Hillbilly Tracking of Low Earth Orbit

silent 30C3 preroll titles

applause

Travis Goodspeed: First I need
to apologize for typesetting this

in OpenOffice. I know that the
text looks like a ransom note.

But that’s what happens
when you don’t use LaTex.

I’d also like to give a shoutout to
Collin Mulliner if he is here,

and our Dinosaur rock band.

laughs, applause

We’re a Christian rock band, we’re
called ‘Jesus lives in the ISS’ and

we know that he is always watching us,
but we think that it’s easier for him

to hear our prayers when
he’s, you know, in an orbit

that passes over us. So we need to use
orbital tracking to know when to pray!

laughter

As I’m sure you can guess I’m not
recognized as a legal minority religion

in Germany. I’d also like to thank skytee

and Fabienne Serrière and Adam Laurie

and Jim Geovedi for some
prior satellite tracking work,

and the Scooby Crew at Dartmouth
College for all sorts of fun

whenever I bounce out there.
This is the mission patch

of the Southern Appalachian
Space Agency (SASA).

applause and cheers

This was drawn by Scott Beibin and there
are a few pieces of my people’s native

culture that I need to point out here. On
the right the little Dinosaur type thing

with his finger going out, you might
call him E.T. but we call these things

‘buggers’. They are like this tall, and
they are green and that’s why the man

on the left has a shotgun.
laughter

Because he doesn’t want to be abducted.
You got a satellite dish in the middle

and it’s sitting on sinter blocks because
that’s also a piece of my people’s

native culture. There’s a moonshine
still in the background.

That’s kind of like Vodka but you
make it at home and from corn.

And then there’s the mountain… a piece…
it looks like there are snow peaks

on those mountain tops. But our mountains
aren’t tall enough to have snow.

These are actually that we’ve blown off
the lids of the mountains for coal mining.

Which is another piece of
my people’s native culture.

And at the top, in space you can see
the ISS, and you can see a banana,

and you can see what I think is a bulb.
This is to signify space trash.

I mean there’s a lot of stuff up there.
And, you know it’s symbolism that matters

in these things, you know?

At BerlinSides, in May of 2012

I did a lecture on reverse-
engineering the SPOT Connect.

The SPOT Connect is a little
hockey puck type thing

– this is what it looks like.
And these things are great.

It weighs a bit more than your cell phone
but it runs off of a couple of batteries,

it connects to your phone by Bluetooth.

Originally these were emergency locator
beacons. So if you’re going hiking…

have any of you seen the movie where
the guy has to cut off his arm

with a dull knife? If you’re hiking and
you don’t want that same experience

you buy one of these things. And
then there’s an emergency button

you can push that transmits your
GPS coordinates by satellite

to rescue workers. But that was boring,
so they had to add social media.

laughs, laughter

So in addition to keeping you
from chewing off your own arm

this device will also allow you to
tweet and make Facebook posts.

laughs, laughter

The idea is that as you’re running…
here I’m crossing the Schuylkill River

in Philadelphia and the Android
phone on the left is making a post.

And I did an article on reverse-
engineering the Bluetooth side

of these things. Because… I use a weird
brand of phone that Microsoft killed off,

and I’m terribly bitter about it. But
I also figured out the physical layer.

And that’s what this diagram shows.
This transmits at 1.6125 GHz.

And it sends a pseudo-random stream, so
each one of these zeros is a long chunk

where it’s bouncing back and forth
between two different frequencies.

And the same for the ones.
But the way that the pattern works

is that it switches the signal whenever
it is going from the 0 signal

to the 1 signal. And internally, there are
these little pops that you can actually

identify on a software defined radio
recording. And this is how you can

reverse-engineer the signal that
the SPOT Connect is sending up

to its satellite network.

Everything is clear text on this.
And it’s completely unencrypted.

It just has your serial number, your GPS
coordinates, and a bit of ASCII text.

So if you listen on this frequency and
you have the correct recording software

you can actually watch all of the SPOT
Connect messages that are transmitting

up from your location. And this would be
great except that this is designed for

hiking in areas where there’s no cell
phone service. So having an antenna

on the uplink frequency is kind of
useless. You know you would actually

have to go out to a national park, find
some guy who is about to chew his arm off,

and then you could listen to his uplink
where he is like tweeting: “Hey, I’m gonna

chew my arm off”, you know?
laughter

So that’s great as a proof of concept
but it’s not really anything practical.

The current state of that was that I knew
the protocol and I could sniff the uplinks.

But I wanted to sniff the downlinks. So
it’s easy for me to get the thing that

goes up to the satellite. But what I wanted
was what comes down from the satellite.

And that requires a satellite dish. But
a geo-stationary dish isn’t good enough

because the satellites that run this
network – there are a lot of them,

it’s called the Globalstar network,
they fly really low across the earth,

and they fly across the earth in very
tight, very fast orbits. So they’ll move

from horizon to horizon in 15 to 20
minutes. Which means that you either need

like a sweat shop army of kids
trying to aim the satellite dish

as it’s going across or you need
to make it computer-controlled.

Stepping back from the SPOT
Connect for a little bit, and

discussing some prior research.
Adam Laurie did some work

with geostationary satellites.
These are the satellites that stay

in one position in the sky.
He gave two sets of talks

– one in 2008 and the second in
2010. And he used a DVB-S card

connected to a satellite dish with
a DiSEqC motor, so that it could move

the satellite dish left and right in order
to scan a region of the horizon.

His tool is publicly available,
it’s called satmap.

You can grab it at this URL.

And then after he finds a signal he has
a feed scanner. Normally when you use

Satellite TV your provider gives you
a listing of the frequencies, and

your provider gives you an exact orbital
position to aim your satellite dish at.

But Adam’s tool allows you to scan to
see which frequencies are in use and

which protocols are in use, once
you’ve correctly aimed your dish.

And he also describes a technique
for moving your dish left and right

while doing this in order to
identify where the satellites are.

This recording here is from
a re-implementation that I made

of Adam’s work, in order to
catch up with it. In this diagram

the x-axis – because you move left
and right – that shows the azimuth,

that shows how far left or right my
satellite dish has moved. And then

the y-axis shows the frequency. And
all of these dots are strong signals.

So every vertical bar in which you see
chunks of frequencies, that’s a satellite.

But these stay in the same position. So
it’s easy for me to repeat this experiment.

It’s easy for me to re-run it, and to find
the same satellites in the same position.

It’s easy to debug this.
But it can’t move in elevation.

This diagram is actually
a very small slice of the sky.

We’re looking at a single line,
maybe 10 degrees across.

Maybe only 5 degrees across.

So hacking Ku-band – the television
satellites – has the advantage

that you can use cheap standardized
hardware. I bought one of these DVB-S cards

in Mauerpark, in Berlin for 3 Euro. You
can use standardized DiSEqC motors,

you can buy them at a satellite TV shop.

TV signals come with video feeds
so you can actually see pictures.

There was a scandal about 4..5 years
ago where they were finding

drone [control] feeds that were being
bounced across these satellites.

In the nineties it was very popular to
listen to the sort of unedited sections

of interviews, when people would
be interviewed over a satellite,

before Skype and such
things became options. And

there are also networking signals here
using TCP/IP packets. So you can actually

turn your DVB-S card into
a promiscuous ethernet adapter,

and start sniffing all of the traffic that
comes across. This is also a great way

to get free downlink bandwidth. Because
you can just flood packets at an address

that, you know, will be routed to
you, or several addresses, and

then you sniff it out as the
legitimate receiver ignores them.

But it also has some disadvantages. It
only works for geostationary satellites.

If the satellite is not staying in the
same position relative to the ground

then you can’t track it. Your
dish also moves very slowly.

And it only moves left and right.
It won’t move up and down.

And you’re limited to standardized
signals. So while it’s great that you get

video and TCP/IP you’re never
going to get anything weird.

You’re not gonna get any mobile
data, you’re not going to get any

Brazilian truck-drivers – we’ll
get to those in a bit. laughs

I misspoke, you actually will get
Brazilian truck-drivers in this.

So I bought a satellite dish. One of the
best things about living in America is

that you can buy industrial
hardware cheap as dirt on ebay.

I know things aren’t likely used to being
a cat bite to (?)(?) human children anymore.

But this satellite dish here on
the left – the one in the radome –

that’s my dish. And to the right,
that’s the boat that it came from.

applause
laughs

This came from a military ship.
But the dish itself is also available

for civilian use on very large yachts.

The dish itself is a Felcom 81 and it
was intended for use with a network

called Inmarsat. Inmarsat allows
for telephone connections,

and also data connections when you’re on
a boat. So if the crew wants to call home

or wants to go to AOL Keywords

or whatever was popular back when
this was common they could do that.

And the dish was designed to sit
at the very top of a ship’s mast.

The reason why is that at the top of
the mast there aren’t any obstructions

– it has a clear view of the sky in all
directions. But there’s a complication

with being on the top of the mast. Which
is that the ship is rocking beneath you

and you’re moving more
than the rest of the ship.

So they have stepper motors
for azimuth, elevation and tilt.

And then they have spinning gyroscopes.
Back before the iPhone there was

this dark, dark time when
gyroscopes actually spun.

And this is the sort of gyroscope that
it has. It actually has 4 of them so

that it can measure its movement.

And then it has a control computer. So the
idea is that the dish itself can be moved

while remaining absolutely stable
with regard to the gyroscopes.

So it compensates for the rocking of
the ship beneath it as it’s targeting

a stationary satellite.
In America this costs 250 dollars

but it’s electronics equipment, so while
you think that would only be a 180 Euro

it’s more like 2500. And that’s before
import duties and it being impounded.

We also have this lovely culture in which
people love excuses to use their trucks.

So the guy that I bought this from offered
to deliver it to my home for only $200.

It was an 11-hour drive.

But if you wanted this you’d have to
bring it back in your carry-on luggage

and that could be awkward.

I got this dish and I decided I had
to do something with it. So I created

the Southern Appalachian Space Agency.
I’m from the state of Tennessee,

formerly known as the State of Franklin
until North Carolina invaded us.

It’s ok, I know Europeans suck at history.

laughs
laughter and applause

Now I’m trying to think of how to show
you on a map where Tennessee is

without having a map. But, you know,
it’s okay, I know you suck at geography

and will forget it soon. (?)

From audience: It’s very
near Texas, to the north.

Travis: Texas is our first colony. But
it’s actually a decent drive to the east.

Due east (?). You don’t
actually have to go it anyways.

So what I did was I took these motors
which were designed to be able to move

the satellite dish to compensate
for the rocking the ship and

I re-purposed them to track through
the sky while the ground is stable.

We don’t have very many earthquakes in
Tennessee. The last one that we had

made rivers run the wrong direction.
But it’s okay – it’s a geography thing.

laughs
So this allows me to track things

that are moving through the sky.
But it doesn’t actually matter

where they’re moving in the sky because
that’s just a software problem.

So in addition to tracking objects that
are in low-earth orbit by a software patch

I can also track things that are in deep
space. It’s not much harder to track

deep space probes or stars than it
is to track items in low-earth orbit.

And then I added a software defined radio
which allows me to record a signal now

and then demodulate it later.
Which is necessary if you intend

to reverse-engineer a signal. Because
a lot of the downlinks from these satellites

are completely non… completely
undocumented. And being able

to tune in to the right frequency is only
half of it. You also need a recording

of sufficient quality that you can
reverse-engineer it after the fact.

We’re sort of spoiled by software
defined radios in that when doing

software defined radio work we usually
have a very good signal to work from.

So having high quality signals for later
reverse-engineering is necessary.

I really wanted to be able to identify
undocumented downlinks for low-earth orbit

in the same way that we already
do this for geo-stationary orbit

using tools like the ones that Adam
Laurie and Jim Geovedi made.

So I built a software framework as
a collection of Python daemons.

And these run across a home
area network in my house.

There’s a Beaglebone inside of the Radome.

And an x86 server in the house. Or AMD64,
whatever the kids call it these days.

And then I used Postgres for coordination.
So that all of these daemons can talk

to each other without… without me really
caring which machine they’re on.

So for maintenance I can have my
laptop pretending to be the dish,

and I can have stepper motors on my desk,
and I can watch them spin, and I can even

make a model of the dish and swap these
components in and out without the rest of

the network being confused. This also
allows for SQL injection attacks to

physically move my dish. Which is why the
sensor network is not on one of those

fancy WEB 2.0 things. Because of you could
inject, say, “UPDATE target SET name=

‘VOYAGER 1’”. Then my dish would physically
move and start tracking Voyager 1

through the sky. Voyager 2

doesn’t actually come into the sky because
of my position in the Northern hemisphere.

So, it’s okay, I know you suck at
geography. But Voyager 1 is going up,

and Voyager 2 is going down.

There’s a Realtek software defined radio
for the radio reception. Although

these things are garbage. So I’m in the
process of replacing this for the HackRF.

There’s also an EiBot board for motor
control. We’ll get back to that in a minute.

And there’s an Inertial Measurement Unit
from VectorNav which actually measures

using the fancy MEMS gyroscopes and
a MEMS compass how I’m moving.

This isn’t accurate enough to target
the dish, so I’m still counting steps

to move the dish. But it is accurate
enough to tell me when my belts

have broken. Or when I’m up
against a physical obstruction.

This is skytee helping
me out with the dish.

He’s zip-tying it. Because, you know
we know everything about duct tape

where I come from, but we don’t know
anything about zip-ties. So I had

to bring in a German engineer.
laughter

We call him a gerry wigger(?)
but, you know…

This is the satellite dish itself. And you
can sort of see in this photograph

where we’ve strapped on the equipment.
There’s like an umbilical cord.

Or more like a spinal column that actually
runs up the back of the dish. So we just

added new cables onto that line.
And then zip-tied them in place.

And skytee came up with all these
crazy ideas like that we should use

chains and zip-ties to make sure that the
cables don’t tear themselves out. And

that worked tremendously well in practice.
So, as this thing spins around,

by the original design there’s a ring
connector that all of the signals

go through. That all of the networking
goes through. That all of the rest

goes through. And that worked in the
nineties because it had no reason

to send anything faster than 9600 baud.

But with the modern signals going across
it I need 100 MBit/s or even GB ethernet,

that’s not enough, I need more than
two wires. So there’s a cable that comes

across it, and then I rely on the
software to keep it from wrapping

that cable around itself. So it can only
move, say, 400 degrees around.

But that’s still more than a full circle.
So by stopping halfway and moving back

I can prevent it from getting snagged.

We’ve got the Beaglebone on the left,
in the middle there’s a USB hub

and on the right is the motor controller.

The Beaglebone runs Debian Linux and
takes care of sending the software defined

radio recordings over the network. It also
takes care of updating the motor positions

to be the ones that the database
declares should be current.

The stepper motors themselves are the
originals that the dish was designed with.

And they’re running to an EiBot Board.
The EiBot board was intended

for plotting on Easter eggs
laughs, laughter

I feel, you know… is that neat?

laughs
applause

So you can actually aim a satellite dish
that’s as tall as you are, with of these

fancy motors using less sophisticated
equipment than what’s used

in a 3D printer. Don’t panic, though.

It’s a hell of a lot more
reliable than a 3D printer.

But we needed some sort of backup in
addition to the inertial measurement unit

telling us when the device
had snagged itself.

It would also help to have
a visual queue. Because

the satellite dish sits in Tennessee, and
while I love my home town, and, you know

I’m very proud of being Tennessean, it’s
also a long way to travel when you need

to re-orient the dish. Using an
accelerometer it’s easy enough

to correct the elevation. Because you can
use the accelerometer as a level, and

you can use that to tell how high up the
dish is pointing, at an absolute scale.

But the compass isn’t very accurate. So
instead, as a backup we have a webcam

that’s taped to the top. Taping
is my people’s native culture.

We have it taped to the top, and then
it’s pointing backwards. So this gives us

like a rear view camera,
from the dish’s position.

So as the dish sits
inside of its radome…

– junk cars in the yard are also
my people’s native tradition!

laughs, laughter

So the dish sits there next to
my brother’s Toyota Supra.

And that thing, you know,
that thing flies as soon as it gets

an engine put back in it.
laughter

So it sits there and it’s moving but
externally you can’t see where it is.

Which means that I can’t call my family
in Tennessee and blackmail them into

– yet again – looking at my dish to tell
where it’s pointed. There are bolts

that hold this down, it takes half an hour
to remove the lid, another half an hour

to put it back on.

So instead we took the radome…
that’s Frank, he’s my cat.

Give a “Cheers!” for Frank!

applause and cheers

Yeah, we had such a great time with Frank.
And we never knew that she was pregnant.

If you happen to need kittens and wanna
pay the customs fees I’ll hook you up!

So then we took tape and ran tape
down the edges of the radome,

and then marked it. So from the markings
you can tell which clock position

the back of the satellite dish is pointing
at. So if you point the dish towards 12:00

you know that you’re roughly at 6:00,
so you know that it’s pointing South.

And then you can sort of scan the sky
for a stationary target, and navigate

off of that, to recover your position.

Software-wise… remember, the
whole thing runs through Postgres,

so I just tunnel the Postgres over SSH,
and then I wrote a Python client

that displays the satellite positions
and the satellite state in PyGame.

This is intended for making those games
where you see the rabbit and the rabbit

jumps on the other rabbit. But it… works!
And it works perfectly well enough

to target the dish. Because all that this
software has to do is plot the positions

of the satellites, and give orders back to
the database when I click on a satellite

or click on a position.
It can also display stars.

So the red items are satellites which are
not selected. The green item is GOES-3

which is the satellite that I’m targeting.
And then the white items are

stars in the sky. Now this is
a plot in which the azimuth

is on the X axis, and the elevation is on
the Y axis. But I can also arrange it

into a polar plot. Which sort of gives me
an upside-down view of the satellite dish

looking at the sky.
I doubt you can read it but

just above the green circle in the center,
that’s Polaris which is the North star.

It’s also weird because, you know,
working on this, you know, I thought

that I got really good at astronomy
until I realized that I only knew

what the stars looked like during the day.
laughter, laughs

And it being PyGame you can
actually run it on a mobile device.

So the same client that runs on my
laptop can also run on my Nokia N900.

laughs
applause

A significant portion of the GUI client for
this was written while stuck on the U-Bahn,

connected over 3G, SSH through
and just using emacs on the phone.

laughter, laughs
applause

If you’re one of those people who needs to
complain about the N900 being too old,

it also runs on the N9.

And then you can take the data out of this
and run it through scientific software.

In addition of the software defined radio
recordings themselves being dumped out

to a text file or a binary file on disk
you can also dump out things like

the received signal strength indicators
(RSSI). So this is a screenshot in which

I’m identifying different satellites that
I’ve seen in the sky based upon

their downlink signal peaks. You can see
the noise floor there, at the bottom,

and then there’s a rather strong signal on
the left. And a weaker, narrower signal

on the right. Now, the
daemons that build this up…

you need an orbit prediction daemon.
Because you need to know

where the satellites are and where
they’re going, and where they will be

by the time you get to them.

You need to update the orbits themselves.

LEO satellites are described in TLE files,

these are called ‘Two Line Entry’ and
they’re called ‘Two Line Entry’ because

they’re three lines long.
laughter

These were originally used by NORAD for
inter-continental ballistic missile tracking.

And because a ballistic missile
is basically in orbit, it’s just that

that orbit happens
to collide with the earth.

But this format isn’t terribly accurate
for satellites that adjust their own orbit.

So anything that has fuel, or has engines,
or changes mass will vary its position.

And this also doesn’t account for drag.
Because, you know, the missile itself,

you know it goes up it goes down, it’s
not orbiting enough for the light drag

in the upper atmosphere to matter. But for
a satellite it does. So these Two Line Entries

will work for a matter of days or maybe
a couple of weeks. But they don’t last

longer than that. So you need a daemon
that grabs the new files from Space Track.

And this is just a matter of like
a recursive WGET, and then

parsing the files. And that still needs
to be done. You also need motor control,

because you need to move the dish
physically to track your target.

You need input for the Inertial
Measurement Unit. This comes over

a low voltage serial port. And then
you need radio daemons to handle

spectrum analysis or downlink recording.
And these you’ll have several of them,

you have to swap them out. So you’ll begin
by using the spectrum analyzer to identify

that your aim is accurate, that you’re
accurately tracking the targets

well enough to get a recording from
them. And then after that you begin

to take software defined recordings off
them. And, eventually, you might have

a standalone application that parses
what you’re receiving. Such as

the Osmocom guys did with OpenGMR.

So for orbit prediction I began
with a DOS program that had been

ported to Unix, called PREDICT.

And this worked, but it’s garbage.

It only supports 20 satellites plus the
sun, the moon, Venus and Mars.

But no other planets because it’s
designed for astronomy photographers

who want to get a picture of something
as it comes over the horizon. You know,

I need to track hundreds of targets and
then write a script to opportunistically

pick the ones that I want to record.
Because otherwise you have to like

set an alarm clock for the half-hour pass
in which you can play with something.

That software does allow you to query the
results by UDP, though. So you can just

send it a flood of request packets,
then it will flood back with the data

you’re looking for. So I switched to
a library called PyEphem which allows you

to track hundreds of birds. It has no
UDP nonsense. It will also calculate

satellites, planets and stars.
And the really nifty thing about this

is that you tell it… you know, it being
a library you tell it when to update

the individual object that you’re
interested in. So you can update

objects that are out of view or
uninteresting more slowly

than the ones that you care about.
So I managed to track every single item

in geo-stationary orbit. This thick
ring here is the Clarke Belt

of all satellites in geo-stationary orbit,
as viewed from my Southern horizon.

applause

The Two Line Entry files you can get
freely from CELESTRAK.COM.

So this is just a simple script that
grabs them and then inserts them.

And the prediction daemon will actually
select them as it is loading up.

Because all inter process communication is
running through this Postgres database.

And this daemon can be moved to
a different machine if I needed

more computing power, or anything
like that. The motor control demon…

well, the EiBot board is designed to take
stepper motor commands. It shows up

as USB Serial device on Linux. So as
I plug it in to the Beaglebone it appears

as /dev/ttyACM0. And the baud rate doesn’t
matter. Because this is a USB device.

You could then send it simple commands.
Like ‘SM,3000,500,-400’ means that I wanna

move a stepper motor for 3000 ms. I want
the first motor to move 500 forwards,

that’s UP, and the second one to move
400 LEFT which is backwards 400 steps.

And then it will count that out, and
then it sends me back an OK.

If I want to disable the motors, I send
‘EM,0,0’. This allows the motors to be

freely spun. Because normally a stepper
motor will physically hold its position,

you need to turn them off in
order to slide the dish around.

‘EM,1,1’ will enable both motors
in 1/16-of-a-step mode.

Stepper motors can do fractional
steps because they’re

holding themselves in position.

You can see the motors themselves
with the belts and the gear train.

This thing on the right would probably
be illegal for me to turn on.

The thing on the right is a 250 W
amplifier. laughter

The stepper motors themselves just have
six wires. In a lot of 3D printer type stuff

they ignore the middle two. So you just
drop off the middle two wires, you run

the other four to your stepper
controller, and you’re good to go.

The belts and stuff need to be measured
in order to figure out exactly

what the gear reduction is. Because you
need to know how many steps form a degree.

The IMU unit, this Vectornav VN100,
it’s a MEMS gyroscope and accelerometer

and a compass in a single box.
It costs $500 which was

more than all of the other
equipment put together.

The compass is confused by the stepper
motors because the compass is measuring

magnetic fields. So you need to
mount this physically as far away

from the stepper motors as possible. And
the gyroscope is confused by motor jerk

which is a shame because stepper motors
work as a series of jerks rather than

as a single consistent motion. And the
accelerometer is confused by gimbal lock,

so you have to switch it to
a quaternion mode in order to get

consistent values out of it. And if I had
to do this over again I’d really try

to drop this piece of garbage. But it’s
a lovely technology when it works.

some laughter

Now for position calculations: the
elevation itself comes from the IMU,

the azimuth comes from the motor daemon.
This is because the accelerometer

can very accurately tell which way
the earth’s gravity is pulling it

whereas the accelerometer has to integrate
jerks over time in order to figure out

its position. So the
accelerometer will drift

and the compass will be confused by the
magnetic fields while the elevation is

just a single accelerometer
that doesn’t drift.

And the IMU will become
a backup for these things

in order to figure out how to make
it reliable. But at the moment

the position measurement is infinitely
more reliable. The tilt motor

I’m not using at present because on
a ship that’s rocking it’s necessary

to tilt the dish. On a satellite dish
that’s staying still the only useful

tilting the dish is so that you can follow
the arc of a satellite through the sky

by only moving a single motor.
Photopgraphers do this when they’re

trying to get long exposures of moving
satellites. At the moment my software

doesn’t support this feature. But
if it turns out to be necessary

to get higher quality
recordings I might add it.

There are radio daemons. The
first is a spectrum analyzer.

This just measures the signal strength
on each frequency. And it does it by the

power spectral density function.

And the strength itself will
vary with the position error.

So this allows you to figure out how
far off you are by sort of testing,

by overshooting just a little bit,
or undershooting just a little bit

to center on your target. The downlink
recorder dumps the IQ values

in the software defined radio
directly to an NFS share,

which can later be decoded and
read and reverse-engineered.

We’ve got a whole table of spectrum
data. And then I plot that in a tool

called Viewpoints which NASA releases
for dealing with giant scatter plots

in multiple dimensions. Each view takes
two dimensions, and it’s tons of fun.

The client GUI is this PyGame. I have
Postgres for communications, and

the server does all the heavy lifting,
so the Beaglebone itself never has

to do anything complicated with
regards to software defined radio.

This is also about these faint blue lines
are positions at which I’ve seen

particularly strong signals in order to
identify which satellites are active

and which ones are inactive.
Because satellites die over time.

And particularly useful targets we’re
reverse-engineering are satellites that are

out-of-commission or outdated.
I’m running out of time by these markers.

Does that mean that we’re skipping
questions, or does that mean that

I need to be off the stage?
mumbling to stage

Not having Q&A, okay. So today I get
accurate tracking of satellites.

And this thing can run unattended 24h
a day for months without maintenance.

Like I said: it’s nothing like a 3D printer.
laughter

It takes software defined radio
recordings, it can provide maps

of views of different
satellites in the sky.

The next step is I want to publish
a ‘port scan’ of the entire sky.

So which frequencies are in use on which
birds, for every bird that ever comes

above Tennessee, on every
downlink that fits my antenna

as well as a database of software
defined radio recordings. If anyone

would care to donate a truckload
of disks – that might be handy.

I’d also like to make other ground
stations. The software that I’ve written

ought to be portable to new hardware.
So there’s nothing that should keep you

from being able to port this to run on
your own dish. And I have a large yard,

so I could conceivably have
a dozen of these things.

Another way that you can do it, and
the way that it’s traditionally done

for, say, cube satellites is having
Yagis or other loosely directional antennas

in order to receive the signals.
I went with a dish because I wanted

more selectivity. I wanted to be able to
get reverse-engineerable recordings

rather than intentional ones for which
I already knew the downlink protocol.

So this is my van, my van is amazing.

applause

Thanks to Nick Farr. I had a bit too
much to drink in Montreal and

I called Nick Farr and I said: “Nick,
I want a DUKW”, like these amphibious

troop transport vehicles. And Nick
said: “Sorry, I can’t get you one but

you want a news van!” And I said:
“Hell yeah, I want a news van!”

So – this pole in the background, that’s
not a lighting pole. That’s actually

part of the van.
laughter

This is the antenna retracted. This mast
goes up 20 m by pneumatic power.

There’s an air compressor in the back.
Here is the control panel,

there’s an air-conditioned
office in the middle.

laughter, laughs

This has four 19" server racks as well
as some A/V equipment that was left over.

I was particularly excited about the
video monitor which supports PAL

which you folks are familiar with,
NTSC or “Never The Same Color”

which is my people’s native culture…
laughter

But most importantly, it does SECAM,
the system essentially contrary

to the American method.
laughs

laughter and applause

So in addition to my radio equipment
I’m adding my Soviet PDP-11 which was…

laughs
…and that’s not a joke. I have a Soviet

PDP-11 thanks to the kind folks at the
Positive Hacking Days conference.

This is the control panel,
and that’s my talk!

applause

Herald: Thank you so much.
There actually is time for Q&A now.

Travis: Well, first I’d like to introduce
you to my cat. If we could go back

to the prior image. This is Frank!
We didn’t know it at that time, but

Frank was not dad (?) when this picture was
taken. If you’d like kittens get in touch!

Okay. Are there any questions?

Question: Great talk. What’s the most
interesting signal you decoded so far?

Travis: At the moment I’m sort of stuck
at the L band range. Because of filters

that I have yet to remove. So everything
gets attenuated, and becomes annoyingly

quiet outside of the 1.5 ..1.6 -ish range.

The Globalstar network is what I’m
most interested in targeting next.

I can’t wait to see what
people are tweeting

while they should be enjoying nature.

Herald: Is there a question
from the internet?

Signal Angel: Yeah, the internet has
many questions. So first one was:

Is there really no authentication or
encryption on the Q band IP services?

So you can just spoof at will? And…

can the birds see the physical
location of the source

accurately enough to
find who is spoofing?

Travis: I’m not an expert in Ku band. The…
for the downlink the bird has no clue

as to the location of the dish. Because
you’re only listening. They can roughly

figure out your geographic area because…
they need to figure out where

the spot beam is going. So they might know
whether you’re in, say, Germany or

in France. But they won’t know whether
you’re in Heidelberg or Mannheim.

They do have forms of authentication for
many satellite networks. Satellite TV

is one of the best-protected network
services because of the satellite wars

in the nineties in which TV pirates would
fight back and forth with smart card

designers. But there are also many
unencrypted links. And there are…

because of standard protocols those
are particularly easy to find in Ku band.

Question: You’ve been talking about
using RTLSDR from osmocom.

And you were talking about your spectrum
analysis program. Is this one working

with RTLSDR?

Travis: So… RTLSDR… so I’m using
the RTLSDR, not the OsmoSDR.

Which are separate. The spectrum
analyzer is working with the RTLSDR.

My complaint about the RTLSDR is that
when you have a strong signal next to

a weak signal the weak signal is
utterly useless for interpretation.

Question: Okay. Thank you.

Herald: Another question
from the internet?

Signal Angel: Okay, next question from
the internet is: How do you record

the radio signal from the dish,
at what sampling rate?

Travis: The RTLSDR samples at 2 million
samples per second. As soon as I switch it

over to the HackRF I’ll be having
20 million samples per second.

The sampling rate can be reduced once
the bandwidth of the signal is known.

For reduced storage. And the
recordings can also be compressed.

But it’s still a hell of a lot of storage.

Herald: Any other questions?

Signal Angel: The internet
has more questions…

Herald: Okay…

Signal Angel: Did you look into obtaining
a capacitive high-bandwidth coupler as used

for the rotary gantries in CT scanners?
Those can apparently transmit contactless

several GBytes per
second, bi-directionally.

Travis: I’ve not looked into those.
It seemed better to have an umbilical

cable and to be careful not to snap it.

The whole thing was done for a budget
of less than 2000 Dollars, and can be

recreated for less than a budget of 1000
[Dollars]. And they… so we tried to avoid

fancy parts. The local radio shack loved
us because we’d swing in and buy all sorts

of crazy stuff. As soon as we told them
that we wanted the satellite dish to

dance Gangnam style…
laughs

laughter

in German, strong accent:
Danke, gerne!

applause

silent postroll titles

subtitles created by c3subtitles.de
in the year 2017. Join, and help us!