Spoofing Cell Networks with a USB to VGA Adapter

RTL-SDR brought cheap and ubiquitous Software Defined Radio (SDR) to the masses, opening up whole swaths of the RF spectrum which were simply unavailable to the average hacker previously. Because the RTL-SDR supported devices were designed as TV tuners, they had no capability to transmit. For the price they are still an absolutely fantastic deal, and deserve to be in any modern hacker’s toolkit, but sometimes you want to reach out and touch someone.

GSM network broadcast from a VGA adapter

Now you can. At OsmoDevCon [Steve Markgraf] released osmo-fl2k, a tool which allows transmit-only SDR through cheap USB 3.0 to VGA adapters based on the Fresco Logic FL2000 chip. Available through the usual overseas suppliers for as little has $5 USD, these devices can be used unmodified to transmit low-power FM, DAB, DVB-T, GSM, UMTS and GPS signals.

In a demonstration on the project page, one of these USB VGA adapters is used to broadcast a GSM cellular network which is picked up by the adjacent cell phones. Another example shows how it can be used to broadcast FM radio. A GitHub repository has been set up which includes more examples. The signals transmitted from the FL2000 chip are obviously quite weak, but the next step will logically be the hardware modifications necessary to boost transmission to more useful levels.

To say this is a big deal is something of an understatement. For a few bucks, you’ll be able to get a device to spoof cellular networks and GPS signals. This was possible before, of course, but took SDR hardware that was generally outside the budget of the casual experimenter. If you bought a HackRF or an Ettus Research rig, you were probably responsible enough not to get into trouble with it, but that’s not necessarily the case anymore. As exciting as this technology is, we would be wise to approach it with caution. In an increasingly automated world, GPS spoofing can have some pretty bad results.

SDR IF Experiments

The R820T tuner IC is used in the popular Airspy software defined radio (SDR) as well as many of the inexpensive RTL SDR dongles. [TLeconte] did some experiments on intermediate frequency (IF) configuration of the chip, and you’ll find his results interesting.

Using 5 million samples per second and the device’s real mode, the tests look at a what comes out when the IC reads a noise source. There are two registers that set the IF parameters, but the tests show the effects these registers have in precise terms.

Continue reading “SDR IF Experiments”

The Raspberry Pi 3B+ As An SDR – Without The SDR!

We’ve become used to software-defined radio as the future of radio experimentation, and many of us will have some form of SDR hardware. From the $10 RTL USB sticks through to all-singing, all-dancing models at eye-watering prices, there is an SDR for everyone.

What about the idea of an SDR without any external hardware? Instead of plugging something into your Raspberry Pi, how about using the Pi itself, unmodified? That’s just what the Nexmon SDR project has achieved, and this has been made possible through clever use of the on-board Broadcom 802.11ac WiFi chip. The result is a TX-capable SDR, albeit one only capable of operating within the 2.4 GHz and 5 GHz spectrum used by WiFi.

The team had previously worked extensively with the chipset in the Nexus 5 phone, and the SDR extension was first available on that platform. Then along came the Raspberry Pi 3 B+ with a similar-enough WiFi chipset that the same hack was portable to that platform, et voilá: WiFi SDR on a Pi 3 B+.

If you’ve not looked at the Pi 3 B+ we’d like to direct you to our review. If you don’t have a Nexus 5 kicking around, and you’d like to do some WiFi-band SDR work, it’s looking like an amazing deal.

Via rtl-sdr.com.

Icoboard Software Defined Radio Platform

The Icoboard is a plug-in for the Raspberry Pi with a Lattice iCE FPGA onboard. Combined with a cheap A/D converter, [OpenTechLab] build a software-defined radio using all open source tools. He found some inexpensive converters that cost about $25 and were fast enough (32 MHz) for the purpose at hand. The boards also had a digital to analog converter and he was able to find the data sheets. You can see a video with the whole project covered, below.

The video, by the way, is pretty extensive (about an hour’s worth) and covers the creation of a PC board to connect from the Icoboard to the converters. There’s also a 3D printed frame, and that’s explained in detail as well.

Continue reading “Icoboard Software Defined Radio Platform”

Review: LimeSDR Mini Software Defined Radio Transceiver

It’s fair to say that software-defined radio represents the most significant advance in affordable radio equipment that we have seen over the last decade or so. Moving signal processing from purpose-built analogue hardware into the realm of software has opened up so many exciting possibilities in terms of what can be done both with more traditional modes of radio communication and with newer ones made possible only by the new technology.

It’s also fair to say that radio enthusiasts seeking a high-performance SDR would also have to be prepared with a hefty bank balance, as some of the components required to deliver software defined radios have been rather expensive. Thus the budget end of the market has been the preserve of radios using the limited baseband bandwidth of an existing analogue interface such as a computer sound card, or of happy accidents in driver hacking such as the discovery that the cheap and now-ubiquitous RTL2832 chipset digital TV receivers could function as an SDR receiver. Transmitting has been, and still is, more expensive.

The LimeSDR Mini's chunky USB stick form factor.
The LimeSDR Mini’s chunky USB stick form factor.

A new generation of budget SDRs, as typified by today’s subject the LimeSDR Mini, have brought down the price of transmitting. This is the latest addition to the LimeSDR range of products, an SDR transceiver and FPGA development board in a USB stick format that uses the same Lime Microsystems LMS7002M at its heart as the existing LimeSDR USB, but with a lower specification. Chief among the changes are that there is only one receive and one transmit channel to the USB’s two each, the bandwidth of 30.72 MHz is halved, and the lower-end frequency range jumps from 100 kHz to 10 MHz. The most interesting lower figure associated with the Mini though is its price, with the early birds snapping it up for $99 — half that of its predecessor. (It’s now available on Kickstarter for $139.)

Continue reading “Review: LimeSDR Mini Software Defined Radio Transceiver”

Finding Noise with an Antenna

[K5ACL], aka [SignalSearch], recently brought his active receive loop antenna in off the roof to give it a checkup and perform any necessary maintenance. While it was in the shack, he took the opportunity to discuss how well it would perform indoors. The verdict? Not ideal. He’d mount it 50 feet away from the house if the HOA would let him.

Houses, and subsequently most ham shacks, are filled with noise sources that interfere badly with HF. So after spending a minute or so listening on an SDR, [K5ACL] demonstrates another use for this type of tightly-tuned antenna—as a noise detector.

The main culprit in [K5ACL]’s house is the ceiling light that’s right there in the shack. You can see the noise striping the waterfall as he turns it on and off. But the noise from the light is small potatoes compared to some other common household items, like those power line adapters that turn house wiring into networking cable. Those produce so much noise that even an active loop is really no match. Stay tuned after the break to watch [K5ACL] work the bands through the noise.

Loop antennas are great if you’re stuck in an apartment building or a congested city. They’re easy enough to make, whether you want a portable loop or a permanent installation.

Continue reading “Finding Noise with an Antenna”

Making Software Defined Radio Portable

While most smartphones can receive at least some radio, transmitting radio signals is an entirely different matter. But, if you have an Android phone and a few antennas (and a ham radio license) it turns out that it is possible to get a respectable software-defined radio on your handset.

[Adrian] set this up to be fully portable as well, so he is running both the transceiver and the Android phone from a rechargeable battery bank. The transceiver is also an interesting miniaturized version of the LimeSDR, the Lime SDR Mini, a crowdfunded Open Source radio platform intended for applications where space is at a premium. It operates on the 10 MHz to 3.5 GHz bands, has two channels, and has a decent price tag too at under $100.

For someone looking for an SDR project or who needs something very portable and self-contained, this could be a great option. The code, firmware, and board layout files are all also open source, which is always a great feature. If you’re new to SDR though, there’s a classic project that will get you off the ground for even less effort.

Continue reading “Making Software Defined Radio Portable”