start	end	text
6580	9500	Welcome to Software Defined Radios for Aerospace Cyber.
9500	16360	This is an introductory talk that will get you going with learning about radio frequencies and the use of SDRs.
20960	27820	Software Defined Radios are relatively inexpensive and a great way to learn about the radio frequency world and data communications.
28040	31400	In a short period, you can be receiving signals from aircraft.
31400	35780	And with a little bit more work, you can be receiving signals from satellites as well.
38480	42020	We want to thank our sponsors, Capital Technology University,
42020	45620	APS Global LLC, and the Maser Makerspace.
45620	50180	We want to give a special shout out to Dan Allen, who engineered and built the badges,
50180	53960	and Steve Lozinski, who brought all this together.
54140	58680	Our students Zach, Charisse, and Ryan, who helped with the video,
58680	63980	and especially everyone who bought a badge to support the village and our project.
67230	70170	What you'll learn. The basics of how to use an SDR.
70170	74610	Basic radio frequency concepts include frequency, bandwidth, and modulation.
74610	79450	And how an SDR converts millions of samples per second into binary data.
79830	86790	Software Defined Radios are connected to antennas that collect raw, analog, RF information,
86790	90530	and then decode them into binary data that your computer can use.
92210	96070	Explore the RF spectrum with your Aerospace Village badge.
96070	101290	The badge has an integrated dipole antenna tuned to 1090 MHz,
101290	104170	which is the frequency used by ADS-B.
104170	109390	In addition, the badge has two terminal blocks connected to the SMA connector,
109390	115490	which can be used to connect custom-cut wire lengths tuned to the frequency of interest.
116210	119690	Connect the wires and the correct SMA to your SDR,
119690	126650	or connect to the other SMA and use the integrated ADS-B antenna, and you're ready to go.
127590	130250	This is a lot of fun and very straightforward.
130250	135190	You already understand how to install software packages and connect devices to your USB board.
135250	138770	Once you learn the fundamentals of RF communications,
138770	142010	you'll be able to look at a number of digital signals,
142010	146470	understand their protocols, and figure out any vulnerabilities which need to be patched.
146470	153390	It's a lot of fun, and all you need is an SDR, some free software, and a couple pieces of wire to get started.
156540	160660	You're going to be using the SDR Sharp program. It's free.
160660	164740	You plug in your SDR into the USB port.
164740	167700	Start up SDR Sharp, push the play button at the upper left,
167700	172260	and you can start listening to radio signals and analyzing them immediately.
175430	180830	This slide shows some of the terms and how you use the SDR Sharp program.
180830	183270	There's a play button that starts receiving.
183330	186110	You put in the frequency of the signal you're looking for,
186110	191270	and you can push on the top of a number to go up and the bottom of a number to go down in frequency.
191470	197830	The display shows the strength of the signals by frequency at this moment,
197830	202970	and underneath is a waterfall which shows the strength and frequency over time.
202970	205570	On the left side, you've got something called modulation,
205570	211170	which is the mathematical operations needed to extract information from the signal,
211170	212290	and the bandwidth.
212530	215550	On the next screen, we'll be showing a live FM signal.
215550	220010	Please pay attention to how the different graphs move over time.
220010	222510	That will give you an idea of how the signal is being processed.
265380	271220	By watching how the sound moves, how the signal strength grows and decreases over time,
271220	273800	it gives you an idea of what's happening with the signal.
273800	278360	Now on our next slide, you're going to hear a digital signal and see it in operation.
278580	281680	You can't decode it with the human ear. You need a computer for this.
281680	285920	You'll notice the digital signals have a distinctive sound.
312260	315480	ACARS is essentially text messaging for airplanes.
315760	319880	It's a very simple format, uses a few VHF frequencies.
320260	322580	It's vulnerable to spoofing.
322620	327140	There's no independent authentication such as a digital signature on them.
327140	332020	The software is pretty easy to use and the messages can be dumped into a HEX format
332020	336060	so you can examine the protocols and even build your own compliant messages.
336060	340900	Here are a couple of ACARS messages.
340900	346340	You can see the type of aircraft, the flight number if it's available, and other information.
346360	350820	These messages can be passed through a further layer of decoding so you can see the contents
350820	359380	such as temperature, flight level, fuel remaining, number of passengers, etc.
360200	366640	You can dump this into text and you can do even further examination on it.
367260	371280	ACARS is pretty cool.
371280	375060	It uses a channel normally meant for voice communications to send data.
375660	380020	If you see the tall peak at the center, that's the carrier on an AM signal.
380020	386040	And they use a device much like a modem used for an old school telephone line to convert digital data to tones.
386040	388380	Those are the smaller peaks you see off to the side.
388380	394180	Then at the other end, those peaks and those tones are converted back into digital data.
401530	403990	ADS-B is very serious business.
403990	406450	It's used to manage the airspace.
406450	413270	It shows the direction, altitude, speed, and other information needed to keep the airways safe.
413270	416130	There's very little verification of these signals.
416130	418430	They're vulnerable to spoofing and other attacks.
418730	423830	And we need more cyber professionals looking at this to provide the security it deserves.
429650	432530	Here is the virtual radar software.
432530	439270	This takes the ADS-B output and plots on a map so you can see where aircraft are in relation to you and to each other.
439270	444390	There's a lot of information that can be expanded by clicking on a particular aircraft.
444390	447450	If you're connected to the internet, you can even bring back pictures.
447710	452070	Note that ADS-B is susceptible to spoofing and packet forgery.
452670	455590	It's an area where there's a lot more research needed.
459960	463060	Dump 1090 provides a neat textual output.
463060	467160	It's cool to watch the aircraft as they move, as they climb, as they descend.
467160	470320	You can also dump data in a hex format.
470320	475060	Now you can look at the protocol and even try and spoof it by building your own packets.
482820	489100	Using your badge or other simple antenna, you can download signals directly from satellites right to your PC.
489760	493860	You'll have to check the schedule and see what time they're going to pass overhead.
493880	500200	Get your antenna outside with no obstructions, and you have a good chance of receiving a great map from a satellite.
503820	508220	And here's a NOAA weather image which we downloaded just last week.
508220	511340	You can see the Great Lakes in the image. You can see cloud cover.
511340	516700	It's pretty cool. If we'd gotten a picture from this week, you could have seen the hurricane coming up the coast.
520880	527940	This is really interesting. The satellite is 500 miles above the earth, and yet you're able to receive a picture from it.
527940	531780	You see they've got a number of different peaks. Those are different signals it's using.
531780	536440	Each one works together with the others to send lots of data in a very short time.
536440	538480	That's why the signal is so wide.
542710	547050	Software-defined radios are like the Kali Linux of the radio frequency world.
547070	553190	If there's a signal you want to look at, if it's in wide use, the odds are someone's built a decoder so you can examine it.
553590	557910	Now, you see a picture of a 50-ohm resistor. That's a dummy load.
557910	563150	If you do decide to transmit, that'll keep the signal from going more than a few inches or a few feet,
563150	567090	so you can safely look at protocols and hack signals.
571900	577560	We've been talking about SDR receivers. The HackRF1 is a transceiver.
577560	585960	It transmits and receives from 0 to 6 gigahertz. That's way above even 5 gigahertz Wi-Fi.
586560	593580	Now, you have to be very careful. There are legal ramifications for transmitting in a way that would interfere with other signals.
593580	599240	The HackRF1 is great for research, transmitting things like key fobs,
599240	603580	experimenting in a confined area where you know the signal isn't going to get out.
603720	607920	Now, if there's concerns about the signal escaping, on the right is what's called a dummy load.
607920	616300	It's a 50-ohm resistor that absorbs the energy and keeps it from making it out into the world where it could interfere with things.
616380	618740	There are also a number of types of antennas you can get.
618740	627240	I'm a directional. They're like a table lamp. Others are unidirectional or directional, which means they're like a flashlight.
631780	640340	There are all sorts of signals you can look at with standard Linux tools for examining protocols, for examining hex and binary data.
640340	645440	For example, you've got command links to drones. You've got the key fob that opens the doors in your car.
645440	652040	Please remember, if you transmit, be very careful. It's dangerous and illegal to interfere with other people.
652180	657840	Stay safe and learn the xxd and od commands if you haven't already started working with binary.
662220	667300	If you're really excited about this, there are small packs you can put around a HackRF,
667300	674300	which will allow you to listen to everything from your electric meter transmitting to boats and cars sending information.
674580	678860	Once again, this is a really cool tool for research. Just be smart while you use it.
680980	683840	Thank you. If you'd love to know more, please reach out.
683840	688620	We'd like nothing more than to see you win next year when it comes to the Hack the Satellite competition.
688620	693660	Now, you're going to learn how to set up and install the apps with Zach, Charisse, and Ryan.
696220	701240	Hi, I'm Zachary Klein. I'm a student at the University of Maryland College Park.
701300	706120	Hi, I'm Carrie Houston, and I'm a student at Tableau Technology University in Oro, Maryland.
706120	716100	So now that we have established our antenna and our SDR, we now, in order to actually view those signals and decode them,
716100	722240	we need to get a program for that. So we're going to install something called SDR-Sharp.
722240	729820	So on the AirSpy website, we're going to install what's called the Windows SDR software package.
729820	737140	So once we have that downloaded, we'll have a zip file which we will extract.
740750	748570	And so, for the initial installation, we will run the install RTL SDR batch file.
749030	753630	And this will handle some of the primary drivers that we'll need.
760380	770800	Once that's taken care of, we're going to go at the bottom of this list and look for something called Zodeg.exe.
772420	776680	And this will provide some drivers for our SDR device.
777360	782840	So in order to find it, we'll go under options, list all devices,
782840	791220	and we're going to look for the device once we have plugged in our SDR.
791560	801100	So we're going to look for either something that says Bulk Interface Interface 0, or maybe something that says RTL 2832.
802580	813620	Once we have that selected, we're going to make sure that we have a USB ID of 0BDA283800.
814220	819480	From there, we'll select WinUSB, and we will replace the driver.
820000	822880	Since we've already done this, it says Reinstall Driver.
827020	831140	Now with this handle, we have SDRSharp installed.
834580	838300	Now that you have the software downloaded, it's time to use it.
838300	842440	The first thing that you're going to want to do is you're going to want to check the source.
842820	848880	So in the drop-down, you want to make sure that you have the RTL-SDR USB and not the TCP.
849180	859520	The next thing is you're going to press play, and from there you should see the FM broadcast that your SDR is picking up.
860250	871350	In order to see the signal better, you can turn up the RF gauge.
871350	877290	You want to slowly do that until you see it peak a little bit more.
886660	893920	If you see here, this is your waterfall that you can see over time as the signal is picked up.
896740	900800	And if you see the whiff here, that is considered your bandwidth.
901540	907560	So now we're going to tune in to a different signal, and this time it's going to be the NOAA's weather station.
939490	943410	Zoomed out now so you can see different signals that are being picked up.
945950	951890	Now that we've looked at radio stations and other types of signals that can be easily found with an SDRSharp,
951890	955150	we're going to look at another easy signal, ADS-B.
955150	963310	This is typically used to either prevent airplanes from collisions and other relevant data for air traffic.
964630	973590	So first we're going to install a program called Dump 1090, and this program is available on pbworks.com.
974250	979630	So once we have that installed, we'll get a zip file and we'll extract that.
986430	991070	And there the first thing that we will run is the Dump 1090 batch.
991470	996430	If you have any trouble with it, or if your computer says that you have multiple devices,
996430	1004250	you can add a parameter that will allow you to select that device.
1005850	1007730	Device index.
1020080	1027870	Upon launching, we'll see a terminal window which will display any currently received air traffic.
1028140	1032360	Since we're indoors, we're not likely to receive very many signals.
1034420	1044560	Additionally, if we do receive signals, we can use what's called a virtual radar server to produce a map of these recorded air traffic.
1045600	1050000	So we've shifted so that we moved our antenna outside to receive more signals.
1050320	1056200	And if you can see on our screen here, we've got three different aircraft that we are currently tracking.
1063940	1070880	Alright, using Dump 1090, we're able to see different types of information regarding air traffic.
1070880	1081420	For example, we can see the flight number, as well as the altitude, the speed of the aircraft, the heading number, as well as longitude and latitude.
1085300	1090880	Using virtual radar, we can get the same information displayed on a graphical interface.
1103340	1106780	The next signal we'll be looking at is ACARS.
1106780	1110680	ACARS is essentially messages between the ground and aircraft.
1111740	1119380	So what we'll be using to decode ACARS signals is called ACARS Deco2.
1119380	1125460	And once you install the zip, there will be a batch file.
1126260	1136320	And in here, there are a couple of arguments. You can put up with three arguments for different frequencies that the program will look for ACARS signals.
1136700	1145360	Prior to actually running this, you may have to use SDRSharp to find any active ACARS signals in your area.
1145360	1161240	Since we've already done that previously, we're going to run the program, and we should eventually receive ACARS signals.
1165900	1169720	Here are some examples of previous signals we've recorded.
1178150	1185230	Capturing NOAA weather satellite images can be rewarding, but they require more pre-planning in order to get good results.
1185230	1194850	All that's needed is SDRSharp and an APT decoder, which stands for Automatic Picture Transmission, the type of signal that we're seeking.
1196470	1201190	In preparing SDRSharp for capture, we're going to need to change a few of the settings.
1203150	1211970	Clicking the cog wheel up at the top, we're going to select the sample rate that allows us to cleanly hear an FM station without any sort of stuttering.
1215370	1218970	Then, in the radio tab, we're going to select Wide FM.
1219350	1225390	And then, for the bandwidth, we're going to set it to somewhere between 36 and 50 kHz.
1225390	1229190	And this is only to account for Doppler shifting of the signal.
1230450	1236170	In the recording tab, we're going to check audio and uncheck bass band.
1236350	1239170	And the record button is here when we are ready.
1239970	1248890	Additionally, we can also use the audio noise reduction and IF noise reduction tabs if we have a very noisy signal.
1249110	1253930	In terms of physical preparations, we're going to need to do a weather check first.
1254210	1257670	Clouds or rain are going to significantly affect our reception.
1258150	1264890	We're also going to want to elevate ourselves, be outside, and be distant from any sort of tall obstructions.
1264890	1266610	An open field is ideal.
1266610	1272450	In terms of an antenna, the signal is right-hand circular polarized.
1273150	1275330	So helical antennas are wonderful.
1275470	1282810	However, there is quite a bit of success to be had in just a very simple horizontal half-wavelength dipole.
1283370	1287850	A V-dipole oriented north-south works really well, and it's what we use.
1292600	1299400	Before going out and recording APT signals, we need to know when a satellite is actually passing overhead.
1300500	1307720	Signals can only be received from when the satellite rises over the horizon to when it drops just below the horizon.
1308240	1314860	I'm using n2yo.com in order to provide these time estimations of when we acquire the signal.
1315500	1319300	We also want to check and see what the max elevation is.
1319440	1328380	While about 30 degrees is ideal, we've had successful images received at about 15 degrees minimum.
1332920	1337600	For reference, here's a sample of an ideal APT signal.
1337840	1346300	On the right is a screenshot of what the signal would look like in SDRSharp, and I'm now going to play an audio byte of the signal.
1355310	1362330	Once we have our recording complete, SDRSharp will save the recordings in the respective extracted folder.
1362710	1366010	I'm using the decoder straight forward from here.
1366010	1369350	So we select our file, decode.
1369670	1381490	We can add some post-decode processing, such as placing land and country borders, and then saving the image from here.
1384250	1394650	We can improve the weather images that we capture by either constructing an improved antenna, such as a QFH or a double-cross dipole antenna.
1394650	1398430	You could also use a low-noise amplifier as well.
1399270	1405410	And since we're recording a WAV file, you can also use audio editing in order to reduce the noise.
1406230	1408970	Thanks for the opportunity to present this information.
1409010	1414290	Is there anything else you'd like to see? As you play with it, you'll learn more and you'll have more questions.
1414290	1420030	Please feel free to reach out to us. We'd love to go ahead and provide more videos and more demonstrations for you.