silent 30C3 preroll titles
applause
Travis Goodspeed: First I need
to apologize for typesetting this
in OpenOffice. I know that the
text looks like a ransom note.
But that’s what happens
when you don’t use LaTex.
I’d also like to give a shoutout to
Collin Mulliner if he is here,
and our Dinosaur rock band.
laughs, applause
We’re a Christian rock band, we’re
called ‘Jesus lives in the ISS’ and
we know that he is always watching us,
but we think that it’s easier for him
to hear our prayers when
he’s, you know, in an orbit
that passes over us. So we need to use
orbital tracking to know when to pray!
laughter
As I’m sure you can guess I’m not
recognized as a legal minority religion
in Germany. I’d also like to thank skytee
and Fabienne Serrière and Adam Laurie
and Jim Geovedi for some
prior satellite tracking work,
and the Scooby Crew at Dartmouth
College for all sorts of fun
whenever I bounce out there.
This is the mission patch
of the Southern Appalachian
Space Agency (SASA).
applause and cheers
This was drawn by Scott Beibin and there
are a few pieces of my people’s native
culture that I need to point out here. On
the right the little Dinosaur type thing
with his finger going out, you might
call him E.T. but we call these things
‘buggers’. They are like this tall, and
they are green and that’s why the man
on the left has a shotgun.
laughter
Because he doesn’t want to be abducted.
You got a satellite dish in the middle
and it’s sitting on sinter blocks because
that’s also a piece of my people’s
native culture. There’s a moonshine
still in the background.
That’s kind of like Vodka but you
make it at home and from corn.
And then there’s the mountain… a piece…
it looks like there are snow peaks
on those mountain tops. But our mountains
aren’t tall enough to have snow.
These are actually that we’ve blown off
the lids of the mountains for coal mining.
Which is another piece of
my people’s native culture.
And at the top, in space you can see
the ISS, and you can see a banana,
and you can see what I think is a bulb.
This is to signify space trash.
I mean there’s a lot of stuff up there.
And, you know it’s symbolism that matters
in these things, you know?
At BerlinSides, in May of 2012
I did a lecture on reverse-
engineering the SPOT Connect.
The SPOT Connect is a little
hockey puck type thing
– this is what it looks like.
And these things are great.
It weighs a bit more than your cell phone
but it runs off of a couple of batteries,
it connects to your phone by Bluetooth.
Originally these were emergency locator
beacons. So if you’re going hiking…
have any of you seen the movie where
the guy has to cut off his arm
with a dull knife? If you’re hiking and
you don’t want that same experience
you buy one of these things. And
then there’s an emergency button
you can push that transmits your
GPS coordinates by satellite
to rescue workers. But that was boring,
so they had to add social media.
laughs, laughter
So in addition to keeping you
from chewing off your own arm
this device will also allow you to
tweet and make Facebook posts.
laughs, laughter
The idea is that as you’re running…
here I’m crossing the Schuylkill River
in Philadelphia and the Android
phone on the left is making a post.
And I did an article on reverse-
engineering the Bluetooth side
of these things. Because… I use a weird
brand of phone that Microsoft killed off,
and I’m terribly bitter about it. But
I also figured out the physical layer.
And that’s what this diagram shows.
This transmits at 1.6125 GHz.
And it sends a pseudo-random stream, so
each one of these zeros is a long chunk
where it’s bouncing back and forth
between two different frequencies.
And the same for the ones.
But the way that the pattern works
is that it switches the signal whenever
it is going from the 0 signal
to the 1 signal. And internally, there are
these little pops that you can actually
identify on a software defined radio
recording. And this is how you can
reverse-engineer the signal that
the SPOT Connect is sending up
to its satellite network.
Everything is clear text on this.
And it’s completely unencrypted.
It just has your serial number, your GPS
coordinates, and a bit of ASCII text.
So if you listen on this frequency and
you have the correct recording software
you can actually watch all of the SPOT
Connect messages that are transmitting
up from your location. And this would be
great except that this is designed for
hiking in areas where there’s no cell
phone service. So having an antenna
on the uplink frequency is kind of
useless. You know you would actually
have to go out to a national park, find
some guy who is about to chew his arm off,
and then you could listen to his uplink
where he is like tweeting: “Hey, I’m gonna
chew my arm off”, you know?
laughter
So that’s great as a proof of concept
but it’s not really anything practical.
The current state of that was that I knew
the protocol and I could sniff the uplinks.
But I wanted to sniff the downlinks. So
it’s easy for me to get the thing that
goes up to the satellite. But what I wanted
was what comes down from the satellite.
And that requires a satellite dish. But
a geo-stationary dish isn’t good enough
because the satellites that run this
network – there are a lot of them,
it’s called the Globalstar network,
they fly really low across the earth,
and they fly across the earth in very
tight, very fast orbits. So they’ll move
from horizon to horizon in 15 to 20
minutes. Which means that you either need
like a sweat shop army of kids
trying to aim the satellite dish
as it’s going across or you need
to make it computer-controlled.
Stepping back from the SPOT
Connect for a little bit, and
discussing some prior research.
Adam Laurie did some work
with geostationary satellites.
These are the satellites that stay
in one position in the sky.
He gave two sets of talks
– one in 2008 and the second in
2010. And he used a DVB-S card
connected to a satellite dish with
a DiSEqC motor, so that it could move
the satellite dish left and right in order
to scan a region of the horizon.
His tool is publicly available,
it’s called satmap.
You can grab it at this URL.
And then after he finds a signal he has
a feed scanner. Normally when you use
Satellite TV your provider gives you
a listing of the frequencies, and
your provider gives you an exact orbital
position to aim your satellite dish at.
But Adam’s tool allows you to scan to
see which frequencies are in use and
which protocols are in use, once
you’ve correctly aimed your dish.
And he also describes a technique
for moving your dish left and right
while doing this in order to
identify where the satellites are.
This recording here is from
a re-implementation that I made
of Adam’s work, in order to
catch up with it. In this diagram
the x-axis – because you move left
and right – that shows the azimuth,
that shows how far left or right my
satellite dish has moved. And then
the y-axis shows the frequency. And
all of these dots are strong signals.
So every vertical bar in which you see
chunks of frequencies, that’s a satellite.
But these stay in the same position. So
it’s easy for me to repeat this experiment.
It’s easy for me to re-run it, and to find
the same satellites in the same position.
It’s easy to debug this.
But it can’t move in elevation.
This diagram is actually
a very small slice of the sky.
We’re looking at a single line,
maybe 10 degrees across.
Maybe only 5 degrees across.
So hacking Ku-band – the television
satellites – has the advantage
that you can use cheap standardized
hardware. I bought one of these DVB-S cards
in Mauerpark, in Berlin for 3 Euro. You
can use standardized DiSEqC motors,
you can buy them at a satellite TV shop.
TV signals come with video feeds
so you can actually see pictures.
There was a scandal about 4..5 years
ago where they were finding
drone [control] feeds that were being
bounced across these satellites.
In the nineties it was very popular to
listen to the sort of unedited sections
of interviews, when people would
be interviewed over a satellite,
before Skype and such
things became options. And
there are also networking signals here
using TCP/IP packets. So you can actually
turn your DVB-S card into
a promiscuous ethernet adapter,
and start sniffing all of the traffic that
comes across. This is also a great way
to get free downlink bandwidth. Because
you can just flood packets at an address
that, you know, will be routed to
you, or several addresses, and
then you sniff it out as the
legitimate receiver ignores them.
But it also has some disadvantages. It
only works for geostationary satellites.
If the satellite is not staying in the
same position relative to the ground
then you can’t track it. Your
dish also moves very slowly.
And it only moves left and right.
It won’t move up and down.
And you’re limited to standardized
signals. So while it’s great that you get
video and TCP/IP you’re never
going to get anything weird.
You’re not gonna get any mobile
data, you’re not going to get any
Brazilian truck-drivers – we’ll
get to those in a bit. laughs
I misspoke, you actually will get
Brazilian truck-drivers in this.
So I bought a satellite dish. One of the
best things about living in America is
that you can buy industrial
hardware cheap as dirt on ebay.
I know things aren’t likely used to being
a cat bite to (?)(?) human children anymore.
But this satellite dish here on
the left – the one in the radome –
that’s my dish. And to the right,
that’s the boat that it came from.
applause
laughs
This came from a military ship.
But the dish itself is also available
for civilian use on very large yachts.
The dish itself is a Felcom 81 and it
was intended for use with a network
called Inmarsat. Inmarsat allows
for telephone connections,
and also data connections when you’re on
a boat. So if the crew wants to call home
or wants to go to AOL Keywords
or whatever was popular back when
this was common they could do that.
And the dish was designed to sit
at the very top of a ship’s mast.
The reason why is that at the top of
the mast there aren’t any obstructions
– it has a clear view of the sky in all
directions. But there’s a complication
with being on the top of the mast. Which
is that the ship is rocking beneath you
and you’re moving more
than the rest of the ship.
So they have stepper motors
for azimuth, elevation and tilt.
And then they have spinning gyroscopes.
Back before the iPhone there was
this dark, dark time when
gyroscopes actually spun.
And this is the sort of gyroscope that
it has. It actually has 4 of them so
that it can measure its movement.
And then it has a control computer. So the
idea is that the dish itself can be moved
while remaining absolutely stable
with regard to the gyroscopes.
So it compensates for the rocking of
the ship beneath it as it’s targeting
a stationary satellite.
In America this costs 250 dollars
but it’s electronics equipment, so while
you think that would only be a 180 Euro
it’s more like 2500. And that’s before
import duties and it being impounded.
We also have this lovely culture in which
people love excuses to use their trucks.
So the guy that I bought this from offered
to deliver it to my home for only $200.
It was an 11-hour drive.
But if you wanted this you’d have to
bring it back in your carry-on luggage
and that could be awkward.
I got this dish and I decided I had
to do something with it. So I created
the Southern Appalachian Space Agency.
I’m from the state of Tennessee,
formerly known as the State of Franklin
until North Carolina invaded us.
It’s ok, I know Europeans suck at history.
laughs
laughter and applause
Now I’m trying to think of how to show
you on a map where Tennessee is
without having a map. But, you know,
it’s okay, I know you suck at geography
and will forget it soon. (?)
From audience: It’s very
near Texas, to the north.
Travis: Texas is our first colony. But
it’s actually a decent drive to the east.
Due east (?). You don’t
actually have to go it anyways.
So what I did was I took these motors
which were designed to be able to move
the satellite dish to compensate
for the rocking the ship and
I re-purposed them to track through
the sky while the ground is stable.
We don’t have very many earthquakes in
Tennessee. The last one that we had
made rivers run the wrong direction.
But it’s okay – it’s a geography thing.
laughs
So this allows me to track things
that are moving through the sky.
But it doesn’t actually matter
where they’re moving in the sky because
that’s just a software problem.
So in addition to tracking objects that
are in low-earth orbit by a software patch
I can also track things that are in deep
space. It’s not much harder to track
deep space probes or stars than it
is to track items in low-earth orbit.
And then I added a software defined radio
which allows me to record a signal now
and then demodulate it later.
Which is necessary if you intend
to reverse-engineer a signal. Because
a lot of the downlinks from these satellites
are completely non… completely
undocumented. And being able
to tune in to the right frequency is only
half of it. You also need a recording
of sufficient quality that you can
reverse-engineer it after the fact.
We’re sort of spoiled by software
defined radios in that when doing
software defined radio work we usually
have a very good signal to work from.
So having high quality signals for later
reverse-engineering is necessary.
I really wanted to be able to identify
undocumented downlinks for low-earth orbit
in the same way that we already
do this for geo-stationary orbit
using tools like the ones that Adam
Laurie and Jim Geovedi made.
So I built a software framework as
a collection of Python daemons.
And these run across a home
area network in my house.
There’s a Beaglebone inside of the Radome.
And an x86 server in the house. Or AMD64,
whatever the kids call it these days.
And then I used Postgres for coordination.
So that all of these daemons can talk
to each other without… without me really
caring which machine they’re on.
So for maintenance I can have my
laptop pretending to be the dish,
and I can have stepper motors on my desk,
and I can watch them spin, and I can even
make a model of the dish and swap these
components in and out without the rest of
the network being confused. This also
allows for SQL injection attacks to
physically move my dish. Which is why the
sensor network is not on one of those
fancy WEB 2.0 things. Because of you could
inject, say, “UPDATE target SET name=
‘VOYAGER 1’”. Then my dish would physically
move and start tracking Voyager 1
through the sky. Voyager 2
doesn’t actually come into the sky because
of my position in the Northern hemisphere.
So, it’s okay, I know you suck at
geography. But Voyager 1 is going up,
and Voyager 2 is going down.
There’s a Realtek software defined radio
for the radio reception. Although
these things are garbage. So I’m in the
process of replacing this for the HackRF.
There’s also an EiBot board for motor
control. We’ll get back to that in a minute.
And there’s an Inertial Measurement Unit
from VectorNav which actually measures
using the fancy MEMS gyroscopes and
a MEMS compass how I’m moving.
This isn’t accurate enough to target
the dish, so I’m still counting steps
to move the dish. But it is accurate
enough to tell me when my belts
have broken. Or when I’m up
against a physical obstruction.
This is skytee helping
me out with the dish.
He’s zip-tying it. Because, you know
we know everything about duct tape
where I come from, but we don’t know
anything about zip-ties. So I had
to bring in a German engineer.
laughter
We call him a gerry wigger(?)
but, you know…
This is the satellite dish itself. And you
can sort of see in this photograph
where we’ve strapped on the equipment.
There’s like an umbilical cord.
Or more like a spinal column that actually
runs up the back of the dish. So we just
added new cables onto that line.
And then zip-tied them in place.
And skytee came up with all these
crazy ideas like that we should use
chains and zip-ties to make sure that the
cables don’t tear themselves out. And
that worked tremendously well in practice.
So, as this thing spins around,
by the original design there’s a ring
connector that all of the signals
go through. That all of the networking
goes through. That all of the rest
goes through. And that worked in the
nineties because it had no reason
to send anything faster than 9600 baud.
But with the modern signals going across
it I need 100 MBit/s or even GB ethernet,
that’s not enough, I need more than
two wires. So there’s a cable that comes
across it, and then I rely on the
software to keep it from wrapping
that cable around itself. So it can only
move, say, 400 degrees around.
But that’s still more than a full circle.
So by stopping halfway and moving back
I can prevent it from getting snagged.
We’ve got the Beaglebone on the left,
in the middle there’s a USB hub
and on the right is the motor controller.
The Beaglebone runs Debian Linux and
takes care of sending the software defined
radio recordings over the network. It also
takes care of updating the motor positions
to be the ones that the database
declares should be current.
The stepper motors themselves are the
originals that the dish was designed with.
And they’re running to an EiBot Board.
The EiBot board was intended
for plotting on Easter eggs
laughs, laughter
I feel, you know… is that neat?
laughs
applause
So you can actually aim a satellite dish
that’s as tall as you are, with of these
fancy motors using less sophisticated
equipment than what’s used
in a 3D printer. Don’t panic, though.
It’s a hell of a lot more
reliable than a 3D printer.
But we needed some sort of backup in
addition to the inertial measurement unit
telling us when the device
had snagged itself.
It would also help to have
a visual queue. Because
the satellite dish sits in Tennessee, and
while I love my home town, and, you know
I’m very proud of being Tennessean, it’s
also a long way to travel when you need
to re-orient the dish. Using an
accelerometer it’s easy enough
to correct the elevation. Because you can
use the accelerometer as a level, and
you can use that to tell how high up the
dish is pointing, at an absolute scale.
But the compass isn’t very accurate. So
instead, as a backup we have a webcam
that’s taped to the top. Taping
is my people’s native culture.
We have it taped to the top, and then
it’s pointing backwards. So this gives us
like a rear view camera,
from the dish’s position.
So as the dish sits
inside of its radome…
– junk cars in the yard are also
my people’s native tradition!
laughs, laughter
So the dish sits there next to
my brother’s Toyota Supra.
And that thing, you know,
that thing flies as soon as it gets
an engine put back in it.
laughter
So it sits there and it’s moving but
externally you can’t see where it is.
Which means that I can’t call my family
in Tennessee and blackmail them into
– yet again – looking at my dish to tell
where it’s pointed. There are bolts
that hold this down, it takes half an hour
to remove the lid, another half an hour
to put it back on.
So instead we took the radome…
that’s Frank, he’s my cat.
Give a “Cheers!” for Frank!
applause and cheers
Yeah, we had such a great time with Frank.
And we never knew that she was pregnant.
If you happen to need kittens and wanna
pay the customs fees I’ll hook you up!
So then we took tape and ran tape
down the edges of the radome,
and then marked it. So from the markings
you can tell which clock position
the back of the satellite dish is pointing
at. So if you point the dish towards 12:00
you know that you’re roughly at 6:00,
so you know that it’s pointing South.
And then you can sort of scan the sky
for a stationary target, and navigate
off of that, to recover your position.
Software-wise… remember, the
whole thing runs through Postgres,
so I just tunnel the Postgres over SSH,
and then I wrote a Python client
that displays the satellite positions
and the satellite state in PyGame.
This is intended for making those games
where you see the rabbit and the rabbit
jumps on the other rabbit. But it… works!
And it works perfectly well enough
to target the dish. Because all that this
software has to do is plot the positions
of the satellites, and give orders back to
the database when I click on a satellite
or click on a position.
It can also display stars.
So the red items are satellites which are
not selected. The green item is GOES-3
which is the satellite that I’m targeting.
And then the white items are
stars in the sky. Now this is
a plot in which the azimuth
is on the X axis, and the elevation is on
the Y axis. But I can also arrange it
into a polar plot. Which sort of gives me
an upside-down view of the satellite dish
looking at the sky.
I doubt you can read it but
just above the green circle in the center,
that’s Polaris which is the North star.
It’s also weird because, you know,
working on this, you know, I thought
that I got really good at astronomy
until I realized that I only knew
what the stars looked like during the day.
laughter, laughs
And it being PyGame you can
actually run it on a mobile device.
So the same client that runs on my
laptop can also run on my Nokia N900.
laughs
applause
A significant portion of the GUI client for
this was written while stuck on the U-Bahn,
connected over 3G, SSH through
and just using emacs on the phone.
laughter, laughs
applause
If you’re one of those people who needs to
complain about the N900 being too old,
it also runs on the N9.
And then you can take the data out of this
and run it through scientific software.
In addition of the software defined radio
recordings themselves being dumped out
to a text file or a binary file on disk
you can also dump out things like
the received signal strength indicators
(RSSI). So this is a screenshot in which
I’m identifying different satellites that
I’ve seen in the sky based upon
their downlink signal peaks. You can see
the noise floor there, at the bottom,
and then there’s a rather strong signal on
the left. And a weaker, narrower signal
on the right. Now, the
daemons that build this up…
you need an orbit prediction daemon.
Because you need to know
where the satellites are and where
they’re going, and where they will be
by the time you get to them.
You need to update the orbits themselves.
LEO satellites are described in TLE files,
these are called ‘Two Line Entry’ and
they’re called ‘Two Line Entry’ because
they’re three lines long.
laughter
These were originally used by NORAD for
inter-continental ballistic missile tracking.
And because a ballistic missile
is basically in orbit, it’s just that
that orbit happens
to collide with the earth.
But this format isn’t terribly accurate
for satellites that adjust their own orbit.
So anything that has fuel, or has engines,
or changes mass will vary its position.
And this also doesn’t account for drag.
Because, you know, the missile itself,
you know it goes up it goes down, it’s
not orbiting enough for the light drag
in the upper atmosphere to matter. But for
a satellite it does. So these Two Line Entries
will work for a matter of days or maybe
a couple of weeks. But they don’t last
longer than that. So you need a daemon
that grabs the new files from Space Track.
And this is just a matter of like
a recursive WGET, and then
parsing the files. And that still needs
to be done. You also need motor control,
because you need to move the dish
physically to track your target.
You need input for the Inertial
Measurement Unit. This comes over
a low voltage serial port. And then
you need radio daemons to handle
spectrum analysis or downlink recording.
And these you’ll have several of them,
you have to swap them out. So you’ll begin
by using the spectrum analyzer to identify
that your aim is accurate, that you’re
accurately tracking the targets
well enough to get a recording from
them. And then after that you begin
to take software defined recordings off
them. And, eventually, you might have
a standalone application that parses
what you’re receiving. Such as
the Osmocom guys did with OpenGMR.
So for orbit prediction I began
with a DOS program that had been
ported to Unix, called PREDICT.
And this worked, but it’s garbage.
It only supports 20 satellites plus the
sun, the moon, Venus and Mars.
But no other planets because it’s
designed for astronomy photographers
who want to get a picture of something
as it comes over the horizon. You know,
I need to track hundreds of targets and
then write a script to opportunistically
pick the ones that I want to record.
Because otherwise you have to like
set an alarm clock for the half-hour pass
in which you can play with something.
That software does allow you to query the
results by UDP, though. So you can just
send it a flood of request packets,
then it will flood back with the data
you’re looking for. So I switched to
a library called PyEphem which allows you
to track hundreds of birds. It has no
UDP nonsense. It will also calculate
satellites, planets and stars.
And the really nifty thing about this
is that you tell it… you know, it being
a library you tell it when to update
the individual object that you’re
interested in. So you can update
objects that are out of view or
uninteresting more slowly
than the ones that you care about.
So I managed to track every single item
in geo-stationary orbit. This thick
ring here is the Clarke Belt
of all satellites in geo-stationary orbit,
as viewed from my Southern horizon.
applause
The Two Line Entry files you can get
freely from CELESTRAK.COM.
So this is just a simple script that
grabs them and then inserts them.
And the prediction daemon will actually
select them as it is loading up.
Because all inter process communication is
running through this Postgres database.
And this daemon can be moved to
a different machine if I needed
more computing power, or anything
like that. The motor control demon…
well, the EiBot board is designed to take
stepper motor commands. It shows up
as USB Serial device on Linux. So as
I plug it in to the Beaglebone it appears
as /dev/ttyACM0. And the baud rate doesn’t
matter. Because this is a USB device.
You could then send it simple commands.
Like ‘SM,3000,500,-400’ means that I wanna
move a stepper motor for 3000 ms. I want
the first motor to move 500 forwards,
that’s UP, and the second one to move
400 LEFT which is backwards 400 steps.
And then it will count that out, and
then it sends me back an OK.
If I want to disable the motors, I send
‘EM,0,0’. This allows the motors to be
freely spun. Because normally a stepper
motor will physically hold its position,
you need to turn them off in
order to slide the dish around.
‘EM,1,1’ will enable both motors
in 1/16-of-a-step mode.
Stepper motors can do fractional
steps because they’re
holding themselves in position.
You can see the motors themselves
with the belts and the gear train.
This thing on the right would probably
be illegal for me to turn on.
The thing on the right is a 250 W
amplifier. laughter
The stepper motors themselves just have
six wires. In a lot of 3D printer type stuff
they ignore the middle two. So you just
drop off the middle two wires, you run
the other four to your stepper
controller, and you’re good to go.
The belts and stuff need to be measured
in order to figure out exactly
what the gear reduction is. Because you
need to know how many steps form a degree.
The IMU unit, this Vectornav VN100,
it’s a MEMS gyroscope and accelerometer
and a compass in a single box.
It costs $500 which was
more than all of the other
equipment put together.
The compass is confused by the stepper
motors because the compass is measuring
magnetic fields. So you need to
mount this physically as far away
from the stepper motors as possible. And
the gyroscope is confused by motor jerk
which is a shame because stepper motors
work as a series of jerks rather than
as a single consistent motion. And the
accelerometer is confused by gimbal lock,
so you have to switch it to
a quaternion mode in order to get
consistent values out of it. And if I had
to do this over again I’d really try
to drop this piece of garbage. But it’s
a lovely technology when it works.
some laughter
Now for position calculations: the
elevation itself comes from the IMU,
the azimuth comes from the motor daemon.
This is because the accelerometer
can very accurately tell which way
the earth’s gravity is pulling it
whereas the accelerometer has to integrate
jerks over time in order to figure out
its position. So the
accelerometer will drift
and the compass will be confused by the
magnetic fields while the elevation is
just a single accelerometer
that doesn’t drift.
And the IMU will become
a backup for these things
in order to figure out how to make
it reliable. But at the moment
the position measurement is infinitely
more reliable. The tilt motor
I’m not using at present because on
a ship that’s rocking it’s necessary
to tilt the dish. On a satellite dish
that’s staying still the only useful
tilting the dish is so that you can follow
the arc of a satellite through the sky
by only moving a single motor.
Photopgraphers do this when they’re
trying to get long exposures of moving
satellites. At the moment my software
doesn’t support this feature. But
if it turns out to be necessary
to get higher quality
recordings I might add it.
There are radio daemons. The
first is a spectrum analyzer.
This just measures the signal strength
on each frequency. And it does it by the
power spectral density function.
And the strength itself will
vary with the position error.
So this allows you to figure out how
far off you are by sort of testing,
by overshooting just a little bit,
or undershooting just a little bit
to center on your target. The downlink
recorder dumps the IQ values
in the software defined radio
directly to an NFS share,
which can later be decoded and
read and reverse-engineered.
We’ve got a whole table of spectrum
data. And then I plot that in a tool
called Viewpoints which NASA releases
for dealing with giant scatter plots
in multiple dimensions. Each view takes
two dimensions, and it’s tons of fun.
The client GUI is this PyGame. I have
Postgres for communications, and
the server does all the heavy lifting,
so the Beaglebone itself never has
to do anything complicated with
regards to software defined radio.
This is also about these faint blue lines
are positions at which I’ve seen
particularly strong signals in order to
identify which satellites are active
and which ones are inactive.
Because satellites die over time.
And particularly useful targets we’re
reverse-engineering are satellites that are
out-of-commission or outdated.
I’m running out of time by these markers.
Does that mean that we’re skipping
questions, or does that mean that
I need to be off the stage?
mumbling to stage
Not having Q&A, okay. So today I get
accurate tracking of satellites.
And this thing can run unattended 24h
a day for months without maintenance.
Like I said: it’s nothing like a 3D printer.
laughter
It takes software defined radio
recordings, it can provide maps
of views of different
satellites in the sky.
The next step is I want to publish
a ‘port scan’ of the entire sky.
So which frequencies are in use on which
birds, for every bird that ever comes
above Tennessee, on every
downlink that fits my antenna
as well as a database of software
defined radio recordings. If anyone
would care to donate a truckload
of disks – that might be handy.
I’d also like to make other ground
stations. The software that I’ve written
ought to be portable to new hardware.
So there’s nothing that should keep you
from being able to port this to run on
your own dish. And I have a large yard,
so I could conceivably have
a dozen of these things.
Another way that you can do it, and
the way that it’s traditionally done
for, say, cube satellites is having
Yagis or other loosely directional antennas
in order to receive the signals.
I went with a dish because I wanted
more selectivity. I wanted to be able to
get reverse-engineerable recordings
rather than intentional ones for which
I already knew the downlink protocol.
So this is my van, my van is amazing.
applause
Thanks to Nick Farr. I had a bit too
much to drink in Montreal and
I called Nick Farr and I said: “Nick,
I want a DUKW”, like these amphibious
troop transport vehicles. And Nick
said: “Sorry, I can’t get you one but
you want a news van!” And I said:
“Hell yeah, I want a news van!”
So – this pole in the background, that’s
not a lighting pole. That’s actually
part of the van.
laughter
This is the antenna retracted. This mast
goes up 20 m by pneumatic power.
There’s an air compressor in the back.
Here is the control panel,
there’s an air-conditioned
office in the middle.
laughter, laughs
This has four 19" server racks as well
as some A/V equipment that was left over.
I was particularly excited about the
video monitor which supports PAL
which you folks are familiar with,
NTSC or “Never The Same Color”
which is my people’s native culture…
laughter
But most importantly, it does SECAM,
the system essentially contrary
to the American method.
laughs
laughter and applause
So in addition to my radio equipment
I’m adding my Soviet PDP-11 which was…
laughs
…and that’s not a joke. I have a Soviet
PDP-11 thanks to the kind folks at the
Positive Hacking Days conference.
This is the control panel,
and that’s my talk!
applause
Herald: Thank you so much.
There actually is time for Q&A now.
Travis: Well, first I’d like to introduce
you to my cat. If we could go back
to the prior image. This is Frank!
We didn’t know it at that time, but
Frank was not dad (?) when this picture was
taken. If you’d like kittens get in touch!
Okay. Are there any questions?
Question: Great talk. What’s the most
interesting signal you decoded so far?
Travis: At the moment I’m sort of stuck
at the L band range. Because of filters
that I have yet to remove. So everything
gets attenuated, and becomes annoyingly
quiet outside of the 1.5 ..1.6 -ish range.
The Globalstar network is what I’m
most interested in targeting next.
I can’t wait to see what
people are tweeting
while they should be enjoying nature.
Herald: Is there a question
from the internet?
Signal Angel: Yeah, the internet has
many questions. So first one was:
Is there really no authentication or
encryption on the Q band IP services?
So you can just spoof at will? And…
can the birds see the physical
location of the source
accurately enough to
find who is spoofing?
Travis: I’m not an expert in Ku band. The…
for the downlink the bird has no clue
as to the location of the dish. Because
you’re only listening. They can roughly
figure out your geographic area because…
they need to figure out where
the spot beam is going. So they might know
whether you’re in, say, Germany or
in France. But they won’t know whether
you’re in Heidelberg or Mannheim.
They do have forms of authentication for
many satellite networks. Satellite TV
is one of the best-protected network
services because of the satellite wars
in the nineties in which TV pirates would
fight back and forth with smart card
designers. But there are also many
unencrypted links. And there are…
because of standard protocols those
are particularly easy to find in Ku band.
Question: You’ve been talking about
using RTLSDR from osmocom.
And you were talking about your spectrum
analysis program. Is this one working
with RTLSDR?
Travis: So… RTLSDR… so I’m using
the RTLSDR, not the OsmoSDR.
Which are separate. The spectrum
analyzer is working with the RTLSDR.
My complaint about the RTLSDR is that
when you have a strong signal next to
a weak signal the weak signal is
utterly useless for interpretation.
Question: Okay. Thank you.
Herald: Another question
from the internet?
Signal Angel: Okay, next question from
the internet is: How do you record
the radio signal from the dish,
at what sampling rate?
Travis: The RTLSDR samples at 2 million
samples per second. As soon as I switch it
over to the HackRF I’ll be having
20 million samples per second.
The sampling rate can be reduced once
the bandwidth of the signal is known.
For reduced storage. And the
recordings can also be compressed.
But it’s still a hell of a lot of storage.
Herald: Any other questions?
Signal Angel: The internet
has more questions…
Herald: Okay…
Signal Angel: Did you look into obtaining
a capacitive high-bandwidth coupler as used
for the rotary gantries in CT scanners?
Those can apparently transmit contactless
several GBytes per
second, bi-directionally.
Travis: I’ve not looked into those.
It seemed better to have an umbilical
cable and to be careful not to snap it.
The whole thing was done for a budget
of less than 2000 Dollars, and can be
recreated for less than a budget of 1000
[Dollars]. And they… so we tried to avoid
fancy parts. The local radio shack loved
us because we’d swing in and buy all sorts
of crazy stuff. As soon as we told them
that we wanted the satellite dish to
dance Gangnam style…
laughs
laughter
in German, strong accent:
Danke, gerne!
applause
silent postroll titles
subtitles created by c3subtitles.de
in the year 2017. Join, and help us!