Troy Jessup

### Overview In this presentation, Troy Jessup provides a hands-on introduction to Software-Defined Radio (SDR) and its applications in penetration testing, monitoring, and security research. Using low-cost RTL-SDR USB dongles and a HackRF One, the speaker demonstrates how easily unencrypted radio frequency (RF) transmissions can be intercepted, decoded, and analyzed using widely available software tools on Windows.

### Key Topics - **Software-Defined Radio Basics**: The fundamentals of SDR, using RTL-SDR dongles, antenna selection and tuning (such as homebrew ground-plane antennas), and comparing cheap RTL-SDR dongles against the higher-end HackRF One. - **Tooling & Driver Setup**: Using Zadig to install WinUSB drivers for RTL-SDR and HackRF hardware, and running applications like SDR# (SDR Sharp) as administrator. - **Pager Traffic Interception**: Capturing RF signals in the ~929 MHz band and routing audio via VB-Audio Virtual Cable into the PDW decoding software to reveal unencrypted, sensitive messages. - **Aircraft Tracking and ADS-B Security**: Receiving 1090 MHz ADS-B transponder frames with ADS-B Sharp and plotting flight data in real time using ADS-B Scope, accompanied by a discussion on ADS-B spoofing risks. - **Public Safety & Voice Monitoring**: Scanning narrowband FM and trunked radio systems in the 850 MHz spectrum, monitoring local dispatch audio, and recording RF signals for replay attacks (e.g., garage door openers).

### Technical Details - **Hardware & Antennas**: The speaker highlights that antenna choice is critical—antennas tuned for 800–900 MHz or ~1900 MHz (noted in talk for ADS-B tracking) require proper ground planes (even placing them on laptop lids helps). RTL-SDR dongles operate at roughly 3.2 MSPS and suffer from cheap crystal drift, while the HackRF One provides up to 28 MSPS, cleaner spectrum resolution, wider bandwidth, and transmission capabilities. - **Pager Decoding**: Using SDR# tuned to 929.615 MHz in narrowband FM (NFM), audio is routed through a virtual audio cable directly into PDW. The live demo showed intercepting unencrypted hospital pages containing Protected Health Information (PHI) like patient names, test results, and room assignments, as well as infrastructure alerts, internal Jira ticket notifications, and conference bridge numbers. - **ADS-B Demodulation & Spoofing**: ADS-B Sharp receives raw frames and opens a local TCP port (such as 47806), which ADS-B Scope connects to as a client to map aircraft position, heading, altitude, and speed. The speaker points out that because ADS-B lacks authentication, a transmit-capable SDR like the HackRF One coupled with a directional Yagi antenna can theoretically inject false aircraft beacons, triggering cockpit Traffic Collision Avoidance System (TCAS) alerts and forcing automated autopilot evasion. - **RF Signal Analysis & Replay**: SDR# supports multiple modulation types (AM, WFM, NFM, USB, LSB) and signal recording. The speaker outlines how recorded digital signals (such as fixed-code garage door openers using frequency shifting spaced roughly 12 kHz apart) can be recorded, analyzed bit-by-bit, and replayed.

### Takeaways Unencrypted wireless protocols continue to expose sensitive data across healthcare, telecommunications, and aviation. Low-cost SDR setups empower security analysts and penetration testers to discover unauthenticated radio traffic, inspect proprietary communications, and evaluate the security posture of systems relying on RF obscurity.