Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Going Meta–Pulling Info from Encrypted Radios

Luke Berndt

WirelessTalks23 minIntermediateOpen on YouTube ↗

Where

Talks
ShmooCon 2024

Duration

23 min

Shows how passive listening to encrypted public safety trunked radio systems leaks metadata about talk groups and radio activity.

Summary

The talk opens with the basics of trunked radio. Talk groups are dynamically assigned channels, and digital P25 systems, standardized from 1989 with little security input, are widely used by public safety agencies. Voice traffic is usually encrypted, while control messages are not, and most radios and base stations do not authenticate each other. The speaker notes that the standards are costly to obtain, though some are available through archive sites.

Next, he walks through his setup: a cheap software-defined radio running open-source software such as trunk recorder, GNU Radio and OP25, with results stored in a database and analysed in a notebook. Over nine days of Washington, DC traffic, about three quarters of the calls he captured were encrypted. Even without audio, the metadata showed clear patterns. A large fire drew hundreds of listening units and a spike in transmissions, and a police special operations talk group spiked during a week of school bomb threats. Registration and affiliation records also suggested that a few radios powered up only during big events, possibly tied to special vehicles.

He closes by arguing that open dispatch audio has exposed dispatch errors and police conduct issues, while encryption complicates interoperability. He is unsure whether radio designs will be improved, and calls for community discussion about what should stay open. He invites listeners to build on the tooling, including a light that alerts when activity thresholds are crossed.

Related talks