Wireless Hacks

885 Articles

NanoVNA Tests Antenna Pattern

January 11, 2020 by 6 Comments

When [Jephthai] wanted to build his own Yagi antenna, he turned to MMANA software for antenna modeling. This is an antenna analysis program that uses the moment method to calculate parameters for different antenna geometries. After building the Yagi, the predicted tuning and impedance matched the real antenna nicely. But what about the radiation pattern? To test that, he used a NanoVNA and a clever test setup.

He needed a test spot out of the antenna’s near field so he set up his workstation 18 feet away from the test antenna which was on a mount that could rotate. On the edge of the workstation table — affixed with painter’s tape — is a NanoVNA connected to a laptop.

Continue reading “NanoVNA Tests Antenna Pattern” →

Full Duplex Radio Claimed Easier With Analog Module

January 6, 2020 by 37 Comments

There’s an old saying that we have one mouth and two ears so you can listen twice as much as you talk. However, talking and listening at the same time is fairly difficult and doing it with radio signals is especially hard. A company called Kumu Networks has an analog module that can use self-interference cancellation which allows transmitting and receiving on the same frequency with around 50 dB of the transmitted signal in the transceiver. You can see a video about Kumu’s claims its technology below.

You may think that cell phones and ham radio repeaters transmit and receive at the same time, which of course they do, but usually on different frequencies to avoid direct interference. A diplexer is a device that sorts out the two frequencies while a duplexer sorts them out by the direction of the signal, but they are tricky to use. A duplexer can operate on a single frequency in applications such as radar, and even then it is still very difficult to prevent leakage from the transmitter from overloading and desensitizing the receiver.

Continue reading “Full Duplex Radio Claimed Easier With Analog Module” →

36C3: All Wireless Stacks Are Broken

December 30, 2019 by 29 Comments

Your cellphone is the least secure computer that you own, and worse than that, it’s got a radio. [Jiska Classen] and her lab have been hacking on cellphones’ wireless systems for a while now, and in this talk gives an overview of the wireless vulnerabilities and attack surfaces that they bring along. While the talk provides some basic background on wireless (in)security, it also presents two new areas of research that she and her colleagues have been working on the last year.

One of the new hacks is based on the fact that a phone that wants to support both Bluetooth and WiFi needs to figure out a way to share the radio, because both protocols use the same 2.4 GHz band. And so it turns out that the Bluetooth hardware has to talk to the WiFi hardware, and it wouldn’t entirely surprise you that when [Jiska] gets into the Bluetooth stack, she’s able to DOS the WiFi. What this does to the operating system depends on the phone, but many of them just fall over and reboot.

Lately [Jiska] has been doing a lot of fuzzing on the cell phone stack enabled by some work by one of her students [Jan Ruge] work on emulation, codenamed “Frankenstein”. The coolest thing here is that the emulation runs in real time, and can be threaded into the operating system, enabling full-stack fuzzing. More complexity means more bugs, so we expect to see a lot more coming out of this line of research in the next year.

[Jiska] gives the presentation in a tinfoil hat, but that’s just a metaphor. In the end, when asked about how to properly secure your phone, she gives out the best advice ever: toss it in the blender.

Tiny Bubbles In The Clock

December 20, 2019 by 9 Comments

When [DonHo] sang about tiny bubbles, he probably wasn’t thinking of them embedded in glycerine. But that’s where the bubbles in [ShinodaY]’s clock reside. The viscous fluid holds the bubbles better allowing the time to be read more easily. You can watch the relaxing display in the video below.

The theory of operation is simple and reminds us somehow of a reverse Tetris game. Solenoid valves at the base release air bubbles to form a row of the display. The bubbles rising makes room for the next row. The display has as many columns as there are air outlets at the bottom. Spacing the bubble pixels is as simple as adjusting the timing between air bubbles.

Continue reading “Tiny Bubbles In The Clock” →

Cloned Gate Remote Does It (Slightly) Better

December 11, 2019 by 20 Comments

Ever make something just to see if you could? Yeah, we thought so. [serverframework] wanted to see if he could clone the remote that opens his neighborhood gate, inspired by the long distance ding-dong-ditch efforts of [Samy Kamkar].

This clone uses an ATtiny85 and an RF module to emulate and send the frequency that the gate is waiting for. To accomplish that, [serverframework] had to figure out both the operating frequency and the timing used by the remote. The crystal inside seemed to indicate 295 MHz, and a quick check of the device’s FCC registration confirmed it. Then he used an SDR dongle to watch the data coming across when he pressed the button, and ran it through Audacity to figure out the timing.

Unfortunately, the 295 MHz crystal is a rare beast, so [serverframework] had to transplant the original to the donor RF module. Then it was just a matter of programming the ATtiny85 to send the frequency with the right timing. It actually does a better job since the original has no timing crystal, and the ‘tiny is clocked with a standard 16 kHz oscillator. The code is available within [serverframework]’s excellent write-up, and you can see a tiny demo after the break.

There’s more than one way to clone a gate remote. This one leverages MQTT to turn friends’ phones into remotes.

Continue reading “Cloned Gate Remote Does It (Slightly) Better” →

Your WiFi Signals Are Revealing Your Location

November 28, 2019 by 43 Comments

The home may be the hearth, but it’s not going to be a place of safety for too long.

With the abundance of connected devices making their ways into our homes, increasing levels of data may allow for more accurate methods for remote surveillance. By measuring the strength of ambient signals emitted from devices, a site can be remotely monitored for movement. That is to say, WiFi signals may soon pose a physical security vulnerability.

In a study from the University of Chicago and the University of California, Santa Barbara, researchers built on earlier studies where they could use similar techniques to “see through walls” to demonstrate a proof-of-concept for passive listening. Attackers don’t need to transmit signals or break encryptions to gain access to a victim’s location – they just need to listen to the ambient signals coming from connected devices, making it more difficult to track bad actors down.

Typically, connected devices communicate to an access point such as a router rather than directly with the Internet. A person walking near a device can subtly change the signal propagated to the access point, which is picked up by a receiver sniffing the signal. Most building materials do not block WiFi signals from propagating, allowing receivers to be placed inconspicuously in different rooms from the access point.

WiFi sniffers are relatively inexpensive, with models running for less than $20. They’re also small enough to hide in unsuspecting locations – inside backpacks, inside a box – and emit no signal that could be detected by a target. The researchers proposed some methods for safeguarding against the vulnerability: insulating buildings against WiFi leakage (while ensuring that desirable signals, i.e. signals from cell tower are still able to enter) or having access points emit a “cover signal” that mixes signals from connected devices to make it harder to sniff for motion.

While we may not be seeing buildings surrounded by Faraday cages anytime soon, there’s only going to be more attack surfaces to worry about as our devices continue to become connected.

[Thanks to Qes for the tip!]

A Radio For The Apocalypse

November 15, 2019 by 53 Comments

There’s been a spate of apocalypse related articles over the last few weeks, but when I saw an AM radio made from a hand-wound coil and an oxidized British penny, I couldn’t help but be impressed. We’ve covered foxhole radios, stereotypical radios that are cobbled together from found parts during wartime.

This example uses a variable capacitor for tuning, but that’s technically optional. All that’s really needed is a coil and something to work as a diode. Surprisingly, copper oxide is a semiconductor, and the surface oxidation on a penny is enough to form a rudimentary diode. Though, note, not all pennies have that necessary coating of copper. If a penny has green oxide, it’s likely a candidate.

Need a quickly cobbled together AM radio? Have some wire and a penny? Yeah, watch the video below the break, and you’ll know how to make it happen. When the apocalypse comes, you’ll thank us.

Continue reading “A Radio For The Apocalypse” →