Welcome to Software Defined Radios for Aerospace Cyber.
This is an introductory talk that will get you going with learning about radio frequencies and the use of SDRs.
Software Defined Radios are relatively inexpensive and a great way to learn about the radio frequency world and data communications.
In a short period, you can be receiving signals from aircraft.
And with a little bit more work, you can be receiving signals from satellites as well.
We want to thank our sponsors, Capital Technology University,
APS Global LLC, and the Maser Makerspace.
We want to give a special shout out to Dan Allen, who engineered and built the badges,
and Steve Lozinski, who brought all this together.
Our students Zach, Charisse, and Ryan, who helped with the video,
and especially everyone who bought a badge to support the village and our project.
What you'll learn. The basics of how to use an SDR.
Basic radio frequency concepts include frequency, bandwidth, and modulation.
And how an SDR converts millions of samples per second into binary data.
Software Defined Radios are connected to antennas that collect raw, analog, RF information,
and then decode them into binary data that your computer can use.
Explore the RF spectrum with your Aerospace Village badge.
The badge has an integrated dipole antenna tuned to 1090 MHz,
which is the frequency used by ADS-B.
In addition, the badge has two terminal blocks connected to the SMA connector,
which can be used to connect custom-cut wire lengths tuned to the frequency of interest.
Connect the wires and the correct SMA to your SDR,
or connect to the other SMA and use the integrated ADS-B antenna, and you're ready to go.
This is a lot of fun and very straightforward.
You already understand how to install software packages and connect devices to your USB board.
Once you learn the fundamentals of RF communications,
you'll be able to look at a number of digital signals,
understand their protocols, and figure out any vulnerabilities which need to be patched.
It's a lot of fun, and all you need is an SDR, some free software, and a couple pieces of wire to get started.
You're going to be using the SDR Sharp program. It's free.
You plug in your SDR into the USB port.
Start up SDR Sharp, push the play button at the upper left,
and you can start listening to radio signals and analyzing them immediately.
This slide shows some of the terms and how you use the SDR Sharp program.
There's a play button that starts receiving.
You put in the frequency of the signal you're looking for,
and you can push on the top of a number to go up and the bottom of a number to go down in frequency.
The display shows the strength of the signals by frequency at this moment,
and underneath is a waterfall which shows the strength and frequency over time.
On the left side, you've got something called modulation,
which is the mathematical operations needed to extract information from the signal,
and the bandwidth.
On the next screen, we'll be showing a live FM signal.
Please pay attention to how the different graphs move over time.
That will give you an idea of how the signal is being processed.
By watching how the sound moves, how the signal strength grows and decreases over time,
it gives you an idea of what's happening with the signal.
Now on our next slide, you're going to hear a digital signal and see it in operation.
You can't decode it with the human ear. You need a computer for this.
You'll notice the digital signals have a distinctive sound.
ACARS is essentially text messaging for airplanes.
It's a very simple format, uses a few VHF frequencies.
It's vulnerable to spoofing.
There's no independent authentication such as a digital signature on them.
The software is pretty easy to use and the messages can be dumped into a HEX format
so you can examine the protocols and even build your own compliant messages.
Here are a couple of ACARS messages.
You can see the type of aircraft, the flight number if it's available, and other information.
These messages can be passed through a further layer of decoding so you can see the contents
such as temperature, flight level, fuel remaining, number of passengers, etc.
You can dump this into text and you can do even further examination on it.
ACARS is pretty cool.
It uses a channel normally meant for voice communications to send data.
If you see the tall peak at the center, that's the carrier on an AM signal.
And they use a device much like a modem used for an old school telephone line to convert digital data to tones.
Those are the smaller peaks you see off to the side.
Then at the other end, those peaks and those tones are converted back into digital data.
ADS-B is very serious business.
It's used to manage the airspace.
It shows the direction, altitude, speed, and other information needed to keep the airways safe.
There's very little verification of these signals.
They're vulnerable to spoofing and other attacks.
And we need more cyber professionals looking at this to provide the security it deserves.
Here is the virtual radar software.
This takes the ADS-B output and plots on a map so you can see where aircraft are in relation to you and to each other.
There's a lot of information that can be expanded by clicking on a particular aircraft.
If you're connected to the internet, you can even bring back pictures.
Note that ADS-B is susceptible to spoofing and packet forgery.
It's an area where there's a lot more research needed.
Dump 1090 provides a neat textual output.
It's cool to watch the aircraft as they move, as they climb, as they descend.
You can also dump data in a hex format.
Now you can look at the protocol and even try and spoof it by building your own packets.
Using your badge or other simple antenna, you can download signals directly from satellites right to your PC.
You'll have to check the schedule and see what time they're going to pass overhead.
Get your antenna outside with no obstructions, and you have a good chance of receiving a great map from a satellite.
And here's a NOAA weather image which we downloaded just last week.
You can see the Great Lakes in the image. You can see cloud cover.
It's pretty cool. If we'd gotten a picture from this week, you could have seen the hurricane coming up the coast.
This is really interesting. The satellite is 500 miles above the earth, and yet you're able to receive a picture from it.
You see they've got a number of different peaks. Those are different signals it's using.
Each one works together with the others to send lots of data in a very short time.
That's why the signal is so wide.
Software-defined radios are like the Kali Linux of the radio frequency world.
If there's a signal you want to look at, if it's in wide use, the odds are someone's built a decoder so you can examine it.
Now, you see a picture of a 50-ohm resistor. That's a dummy load.
If you do decide to transmit, that'll keep the signal from going more than a few inches or a few feet,
so you can safely look at protocols and hack signals.
We've been talking about SDR receivers. The HackRF1 is a transceiver.
It transmits and receives from 0 to 6 gigahertz. That's way above even 5 gigahertz Wi-Fi.
Now, you have to be very careful. There are legal ramifications for transmitting in a way that would interfere with other signals.
The HackRF1 is great for research, transmitting things like key fobs,
experimenting in a confined area where you know the signal isn't going to get out.
Now, if there's concerns about the signal escaping, on the right is what's called a dummy load.
It's a 50-ohm resistor that absorbs the energy and keeps it from making it out into the world where it could interfere with things.
There are also a number of types of antennas you can get.
I'm a directional. They're like a table lamp. Others are unidirectional or directional, which means they're like a flashlight.
There are all sorts of signals you can look at with standard Linux tools for examining protocols, for examining hex and binary data.
For example, you've got command links to drones. You've got the key fob that opens the doors in your car.
Please remember, if you transmit, be very careful. It's dangerous and illegal to interfere with other people.
Stay safe and learn the xxd and od commands if you haven't already started working with binary.
If you're really excited about this, there are small packs you can put around a HackRF,
which will allow you to listen to everything from your electric meter transmitting to boats and cars sending information.
Once again, this is a really cool tool for research. Just be smart while you use it.
Thank you. If you'd love to know more, please reach out.
We'd like nothing more than to see you win next year when it comes to the Hack the Satellite competition.
Now, you're going to learn how to set up and install the apps with Zach, Charisse, and Ryan.
Hi, I'm Zachary Klein. I'm a student at the University of Maryland College Park.
Hi, I'm Carrie Houston, and I'm a student at Tableau Technology University in Oro, Maryland.
So now that we have established our antenna and our SDR, we now, in order to actually view those signals and decode them,
we need to get a program for that. So we're going to install something called SDR-Sharp.
So on the AirSpy website, we're going to install what's called the Windows SDR software package.
So once we have that downloaded, we'll have a zip file which we will extract.
And so, for the initial installation, we will run the install RTL SDR batch file.
And this will handle some of the primary drivers that we'll need.
Once that's taken care of, we're going to go at the bottom of this list and look for something called Zodeg.exe.
And this will provide some drivers for our SDR device.
So in order to find it, we'll go under options, list all devices,
and we're going to look for the device once we have plugged in our SDR.
So we're going to look for either something that says Bulk Interface Interface 0, or maybe something that says RTL 2832.
Once we have that selected, we're going to make sure that we have a USB ID of 0BDA283800.
From there, we'll select WinUSB, and we will replace the driver.
Since we've already done this, it says Reinstall Driver.
Now with this handle, we have SDRSharp installed.
Now that you have the software downloaded, it's time to use it.
The first thing that you're going to want to do is you're going to want to check the source.
So in the drop-down, you want to make sure that you have the RTL-SDR USB and not the TCP.
The next thing is you're going to press play, and from there you should see the FM broadcast that your SDR is picking up.
In order to see the signal better, you can turn up the RF gauge.
You want to slowly do that until you see it peak a little bit more.
If you see here, this is your waterfall that you can see over time as the signal is picked up.
And if you see the whiff here, that is considered your bandwidth.
So now we're going to tune in to a different signal, and this time it's going to be the NOAA's weather station.
Zoomed out now so you can see different signals that are being picked up.
Now that we've looked at radio stations and other types of signals that can be easily found with an SDRSharp,
we're going to look at another easy signal, ADS-B.
This is typically used to either prevent airplanes from collisions and other relevant data for air traffic.
So first we're going to install a program called Dump 1090, and this program is available on pbworks.com.
So once we have that installed, we'll get a zip file and we'll extract that.
And there the first thing that we will run is the Dump 1090 batch.
If you have any trouble with it, or if your computer says that you have multiple devices,
you can add a parameter that will allow you to select that device.
Device index.
Upon launching, we'll see a terminal window which will display any currently received air traffic.
Since we're indoors, we're not likely to receive very many signals.
Additionally, if we do receive signals, we can use what's called a virtual radar server to produce a map of these recorded air traffic.
So we've shifted so that we moved our antenna outside to receive more signals.
And if you can see on our screen here, we've got three different aircraft that we are currently tracking.
Alright, using Dump 1090, we're able to see different types of information regarding air traffic.
For example, we can see the flight number, as well as the altitude, the speed of the aircraft, the heading number, as well as longitude and latitude.
Using virtual radar, we can get the same information displayed on a graphical interface.
The next signal we'll be looking at is ACARS.
ACARS is essentially messages between the ground and aircraft.
So what we'll be using to decode ACARS signals is called ACARS Deco2.
And once you install the zip, there will be a batch file.
And in here, there are a couple of arguments. You can put up with three arguments for different frequencies that the program will look for ACARS signals.
Prior to actually running this, you may have to use SDRSharp to find any active ACARS signals in your area.
Since we've already done that previously, we're going to run the program, and we should eventually receive ACARS signals.
Here are some examples of previous signals we've recorded.
Capturing NOAA weather satellite images can be rewarding, but they require more pre-planning in order to get good results.
All that's needed is SDRSharp and an APT decoder, which stands for Automatic Picture Transmission, the type of signal that we're seeking.
In preparing SDRSharp for capture, we're going to need to change a few of the settings.
Clicking the cog wheel up at the top, we're going to select the sample rate that allows us to cleanly hear an FM station without any sort of stuttering.
Then, in the radio tab, we're going to select Wide FM.
And then, for the bandwidth, we're going to set it to somewhere between 36 and 50 kHz.
And this is only to account for Doppler shifting of the signal.
In the recording tab, we're going to check audio and uncheck bass band.
And the record button is here when we are ready.
Additionally, we can also use the audio noise reduction and IF noise reduction tabs if we have a very noisy signal.
In terms of physical preparations, we're going to need to do a weather check first.
Clouds or rain are going to significantly affect our reception.
We're also going to want to elevate ourselves, be outside, and be distant from any sort of tall obstructions.
An open field is ideal.
In terms of an antenna, the signal is right-hand circular polarized.
So helical antennas are wonderful.
However, there is quite a bit of success to be had in just a very simple horizontal half-wavelength dipole.
A V-dipole oriented north-south works really well, and it's what we use.
Before going out and recording APT signals, we need to know when a satellite is actually passing overhead.
Signals can only be received from when the satellite rises over the horizon to when it drops just below the horizon.
I'm using n2yo.com in order to provide these time estimations of when we acquire the signal.
We also want to check and see what the max elevation is.
While about 30 degrees is ideal, we've had successful images received at about 15 degrees minimum.
For reference, here's a sample of an ideal APT signal.
On the right is a screenshot of what the signal would look like in SDRSharp, and I'm now going to play an audio byte of the signal.
Once we have our recording complete, SDRSharp will save the recordings in the respective extracted folder.
I'm using the decoder straight forward from here.
So we select our file, decode.
We can add some post-decode processing, such as placing land and country borders, and then saving the image from here.
We can improve the weather images that we capture by either constructing an improved antenna, such as a QFH or a double-cross dipole antenna.
You could also use a low-noise amplifier as well.
And since we're recording a WAV file, you can also use audio editing in order to reduce the noise.
Thanks for the opportunity to present this information.
Is there anything else you'd like to see? As you play with it, you'll learn more and you'll have more questions.
Please feel free to reach out to us. We'd love to go ahead and provide more videos and more demonstrations for you.