SDR & RF Hacking
Introduction to Software Defined Radio (SDR), signal analysis, and replay attacks. Learn how to capture, analyze, and replay radio signals using hardware like HackRF and RTL-SDR, and software tools like URH and GQRX.
Warning
Signal Analysis
Signal analysis involves visualizing and interpreting radio signals to understand their properties. The most common visualization tool is the waterfall display, which shows frequency over time, with color intensity representing signal strength.
Key Concepts
- Frequency: The specific radio frequency the signal is operating on (e.g., 433.92 MHz).
- Bandwidth: The range of frequencies the signal occupies.
- Modulation: How data is encoded onto the carrier wave. Common types include:
- ASK (Amplitude Shift Keying): Data is represented by varying the amplitude.
- OOK (On-Off Keying): A simple form of ASK where the carrier is present for '1' and absent for '0'.
- FSK (Frequency Shift Keying): Data is represented by varying the frequency.
Replay Attacks
A replay attack involves capturing a valid signal (e.g., from a car key fob or garage door remote) and retransmitting it later to trigger the same action. This is effective against simple systems that use fixed codes.
Information
Modern systems use "Rolling Codes" (or Hopping Codes), where the code changes with every button press. If you capture a code and replay it, the receiver will reject it because it expects a new, unique code.
Recording a Signal
Use hackrf_transfer to capture a signal to a file.
hackrf_transfer -r capture.bin -f 433920000 -s 2000000Replaying a Signal
Transmit the captured signal back on the same frequency.
hackrf_transfer -t capture.bin -f 433920000 -s 2000000 -x 47Flipper Zero
The Flipper Zero is a portable multi-tool for pentesters and geeks in a toy-like body. It supports Sub-GHz, NFC, RFID, Infrared, and more. It significantly simplifies the process of capturing and replaying signals compared to using a laptop with an SDR dongle.
For Sub-GHz attacks, the Flipper Zero can:
- Read and save signals from remotes.
- Emulate saved signals (Replay Attack).
- Analyze frequency usage.