Post on 17-Oct-2020
Free
PowerPoint
Templates
ScanningtheAirwavesor: how to build a trunked radio scanner with a $20 USB stick
Free
PowerPoint
Templates
BRYANPASSIFIUME&RICHARDHENDERSONDefCon 25,LasVegas– July2017
Free
PowerPoint
Templates
Welcome!
Free
PowerPoint
Templates
WhoWeAre
Bryan:
Ham,CrimeReporter/PhotogforCalgarySun.Co-founderofHamRadiosatiresiteHamsexy.com
@BryanPassifiume
Richard:
Ham,writer,infosec professional.
@RichSentMe
Free
PowerPoint
Templates
Is:
awaytolearnmoreaboutSDR,listeningin,modernfrequencyscanning
teachingthebasictoolstogetstarted
IsNOT:
anall-encompassingwalkthroughofhowtolistentoeverythingoutthere.
awaytocrackencryptedcomms… well,notall encryptedcomms (voiceinversionisNOTcryptolulz)
ahand-holdingexercisetosetyouupwithascannerandletyouloose– you’llneedtotakewhatyoulearn
andapplyittoyourownlocalenvironment
VSWhatthisis
Whatthisisnot
Free
PowerPoint
Templates
Free
PowerPoint
Templates
Wearenotlawyers.Don’tbestupid.Yourmileage
mayvary.Usethisforbad,it’syourass.“-- Bryan&Richard,NotLawyers
Free
PowerPoint
Templates
Free
PowerPoint
Templates
It’sWorthIt!
WhyGetaLicense?
It’sEasy Community KeytoRFExperimentation
Resources Trouble?Havingalicenseopensupallsortsofnew
gadgets,powerlevels,andideas.
Gettingstartedinmostplacesissupereasy.Noadvancedelectronicsknowledgeis
needed.
Itmaybeadyinghobby,buttherearestillaLOTofhamsout
there.
1000Wattsofpowercancarry.
Highpowerlevels,datalinks,moonbounce,satellites,etc.
Likemostthings,youcanfindtonsofhelponline.
Insomeplaces,havingahamlicenseistheonlylegally
alloweduseofcertainscanning
equipment
Free
PowerPoint
Templates
Free
PowerPoint
Templates
SYSTEMREQUIREMENTS----- Windows.NoVMs.Srs. -----
Free
PowerPoint
Templates
Free
PowerPoint
Templates
2
3
4
1AQuickHistoryHowdidwegettohere?
PracticalIntroduction
SoftwareInstallation&Setup
AdvancedMonitoring
Currentstateofhardware,antennatypes,whyheatmatters,etc.
Gettingstartedwiththeintroductorysoftware(HDSDR)
Movingintotrunkedradiosystems– howtheywork,installingothersoftwaretomonitor
Free
PowerPoint
Templates
Agenda
5WheretoGofromHere?Multi-stickmonitoring,pagerdecoding,wheretofindmoreinfo
Free
PowerPoint
Templates
PARTONE:
----- IntheBeginning… -----
Free
PowerPoint
Templates
EarlyRadioScanners…
Free
PowerPoint
Templates
TheBirthofSDR
Free
PowerPoint
Templates
Free
PowerPoint
Templates
UniversalSoftwareRadioPeripheral(USRP)
Free
PowerPoint
Templates
Free
PowerPoint
Templates
EntertheRealtek RTL2832U…
Free
PowerPoint
Templates
Free
PowerPoint
Templates
PARTTWO:
----- IntroductiontoSDRScanningToday -----
Free
PowerPoint
Templates
Free
PowerPoint
Templates
TheBasics:
Free
PowerPoint
Templates
Free
PowerPoint
Templates
OtherSticks:
Free
PowerPoint
Templates
Free
PowerPoint
Templates
AQuickNoteonAntennaConnectors:
Free
PowerPoint
Templates
Free
PowerPoint
Templates
AWordorTwoonHeat:
Free
PowerPoint
Templates
Free
PowerPoint
Templates
AWordorTwoonHeat:
Free
PowerPoint
Templates
Free
PowerPoint
Templates
PARTTHREE:
----- GettingStartedwithBasicScanning-----
Free
PowerPoint
Templates
Free
PowerPoint
Templates
GettingtheSoftware
Free
PowerPoint
Templates
Drivers:•WinUSB drivers via Zadig installer (http://zadig.akeo.ie/)
•ExtIO.DLL (https://github.com/josemariaaraujo/ExtIO_RTL)
Software:•HDSDR (http://www.hdsdr.de/)
•UniTrunker 1.0.32.5 (http://www.unitrunker.com/)
•DSDPlus 1.101 (https://www.dsdplus.com/)
•VB Cable 4.5 (http://www.vb-audio.com/Cable/index.htm)
Free
PowerPoint
Templates
InstallingtheSoftware
Free
PowerPoint
Templates
WinUSB: •Run ZADIG installer to load WinUSB drivers for each “bulk-in, interface” instance noted (if needed)
Free
PowerPoint
Templates
InstallingtheSoftware
Free
PowerPoint
Templates
SDRDriver/Libraries:
UnzipExtIO_RTL-master.zip
CopyzipfilecontentstoC:\ProgramFiles(x86)\HDSDR
HDSDR:
•RunHDSDR_install.exe,followetc.
•Runprogram
•LoadEXT_IOforSDRdongle:
• Options(F7)
• SelectInput
• PointtoExtIO_RTL.DLL in/release/folder
Free
PowerPoint
Templates
InstallingtheSoftware
Free
PowerPoint
Templates
Free
PowerPoint
Templates
Calibration&Operation
Free
PowerPoint
Templates
Free
PowerPoint
Templates
Calibration&Operation
Free
PowerPoint
Templates
Free
PowerPoint
Templates
TimetoDoSomeScanning!
Free
PowerPoint
Templates
Let’s take 30 minutes (or more!) to experiment.
Tune around, see what interesting signals you can find!
Suggestions:
- Local broadcast FM (87-108MHz)
- Other signals in the 450-520MHz range (FRS radio, commercial
UHF)
- We’ll key up radios and show you what low power vs. high power
signals might look like on your computer
- Can you find local ATC?
- Troubleshooting, initial questions, help, etc.
Free
PowerPoint
Templates
PARTFOUR:
----- AdvancedMonitoring-----
Free
PowerPoint
Templates
Free
PowerPoint
Templates
Trunking
Free
PowerPoint
Templates
Mostlargemunicipalradiosystemsemploysomeformoftrunkedradio
system,arepeater-based,scalablepacket-switchingradionetworkthat
permitsalargeamountofuserstouseasmallamountoffrequencies:
Free
PowerPoint
Templates
Trunking
Free
PowerPoint
Templates
MostcommonarevariantsofMotorolaTypeIInetworkssystem,using
singlecontrolchanneltoallocate&assignfrequenciestotalkgroups.
ExampleofTrunk88runningonmyhomecomputer:
Free
PowerPoint
Templates
HowDoTrunking SystemsWork?
Free
PowerPoint
Templates
- Talkgroups analogousto‘virtualchannels’
- Frequencyassignmentistransparenttotheuser
- Systemsaretypicallydesigned,built,andoperatedaroundthe”5x5”
principle
- Therefore,mostsystemshavealargenumberofTGsandasmall
numberofavailablefrequenciesandvoicechannels
- ThenumberofmaximumactiveTGsatonceis,asyou’dexpect,
limitedbythenumberofvoicechannels
- DevelopmentofcommercialTrunkTracking scannersrequiredreverseengineeringofeachvendor’sproprietarycontrolchanneldata
Free
PowerPoint
Templates
HowDoTrunking SystemsWork?
Free
PowerPoint
Templates
- Talkgroups analogousto‘virtualchannels’
- Frequencyassignmentistransparenttotheuser
- Systemsaretypicallydesigned,built,andoperatedaroundthe”5x5”
principle
- Therefore,mostsystemshavealargenumberofTGsandasmall
numberofavailablefrequenciesandvoicechannels
- ThenumberofmaximumactiveTGsatonceis,asyou’dexpect,
limitedbythenumberofvoicechannels
- DevelopmentofcommercialTrunkTracking scannersrequiredreverseengineeringofeachvendor’sproprietarycontrolchanneldata
Free
PowerPoint
Templates
HowDoTrunking SystemsWork?
Free
PowerPoint
Templates
Howatrunkedtransmissionworksinthepicturehere:
1. UserpressesPTTkeyonradio,whiletunedtoTGA3
2. Trunkcontrollersearchesforafreefrequency(inthis
case864.000MHz),andthenissueschannelgrantto
allradiostunedtoTGA3touse864.000MHz.
3. WhenuserreleasesPTT,trunkcontrollerordersall
radiosonTGA3tostandby,andthenreleases864.000
backintotheavailablefrequencypool.
Free
PowerPoint
Templates
SomeBackgroundontheHistoryofSystemHacking
Free
PowerPoint
Templates
• Workbuiltonshouldersofdecadesofradiohackingcommunitiescenteredaroundthe
Batlabs website,severalRussian-basedhackingcollectivesandlaterthenow-defunct
P25.ca/communications,support forums.
• MotorolaRSS/CPSsoftwareveryexpensiveandfiercelyprotected,onlinefilesharing
helpedspreadthehobby
• RudimentaryprotectionschemesbyMotorolaeasilycircumvented,suchassoftware
(andlaterhardware)systemkeysfortrunkedradioprogramming,theleakoflab/depot
versionsofprogrammingsoftware,andwhatwasonceathrivingcommunityofhackers
andusers,developingworkaroundsandcountermeasurestoMotorola’slatestefforts
toshutoutunauthorizedusers
• Innovationandworkaroundsmeanalmosteverytrunkedpoliceradiosystemoperating
inNorthAmericahasatleastacoupleofunauthorizedradiossilentlyaffiliatedand
listeningin
• Biggestdetrimentnowisencryption— AES256-based
Free
PowerPoint
Templates
IntroductiontoUniTrunker
Free
PowerPoint
Templates
• Aready-to-rollcopyofUniTrunker willbeprovidedtoattendees,instead
offorcingeveryonetorolltheirown(whichwouldtakeforevertogetset
up).
Free
PowerPoint
Templates
IntroductiontoMOTOTRBOandDSD+
Free
PowerPoint
Templates
• DemonstrationofDSD+anditsabilitytodecodethelocalMotoTrbo
system.;)
• DiscussiononhowDSD+candecodeP25audioviapipedaudiofromother
software(likeHDSDR,UniTrunker,etc.)
Free
PowerPoint
Templates
IntroductiontoMOTOTRBOandDSD+
Free
PowerPoint
Templates
• QuickprimeronMotoTrbo/DMRmethodology(moreslidestocomehere)
• TDMA
• Timeslots
• sidealong data/telemetry,etc.
Free
PowerPoint
Templates
PARTFIVE:
-----WheretoGoFromHere-----
Free
PowerPoint
Templates
Free
PowerPoint
Templates
OnlineResourcesforFrequencyData
Free
PowerPoint
Templates
• RadioReference
• Othersites
• We’lldemofindinginfoforyourarea!
Free
PowerPoint
Templates
OnlineResourcesforGettingaHamRadioLicense
Free
PowerPoint
Templates
• ARRL
• RAC
• QuestionPools
• Howtofindanexaminer,whattheexamislike,etc.
Free
PowerPoint
Templates
SpecificQuestions?
Free
PowerPoint
Templates
• We’llusetherestofthetimetoplay,experiment,TX/RX!