My name is Clayton Smith. I'm an amateur radio operator (call sign VE3IRR), Esperanto speaker, computer security researcher, and hardware hacker.
Recently I bought a Sangean HDR-14 radio, because I wanted to experiment with HD Radio emergency alerts. While some parts of the emergency alert system are described in the NRSC-5-E standard, important details are missing. For instance, the format of the control (CNT) data is not specified. As a result, some reverse engineering will be needed to bring emergency alert support to gr-nrsc5 and nrsc5.…
I’ve been interested in HD Radio for many years, and maintain open-source software for receiving and transmitting HD Radio signals. To verify that the transmit software (gr-nrsc5) is working correctly, I use a Sangean HDT-20 tuner to receive the generated signal. The HD Radio standard (NRSC-5) defines various “service modes,” which allow broadcasters to select how much bandwidth they would like to…
Last week I headed back to Ottawa for the BSides Ottawa conference & CTF. As usual, I put together a series of radio challenges, and Xanthus Security generously provided each team with an RTL-SDR dongle that they could use to receive the mysterious signals floating around the conference area. CTF players were asked to imagine they were employees of “Hackers 4 Cash,” a consulting firm hired by…
Last week I attended the NorthSec conference & CTF in Montreal. It was a great event, and I had a lot of fun! This year’s conference badge included a neat game where attendees could plug their badges together to earn points and unlock additional LED blinking patterns: Photo by Simon Carpentier is licensed under CC BY-NC 4.0 I wanted to reverse engineer the badge-to-badge communication protocol,…
Since 2016, the GNU Radio Conference has held a Capture the Flag (CTF) competition in parallel with its technical track. Secret messages (“flags”) are hidden in radio signals, which players have to find and then submit to a scoring system to earn points. The CTF is my favourite part of GRCon, so when the conference organizers asked whether I’d be willing to organize this year’s competition, I…
For this year’s BSides Ottawa CTF, I built a number of software-defined radio challenges. (More about the CTF can be found in my previous post). One of my favourites was “Hopping along”, a four-part frequency hopping challenge. When players tuned to 922.125 MHz, they were greeted with a narrow-band FM signal: “This is VE3IRR. The first flag is tango…” And then the signal hopped down to 922.025…
BSides Ottawa took place on November 28 & 29, and this year’s CTF was the biggest ever! 200 players showed up, and organized themselves into 35 teams. I volunteered to create a radio track with 24 flags, as well as a crypto track with four flags. Thanks to a generous donation from Xanthus Security, each team received an RTL-SDR dongle which could be used to solve the radio challenges. My favourite…
When my water bill arrived a couple weeks ago, I noticed it was higher than usual. I suspected a leaky appliance, but wasn’t sure what it might be. I was already aware that Ottawa’s water meters use the ERT protocol, which can be received using an RTL-SDR dongle and rtlamr. I installed the program on an old laptop, and stored its output in a file with rtlamr | tee usage.txt. I checked my meter…
Tonight I was visiting a friend of mine, and noticed a strange looking switch on the wall. My friend explained that it was a wireless controller for his ceiling fan. Since we’re both radio geeks, and I happened to have my BladeRF with me, I got the idea to reverse engineer it. The first step was to figure out what frequency the controller was transmitting on. The BladeRF makes that a fairly easy…
I love my BladeRF! It’s a very versatile SDR transceiver, and I’ve used it to receive and transmit all sorts of signals. Most recently I got it transmitting DVB-T digital television signals on the amateur radio bands, with my trusty NooElec TV28T serving as the receiver. (It is a TV tuner, after all, so why not use it as one for once?) In this post, I’ll show you how to replicate what I’ve done.…