1
00:00:00,240 --> 00:00:02,970
- Our next speaker
literally hacked the planet.

2
00:00:02,970 --> 00:00:05,949
So please give a warm
welcome to Karl Kosher.

3
00:00:05,949 --> 00:00:10,199
(audience cheering and applauding)

4
00:00:11,640 --> 00:00:13,350
- Hello, DEF CON.

5
00:00:13,350 --> 00:00:14,460
I am Karl Kosher,

6
00:00:14,460 --> 00:00:17,190
otherwise known online as Supersat.

7
00:00:17,190 --> 00:00:19,020
This is a collaboration

8
00:00:19,020 --> 00:00:21,600
with another member of the Shadytel cabal,

9
00:00:21,600 --> 00:00:22,433
Andrew Green,

10
00:00:22,433 --> 00:00:26,160
who unfortunately couldn't
make it to DEF CON this year

11
00:00:26,160 --> 00:00:29,040
and we're gonna be talking
about hack the hemisphere.

12
00:00:29,040 --> 00:00:30,060
Whoo!

13
00:00:30,060 --> 00:00:31,860
All right.
(audience applauding)

14
00:00:31,860 --> 00:00:35,250
So this was done as a project

15
00:00:35,250 --> 00:00:39,420
under the Shadytel organization

16
00:00:39,420 --> 00:00:42,150
and Shadytel sort of started out

17
00:00:42,150 --> 00:00:44,250
as a Twitter parody account

18
00:00:44,250 --> 00:00:48,510
but now occasionally
provides real service.

19
00:00:48,510 --> 00:00:49,530
Let's see.

20
00:00:49,530 --> 00:00:53,250
Yup, real services at
events like Toor Camp.

21
00:00:53,250 --> 00:00:56,400
And as part of our commitment
to always be in your business,

22
00:00:56,400 --> 00:00:59,460
we're constantly looking to
improve our revenue streams

23
00:00:59,460 --> 00:01:02,460
by expanding into exciting new areas

24
00:01:02,460 --> 00:01:06,570
such as offering triple play
packages including TV service.

25
00:01:06,570 --> 00:01:10,170
So this is a talk about how we
explored offering TV service

26
00:01:10,170 --> 00:01:13,050
and legally broadcast our hacker content

27
00:01:13,050 --> 00:01:15,660
to all of North America
and a little bit beyond,

28
00:01:15,660 --> 00:01:17,310
tiny bit of Russia,

29
00:01:17,310 --> 00:01:20,070
using an end-of-life
geostationary satellite

30
00:01:20,070 --> 00:01:22,923
and how you can set up your
own event broadcast, too.

31
00:01:24,780 --> 00:01:29,780
So to explain what an
unprecedented opportunity we had,

32
00:01:30,570 --> 00:01:33,360
we first need to talk about
some satellite basics.

33
00:01:33,360 --> 00:01:36,480
So when you think about
satellites orbiting the earth,

34
00:01:36,480 --> 00:01:39,390
you might picture something like this,

35
00:01:39,390 --> 00:01:43,263
But in reality, these are only
low earth orbit satellites.

36
00:01:44,340 --> 00:01:46,320
And these satellites can't really be used

37
00:01:46,320 --> 00:01:48,153
for broadcast communications.

38
00:01:49,410 --> 00:01:53,100
Because they're constantly
going around the earth,

39
00:01:53,100 --> 00:01:55,410
they're not in a fixed position in the sky

40
00:01:55,410 --> 00:01:57,270
and for our broadcast communications,

41
00:01:57,270 --> 00:02:00,270
you really want to be able
to have a dish pointed

42
00:02:00,270 --> 00:02:02,163
at a particular point in the sky.

43
00:02:03,420 --> 00:02:08,250
And so if you were going
to do 24/7 communications

44
00:02:08,250 --> 00:02:11,010
with low earth orbit satellites,

45
00:02:11,010 --> 00:02:13,950
you would need a whole
constellation of satellites.

46
00:02:13,950 --> 00:02:16,530
And until, recently that
wasn't really feasible.

47
00:02:16,530 --> 00:02:18,900
And so, sorry, Starlink

48
00:02:18,900 --> 00:02:20,670
but LEO isn't cool.

49
00:02:20,670 --> 00:02:21,750
You know what's cool?

50
00:02:21,750 --> 00:02:22,680
GEO.

51
00:02:22,680 --> 00:02:24,213
All right, so what's GEO?

52
00:02:25,110 --> 00:02:29,640
So that's short for
Geostationary Earth Orbit.

53
00:02:29,640 --> 00:02:31,710
I'm making sure the animation works here.

54
00:02:31,710 --> 00:02:36,000
So, Elon's there.

55
00:02:36,000 --> 00:02:38,040
We are out here.

56
00:02:38,040 --> 00:02:40,620
So basically this animation is showing

57
00:02:40,620 --> 00:02:43,030
that the position of the satellite

58
00:02:44,610 --> 00:02:47,433
follows exactly the rotation of the earth.

59
00:02:49,560 --> 00:02:53,790
But where are we gonna get
a geostationary satellite?

60
00:02:53,790 --> 00:02:57,960
Well, somewhat unfortunately
but fortunately for us,

61
00:02:57,960 --> 00:03:00,640
satellites have limited lifespans

62
00:03:01,770 --> 00:03:04,200
and there are a bunch of reasons for this.

63
00:03:04,200 --> 00:03:08,610
So you can't get into quite perfect orbit

64
00:03:08,610 --> 00:03:10,080
and stay perfectly in sync.

65
00:03:10,080 --> 00:03:13,380
So you need a little bit of
fuel to do some station keeping

66
00:03:13,380 --> 00:03:15,903
and fine tune your position.

67
00:03:16,920 --> 00:03:18,720
There are batteries on board.

68
00:03:18,720 --> 00:03:20,760
Batteries obviously wear out.

69
00:03:20,760 --> 00:03:23,520
There's space debris that
might just blow a hole

70
00:03:23,520 --> 00:03:25,440
through your satellite.

71
00:03:25,440 --> 00:03:28,980
There's radiation that
might cause bit flips

72
00:03:28,980 --> 00:03:32,160
or single event upsets
or things like that.

73
00:03:32,160 --> 00:03:36,573
And so, satellites are engineered
for a specific lifespan.

74
00:03:37,470 --> 00:03:41,790
And once they are at their end of life,

75
00:03:41,790 --> 00:03:45,090
they are moved into what's
known as the graveyard orbit

76
00:03:45,090 --> 00:03:49,110
which is just beyond GEO.

77
00:03:49,110 --> 00:03:50,970
They don't de-orbit it back to earth

78
00:03:50,970 --> 00:03:53,010
because that actually
takes a lot more fuel

79
00:03:53,010 --> 00:03:55,770
than just pushing it a
bit further out into space

80
00:03:55,770 --> 00:03:57,570
where they can bump into each other.

81
00:03:58,410 --> 00:04:01,410
And so, this leads us to this
unprecedented opportunity

82
00:04:01,410 --> 00:04:05,463
that we had to use one of
these end-of-life satellites.

83
00:04:06,660 --> 00:04:09,030
So, this is Anik F1R.

84
00:04:09,030 --> 00:04:14,030
It was launched in 2005 with
a design life of 15 years.

85
00:04:14,610 --> 00:04:16,140
So if you do the math,

86
00:04:16,140 --> 00:04:20,913
it's basically dead or beyond
the end of its design life.

87
00:04:23,220 --> 00:04:28,020
This is the coverage map of Anik F1R.

88
00:04:28,020 --> 00:04:31,830
It's a Canadian satellite
supporting Canadian broadcasters

89
00:04:31,830 --> 00:04:34,320
with excellent polar coverage.

90
00:04:34,320 --> 00:04:38,460
I've been told that satellite
services can't be offered

91
00:04:38,460 --> 00:04:40,890
in Canada without covering
the entire country.

92
00:04:40,890 --> 00:04:43,890
So that might be why

93
00:04:43,890 --> 00:04:47,550
back in the late '90s, early 2000s,

94
00:04:47,550 --> 00:04:52,550
pirating DirecTV dish network
was kind of in a gray area.

95
00:04:52,830 --> 00:04:57,830
Anyway, coverage extends
beyond the Southern US border,

96
00:04:59,700 --> 00:05:00,750
reaches Hawaii,

97
00:05:00,750 --> 00:05:03,123
and covers a little bit of Russia.

98
00:05:04,080 --> 00:05:04,913
All right.

99
00:05:04,913 --> 00:05:08,643
So, how did we actually get on this bird?

100
00:05:11,550 --> 00:05:16,550
So to go into detail about how
we actually sent a broadcast

101
00:05:19,860 --> 00:05:21,180
from the satellite,

102
00:05:21,180 --> 00:05:23,250
we need to first talk a little bit about

103
00:05:23,250 --> 00:05:26,013
how these broadcast
satellite transponders work.

104
00:05:26,880 --> 00:05:30,570
And they're basically dumb analog systems

105
00:05:30,570 --> 00:05:33,870
or sometimes they're called bent pipes.

106
00:05:33,870 --> 00:05:38,870
So they basically receive
some signal from earth,

107
00:05:39,870 --> 00:05:41,913
does some band pass filtering on it,

108
00:05:43,200 --> 00:05:44,670
translates that frequency,

109
00:05:44,670 --> 00:05:48,150
amplifies it out using a linear amplifier,

110
00:05:48,150 --> 00:05:50,913
and then sends it straight back to earth.

111
00:05:51,840 --> 00:05:54,900
And so the fun thing about this is that

112
00:05:54,900 --> 00:05:59,610
it sends any RF signal it
receives back to earth as is.

113
00:05:59,610 --> 00:06:01,590
There's no de-modulation.

114
00:06:01,590 --> 00:06:03,060
There's no authentication.

115
00:06:03,060 --> 00:06:04,230
There's no nothing.

116
00:06:04,230 --> 00:06:08,373
It's just analog in, frequency
translation, analog out.

117
00:06:10,740 --> 00:06:13,560
And the fun thing is that...

118
00:06:13,560 --> 00:06:15,360
So on these satellites,

119
00:06:15,360 --> 00:06:19,080
these transponders will
have a bandwidth of like

120
00:06:19,080 --> 00:06:21,990
36 megahertz or 27 megahertz,

121
00:06:21,990 --> 00:06:26,070
but you can actually pack multiple users

122
00:06:26,070 --> 00:06:27,933
into a single transponder.

123
00:06:28,830 --> 00:06:33,390
The only issue with that is
that all of the uplink power,

124
00:06:33,390 --> 00:06:35,820
all the users of that uplink

125
00:06:35,820 --> 00:06:37,170
or that transponder have to be

126
00:06:37,170 --> 00:06:38,860
at approximately the same power

127
00:06:40,140 --> 00:06:43,500
because you can overload
these transponders

128
00:06:43,500 --> 00:06:46,950
and basically push them into clipping

129
00:06:46,950 --> 00:06:48,513
where you get distortion.

130
00:06:52,710 --> 00:06:55,320
You know distortion from electric guitars

131
00:06:55,320 --> 00:06:57,510
where it's intentional,

132
00:06:57,510 --> 00:07:01,680
but basically that just
flatters your frequency

133
00:07:01,680 --> 00:07:02,880
all over the spectrum.

134
00:07:02,880 --> 00:07:07,620
And so if you send a signal
that is too powerful,

135
00:07:07,620 --> 00:07:09,240
you will actually cause interference

136
00:07:09,240 --> 00:07:11,733
with other users on that transponder.

137
00:07:13,230 --> 00:07:17,340
So this is the Anik F1R
transponder configuration.

138
00:07:17,340 --> 00:07:21,633
There are 24 C band transponders
that are 36 megahertz each.

139
00:07:22,950 --> 00:07:24,843
In North America,

140
00:07:25,740 --> 00:07:28,590
TV channels use 6 megahertz of bandwidth.

141
00:07:28,590 --> 00:07:30,030
So, it can theoretically support

142
00:07:30,030 --> 00:07:32,940
six different channels there.

143
00:07:32,940 --> 00:07:37,940
There's also 32 Ku band
transponders at 27 megahertz each.

144
00:07:38,250 --> 00:07:40,830
And what's interesting here is that

145
00:07:40,830 --> 00:07:44,880
the frequencies of these
transponders actually overlap

146
00:07:44,880 --> 00:07:47,640
and the way that they're
able to do that is by

147
00:07:47,640 --> 00:07:49,290
doing different polarization.

148
00:07:49,290 --> 00:07:52,050
So one transponder is
horizontally polarized

149
00:07:52,050 --> 00:07:53,740
and one's vertically polarized

150
00:07:54,990 --> 00:07:58,560
where basically you can
get some frequency reuse

151
00:07:58,560 --> 00:08:01,920
essentially for free as long as the uplink

152
00:08:01,920 --> 00:08:04,443
and downlink dishes are
configured correctly.

153
00:08:06,300 --> 00:08:08,490
So with Anik F1R,

154
00:08:08,490 --> 00:08:10,860
these transponders were sold

155
00:08:10,860 --> 00:08:13,410
for the lifetime of the satellite

156
00:08:13,410 --> 00:08:16,380
and then companies would buy a particular

157
00:08:16,380 --> 00:08:20,580
transponder allocation
and then sublease that out

158
00:08:20,580 --> 00:08:21,970
to different companies

159
00:08:24,450 --> 00:08:27,660
either in time or frequency or both.

160
00:08:27,660 --> 00:08:29,910
And as it turned out,

161
00:08:29,910 --> 00:08:33,483
we had someone who had
one of these subleases.

162
00:08:35,640 --> 00:08:36,663
Let's see.

163
00:08:38,520 --> 00:08:39,353
Yup.

164
00:08:39,353 --> 00:08:40,186
All right, cool.

165
00:08:41,040 --> 00:08:45,360
So since we had one of
these transponder leases,

166
00:08:45,360 --> 00:08:50,360
we also had a license to
uplink at this unnamed facility

167
00:08:51,240 --> 00:08:56,100
and they had moved off of Anik F1R

168
00:08:56,100 --> 00:08:58,470
because it was already end of life.

169
00:08:58,470 --> 00:09:00,630
So they were using alternate services

170
00:09:00,630 --> 00:09:02,190
or alternate satellites,

171
00:09:02,190 --> 00:09:06,957
also some IP TV services
for their broadcast.

172
00:09:08,730 --> 00:09:09,687
But they still had the lease

173
00:09:09,687 --> 00:09:12,540
and they still had the
license for the uplink.

174
00:09:12,540 --> 00:09:16,050
And they wanted to make
sure that this satellite

175
00:09:16,050 --> 00:09:21,050
or this link still worked in
case they needed a backup.

176
00:09:23,010 --> 00:09:27,930
And what happened is hurricane Ida came

177
00:09:27,930 --> 00:09:30,900
and hit this dish and
knocked it out of position.

178
00:09:30,900 --> 00:09:33,240
And so, they weren't receiving any signal.

179
00:09:33,240 --> 00:09:37,683
And so they wanted to have
a way of testing this dish.

180
00:09:40,530 --> 00:09:44,460
Turns out it didn't work because
the receiver, the antenna,

181
00:09:44,460 --> 00:09:49,080
the low noise block was
crowded hell and back.

182
00:09:49,080 --> 00:09:52,080
Just a quick note on what an LNB is,

183
00:09:52,080 --> 00:09:54,270
that stands for Low Noise Block.

184
00:09:54,270 --> 00:09:58,560
It's an integrated antenna
and low noise amplifier.

185
00:09:58,560 --> 00:10:03,560
So basically, it's at the
focal point of the dish

186
00:10:03,960 --> 00:10:05,310
where there's an antenna

187
00:10:05,310 --> 00:10:08,250
and then it has a specially
designed amplifier

188
00:10:08,250 --> 00:10:11,050
to minimize the amount of
noise that injects the signal.

189
00:10:12,420 --> 00:10:15,510
So we replace the LNB

190
00:10:15,510 --> 00:10:17,610
and we started getting
some kind of signal,

191
00:10:17,610 --> 00:10:20,700
but then there was the
problem of the hurricane

192
00:10:20,700 --> 00:10:22,260
knocking the dish out of position.

193
00:10:22,260 --> 00:10:27,260
And so, we weren't quite lined
up in the right direction.

194
00:10:29,850 --> 00:10:32,940
But as it turns out, we didn't
need to use the usual...

195
00:10:32,940 --> 00:10:34,890
So there's this picking up method

196
00:10:34,890 --> 00:10:37,260
where you have these test tools

197
00:10:37,260 --> 00:10:38,580
where you get the signal strength

198
00:10:38,580 --> 00:10:41,220
and you kind of adjust
the satellite a little bit

199
00:10:41,220 --> 00:10:45,900
and you hone it in to
get it perfectly placed.

200
00:10:45,900 --> 00:10:48,153
And it turns out that was not necessary.

201
00:10:49,470 --> 00:10:52,090
All we did is move the satellite back

202
00:10:53,070 --> 00:10:55,870
or the satellite dish back
to where the rust marks were.

203
00:10:57,270 --> 00:10:58,293
So, that worked.

204
00:10:59,940 --> 00:11:00,773
So at this point,

205
00:11:00,773 --> 00:11:04,530
we were locked onto a
different transponder,

206
00:11:04,530 --> 00:11:08,100
one that was still active
and had not been vacated.

207
00:11:08,100 --> 00:11:12,090
And so then it was time to
test out the transponder

208
00:11:12,090 --> 00:11:13,773
that we actually had a lease on.

209
00:11:16,110 --> 00:11:21,110
So once we verified that the
satellite was still there,

210
00:11:21,840 --> 00:11:25,590
we needed to test the uplink facility

211
00:11:25,590 --> 00:11:29,133
using existing commercial
equipment in there.

212
00:11:30,120 --> 00:11:32,310
So the way that basically works is

213
00:11:32,310 --> 00:11:33,990
they take in a video source,

214
00:11:33,990 --> 00:11:38,610
it goes into a DVB-S encoder into a BUC,

215
00:11:38,610 --> 00:11:41,910
which is a combined up
converter and amplifier,

216
00:11:41,910 --> 00:11:46,320
which takes it from about 1.2
gigahertz up to 6 gigahertz

217
00:11:46,320 --> 00:11:50,220
which is the uplink
frequency for this satellite.

218
00:11:50,220 --> 00:11:52,220
And then that gets sent out to the dish.

219
00:11:53,520 --> 00:11:57,180
So what this looks like
on a spectrum analyzer,

220
00:11:57,180 --> 00:12:02,180
so there is a downlink on C band

221
00:12:02,640 --> 00:12:05,160
that's about at 3.8 gigahertz.

222
00:12:05,160 --> 00:12:09,120
So our transponder slot is about there.

223
00:12:09,120 --> 00:12:12,240
When we turn on the amplifier,

224
00:12:12,240 --> 00:12:13,803
we get a carrier there.

225
00:12:14,850 --> 00:12:16,950
And then when we turn on modulation,

226
00:12:16,950 --> 00:12:20,230
we get a nice wide 6-megahertz signal

227
00:12:21,240 --> 00:12:26,240
and we received that test
signal back without any problem.

228
00:12:26,400 --> 00:12:28,110
It was just the right power level.

229
00:12:28,110 --> 00:12:30,693
It was about the same as everyone else.

230
00:12:31,530 --> 00:12:34,500
A right amount of occupied bandwidth.

231
00:12:34,500 --> 00:12:35,850
So we basically just verified

232
00:12:35,850 --> 00:12:39,363
that everything was hunky-dory there.

233
00:12:40,380 --> 00:12:42,873
But that wasn't the end of our story.

234
00:12:44,940 --> 00:12:48,930
So we wanted to do some custom content

235
00:12:48,930 --> 00:12:53,190
and unfortunately at this uplink facility,

236
00:12:53,190 --> 00:12:56,940
we had this DVB-S encoder,

237
00:12:56,940 --> 00:12:58,890
which was this Tanberg unit,

238
00:12:58,890 --> 00:13:03,690
which accepts this input known as ASI,

239
00:13:03,690 --> 00:13:08,690
and ASI is basically an
MPEG 2 transport stream

240
00:13:11,700 --> 00:13:16,700
over a B and C connector
that is 270 megabit serial.

241
00:13:19,110 --> 00:13:21,330
It's very weird.

242
00:13:21,330 --> 00:13:25,050
It's kind of designed to be
compatible with another...

243
00:13:25,050 --> 00:13:26,520
Electrically compatible at least

244
00:13:26,520 --> 00:13:29,340
with another video standard called SDI

245
00:13:29,340 --> 00:13:30,723
for doing digital video.

246
00:13:33,090 --> 00:13:35,280
But there was really no easy way

247
00:13:35,280 --> 00:13:39,033
to generate this ASI signal.

248
00:13:40,350 --> 00:13:45,000
I was lucky enough to
be gifted a prototype

249
00:13:45,000 --> 00:13:48,330
of one of the Great Scott Gadgets, LUNA,

250
00:13:48,330 --> 00:13:52,170
which is this USB multi-tool
that they're coming out with.

251
00:13:52,170 --> 00:13:55,353
Unfortunately, chip shortage
has delayed that a bit,

252
00:13:56,730 --> 00:14:00,940
but the idea there was to
go from a USB interface

253
00:14:02,910 --> 00:14:07,287
to ASI out of one of the coax ports

254
00:14:08,670 --> 00:14:10,070
that you could add on there.

255
00:14:11,430 --> 00:14:12,750
Unfortunately...

256
00:14:12,750 --> 00:14:14,250
With an FPGA.

257
00:14:14,250 --> 00:14:16,680
So, it was designed to
do this serialization

258
00:14:16,680 --> 00:14:18,153
and deserialization.

259
00:14:19,380 --> 00:14:21,900
Unfortunately, that's a lot of work.

260
00:14:21,900 --> 00:14:24,150
Also, maybe this encoder is old

261
00:14:24,150 --> 00:14:26,150
and we want to do something more modern.

262
00:14:27,690 --> 00:14:32,580
We also thought about buying a
dedicated ASI interface card.

263
00:14:32,580 --> 00:14:34,680
Eventually, we did later.

264
00:14:34,680 --> 00:14:36,240
But the problem with those is that

265
00:14:36,240 --> 00:14:38,460
ASI is kind of an old enough standard

266
00:14:38,460 --> 00:14:42,300
that you can only find them as PCI cards.

267
00:14:42,300 --> 00:14:46,110
And so that was a pain
in the ass to implement.

268
00:14:46,110 --> 00:14:50,640
So we decided to bypass this Tanberg unit

269
00:14:50,640 --> 00:14:52,500
with something of our own.

270
00:14:52,500 --> 00:14:54,843
And it turns out that is very easy to do.

271
00:14:56,550 --> 00:15:01,550
So there is a DVB-S2 encoder
example in Canoe radio

272
00:15:05,490 --> 00:15:10,490
using some of the GRDTV blocks in there.

273
00:15:10,560 --> 00:15:15,560
And this DVB-S2 sample takes
an MPEG 2 transport stream in

274
00:15:19,760 --> 00:15:23,280
at a very precise bit rate that
I'll talk about in a minute

275
00:15:23,280 --> 00:15:26,190
and generates a DVB-S2 signal

276
00:15:26,190 --> 00:15:28,350
with the desired modulation parameters

277
00:15:28,350 --> 00:15:31,050
and then we just fed that into a HackRF

278
00:15:31,050 --> 00:15:35,010
which sends it out in an L band frequency.

279
00:15:35,010 --> 00:15:39,150
So it was like 1.3-35 gigahertz

280
00:15:39,150 --> 00:15:41,850
which the HackRF can easily do.

281
00:15:41,850 --> 00:15:43,830
And then once it goes out there,

282
00:15:43,830 --> 00:15:45,360
it looks the same as the output

283
00:15:45,360 --> 00:15:47,610
from the Tanberg unit into the BUC

284
00:15:47,610 --> 00:15:49,560
which up converts it and amplifies it

285
00:15:49,560 --> 00:15:51,093
and sends it to the satellite.

286
00:15:52,050 --> 00:15:52,890
So I mean,

287
00:15:52,890 --> 00:15:57,600
this is the sample graph
in Canoe radio companion.

288
00:15:57,600 --> 00:16:00,390
We didn't do anything in this.

289
00:16:00,390 --> 00:16:02,373
It just sort of worked as is.

290
00:16:03,240 --> 00:16:08,240
I guess we did change the
sync from a USRP to a HackRF

291
00:16:08,250 --> 00:16:11,280
and the source from a
file to a TCP socket,

292
00:16:11,280 --> 00:16:14,523
but it is basically pretty easy to do.

293
00:16:16,170 --> 00:16:19,560
So we got a test stream up
and running pretty quickly

294
00:16:19,560 --> 00:16:23,160
with a HackRF and a commercial IRD,

295
00:16:23,160 --> 00:16:26,640
which is an integrated receiver decoder.

296
00:16:26,640 --> 00:16:31,640
So, an off the shelf
satellite TV set top box

297
00:16:32,040 --> 00:16:34,293
connected via coax in the lab.

298
00:16:35,310 --> 00:16:40,310
Unfortunately, what these
IRDs do is they send out power

299
00:16:42,420 --> 00:16:45,900
via the coax to power...

300
00:16:45,900 --> 00:16:49,260
Or they send out a DC
Bias to power the LNB

301
00:16:49,260 --> 00:16:51,000
and they actually change their voltage

302
00:16:51,000 --> 00:16:54,030
to change the polarization
between horizontal and vertical

303
00:16:54,030 --> 00:16:55,110
or things like that.

304
00:16:55,110 --> 00:16:58,830
So we were sending 13 to 18 volts

305
00:16:58,830 --> 00:17:01,560
into the HackRF front end

306
00:17:01,560 --> 00:17:04,740
and that just blew it up immediately.

307
00:17:04,740 --> 00:17:09,150
And so we were able to bypass
it with this sketchy amp

308
00:17:09,150 --> 00:17:10,770
shown on the right here

309
00:17:10,770 --> 00:17:14,040
where we basically bypassed
the final amplifier stage

310
00:17:14,040 --> 00:17:18,159
of the HackRF which is kind of notorious

311
00:17:18,159 --> 00:17:20,910
for being very, very delicate.

312
00:17:20,910 --> 00:17:24,153
So, be careful when you're doing that.

313
00:17:25,980 --> 00:17:30,630
So we successfully replayed
a test strand support stream

314
00:17:30,630 --> 00:17:35,493
into a commercial receiver decoder box.

315
00:17:36,390 --> 00:17:38,730
There is a spectrum analyzer.

316
00:17:38,730 --> 00:17:43,730
This is one of the test videos
from this site, w6rz.net.

317
00:17:49,230 --> 00:17:51,510
The bit rate wasn't perfect,

318
00:17:51,510 --> 00:17:56,510
but we got basically some
choppy MTV video on there.

319
00:17:58,530 --> 00:17:59,670
But now the question was,

320
00:17:59,670 --> 00:18:03,213
how do we generate our own
MPEG 2 transport streams?

321
00:18:04,950 --> 00:18:06,240
So to talk about that,

322
00:18:06,240 --> 00:18:08,310
well, let's talk about what these

323
00:18:08,310 --> 00:18:11,940
MPEG 2 transport streams
are in the first place.

324
00:18:11,940 --> 00:18:16,940
So, they are designed to carry
multiple programs or channels

325
00:18:17,430 --> 00:18:19,830
over a continuous stream.

326
00:18:19,830 --> 00:18:22,110
They're basically used everywhere.

327
00:18:22,110 --> 00:18:23,977
People might hear MPEG 2 and think,

328
00:18:23,977 --> 00:18:25,350
"Oh! Well, that's dated.

329
00:18:25,350 --> 00:18:29,490
We're on MPEG 4, MP4, MP5, or whatnot."

330
00:18:29,490 --> 00:18:32,340
But no, the MPEG 2 transport streams

331
00:18:32,340 --> 00:18:34,410
are still used pervasively.

332
00:18:34,410 --> 00:18:36,840
They're used in over-the-air TV

333
00:18:36,840 --> 00:18:41,340
with both DVB in the rest of the world

334
00:18:41,340 --> 00:18:43,590
and ATSC in North America.

335
00:18:43,590 --> 00:18:46,470
They're used in cable TV.

336
00:18:46,470 --> 00:18:47,880
They're used for satellite broadcast

337
00:18:47,880 --> 00:18:51,930
and even your cable modem
uses MPEG 2 transport streams.

338
00:18:51,930 --> 00:18:54,540
They actually take...

339
00:18:54,540 --> 00:18:57,690
Well, except for Voxes 3.1
which does something else.

340
00:18:57,690 --> 00:19:00,840
But basically, they take ethernet packets

341
00:19:00,840 --> 00:19:01,800
and they chunk it up

342
00:19:01,800 --> 00:19:05,820
into different MPEG
transport stream packets

343
00:19:05,820 --> 00:19:08,670
and just send it as another video channel,

344
00:19:08,670 --> 00:19:10,023
which is very weird.

345
00:19:10,950 --> 00:19:11,943
Anyway.

346
00:19:13,710 --> 00:19:17,740
So what MPEG 2 transport
streams do is they take these

347
00:19:19,830 --> 00:19:21,530
different elemental streams or ESS

348
00:19:22,860 --> 00:19:24,750
and they mux them together

349
00:19:24,750 --> 00:19:29,750
and they assign a program
ID or packet ID to each one.

350
00:19:32,100 --> 00:19:36,007
And then there is some
metadata which says,

351
00:19:36,007 --> 00:19:40,980
"Okay, a channel consists
of this ES of the video

352
00:19:40,980 --> 00:19:43,170
and maybe two audio tracks."

353
00:19:43,170 --> 00:19:45,540
And in fact, you can actually do a program

354
00:19:45,540 --> 00:19:47,520
with multiple video tracks.

355
00:19:47,520 --> 00:19:50,910
Some DVDs used it to
change the perspective

356
00:19:50,910 --> 00:19:53,333
of a certain scene.

357
00:19:53,333 --> 00:19:55,503
It is not a popular feature.

358
00:19:56,340 --> 00:20:01,340
But basically, MPEG 2 transport
streams are codec-agnostic.

359
00:20:01,980 --> 00:20:04,923
Originally, you could
do the MPEG 2 standard,

360
00:20:06,270 --> 00:20:08,640
video codex standard H.262,

361
00:20:08,640 --> 00:20:12,540
but now you can do H.264, H.265.

362
00:20:12,540 --> 00:20:15,840
You can do AC-3 which is an audio codec,

363
00:20:15,840 --> 00:20:19,023
all sorts of different audio codecs.

364
00:20:21,240 --> 00:20:24,810
The problem with MPEG 2
transport stream is that

365
00:20:24,810 --> 00:20:27,210
they are designed to be transmitted

366
00:20:27,210 --> 00:20:29,970
at extremely specific bit rates

367
00:20:29,970 --> 00:20:34,970
and I'm talking down to several
decimal digits of precision.

368
00:20:36,060 --> 00:20:41,060
And the reason for that is
that bit rate is derived

369
00:20:41,310 --> 00:20:43,710
from the modulation parameters

370
00:20:43,710 --> 00:20:46,050
of how you are transmitting the signal.

371
00:20:46,050 --> 00:20:49,560
So I'll show some demos

372
00:20:51,420 --> 00:20:55,800
or some diagrams of different
ways of modulating signals,

373
00:20:55,800 --> 00:21:00,800
but you can have a different
number of bits per symbol

374
00:21:00,900 --> 00:21:01,863
that gets it.

375
00:21:04,320 --> 00:21:06,840
You can change the number
of symbols per second.

376
00:21:06,840 --> 00:21:10,173
You change the amount of
bandwidth that you're sending,

377
00:21:11,490 --> 00:21:13,530
your stream over.

378
00:21:13,530 --> 00:21:16,053
You can also add a bunch
of error correction.

379
00:21:17,640 --> 00:21:20,550
And one simple way to think about

380
00:21:20,550 --> 00:21:22,530
this error correction at least,

381
00:21:22,530 --> 00:21:27,530
the very simple retool
man error correction is

382
00:21:27,690 --> 00:21:30,600
you can sort of represent data as a...

383
00:21:30,600 --> 00:21:31,433
What?

384
00:21:31,433 --> 00:21:34,257
Degree N minus one polynomial.

385
00:21:34,257 --> 00:21:37,530
And then if you have more than end points,

386
00:21:37,530 --> 00:21:42,530
you can precisely recover what
the original polynomial was.

387
00:21:42,600 --> 00:21:45,990
So you basically just add
some redundant data there.

388
00:21:45,990 --> 00:21:49,080
That's kind of an old way
of doing error correction.

389
00:21:49,080 --> 00:21:51,360
There are some newer advanced forms

390
00:21:51,360 --> 00:21:56,160
that can take advantage of
what's known as soft-decoding,

391
00:21:56,160 --> 00:21:59,103
I'll show an example of
that on the next screen,

392
00:22:00,480 --> 00:22:01,980
where basically you're not sure

393
00:22:01,980 --> 00:22:03,420
if something is a zero or one

394
00:22:03,420 --> 00:22:05,100
but it's more likely to be a zero,

395
00:22:05,100 --> 00:22:09,990
so you kind of use that to tune for

396
00:22:09,990 --> 00:22:12,663
or to do some advanced error correction.

397
00:22:13,860 --> 00:22:18,330
And then you're gonna have
some variable bit rate content

398
00:22:18,330 --> 00:22:21,147
coming into your muxer

399
00:22:21,147 --> 00:22:23,820
and so you need to actually pad that out

400
00:22:23,820 --> 00:22:27,813
with some null packets to
keep the bit stream constant,

401
00:22:29,610 --> 00:22:33,300
and a lot of this is beyond
the scope of this talk.

402
00:22:33,300 --> 00:22:36,900
So if you wanna know more,

403
00:22:36,900 --> 00:22:38,583
you can search for it.

404
00:22:40,350 --> 00:22:41,183
Let's see.

405
00:22:41,183 --> 00:22:44,370
So, I wanna quickly talk
about constellation diagrams

406
00:22:44,370 --> 00:22:47,880
because this relates to the
different modulation schemes

407
00:22:47,880 --> 00:22:52,770
that I was talking about
on the previous slide.

408
00:22:52,770 --> 00:22:57,770
And so at a very high level,

409
00:23:00,150 --> 00:23:05,000
when you send a symbol over DVB-S,

410
00:23:07,466 --> 00:23:12,466
you could send not just a
single bit but multiple bits

411
00:23:12,900 --> 00:23:16,833
and without getting too
much into the weeds,

412
00:23:18,480 --> 00:23:20,070
when you add more bits,

413
00:23:20,070 --> 00:23:22,350
they are sort of closer together.

414
00:23:22,350 --> 00:23:26,100
And so when you receive a symbol

415
00:23:26,100 --> 00:23:31,100
and it's not perfectly on one
of these constellation points,

416
00:23:32,610 --> 00:23:34,470
you can...

417
00:23:34,470 --> 00:23:37,410
Well, the more constellation
points there are,

418
00:23:37,410 --> 00:23:38,850
the more uncertainty there is.

419
00:23:38,850 --> 00:23:43,850
And so basically the simpler
modulation scheme is,

420
00:23:44,360 --> 00:23:47,373
the easier it is to receive.

421
00:23:48,330 --> 00:23:52,920
One thing that I will note
here is that these diagrams

422
00:23:52,920 --> 00:23:56,380
on the top are phase shift keying

423
00:23:57,570 --> 00:24:02,570
where you basically change the
phase of the carrier signal

424
00:24:02,850 --> 00:24:04,590
that you're sending.

425
00:24:04,590 --> 00:24:06,780
But since it's sort of in a unit circle,

426
00:24:06,780 --> 00:24:09,780
the amplitude of the signal is constant.

427
00:24:09,780 --> 00:24:14,190
And so, you don't actually need
a linear amplifier for that.

428
00:24:14,190 --> 00:24:15,933
The schemes on the bottom,

429
00:24:17,280 --> 00:24:19,290
some of the Quad schemes

430
00:24:19,290 --> 00:24:23,403
or a PS Keying schemes do
need linear amplifiers.

431
00:24:25,050 --> 00:24:30,050
All right, so this is a depiction

432
00:24:30,450 --> 00:24:33,300
of what an MPEG 2
transport stream looks like

433
00:24:33,300 --> 00:24:38,300
when you play it in one
of these test tools.

434
00:24:39,540 --> 00:24:42,450
So, you can see a bunch of metadata there.

435
00:24:42,450 --> 00:24:44,790
So there's like the program table

436
00:24:44,790 --> 00:24:47,400
that defines various channels

437
00:24:47,400 --> 00:24:50,677
and then each channel or program says,

438
00:24:50,677 --> 00:24:53,490
"These are all the
associated video streams,"

439
00:24:53,490 --> 00:24:55,290
and things like that.

440
00:24:55,290 --> 00:24:57,600
All right, so this is basically

441
00:24:57,600 --> 00:25:01,020
what the complete broadcast
chain looked like.

442
00:25:01,020 --> 00:25:06,020
So what we do is we take
in some RTMP sources,

443
00:25:06,120 --> 00:25:09,750
Real Time Media Protocol
or something like that,

444
00:25:09,750 --> 00:25:14,750
and that's generated by OBS, for example.

445
00:25:15,120 --> 00:25:17,820
And I'll get into how
we did that in a second.

446
00:25:17,820 --> 00:25:21,210
We ingest those multiple RTMP streams

447
00:25:21,210 --> 00:25:24,810
into a program called Flussonic.

448
00:25:24,810 --> 00:25:29,810
Flussonic basically just altered
the PIDs of the RTMP stream

449
00:25:31,920 --> 00:25:34,800
so that we could have
multiple streams together.

450
00:25:34,800 --> 00:25:39,800
And then we sent this into
a program called TSDuck

451
00:25:40,620 --> 00:25:44,880
which was actually mentioned
yesterday on one of the...

452
00:25:44,880 --> 00:25:49,590
On the satellite talk yesterday.

453
00:25:49,590 --> 00:25:52,950
And basically, that would mux
all these different streams

454
00:25:52,950 --> 00:25:56,190
together into a very precise bit rate.

455
00:25:56,190 --> 00:25:58,740
Then we send it into Canoe radio

456
00:25:58,740 --> 00:26:02,040
either over a TCP socket or a Unix pipe

457
00:26:02,040 --> 00:26:03,393
or something like that,

458
00:26:04,680 --> 00:26:07,560
and then it goes out.

459
00:26:07,560 --> 00:26:11,100
The HackRF goes through the up converter

460
00:26:11,100 --> 00:26:13,593
and out to the dish.

461
00:26:15,900 --> 00:26:18,787
All right, so we used OBS,

462
00:26:19,920 --> 00:26:21,540
Open Broadcast Studio,

463
00:26:21,540 --> 00:26:25,950
to generate these RTMP data sources.

464
00:26:25,950 --> 00:26:30,950
I pointed this at a server running nginx

465
00:26:31,470 --> 00:26:35,160
that basically just
provided a sync for this.

466
00:26:35,160 --> 00:26:38,580
And then on the uplink site,

467
00:26:38,580 --> 00:26:41,430
they could connect to my nginx server

468
00:26:41,430 --> 00:26:45,123
and pull down the same
MPEG 2 transport stream.

469
00:26:46,350 --> 00:26:47,430
Yeah.

470
00:26:47,430 --> 00:26:49,290
Went over this.

471
00:26:49,290 --> 00:26:53,250
All right, so now that we have
something that might work,

472
00:26:53,250 --> 00:26:55,953
what do we actually put on the satellite?

473
00:26:58,080 --> 00:27:01,050
So why don't we do an entire conference?

474
00:27:01,050 --> 00:27:06,050
So this satellite was expected to be sent

475
00:27:07,710 --> 00:27:10,830
into the graveyard orbit
in November of 2021.

476
00:27:10,830 --> 00:27:14,010
And Toor Camp was happening
in October of 2021.

477
00:27:14,010 --> 00:27:18,120
So we approached them and
we actually got a permission

478
00:27:18,120 --> 00:27:21,960
to re-stream the entirety
of Toor Con San Diego

479
00:27:21,960 --> 00:27:26,160
that they were selling virtual
passes for for 50 bucks.

480
00:27:26,160 --> 00:27:27,900
But if you had a dish,

481
00:27:27,900 --> 00:27:29,100
a new word to put it,

482
00:27:29,100 --> 00:27:30,933
you could get it for free.

483
00:27:31,950 --> 00:27:34,773
So this is what the OBS site looked like.

484
00:27:35,760 --> 00:27:38,280
So we logged into the content site

485
00:27:38,280 --> 00:27:41,880
with the browser embedded in OBS.

486
00:27:41,880 --> 00:27:46,320
We had some cool intermission
content between talks

487
00:27:46,320 --> 00:27:49,413
and during the night we would
like to play hacker movies.

488
00:27:51,690 --> 00:27:53,660
Andrew also allocated...

489
00:27:55,170 --> 00:27:59,040
So because we can
multiplex multiple programs

490
00:27:59,040 --> 00:28:02,310
onto the same transmission
and we had extra bandwidth,

491
00:28:02,310 --> 00:28:05,670
we added more content on there.

492
00:28:05,670 --> 00:28:08,223
So the second video
channel was more movies.

493
00:28:09,090 --> 00:28:10,980
The fifth channel was actually tied

494
00:28:10,980 --> 00:28:12,960
to a phone conference bridge.

495
00:28:12,960 --> 00:28:15,450
So, there was a number that you could call

496
00:28:15,450 --> 00:28:19,200
and just have your
voice broadcast to well,

497
00:28:19,200 --> 00:28:20,643
North America and beyond.

498
00:28:22,110 --> 00:28:27,110
There were plans to include
a number station in this

499
00:28:27,960 --> 00:28:32,717
as part of a long running
ARG called OTP 22.

500
00:28:34,710 --> 00:28:38,640
Unfortunately, one of
the creators behind that

501
00:28:38,640 --> 00:28:43,320
unexpectedly passed away
before we could do this,

502
00:28:43,320 --> 00:28:46,773
so we weren't able to do that.

503
00:28:47,610 --> 00:28:51,587
So, this is a look of us testing

504
00:28:53,250 --> 00:28:55,890
our custom hacker transmission on there.

505
00:28:55,890 --> 00:28:58,203
There's the up converter.

506
00:29:01,860 --> 00:29:03,510
There's lots of cables there.

507
00:29:03,510 --> 00:29:06,360
On that screen, there's
the up converter status.

508
00:29:06,360 --> 00:29:07,440
On that screen,

509
00:29:07,440 --> 00:29:11,493
we have the output of
this Cisco decoder box.

510
00:29:13,440 --> 00:29:16,110
And when we tune into the channel...

511
00:29:16,110 --> 00:29:17,280
Oh, yup! There we go.

512
00:29:17,280 --> 00:29:18,113
All right.

513
00:29:18,113 --> 00:29:20,863
We've got word games on there.

514
00:29:20,863 --> 00:29:22,830
Pulling that off the satellite,

515
00:29:22,830 --> 00:29:26,730
we can change channels to get
different things on there.

516
00:29:26,730 --> 00:29:28,860
Unfortunately, I think the only thing

517
00:29:28,860 --> 00:29:30,090
that's on there is audio.

518
00:29:30,090 --> 00:29:33,060
And I said there wasn't
any audio in these videos.

519
00:29:33,060 --> 00:29:34,920
So, "Oh, oops!"

520
00:29:34,920 --> 00:29:37,890
Anyway, that's showing...

521
00:29:37,890 --> 00:29:40,556
Oh, and we had this
fun little Shadytel bug

522
00:29:40,556 --> 00:29:45,556
on our videos there that was
done with an OBS overlay.

523
00:29:48,300 --> 00:29:49,133
Let's see.

524
00:29:49,133 --> 00:29:53,490
Here's another test going
between different channels

525
00:29:53,490 --> 00:29:56,250
on this decoder box.

526
00:29:56,250 --> 00:29:59,940
So, we had this great
movie "Antitrust" on,

527
00:29:59,940 --> 00:30:01,653
which is very emulsy.

528
00:30:02,940 --> 00:30:04,230
Then...

529
00:30:04,230 --> 00:30:05,063
Let's see.

530
00:30:05,063 --> 00:30:06,090
We can probably...

531
00:30:06,090 --> 00:30:09,150
I think we were gonna
switch channels and show...

532
00:30:09,150 --> 00:30:10,653
Yeah, whatever.

533
00:30:11,640 --> 00:30:14,730
All right, so how were
people supposed to be able

534
00:30:14,730 --> 00:30:16,650
to receive this?

535
00:30:16,650 --> 00:30:20,340
So we sent out this very vague tweet

536
00:30:20,340 --> 00:30:25,340
from the Shadytel account
with this giant C band dish

537
00:30:25,740 --> 00:30:27,147
just saying "Soon."

538
00:30:28,320 --> 00:30:31,380
And really the reason why you need

539
00:30:31,380 --> 00:30:35,730
this large of a dish is
because the wavelengths

540
00:30:35,730 --> 00:30:39,270
of C band are relatively large,

541
00:30:39,270 --> 00:30:40,290
same to Ku band.

542
00:30:40,290 --> 00:30:45,153
So, 3 gigahertz or 3.8
gigahertz versus 11 or 12.

543
00:30:48,600 --> 00:30:52,530
So we did some rough figures to figure out

544
00:30:52,530 --> 00:30:57,530
if people actually needed
one of these C band dishes.

545
00:30:58,830 --> 00:31:02,580
So a little back of the envelope math,

546
00:31:02,580 --> 00:31:06,450
we figured there was
about 37 decibels of gain

547
00:31:06,450 --> 00:31:08,850
in this C band dish

548
00:31:08,850 --> 00:31:13,770
if you got this eight-foot C band dish.

549
00:31:13,770 --> 00:31:15,060
If you went down to three,

550
00:31:15,060 --> 00:31:17,550
you went from 37 to 29.

551
00:31:17,550 --> 00:31:21,090
If you find one of those free
repurposed DirecTV dishes,

552
00:31:21,090 --> 00:31:24,993
you get somewhere between 23 and 26.

553
00:31:27,360 --> 00:31:30,150
So this is the proper way

554
00:31:30,150 --> 00:31:32,730
to actually receive these C band signals.

555
00:31:32,730 --> 00:31:36,120
But we were curious if you
could actually repurpose

556
00:31:36,120 --> 00:31:37,950
one of these other satellite dishes

557
00:31:37,950 --> 00:31:40,950
like a DirecTV dish or a dish network dish

558
00:31:40,950 --> 00:31:42,360
to pull these things in here.

559
00:31:42,360 --> 00:31:44,520
Unfortunately, the satellite went away

560
00:31:44,520 --> 00:31:46,050
before we could fully test this.

561
00:31:46,050 --> 00:31:50,520
So caution, there's
some speculation below.

562
00:31:50,520 --> 00:31:52,980
If this was at ShmooCon,

563
00:31:52,980 --> 00:31:55,170
I'd encourage you to
throw shmoo balls at me

564
00:31:55,170 --> 00:31:58,710
if there's some errors in this slide.

565
00:31:58,710 --> 00:32:00,933
So, this is somewhat speculative.

566
00:32:02,820 --> 00:32:07,820
So we got about a 16-decibel
carrier-to-noise ratio

567
00:32:08,280 --> 00:32:09,720
at the transmitter site.

568
00:32:09,720 --> 00:32:12,870
And that was way up in
Canada and Northern Canada.

569
00:32:12,870 --> 00:32:14,910
So in the continental US,

570
00:32:14,910 --> 00:32:17,670
you should probably get a better signal

571
00:32:17,670 --> 00:32:20,283
because it's more, more overhead.

572
00:32:22,200 --> 00:32:25,950
So going from one of
those nice C band dishes

573
00:32:25,950 --> 00:32:29,070
down to a DirecTV dish would lose us

574
00:32:29,070 --> 00:32:32,070
about 14 decibels of signals.

575
00:32:32,070 --> 00:32:36,033
So that would give us a
carrier-to-noise ratio of about 2.

576
00:32:37,200 --> 00:32:41,370
But luckily we control
the modulation parameter

577
00:32:41,370 --> 00:32:43,830
so we can add more error correction.

578
00:32:43,830 --> 00:32:45,660
We can lower the bit rate.

579
00:32:45,660 --> 00:32:48,210
We can basically make this signal

580
00:32:48,210 --> 00:32:50,763
as easy as possible to receive.

581
00:32:52,920 --> 00:32:54,670
There's some stats on the various

582
00:32:56,670 --> 00:32:58,770
carrier-to-noise ratio requirements too

583
00:32:58,770 --> 00:33:01,800
to receive various modulation schemes

584
00:33:01,800 --> 00:33:05,787
with different error correction overheads.

585
00:33:07,590 --> 00:33:12,590
So if you did a QPSK with
1/4 error correction,

586
00:33:14,790 --> 00:33:17,820
so you send four symbols for every symbol

587
00:33:17,820 --> 00:33:19,623
that you actually want to send.

588
00:33:20,730 --> 00:33:25,590
You can actually send
something below the noise floor

589
00:33:25,590 --> 00:33:27,243
and pick it up.

590
00:33:28,590 --> 00:33:32,970
And yeah, so if you do that

591
00:33:32,970 --> 00:33:37,200
at five mega symbols
per second with pilot,

592
00:33:37,200 --> 00:33:41,770
you get about 2.4 megabits per second

593
00:33:42,960 --> 00:33:47,130
with about 4 dB of link margin there.

594
00:33:47,130 --> 00:33:51,840
So it's not gonna be perfectly
receivable all the time.

595
00:33:51,840 --> 00:33:53,580
There'll be some noise
that'll knock it offline,

596
00:33:53,580 --> 00:33:55,923
but it'll basically work.

597
00:33:57,400 --> 00:34:00,883
And I just looked at what
the DEF CON documentary was

598
00:34:01,950 --> 00:34:06,950
at 1080p encoded with the H.265 codec

599
00:34:07,050 --> 00:34:10,923
that averages about 1.6
megabits per second.

600
00:34:11,820 --> 00:34:13,470
Now, I'm kinda cheating here

601
00:34:13,470 --> 00:34:16,293
because that's the
average and in practice,

602
00:34:20,116 --> 00:34:21,210
it's a variable bit rate.

603
00:34:21,210 --> 00:34:23,190
So, you would occasionally go over

604
00:34:23,190 --> 00:34:25,620
that 2.4 megabit per second,

605
00:34:25,620 --> 00:34:30,620
but you can set your
encoding parameters too

606
00:34:30,810 --> 00:34:33,903
to make sure you're
always under that limit.

607
00:34:35,040 --> 00:34:35,873
All right.

608
00:34:35,873 --> 00:34:39,090
So we looked into doing this

609
00:34:39,090 --> 00:34:43,650
before the satellite got de-orbited

610
00:34:43,650 --> 00:34:46,800
or sent off to the graveyard orbit.

611
00:34:46,800 --> 00:34:48,450
Turns out you can buy these at...

612
00:34:49,620 --> 00:34:52,950
So our plan was to repurpose
some of these old dishes.

613
00:34:52,950 --> 00:34:53,783
Not that one,

614
00:34:53,783 --> 00:34:55,350
it's too bent.

615
00:34:55,350 --> 00:34:56,943
No, don't use that one.

616
00:34:58,830 --> 00:35:03,830
We could get these new C band LNBs.

617
00:35:03,900 --> 00:35:06,810
This was like 42 bucks

618
00:35:06,810 --> 00:35:08,820
for the top of the end
model off of Amazon.

619
00:35:08,820 --> 00:35:11,460
You could get one as low as 29 bucks

620
00:35:11,460 --> 00:35:13,320
depending on the quality.

621
00:35:13,320 --> 00:35:18,320
Unfortunately, you can't
really do this anymore

622
00:35:18,360 --> 00:35:22,410
as of January because these are designed

623
00:35:22,410 --> 00:35:27,410
to pick up the old satellite
L band or C band signals

624
00:35:27,630 --> 00:35:32,430
and the FCC just reallocated
some of that for 5G.

625
00:35:32,430 --> 00:35:37,430
And so you need a new LNB to
basically filter those out.

626
00:35:38,010 --> 00:35:40,680
Otherwise, you're just
gonna have this antenna

627
00:35:40,680 --> 00:35:44,853
being bombarded with 5G noise.

628
00:35:46,170 --> 00:35:49,410
So unfortunately, these
aren't sold anymore.

629
00:35:49,410 --> 00:35:52,410
Maybe they'll come out
with better ones now.

630
00:35:52,410 --> 00:35:55,800
The second hurdle was that
these DirecTV dishes have

631
00:35:55,800 --> 00:35:58,200
these custom LNB mounts.

632
00:35:58,200 --> 00:36:03,200
I got a friend to 3D
print an adapter for that.

633
00:36:03,810 --> 00:36:07,773
That was kind of was held
together like a little clamp.

634
00:36:09,390 --> 00:36:11,100
All right, so where do you get...

635
00:36:11,100 --> 00:36:13,110
So, that's the antenna.

636
00:36:13,110 --> 00:36:16,260
Where do you get the receiver box?

637
00:36:16,260 --> 00:36:18,540
Well, Amazon, of course.

638
00:36:18,540 --> 00:36:22,650
This is a decoder box that runs Linux,

639
00:36:22,650 --> 00:36:26,280
supports H.264, H.265,

640
00:36:26,280 --> 00:36:28,140
is networkable,

641
00:36:28,140 --> 00:36:29,520
sits on the wifi,

642
00:36:29,520 --> 00:36:32,010
probably hackable if the firmware is,

643
00:36:32,010 --> 00:36:34,380
in the clear, not encrypted.

644
00:36:34,380 --> 00:36:35,583
It's 31 bucks.

645
00:36:36,540 --> 00:36:39,480
So that actually worked well

646
00:36:39,480 --> 00:36:44,103
at least with some local tests.

647
00:36:45,300 --> 00:36:49,473
This was our initial attempt
at putting up a dish.

648
00:36:51,501 --> 00:36:56,010
It kind of looks like the
LNB there is not pointed

649
00:36:56,010 --> 00:36:57,933
at the right part of the dish.

650
00:36:59,220 --> 00:37:00,270
There's also...

651
00:37:00,270 --> 00:37:03,660
It's missing what's
known as a conical scaler

652
00:37:03,660 --> 00:37:06,840
which basically blinds part of the LNB

653
00:37:06,840 --> 00:37:09,030
so it doesn't pick up background radiation

654
00:37:09,030 --> 00:37:10,203
from beyond the dish.

655
00:37:11,340 --> 00:37:15,473
And we didn't really have
any good idea of exactly

656
00:37:18,150 --> 00:37:20,037
where the focal point of this dish was.

657
00:37:20,037 --> 00:37:24,330
And so I did this kind of a hacky thing

658
00:37:24,330 --> 00:37:27,810
where I just added a bunch of
reflective tape to the dish

659
00:37:27,810 --> 00:37:32,810
and had a distant light source
to determine the focal point

660
00:37:32,970 --> 00:37:35,535
and basically adjusted the LNB

661
00:37:35,535 --> 00:37:39,843
to be right at that focal point.

662
00:37:41,788 --> 00:37:45,570
Unfortunately, I went
home and we left this out

663
00:37:45,570 --> 00:37:49,650
and the sun came out and I
guess we found the focal point

664
00:37:49,650 --> 00:37:51,963
because we melted the plastic of the LNB.

665
00:37:53,910 --> 00:37:56,940
So, there's a proper way to do this

666
00:37:56,940 --> 00:38:00,430
which is to actually go
to one of these lovely

667
00:38:01,950 --> 00:38:04,800
satellite TV sites.

668
00:38:04,800 --> 00:38:07,380
And you can get one of
these Ku band dishes

669
00:38:07,380 --> 00:38:11,490
and actually convert
them to receiving C band.

670
00:38:11,490 --> 00:38:13,410
So one of these cost...

671
00:38:13,410 --> 00:38:14,243
I don't know.

672
00:38:14,243 --> 00:38:19,170
It's like 150 bucks or
maybe up to 250 bucks.

673
00:38:19,170 --> 00:38:22,800
Basically, it gets you a larger dish,

674
00:38:22,800 --> 00:38:25,743
gets you known parameters
like where the focal point is.

675
00:38:26,880 --> 00:38:30,930
I was talking about this
with someone recently

676
00:38:30,930 --> 00:38:32,107
and they said,

677
00:38:32,107 --> 00:38:33,840
"Oh yeah, you did a mini bud."

678
00:38:33,840 --> 00:38:35,040
I'm like, "What's a mini bud?"

679
00:38:35,040 --> 00:38:38,490
And it turns out a mini bud is modifying

680
00:38:38,490 --> 00:38:43,490
one of these Ku band dishes to
receive C band transmissions.

681
00:38:45,990 --> 00:38:50,990
And so we got about 5 to
10 dB of carrier-to-noise

682
00:38:52,890 --> 00:38:56,820
off of one of these dishes
that a friend brought

683
00:38:56,820 --> 00:38:58,470
and bought over.

684
00:38:58,470 --> 00:39:03,330
If you actually want to do
a proper C band dish size,

685
00:39:03,330 --> 00:39:06,690
well, you can always go
over to China and Alibaba

686
00:39:06,690 --> 00:39:07,920
and there is one for...

687
00:39:07,920 --> 00:39:10,293
I don't know, 150 bucks
or something like that.

688
00:39:11,310 --> 00:39:13,950
Once again, you need new LNBs

689
00:39:13,950 --> 00:39:16,710
because the FCC reallocated

690
00:39:16,710 --> 00:39:18,993
a bunch of those frequencies for 5G, so.

691
00:39:20,280 --> 00:39:22,380
And of course, well,
all of this is moot now

692
00:39:22,380 --> 00:39:23,640
because the satellite's gone.

693
00:39:23,640 --> 00:39:24,473
End of life.

694
00:39:24,473 --> 00:39:26,130
Bye.

695
00:39:26,130 --> 00:39:29,883
But you might still be able to
do this for your own events.

696
00:39:32,100 --> 00:39:36,750
So for what we did, you
need a very large dish.

697
00:39:36,750 --> 00:39:40,710
You need a way to up
convert that to 6 gigahertz.

698
00:39:40,710 --> 00:39:44,790
Apparently, the amplifier
wasn't actually that powerful.

699
00:39:44,790 --> 00:39:48,090
The total power out of
it was about 15 Watts.

700
00:39:48,090 --> 00:39:50,700
There was a lot of gain in the antenna.

701
00:39:50,700 --> 00:39:52,800
Of course, you need permission to do this,

702
00:39:54,240 --> 00:39:58,173
like a transponder lease or
an STA or something like that.

703
00:39:59,100 --> 00:40:01,863
You could do this with Ku band satellites.

704
00:40:03,690 --> 00:40:08,690
Those uplink frequencies are
more like 14.5 gigahertz.

705
00:40:09,150 --> 00:40:12,240
So you need some more esoteric components

706
00:40:12,240 --> 00:40:15,870
and apparently you need
a higher power amplifier.

707
00:40:15,870 --> 00:40:20,870
So, maybe it's a bit more
difficult to do there,

708
00:40:21,180 --> 00:40:25,230
but there are a lot of Ku
band satellite parts available

709
00:40:25,230 --> 00:40:27,420
on eBay because they're
used for a lot of things

710
00:40:27,420 --> 00:40:29,133
like internet access.

711
00:40:31,399 --> 00:40:33,610
I don't know, like news gathering

712
00:40:35,130 --> 00:40:38,223
with those TV trucks and stuff like that.

713
00:40:39,060 --> 00:40:41,640
All right, so how feasible
is this for some...

714
00:40:41,640 --> 00:40:42,663
All right, yeah.

715
00:40:43,800 --> 00:40:44,760
All right.

716
00:40:44,760 --> 00:40:49,020
What if you don't wanna do
something with the satellite?

717
00:40:49,020 --> 00:40:51,030
So almost nothing in this talk

718
00:40:51,030 --> 00:40:54,390
is actually specific to satellites.

719
00:40:54,390 --> 00:40:58,200
So there's a variation on DVB called DVB-T

720
00:40:58,200 --> 00:41:01,170
which is used for terrestrial broadcast.

721
00:41:01,170 --> 00:41:02,700
And as it turns out,

722
00:41:02,700 --> 00:41:06,270
almost everyone at a Hacker
Con has a DVBT receiver.

723
00:41:06,270 --> 00:41:08,670
It's one of those RTL-SDR Dongles.

724
00:41:08,670 --> 00:41:10,260
That's what they were
originally designed for.

725
00:41:10,260 --> 00:41:12,840
They have Silicon to actually de-modulate

726
00:41:12,840 --> 00:41:16,773
these DVB-T terrestrial TV signals.

727
00:41:18,180 --> 00:41:20,850
So you need to change some
of the modulation parameters

728
00:41:20,850 --> 00:41:25,850
and Canoe radio uses the DVP-T
version instead of DVB-S.

729
00:41:26,760 --> 00:41:31,050
But basically, the rest of
the chain is about the same.

730
00:41:31,050 --> 00:41:35,580
You still need to amplify the signal

731
00:41:35,580 --> 00:41:40,533
to get it beyond a couple of
feet or something like that.

732
00:41:41,700 --> 00:41:46,700
You could use some amateur TV amplifiers,

733
00:41:47,340 --> 00:41:49,440
those for like NTSE.

734
00:41:49,440 --> 00:41:51,450
They are linear amplifiers.

735
00:41:51,450 --> 00:41:55,143
They will work just
fine for DVB-T as well.

736
00:41:56,280 --> 00:42:00,287
I found this lovely Russian LTE amp

737
00:42:02,160 --> 00:42:06,030
and it turns out that
Russian cellular frequencies

738
00:42:06,030 --> 00:42:08,310
overlap with...

739
00:42:08,310 --> 00:42:11,760
Or some Russian cellular
frequencies overlap

740
00:42:11,760 --> 00:42:14,403
with some Ham radio frequencies in the US.

741
00:42:15,570 --> 00:42:20,160
So theoretically, you could
use one of these devices

742
00:42:20,160 --> 00:42:23,880
and by applying proper filtering in

743
00:42:23,880 --> 00:42:25,470
and monitoring what you're sending out,

744
00:42:25,470 --> 00:42:28,620
you could probably set this up.

745
00:42:28,620 --> 00:42:30,873
So, this is what it looks like.

746
00:42:33,000 --> 00:42:35,880
It's basically RF in and a lot of RF out

747
00:42:35,880 --> 00:42:38,343
and a lot of RF porn there.

748
00:42:40,020 --> 00:42:42,930
So the final thing you need

749
00:42:42,930 --> 00:42:46,500
to do this is permission, of course.

750
00:42:46,500 --> 00:42:50,460
So one creative way of interpreting

751
00:42:50,460 --> 00:42:54,390
the amateur radio rules is that...

752
00:42:54,390 --> 00:42:57,690
So normally, you can't send broadcasts

753
00:42:57,690 --> 00:42:58,950
over the amateur service.

754
00:42:58,950 --> 00:43:02,340
They need to be either
two-way communications

755
00:43:02,340 --> 00:43:04,740
or seeking two-way communications,

756
00:43:04,740 --> 00:43:09,480
but there is a special carve
out for information bulletins

757
00:43:09,480 --> 00:43:11,310
directly only to amateur operators

758
00:43:11,310 --> 00:43:14,430
consisting solely of subject
matter of direct interest

759
00:43:14,430 --> 00:43:15,810
to the amateur service,

760
00:43:15,810 --> 00:43:16,830
like this talk.

761
00:43:16,830 --> 00:43:18,720
I could have broadcast this talk live.

762
00:43:18,720 --> 00:43:22,050
Unfortunately, we couldn't
test that in time.

763
00:43:22,050 --> 00:43:23,703
So, nevermind about that.

764
00:43:24,660 --> 00:43:26,010
The other way to do it is

765
00:43:26,010 --> 00:43:28,390
to get a Special Temporary Authority

766
00:43:30,000 --> 00:43:35,000
from the FCC for testing
in unused TV white space

767
00:43:35,250 --> 00:43:38,553
or actually any frequency that's unused.

768
00:43:39,510 --> 00:43:43,920
So Shadytel actually
got an STA from the FCC

769
00:43:43,920 --> 00:43:45,810
to run a GSM network.

770
00:43:45,810 --> 00:43:47,460
When you're at Toor Camp,

771
00:43:47,460 --> 00:43:48,660
basically you send out...

772
00:43:48,660 --> 00:43:51,217
You apply to the FCC and you say,

773
00:43:51,217 --> 00:43:55,633
"Here's this test that I wanna do and..."

774
00:43:56,850 --> 00:43:57,683
Yeah, let's see.

775
00:43:58,710 --> 00:43:59,543
Here's what we said,

776
00:43:59,543 --> 00:44:00,750
"The purpose of this test will be

777
00:44:00,750 --> 00:44:02,370
to user verify the functionality

778
00:44:02,370 --> 00:44:04,200
of an open source GSM network design

779
00:44:04,200 --> 00:44:05,340
and an outdoor test range."

780
00:44:05,340 --> 00:44:06,630
Blah, blah, blah, blah, blah.

781
00:44:06,630 --> 00:44:08,910
Yeah, you could do something like that.

782
00:44:08,910 --> 00:44:12,270
Similar if you are at
Hacker camp or Burning Man,

783
00:44:12,270 --> 00:44:13,560
or something like that.

784
00:44:13,560 --> 00:44:14,640
All right.

785
00:44:14,640 --> 00:44:16,680
So what's all this good for?

786
00:44:16,680 --> 00:44:19,740
So with the large enough audience,

787
00:44:19,740 --> 00:44:24,360
these RF broadcasts are a very
efficient use of bandwidth.

788
00:44:24,360 --> 00:44:27,270
So, DEF CON TV could be done over this.

789
00:44:27,270 --> 00:44:30,660
And then if you're in your hotel room

790
00:44:30,660 --> 00:44:32,970
trying to pull it up on Twitch or whatnot

791
00:44:32,970 --> 00:44:35,040
and you're not getting a good signal,

792
00:44:35,040 --> 00:44:37,110
well, you can just pull it over the air

793
00:44:37,110 --> 00:44:38,433
because it's broadcast.

794
00:44:39,420 --> 00:44:43,530
Also the range for these
depending on your power level

795
00:44:43,530 --> 00:44:47,403
and what you're allowed to do
can be significantly larger.

796
00:44:49,140 --> 00:44:52,710
Works if the internet is down.

797
00:44:52,710 --> 00:44:55,740
So if there's geopolitical conflicts,

798
00:44:55,740 --> 00:44:57,423
maybe the internet gets cut,

799
00:44:58,440 --> 00:45:03,440
maybe some sources of
information are being censored.

800
00:45:03,780 --> 00:45:08,760
So, the EU decided to ban RT.

801
00:45:08,760 --> 00:45:11,470
And so you can't actually get RT

802
00:45:14,258 --> 00:45:17,550
from your cable company in the EU,

803
00:45:17,550 --> 00:45:19,923
but you can pull it
directly off the satellite.

804
00:45:21,120 --> 00:45:25,200
But you know, in some
places where reception...

805
00:45:25,200 --> 00:45:27,270
Some places still like...

806
00:45:27,270 --> 00:45:30,840
Especially, some countries
regulate the reception

807
00:45:30,840 --> 00:45:33,150
of TV signals like that.

808
00:45:33,150 --> 00:45:36,360
So, just be careful with that.

809
00:45:36,360 --> 00:45:39,240
And so that's the end of my talk.

810
00:45:39,240 --> 00:45:41,400
I am Karl,

811
00:45:41,400 --> 00:45:42,633
Supersat online,

812
00:45:43,830 --> 00:45:44,940
from Shadytel Labs,

813
00:45:44,940 --> 00:45:46,410
and we are always in your business,

814
00:45:46,410 --> 00:45:47,782
and thank you.

815
00:45:47,782 --> 00:45:50,949
(audience applauding)