07:32,070 Note that ADS-B is susceptible to spoofing and packet forgery. 65 00:07:32,670 --> 00:07:35,590 It's an area where there's a lot more research needed. 66 00:07:39,960 --> 00:07:43,060 Dump 1090 provides a neat textual output. 67 00:07:43,060 --> 00:07:47,160 It's cool to watch the aircraft as they move, as they climb, as they descend. 68 00:07:47,160 --> 00:07:50,320 You can also dump data in a hex format. 69 00:07:50,320 --> 00:07:55,060 Now you can look at the protocol and even try and spoof it by building your own packets. 70 00:08:02,820 --> 00:08:09,100 Using your badge or other simple antenna, you can download signals directly from satellites right to your PC. 71 00:08:09,760 --> 00:08:13,860 You'll have to check the schedule and see what time they're going to pass overhead. 72 00:08:13,880 --> 00:08:20,200 Get your antenna outside with no obstructions, and you have a good chance of receiving a great map from a satellite. 73 00:08:23,820 --> 00:08:28,220 And here's a NOAA weather image which we downloaded just last week. 74 00:08:28,220 --> 00:08:30,020 You can see the Great Lakes in the image. 75 00:08:30,020 --> 00:08:31,340 You can see cloud cover. 76 00:08:31,340 --> 00:08:32,420 It's pretty cool. 77 00:08:32,420 --> 00:08:36,700 If we'd gotten a picture from this week, you could have seen the hurricane coming up the coast. 78 00:08:40,880 --> 00:08:43,040 This is really interesting. 79 00:08:43,040 --> 00:08:47,940 The satellite is 500 miles above the earth, and yet you're able to receive a picture from it. 80 00:08:47,940 --> 00:08:49,980 You see they've got a number of different peaks. 81 00:08:49,980 --> 00:08:51,780 Those are different signals it's using. 82 00:08:51,780 --> 00:08:56,440 Each one works together with the others to send lots of data in a very short time. 83 00:08:56,440 --> 00:08:58,480 That's why the signal is so wide. 84 00:09:02,710 --> 00:09:07,050 Software-defined radios are like the Kali Linux of the radio frequency world. 85 00:09:07,070 --> 00:09:13,190 If there's a signal you want to look at, if it's in wide use, the odds are someone's built a decoder so you can examine it. 86 00:09:13,590 --> 00:09:16,710 Now, you see a picture of a 50-ohm resistor. 87 00:09:16,710 --> 00:09:17,910 That's a dummy load. 88 00:09:17,910 --> 00:09:27,090 If you do decide to transmit, that'll keep the signal from going more than a few inches or a few feet, so you can safely look at protocols and hack signals. 89 00:09:31,900 --> 00:09:35,440 We've been talking about SDR receivers. 90 00:09:35,600 --> 00:09:37,560 The HackRF1 is a transceiver. 91 00:09:37,560 --> 00:09:41,060 It transmits and receives from 0 to 6 gigahertz. 92 00:09:41,060 --> 00:09:45,960 That's way above even 5 gigahertz Wi-Fi. 93 00:09:46,560 --> 00:09:48,280 Now, you have to be very careful. 94 00:09:48,280 --> 00:09:53,580 There are legal ramifications for transmitting in a way that would interfere with other signals. 95 00:09:53,580 --> 00:10:03,580 The HackRF1 is great for research, transmitting things like key fobs, experimenting in a confined area where you know the signal isn't going to get out. 96 00:10:03,720 --> 00:10:07,920 Now, if there's concerns about the signal escaping, on the right is what's called a dummy load. 97 00:10:07,920 --> 00:10:16,300 It's a 50-ohm resistor that absorbs the energy and keeps it from making it out into the world where it could interfere with things. 98 00:10:16,380 --> 00:10:18,740 There are also a number of types of antennas you can get. 99 00:10:18,740 --> 00:10:20,240 I'm a directional. 100 00:10:20,240 --> 00:10:21,960 They're like a table lamp. 101 00:10:21,960 --> 00:10:27,240 Others are unidirectional or directional, which means they're like a flashlight. 102 00:10:31,780 --> 00:10:40,340 There are all sorts of signals you can look at with standard Linux tools for examining protocols, for examining hex and binary data. 103 00:10:40,340 --> 00:10:42,500 For example, you've got command links to drones. 104 00:10:42,500 --> 00:10:45,440 You've got the key fob that opens the doors in your car. 105 00:10:45,440 --> 00:10:49,240 Please remember, if you transmit, be very careful. 106 00:10:49,240 --> 00:10:52,040 It's dangerous and illegal to interfere with other people. 107 00:10:52,180 --> 00:10:57,840 Stay safe and learn the xxd and od commands if you haven't already started working with binary. 108 00:11:02,220 --> 00:11:14,300 If you're really excited about this, there are small packs you can put around a HackRF, which will allow you to listen to everything from your electric meter transmitting to boats and cars sending information. 109 00:11:14,580 --> 00:11:17,260 Once again, this is a really cool tool for research. 110 00:11:17,260 --> 00:11:18,860 Just be smart while you use it. 111 00:11:20,980 --> 00:11:21,580 Thank you. 112 00:11:21,580 --> 00:11:23,840 If you'd love to know more, please reach out. 113 00:11:23,840 --> 00:11:28,620 We'd like nothing more than to see you win next year when it comes to the Hack the Satellite competition. 114 00:11:28,620 --> 00:11:33,660 Now, you're going to learn how to set up and install the apps with Zach, Charisse, and Ryan. 115 00:11:36,220 --> 00:11:38,280 Hi, I'm Zachary Klein. 116 00:11:38,280 --> 00:11:41,240 I'm a student at the University of Maryland College Park. 117 00:11:41,300 --> 00:11:46,120 Hi, I'm Carrie Houston, and I'm a student at Tableau Technology University in Oro, Maryland. 118 00:11:46,120 --> 00:11:59,000 So now that we have established our antenna and our SDR, we now, in order to actually view those signals and decode them, we need to get a program for that. 119 00:11:59,000 --> 00:12:02,240 So we're going to install something called SDR-Sharp. 120 00:12:02,240 --> 00:12:09,820 So on the AirSpy website, we're going to install what's called the Windows SDR software package. 121 00:12:09,820 --> 00:12:17,140 So once we have that downloaded, we'll have a zip file which we will extract. 122 00:12:20,750 --> 00:12:28,570 And so, for the initial installation, we will run the install RTL SDR batch file. 123 00:12:29,030 --> 00:12:33,630 And this will handle some of the primary drivers that we'll need. 124 00:12:40,380 --> 00:12:50,800 Once that's taken care of, we're going to go at the bottom of this list and look for something called Zodeg.exe. 125 00:12:52,420 --> 00:12:56,680 And this will provide some drivers for our SDR device. 126 00:12:57,360 --> 00:13:11,220 So in order to find it, we'll go under options, list all devices, and we're going to look for the device once we have plugged in our SDR. 127 00:13:11,560 --> 00:13:21,100 So we're going to look for either something that says Bulk Interface Interface 0, or maybe something that says RTL 2832. 128 00:13:22,580 --> 00:13:33,620 Once we have that selected, we're going to make sure that we have a USB ID of 0BDA283800. 129 00:13:34,220 --> 00:13:39,480 From there, we'll select WinUSB, and we will replace the driver. 130 00:13:40,000 --> 00:13:42,880 Since we've already done this, it says Reinstall Driver. 131 00:13:47,020 --> 00:13:51,140 Now with this handle, we have SDRSharp installed. 132 00:13:54,580 --> 00:13:58,300 Now that you have the software downloaded, it's time to use it. 133 00:13:58,300 --> 00:14:02,440 The first thing that you're going to want to do is you're going to want to check the source. 134 00:14:02,820 --> 00:14:08,880 So in the drop-down, you want to make sure that you have the RTL-SDR USB and not the TCP. 135 00:14:09,180 --> 00:14:19,520 The next thing is you're going to press play, and from there you should see the FM broadcast that your SDR is picking up. 136 00:14:20,250 --> 00:14:31,350 In order to see the signal better, you can turn up the RF gauge. 137 00:14:31,350 --> 00:14:37,290 You want to slowly do that until you see it peak a little bit more. 138 00:14:46,660 --> 00:14:53,920 If you see here, this is your waterfall that you can see over time as the signal is picked up. 139 00:14:56,740 --> 00:15:00,800 And if you see the whiff here, that is considered your bandwidth. 140 00:15:01,540 --> 00:15:07,560 So now we're going to tune in to a different signal, and this time it's going to be the NOAA's weather station. 141 00:15:39,490 --> 00:15:43,410 Zoomed out now so you can see different signals that are being picked up. 142 00:15:45,950 --> 00:15:55,150 Now that we've looked at radio stations and other types of signals that can be easily found with an SDRSharp, we're going to look at another easy signal, ADS-B. 143 00:15:55,150 --> 00:16:03,310 This is typically used to either prevent airplanes from collisions and other relevant data for air traffic. 144 00:16:04,630 --> 00:16:13,590 So first we're going to install a program called Dump 1090, and this program is available on pbworks.com. 145 00:16:14,250 --> 00:16:19,630 So once we have that installed, we'll get a zip file and we'll extract that. 146 00:16:26,430 --> 00:16:31,070 And there the first thing that we will run is the Dump 1090 batch. 147 00:16:31,470 --> 00:16:44,250 If you have any trouble with it, or if your computer says that you have multiple devices, you can add a parameter that will allow you to select that device. 148 00:16:45,850 --> 00:16:47,730 Device index. 149 00:17:00,080 --> 00:17:07,870 Upon launching, we'll see a terminal window which will display any currently received air traffic. 150 00:17:08,140 --> 00:17:12,360 Since we're indoors, we're not likely to receive very many signals. 151 00:17:14,420 --> 00:17:24,560 Additionally, if we do receive signals, we can use what's called a virtual radar server to produce a map of these recorded air traffic. 152 00:17:25,600 --> 00:17:30,000 So we've shifted so that we moved our antenna outside to receive more signals. 153 00:17:30,320 --> 00:17:36,200 And if you can see on our screen here, we've got three different aircraft that we are currently tracking. 154 00:17:43,940 --> 00:17:50,880 Alright, using Dump 1090, we're able to see different types of information regarding air traffic. 155 00:17:50,880 --> 00:18:01,420 For example, we can see the flight number, as well as the altitude, the speed of the aircraft, the heading number, as well as longitude and latitude. 156 00:18:05,300 --> 00:18:10,880 Using virtual radar, we can get the same information displayed on a graphical interface. 157 00:18:23,340 --> 00:18:26,780 The next signal we'll be looking at is ACARS. 158 00:18:26,780 --> 00:18:30,680 ACARS is essentially messages between the ground and aircraft. 159 00:18:31,740 --> 00:18:39,380 So what we'll be using to decode ACARS signals is called ACARS Deco2. 160 00:18:39,380 --> 00:18:45,460 And once you install the zip, there will be a batch file. 161 00:18:46,260 --> 00:18:48,800 And in here, there are a couple of arguments. 162 00:18:48,800 --> 00:18:56,320 You can put up with three arguments for different frequencies that the program will look for ACARS signals. 163 00:18:56,700 --> 00:19:05,360 Prior to actually running this, you may have to use SDRSharp to find any active ACARS signals in your area. 164 00:19:05,360 --> 00:19:21,240 Since we've already done that previously, we're going to run the program, and we should eventually receive ACARS signals. 165 00:19:25,900 --> 00:19:29,720 Here are some examples of previous signals we've recorded. 166 00:19:38,150 --> 00:19:45,230 Capturing NOAA weather satellite images can be rewarding, but they require more pre-planning in order to get good results. 167 00:19:45,230 --> 00:19:54,850 All that's needed is SDRSharp and an APT decoder, which stands for Automatic Picture Transmission, the type of signal that we're seeking. 168 00:19:56,470 --> 00:20:01,190 In preparing SDRSharp for capture, we're going to need to change a few of the settings. 169 00:20:03,150 --> 00:20:11,970 Clicking the cog wheel up at the top, we're going to select the sample rate that allows us to cleanly hear an FM station without any sort of stuttering. 170 00:20:15,370 --> 00:20:18,970 Then, in the radio tab, we're going to select Wide FM. 171 00:20:19,350 --> 00:20:25,390 And then, for the bandwidth, we're going to set it to somewhere between 36 and 50 kHz. 172 00:20:25,390 --> 00:20:29,190 And this is only to account for Doppler shifting of the signal. 173 00:20:30,450 --> 00:20:36,170 In the recording tab, we're going to check audio and uncheck bass band. 174 00:20:36,350 --> 00:20:39,170 And the record button is here when we are ready. 175 00:20:39,970 --> 00:20:48,890 Additionally, we can also use the audio noise reduction and IF noise reduction tabs if we have a very noisy signal. 176 00:20:49,110 --> 00:20:53,930 In terms of physical preparations, we're going to need to do a weather check first. 177 00:20:54,210 --> 00:20:57,670 Clouds or rain are going to significantly affect our reception. 178 00:20:58,150 --> 00:21:04,890 We're also going to want to elevate ourselves, be outside, and be distant from any sort of tall obstructions. 179 00:21:04,890 --> 00:21:06,610 An open field is ideal. 180 00:21:06,610 --> 00:21:12,450 In terms of an antenna, the signal is right-hand circular polarized. 181 00:21:13,150 --> 00:21:15,330 So helical antennas are wonderful. 182 00:21:15,470 --> 00:21:22,810 However, there is quite a bit of success to be had in just a very simple horizontal half-wavelength dipole. 183 00:21:23,370 --> 00:21:27,850 A V-dipole oriented north-south works really well, and it's what we use. 184 00:21:32,600 --> 00:21:39,400 Before going out and recording APT signals, we need to know when a satellite is actually passing overhead. 185 00:21:40,500 --> 00:21:47,720 Signals can only be received from when the satellite rises over the horizon to when it drops just below the horizon. 186 00:21:48,240 --> 00:21:54,860 I'm using n2yo.com in order to provide these time estimations of when we acquire the signal. 187 00:21:55,500 --> 00:21:59,300 We also want to check and see what the max elevation is. 188 00:21:59,440 --> 00:22:08,380 While about 30 degrees is ideal, we've had successful images received at about 15 degrees minimum. 189 00:22:12,920 --> 00:22:17,600 For reference, here's a sample of an ideal APT signal. 190 00:22:17,840 --> 00:22:26,300 On the right is a screenshot of what the signal would look like in SDRSharp, and I'm now going to play an audio byte of the signal. 191 00:22:35,310 --> 00:22:42,330 Once we have our recording complete, SDRSharp will save the recordings in the respective extracted folder. 192 00:22:42,710 --> 00:22:46,010 I'm using the decoder straight forward from here. 193 00:22:46,010 --> 00:22:49,350 So we select our file, decode. 194 00:22:49,670 --> 00:23:01,490 We can add some post-decode processing, such as placing land and country borders, and then saving the image from here. 195 00:23:04,250 --> 00:23:14,650 We can improve the weather images that we capture by either constructing an improved antenna, such as a QFH or a double-cross dipole antenna. 196 00:23:14,650 --> 00:23:18,430 You could also use a low-noise amplifier as well. 197 00:23:19,270 --> 00:23:25,410 And since we're recording a WAV file, you can also use audio editing in order to reduce the noise. 198 00:23:26,230 --> 00:23:28,970 Thanks for the opportunity to present this information. 199 00:23:29,010 --> 00:23:30,790 Is there anything else you'd like to see? 200 00:23:30,790 --> 00:23:34,290 As you play with it, you'll learn more and you'll have more questions. 201 00:23:34,290 --> 00:23:36,250 Please feel free to reach out to us. 202 00:23:36,250 --> 00:23:40,030 We'd love to go ahead and provide more videos and more demonstrations for you.