Stenobird

Episode

059 - Instant Nerd Snipe

Podcast
Unnamed Reverse Engineering Podcast
Published
Jul 4, 2022
Duration seconds
3737
Processing state
processed
Canonical source
https://unnamedre.com/episode/59
Audio
https://traffic.libsyn.com/secure/reverseengineering/episode_59.mp3?dest-id=552832
JSON
/v1/public/podcasts/unnamed-reverse-engineering-podcast-752753/episodes/059-instant-nerd-snipe
Markdown
/podcast/unnamed-reverse-engineering-podcast-752753/059-instant-nerd-snipe.md

Actions

  • POST https://stenobird.com/v1/public/podcasts/unnamed-reverse-engineering-podcast-752753/episodes/059-instant-nerd-snipe/transcription-requests
    Idempotently request low-priority transcript generation for this episode.
  • GET https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/059-instant-nerd-snipe.md
    Read the agent-friendly Markdown representation of this episode resource.

Summary

A deep dive into radio frequency reverse engineering using Software Defined Radios (SDR) and signal analysis. The discussion covers identifying protocols via FCC IDs and detecting NRF24-compatible signals through packet header analysis.

Topics

  • Reverse Engineering
  • Software Defined Radio
  • Bluetooth Low Energy
  • RF Signal Analysis
  • NRF24
  • Wireless Protocols
  • Hardware Hacking
  • SDR Tools

Highlights

  • Main idea: Use FCC IDs and databases like fcc.io to identify frequency bands and hardware specifications before starting analysis
  • Practical takeaway: Look for 9-bit packet headers in 2.4GHz spectrums as a high-probability indicator of NRF24-compatible protocols
  • Practical takeaway: Utilize SDR as a 'golden hammer' for observing over-the-air signals when hardware buses like SPI are inaccessible due to SoC integration
  • Failure mode: Relying on manual bit-slicing and custom Perl scripts can lead to unmaintainable and fragile decoding workflows
  • Technical tip: On-off keying (OOK) is the simplest modulation to identify in a spectrum as it manifests as clear carrier power fluctuations

Chapters

  1. 1:00 The Origin Story: The guest recounts meeting Michael Ossmann at Toorcon and the 'nerd snipe' of reverse engineering the conference badge.
  2. 15:00 Identifying Wireless Protocols: Strategies for using FCC filings to find frequency bands and identifying NRF24 clones via packet structure anomalies.
  3. 20:00 Modulation and Signal Analysis: A technical look at identifying On-Off Keying (OOK) and the challenges of analyzing integrated SoC radios.
  4. 24:00 Decoding Tools and Workflows: Discussion on the utility and frustrations of using custom scripts and tools like Baudline for signal decoding.
  5. 34:00 Hardware Interception Techniques: Using RF splitters and T-junctions to intercept signals between an SDR and a target device.
  6. 43:00 Bluetooth Security and Reconnection: Analyzing the risks of automatic key exchange and the complexities of the BLE stack.
  7. 53:00 Modern Wireless Monitoring: The evolution of Kismet and its modern web interface for wireless network monitoring.