sorry everyone for a bit of a delay as
it turns out technical difficulties a
conference full of hackers
can't get something up on a on a
projector it's how you have it
so um
there is a bit of a hiccup out here
um you know the laptop on which all of
the radio and digital signal processing
software is installed for some reason it
will just not play ball with the
projector so I've got another laptop we
can go through the presentation but for
the practicals you know we I would
encourage then everyone to come forward
and you know this is a Hands-On Workshop
the idea is to get everybody introduced
to Digital Signal processing and
understanding how to process radio waves
in the software realm so um you know
when we get to that part I'm just going
to request everyone to come forward and
take a look so without further Ado let's
get on with it
um short introduction to myself
basically I'm a programmer a hacker and
by virtue of those two an entrepreneur
as well
my experience mostly lies in operational
technology I work a lot on with the
power grid so you know securing pen
testing power plants transmission
distribution a lot of Maritime as well
extensive experience on the Enterprise
side
um I've been doing this for a while now
um
let us yeah so
renewable energy ships
um hydroelectric plants thermal plants
um all that sort of stuff and you know
that's that's what brings me to talk
about radios because a lot of the the
sort of infrastructures that I work with
wireless is a huge component you know
there are control signals for OT that
are being transmitted over Wireless
Technologies often not very well secured
and in order to test the security of
these signals
um software defined radio is invaluable
so what is this talk about you know what
are we going to do I'm going to talk a
little bit about the very Basics you
know the physics of waves what's an
electromagnetic wave basic properties of
it amplitude frequency phase you guys
would have covered this probably in you
know fifth or sixth grade physics but
it's always good to go over it
especially when we start to get Hands-On
you know
um
going to talk about modulation schemes
how is data sort of carried by these
waves
how do we put data into waves so
different types of modulations a lot of
you will be familiar with amplitude
modulation frequency modulation phase
shift keying and modern systems of
modulation such as ofdm which is
basically powering pretty much LTE 5G
and everything around us
um
we're going to talk about tools which is
the hardware and software that are used
to explore these signals to generate
these signals and of course some live
examples and this is something we can
all participate in I see a lot of you
with your laptops open so that's awesome
we've got a booth a radio hacking booth
just at the end of this Corridor so you
know after this Workshop feel free to
drop in and hack out with us we've got
to capture the signal tournament running
and we're streaming RF over TCP so you
don't need any specialized Hardware you
can just come in there connect to our
Wi-Fi network and play
um more about the CTS a bit later
so I'm going to assume that everybody
here is new to software defined radio
and digital signal processing anybody
out here with experience in this domain
software defined radio
none at all
Wireless any Wi-Fi hackers I know
there's one
um
we're running the radio Village together
any anyone else familiar with wi-fi
hacking come on packet injection
no one Okay cool so my assumptions are
right let's start out with the basics
um just a pointer SDR in Singapore you
know I was doing some research before
bringing in all my Hardware because I
don't want to land up in the airport and
go straight to jail right so I did a bit
of homework on whether this stuff is
legal out here and it turns out that's
the minister of defense and Singapore is
using sdrs a lot for Battlefield
awareness you know building their own
mesh networks and you know creating
Advanced situational awareness in
Warfare so it's huge you know that as
civilians we have access to technology
which is at par with military in a legal
way so
right let's get back to the basics
what are we doing out here
what what is RF transmission about so
basically we're trying to send some
information from one place to another
without wires right and how do we do
that we have something called a carrier
wave why is it a carrier because it
carries some information from point A to
B that's called the carrier signal
now the carrier signal by itself is not
of much good it needs to have some sort
of information in it so how does that
happen
we sort of modulate that carrier wave in
such a way that we encapsulate some
information within it and that
information is called well the baseband
signal and then you have the carrier
signal so the information comes in and
it modulates the carrier wave and it
goes out there
um
one of the most simplest forms of
modulation is ook or on off keying
basically the presence of a signal
indicates
um well that it's on and the absence
indicates that it's off and the the most
simple form of on off keying is anyone
yeah can anyone read that
come on
sin con yeah absolutely not bad
who said that
you said it
you said it okay you guys can read Morse
code straight off or did you just read
the number of characters and
yeah all right hackers in the house
figuring stuff out awesome that's that's
pretty cool so um yeah at the at the
easy end of things you've got on off
King where a signal on is a one signal
off is a zero and you can you know send
binary strings across in that way and at
the high end of things you've got ofdm
which is the orthogonal frequency
um
uh where you know all the modern all the
modern standards use it it's where you
know different sort of carrier signals
are very closely entering without any
spacing between the signals and that's
why you know we saw that huge jump in
bandwidth did you remember the days
where we had GSM and 2G and we we'd take
like years to just open a website and
now we're watching 4k on our mobile
phones anyone wonder what the hell
happened you know how how did this
happen so ofdm is basically responsible
for it where we can with the same amount
of bandwidth in a signal we can transmit
you know exponential amounts of
information so
um the ability to to explore all of
these um sort of encoding schemes and
waves it's it's all there with software
defined radio and open source software
um
simple example we've got a carrier wave
right on top
um ignore the equations if you don't
want to you know delve into the
mathematics of it but if maths is your
thing then by all means indulge yourself
um so the the the top one is the carrier
signal which carries the message the
second one is the baseband signal which
is essentially the message and amplitude
modulation is basically you know shaping
that carrier signal according to the
message and you can pretty clearly see
how the amplitude changes with the
message so that's amplitude modulation
very simple
below that is FM or frequency modulation
and you can see where the carrier sorry
where the baseband or the message goes
up the frequency increases you know
these waves come together and where it
goes down they're spaced apart
and that's how frequency modulation
works there's a third type a third
property of a wave which is Phase
modulation sort of works in a similar
way
um
so traditionally if we had to build an
AM circuit it would look something like
this you'd need a bunch of electronics
components and the modulation would be
done in Hardware or electronic circuits
but what we're going to be talking about
today is doing all of this in software
now enter software defined radios yeah
so whereas in in the olden days you'd
have inflexible Hardware to do this
modulation and demodulation nowadays
you've got flexible software to do this
this is a flow graph in gnu radio
and for those of you playing the CTF
take note of it this might actually help
you solve some of the flags
um what we can see is simply the source
which is the information
is modulating a signal which is the
carrier right and what is the
mathematical function it is simply a
multiply and if you go back to the
previous slide sort of makes sense if
you do a mathematical multiplication
between the first and the second you
sort of get this
so it's as simple as that in the digital
domain you do mathematics typically it
happens in complex numbers
is anyone out here on know what complex
numbers are
any idea everyone's just blinking at me
does anyone know what complex numbers
are blink blink blink
okay cool
um yeah I was like this when I started
out with uh you know playing with hacker
I was like yeah I'm gonna hack radio
waves and stuff and then I realize
there's a whole lot of there's a wall of
mathematics between me and hacking radio
waves but it's it's pretty easy you're
going to get past it yeah that's what
the radio hacking Village is for to make
things simple and to sort of gamify this
entire experience for you
um so Basics how do you get an analog
signal into the digital Realm
anyone
anyone here of sampling
yeah
where have you heard of sampling
yeah yeah come on speak up
you guys have heard of sampling of
course audio
yeah you your sound cards 44.1 kilohertz
CD audio 48 kilohertz what's happening
there when you um when you talk into a
microphone suppose you're trying to
record yourself in a computer this is an
acoustic wave it's hitting the
microphone transducer it's being
converted into a continuous signal of
electric current and how is that being
digitized the sound card on your
computer is looking at that electronic
signal and 48 000 times in a second it
is just taking a reading of that entire
signal and when I say reading it is
taking the amplitude the frequency the
phase all of this in the digital Realm
and that's exactly basically that's
sampling it's reducing a continuous time
signal to a discrete quantized signal
and that's what your SDR Hardware is
doing all right that's all the hardware
is doing when we say software defined
radio it's actually more software it's
not the hardware so the hardware is
taking these radio waves which are
flowing through the air and it is
um
quantizing it so you can see that
now it's very important that you choose
the right sampling rate if your sampling
rate is
um
not enough if you just have say one two
three four five points your line can go
anywhere so if you want to accurately
represent the real information your
sampling rate needs to be at least twice
the frequency of the wave of your
carrier wave
so these are some things we'll cover in
the workshop but just want to get you
familiarized with it now complex numbers
why
the mathematics of handling Digital
Signal processing is a lot more simple
in the complex plane all right when we
look at a wave we look at a rotating
phenomenon in the complex plane so what
appears to be something like this in the
time versus amplitude domain in the
complex plane it's just circles that are
rotating and the mathematics of it
becomes easier so it's computationally
cheaper to do this with complex numbers
and hence complex numbers are used for
digital signal processing
um
right let's get down to it so what are
the tools you know way we're going to
talk about some hardware and some
software
so like I said the hardware is basically
just to convert these analog signals
into the digital realm and examples of
the hard Hardware are like this little
guy here the hack RF is what I've got
it is a half duplex SDR which means it
can either transmit or receive it can't
do both at the same time
there are there are limitations to that
certain protocols require you to
transmit and receive at the same time
um but for the purposes of the workshop
and for Learning and prototyping it's
more than enough
RTL SDR it's the cheapest it's it's the
lowest end of it it's this little dongle
you get for about 20 to 30 dollars and
you can capture pretty much any
frequency you can't transmit but you can
receive anything and these are all the
popular
um you know
Hardware components for software defined
radio
we're going to be using open source
software so gnu radio companion is going
to be our best friend I'm going to walk
you through a few examples using this
particular piece of software
python so gnu radio companion is
basically just like a front-end for
python what it does is it you draw that
flow graph you know stuff like I showed
you in the previous slide and at the
back end python code gets generated and
executed so if you're comfy and you're a
good programmer you can just go in there
and write the code yourself
um gqrx in spectrum and you know if
you're good with it you can write your
own tools
so this is what the hardware looks like
I've got this you know there's much more
expensive Hardware all the way up to 30
to 40 000 for you know multi-channel
full duplex Hardware
and that's the kind of stuff you saw on
the first slide that the military was
using
um it's available off the shelf you know
you can order it it'll reach you within
a month be careful using it you know
don't just go ahead and transmit and
restrict it on restricted frequencies
and stuff
so what's the difference in all of these
pieces of Hardware basically it's the
frequency range you know like this hack
RF it can go up to six gigahertz and it
can go low down into you know or maybe I
think 30 megahertz if I'm not mistaken
30 megahertz to 6 gigahertz the more
expensive stuff has a wider range and so
that's the frequency range we already
spoke about full duplex half duplex some
of them have multiple channels they'll
have two transmit and two receive
channels so you can then you know pen
test stuff like 5G radio signals and
you can do a lot of cool stuff
um
software
gqrx gnu radio I'm going to show you
practical examples of this and what
parts of the spectrum look like we're
going to look at the 2G Spectrum the 3G
Spectrum right now we're going to look
at the 2.4 gigahertz spectrum and the
gentleman in that corner who has a big
um Jammer
have you seen the guy in the Drone
kampung
he's he's got yeah he's got a he's got a
yagi UDA antenna connected to a Jammer
and that just jams the entire 2.4
gigahertz range pretty pretty
interesting stuff illegal but
interesting
all right so you know time for some
practical stuff now we're going to get
our hands dirty
um our pause dirty and I may ask you to
come up
um out here but before that let me just
conclude with the presentation because
once I ask everyone to come up or you
know around the table I can bring it to
any one of the central tables
um I won't be coming back here and this
is because the display was not working
on that laptop
so what are the advantages of learning
this I would say art of software defined
radio
well you can reverse engineer and test
the security of pretty much all the
layers of wireless communication
so you know you guys who are familiar
with Wi-Fi pen testing you've used those
adapters which are capable of monitor
mode so when you have that kind of
Hardware what you can do is essentially
test Layer Two
the data frame all of the properties of
the data frame and the layers above it
the link layer itself remains out of
your reach because the demodulation is
happening in Hardware when you have
software defined radio you can do that
yourself so you can test pretty much
every layer of of the stack of your
communication stack
um
you can interact with or read exploit
pretty much everything you know
Wireless signals are flowing through the
air all around us they are being
received by different
circuits the data is flowing through
embedded systems
who knows you know you change a few bits
here and there you could trigger a
device to do something it was not
intended to do
um in short it enables you to test the
security of pretty much any sort of
wireless system
um the image on the right is pretty
interesting it's a cool story
um by the it's it's it's by one of my
SDR Heroes his name is balance sibo
currently works for Apple in their
satellite program
um what he did is he plugged his
software defined radio into a large
radio telescope and essentially brought
to life a spacecraft that was abandoned
36 years ago it was orbiting somewhere
between you know Venus and the Sun and
yeah a device pretty much like that you
take the output you know amplify it
stick it to a pretty powerful antenna
and you can do stuff like that fire
thrusters on spacecrafts and you know
um who knows what else who knows what
else so obviously this was done with the
permission of NASA he just didn't go and
you know fire up a spacecraft out of the
blue so don't don't get ideas I know
there are too many hackers in the room
um
you can look at you know adsb signals
these are just examples so all aircrafts
you know they have this sort of passive
monitoring where they keep spewing out
these packets over radio reporting their
position heading
um ships do something similar it's
called AIS uh there's a there's a ton of
stuff going on in the radio spectrum
that most of us are not aware of and
once we start exploring it gets very
very interesting indeed there's the
whole ham radio scene as well you know
if you're interested to communicate with
people thousands of miles away on the
other side of the earth you can you know
with the right antennas and of course
you need a license once you're licensed
you can operate on the ham frequencies
so a lot of cool stuff you can do with
SDR you can download data directly from
weather satellites all of this is legal
you just you know tune into the right
frequency write some Python and you've
got it
so
um the CTS challenge out there is
something that I would encourage all of
you to come in and play
all right it's very beginner friendly
and you know we are there to help you
out and it's the only way you can
understand this by learning it the
hardware getting your hands dirty trying
failing trying again failing and
eventually you'll figure it out those of
you who are smart programmers and
hackers you might just figure it out
there may be some of you out here who
are better than us so in that case you
know please teach us and you know we're
ready to to learn
um we're going to be using common
Technologies you know FM RDS ntsc these
are things that we use in our day-to-day
lives but we don't really understand how
these signals work so the the flags are
hidden in these signals it's not
necessarily difficult to solve you can
solve it by writing a demodulator
yourself
or alternatively you could just bring a
device like an FM radio nearby the the
antenna and you know get the flag out
who knows there's a lot of interesting
stuff in there
um there are some softwares that you
would require and I had requested
everyone on the Discord channel to get a
bootable pen to
pen two is a distribution of Linux that
is pre-loaded with
um you know the drivers and tools that
are necessary for exploring the wireless
Realm
um no specialized Hardware is required
we're streaming everything over Wi-Fi
and TCP so
super inclusive
um
yeah these are the different challenges
I won't go to I won't go into them too
much now because they're quite dependent
on what we do in the practical
um we've got some interesting stuff
um
who's heard of a radio replay attack
anyone
no
absolutely it's it's exactly that it's
just uh sniffing a signal out of the air
typically like you said it's a car key
and the way to do that with a car key is
that you need to jam and sniff at the
same time because
um most key fobs for cars they have a
rotating key so that you can't do a
simple replay attack so when you do this
when the person goes to open their car
you jam his device so that the signal
doesn't reach the car at the same time
you take a copy of you know whatever
he's transmitted and you don't even need
to decode it you don't need to do
anything you can just save it as a WAV
file a raw you know raw capture file and
then just rebroadcast it and the car
opens so we've got an interesting way of
learning
um replay attacks this is something
pulled out of Defcon you know the little
collars that we use to train pets
deliver a small electric shock when you
press a button on a remote
so yeah it's called the Dual two people
sitting on a table opposite each other
blank terminals wearing a shock collar
yeah
so you got a reverse engineer the signal
and the first person to shock the other
person wins so I mean yeah there's no
better way to learn than under pressure
um
yeah it's just you know I've
electrocuted myself all weekend trying
to figure this challenge out
please come in there play with us be
safe there are five levels of you know
shock you can deliver
it's all honor of King so you know make
sure you get those ones and zeros right
or someone someone could get hurt
um some some cool resources that I want
to show you guys there is the Sig ID
Wiki and web SDR so I'm gonna just uh
go to the Sig ID Wiki so this is a
signal identification Wikipedia and what
that is is when you have your SDR
running and you look at a signals
pattern you can't identify it easily so
this is basically like an index a
directory of all the categories of
signals that are there and you can you
know visually sort of identify your
signal and begin to reverse engineer or
decode it
um
and then there is web SDR which is a
very interesting project it's basically
a network of sdrs all around the world
that are connected to the internet and
that are listening on these frequencies
and you can tune into them over IP and
you know start to manipulate radio waves
in different parts of the world
and if you so feel benevolent you may
connect your own SDR to this network and
open it up to other people on the
internet of course put restrictions on
the transmission right because we it's
illegal to transmit on certain
frequencies
but um
yeah
so some QR codes in case you guys want
to take pictures or you know reference
the stuff for later
some housekeeping before we get into the
practicals okay
um
some do's and don'ts
when playing the CTS respect others
um basically you know don't do stuff
like jamming the airwaves okay don't
deny service to anyone the CTF
infrastructure is open it is not secured
it's for all of us to play and have fun
so you know don't take it out don't try
to hack the the CTF server
um do not transmit on licensed or
restricted frequencies that's really
important there are certain frequencies
out here that are unlicensed like your
433 megahertz your you know 866
megahertz all that is fine
um it's absolutely illegal to transmit
on on license frequencies
um
any others if you are unsure please ask
you can ask anyone in a green t-shirt or
you can ask me if you've got your own
SDR and you're unsure of what to do
um and above all have fun and learn
here's the spectrum allocation in
Singapore this is the latest copy from
the government website you can you know
just scan that QR code if you have any
doubt
um you know check out what you are
allowed to do what you're not allowed to
do and also when you start exploring the
Spectrum you can easily identify which
band which bands have what sort of data
on it and uh yeah pretty pretty
interesting to see what's what's going
on in the airwaves
um
finally remember
we are not lawyers so when I tell you
don't transmit on a frequency and you
can transmit on this one it's just
advice what you do is entirely or your
responsibility
um there is a separate Network called
RHK Network which you will all see on
your phone the password is pasted up on
the wall
everything on that network is within
scope so you know if if you're new to
this and you've not played ctfs
alongside other hackers perhaps don't
bring your work laptop onto this network
you know if you're if you've been pen
testing other companies and you have
your clients data on it and you're not
sure what you're doing I would say maybe
spawn a VM and get on the network you
know just take some basic hygiene steps
um you could be playing alongside
hackers who are significantly more
advanced than you and you never know so
just you know keep that isolation there
um
yeah please have fun that's that's it I
think that's all thank you and now for
the Practical part since um you know I
can't connect my main laptop to the
screen I would encourage everyone to
come forward which table should I use
um should I should I sit on a table
where there are more people
that makes sense right
yeah
which which table should I use the
center one yeah out there okay cool let
me try one last time sticking this HDMI
cable in
and
Let's cross our fingers it's not going
to work
yep it's not working okay I'm coming
there
I don't think I need the mic anymore
right
all right pulling up gqrx out here
and what what this allows us to do is
just you know look at the Spectrum and
we're looking at you know 20 megahertz
of the spec of a spectrum at the time
this is the FM band so these are all of
the radio stations within Singapore
we're not demodulating anything at the
moment
but I think we could if if you guys want
to hear something let's
yeah Savage Garden
it's never bad right let's record this
as well
okay we got a bit of that so the the
cool part is right now uh where
simultaneously processing 20 megahertz
of bandwidth so that's all of these FM
stations at the same time and you know
if we so wanted we could play all of
them simultaneously at the same time so
these are your air traffic control
frequencies Ground Control I'm not going
to play them because I believe it's
illegal for others to listen to it but
we can definitely look at the patterns
that's not illegal
um let us look at somewhere around 950
megahertz which is your you know 3G
um this is the kind of stuff that's you
know running all your mobiles at the
moment you can see how heavily it's
painted you can see the density of the
data and the thing is by looking at
these patterns you you should be able to
discern what sort of encoding scheme it
is and how do you do that you just refer
back to that Sig ID Wiki that you know I
had put up earlier
so I want to look at something that
we're all familiar with we can look at
the 2.4 gigahertz Spectrum this is uh
pretty much like our Wi-Fi you know
zigbee Bluetooth or all of that operates
around here
and you can see it's pretty busy there's
a lot of Wi-Fi stuff going on this the
Drone guy outside who's
who's been abusing this portion of the
spectrum and
there's some pretty interesting stuff
that I found out here you know even at
say 500 megahertz you find some signals
which are just coming on and off in the
middle all of these mean something okay
so um
yeah we saw how to demodulate FM using
this but what I want to show you guys is
how to do it you know using gnu radio
so I'm going to close this and I am
going to open uh
a GNU radio flow graph
um
so this is a this is what it takes to
receive
FM so what am I doing I'm starting out
with a signal from my hack RF device
okay this is a source and there's a sync
if any of you guys in software security
know that data always enters a program
through a source and it lands up at a
sync so we've set it up as a source to
get data from here and I'm taking data
in at something called samp rate which
is the samples per second I'm taking 10
million samples per second 10 megahertz
of bandwidth that's a lot
okay to capture FM you only need 200
kilohertz so
um how do we do that we're going to sort
of decimate this signal now decimation
is a process of down sampling or
reducing your sample rate and we're
going to filter out you know just the
portion that we need
so I'm going to put this graph up for
all of you to download
um so we don't necessarily need to go
through all the parameters now but long
story short I want to listen to 98.7 FM
I kind of liked it
um so we start out with the center
frequency of 100 megahertz there's
something called a DC offset on these
devices it creates a huge Spike so if I
want to listen to 98.7 I create another
signal Source
where the center frequency is sort of
um it's it's a difference between 100
megahertz and 98.7 so that's 1.3
megahertz multiply the two
put it through a low pass filter to get
it down to just the 200 kilohertz of FM
and then we need an fmd modulator and
send it to my audio sync so
yeah
that's what it takes to listen to FM
but now you want to see something super
cool
yeah I didn't intend for that to play
for so long okay so you want to see
something pretty cool now what I can do
is I can take this uh
signal
and I can send it instead of
demodulating it right here I can send it
to something called 0mq zmq so it's it's
like a messaging queue if you know Kafka
or rabbitmq or any of your other Pub sub
sort of infrastructures
I'm going to send all of these raw
samples over messaging queue to
Port 8000 and let's see I'm connected to
the radio hacking Network and my IP
address is
uh
14.251 so
10.200.14.251 so once I start this graph
any of you can actually just connect to
10.00.14.251 on Port 8000.
and I'm going to draw the remaining part
of that flow graph where I actually
um
have
The Source out here
so the source is now a messaging queue
source and what I'm going to do is I'm
going to try and complete the remaining
part of my flow graph
by taking
the messaging queue source and plugging
it straight into my fmd modulator so you
all can do this as well you can just
stream the samples over TCP and run it
and listen to FM
so what I could do is now stream the
entire 20 megahertz of bandwidth and
each one of you could receive that 20
megahertz bit decimated and filter it
yourselves and each one of you could
listen to a different radio station
so this is the power of SDR you can
actually grab very large portions of the
spectrum and you know process it later
and what what that means is you know
even for stuff like signals intelligence
and Military what they typically do is
they just grab the whole Spectrum for
yours and save it until encryption
breaks you know someone pokes a hole in
AES and they're like you suddenly got 20
years of you know secret Communications
decrypted so it that that's why people
are searching for Quantum proof
encryption and stuff nowadays but anyway
SDR gives you the ability to sort of you
know play around with all of this and
and pull stuff out of the air and test
the security and yeah I've just shown
you a very basic example of FM but
pretty much everything out there is up
for grabs so head over to the radio
hacking Village you know we'll we'll set
you up with the CTS it starts out with
really really simple stuff you know
we're doing some Spectrum painting and
all you might have seen it on the big TV
out there
um
um yeah just come in enjoy have a good
time be safe don't do anything illegal
yeah any any questions
any questions comments any anything
at all
Wow that's scary
it either means you've understood
everything and you know it all better
than me and or it means you've
understood nothing both of which are not
good
since my past time I'm going to conclude
out here thank you all very much if you
have any questions please head over to
the radio hacking Village and we'll take
them there thank you