Рубрика «Блоги»

New Store Products: SDRplay RSP1A Metal Case Upgrade + Portable Antenna Set

Over on our store we've just released two new products for sale. The first is a metal case upgrade kit for the SDRplay RSP1A. It is similar to the previous enclosure that we sold for the RSP1, but no longer comes with an included BCFM filter since the RSP1A has this filter built in as a software switchable option.

Instead we've included a portable 7 meter (23 feet) long wire antenna spool (Tecsun AN-03L) with SMA adapter, and an 11 cm to 48 cm adjustable SMA telescopic antenna. The 7 meter antenna is great for HF SWLing, and neatly rolls up into the spool for travelling. The telescopic antenna is a portable VHF/UHF antenna that can plug directly into the SMA port of the RSP1A. Both antennas fit neatly into the supplied semi-hardshell carry case. The set costs US$29.95 including shipping and is available on our store, and will be on US Amazon in a couple of weeks.

The second product is the portable antenna set just by itself. The set includes the 7m Tecsun AN-03L antenna spool, the mono plug to SMA adapter and the 11 cm to 48 cm telescopic antenna. It can be used on any SDR with SMA ports. The set costs US$11.95 and is also available on our store. It will also be on Amazon in a couple of weeks. 


The post New Store Products: SDRplay RSP1A Metal Case Upgrade + Portable Antenna Set appeared first on rtl-sdr.com.

Cloned SDRPlay and Airspy Units Now Appearing on Aliexpress/eBay

Recently we've found that there are now cloned units of SDRplay RSP1 and Airspy R2 units appearing on Aliexpress and eBay. (We won't link them here to avoid improving the Google ranking of the clone listings). This post is just a warning and reminder that these are not official products of SDRplay or Airspy, and as such you would not receive any support if something went wrong with them. The performance and long term software support of the clones also isn't known. Buying clones also damages the original developers abilities to bring out exciting new products like we've seen so far constantly with Airspy and SDRplay.


We've been in contact with SDRplay for a statement and they believe that the unit is a clone of the older and now discontinued RSP1, and not the RSP1A, despite the listings advertising RSP1A features such as additional filtering. SDRplay note from the pictures of the circuit board that the cloned unit's circuit board looks like an RSP1, and that the listing description is probably just blindly copied directly from the official RSP1A description.

Currently given that the price of the cloned RSP1 is $139, which is higher than the $99 cost of an original and newer model RSP1A, we don't see many taking up the offer.


The Airspy R2 has also recently been cloned and now appears on Aliexpress with the lowest price being US$139 without any metal enclosure. Given that the price of an original Airspy R2 with metal enclosure is US$169, we again don't see many taking up the offer of the clone.


The HackRF is a different story in respect to clones. The HackRF design and circuits are open source, so unlike the closed source designs of the SDRplay and Airspy, in a way HackRF clones are actually encouraged and are legal. For some time now it's been possible to find cloned HackRF's on Aliexpress for only US$120 at the lowest, and from $150 - $200 including antennas and TCXO upgrades. This is quite a saving on the $299+ cost of the original HackRF. Reports from buyers indicate that the HackRF clones are actually decent and work well. The advantage of buying the original version is that you support Michael Ossmann, the creator of the HackRF, and may potentially get a better performing unit.


We also note that recently there have been several green color RTL-SDRs released on the market with some being advertised as "RTL-SDR Blog V3" units. These are not our units, and are not even actual clones of the V3. These green units appear to just be standard RTL-SDRs without any real improvements apart from a TCXO. Some listings even advertise the V3's bias tee and HF features, but they are not implemented. Real V3 units come in a silver enclosure branded with RTL-SDR.COM.

Final Words

If you know how China works, you'll understand that it's very unlikely that there is any legal recourse for SDRplay and Airspy to remove these products from sale. Once a product is popular it is almost a given that it will be cloned. It's possible that the clones might be able to be gimped via blacklisting official software, but that the companies would implement this is a stretch, and would probably be easy to get around.

If readers are interested in a comparison between the clones and original units, please let us know as we may consider an article on it.

Cloned SDRs Roundup
Cloned SDRs Roundup

The post Cloned SDRPlay and Airspy Units Now Appearing on Aliexpress/eBay appeared first on rtl-sdr.com.

New Alternative WxToImg Website with Most Files

Last month we posted that the website for the popular NOAA APT weather satellite decoding software known as WxtoImg went down. Since then we've been in contact with the developer of the software, and he did indicate that he may restore the site at some time in the future, but is currently busy with other projects so doesn't have much time to devote to his old software at the moment.

In the meantime (or perhaps permanently) a WXtoImg fan has created a clone of the original website which he's called "WXtoImg Restored". The site contains most of the downloads as well as a professional edition update key, which was released for free by the original author before. If you don't trust the third party site, some downloads are also still available from the internet archival project's copies of the original WXtoImg website.

There are still some files missing on WXtoImg Restored, and these are outlined on the new website's homepage, so if you have them please contribute them to the site email.

The post New Alternative WxToImg Website with Most Files appeared first on rtl-sdr.com.

RS41 RadioSonde Tracking Software

A radiosonde is a small weather sensor package that is typically attached to a weather balloon. As it rises into the atmosphere it measures parameters such as temperature, humidity, pressure, GPS location etc, and transmits this data back down to a receiver base station using a radio signal. The RS41 is one of the newer radiosonde modules sold by  radiosonde manufacturer Vaisala, and is currently one of the most popular radiosondes in use by meteorological agencies. The signal is typically found at around 400 MHz and can be received with an RTL-SDR and an antenna tuned for 400 MHz. We have a general tutorial on radiosonde decoding available here.

There are several software packages that can decode RS41 data, such as the multi-radiosonde decoder Windows program called SondeMonitor (25 euros), or the free Linux command line software called RS. Recently a new free Windows GUI based RS41 decoder has been released by IW1GIS. The software can display on Google maps the current location and previous path of the radiosonde, as well as it's weather data telemetry.

Main features are:

  • Directly decoding of GFSK signal received by the FM radio receiver (the use of a Software Defined Radio is recommended).
  • Capability to connect and command SDRSharp software by mean of Net Remote Control plugin.
  • Advanced frequencies scan and decode: RS41 Tracker is able to look for RS41 radiosonde signal in a given list of frequencies, starting the radiosonde decoding when a valid signal is detected.
  • Real time showing radiosonde position on google map (internet connection is required)
  • Map auto centered on radiosonde position
  • Map type selectable by user (road, satellite, hybrid, terrain).
  • Burst killer detailed information and launch time estimation.
  • Radiosonde RAW data save
  • Post processing of RS41 RAW data file
  • Tracking information (elevation, bearing, slant range)
  • Radiosonde track saved on kml file
  • Ghost track shown on map (loading from kml file)
  • Shortcut for google maps in browser
RS41 Tracker Software
RS41 Tracker Software

The post RS41 RadioSonde Tracking Software appeared first on rtl-sdr.com.

New TETRA Trunk Tracker for use with SDR# and the TETRA Demodulator Plugin

Over on our forums user thewraith2008 has just released news about his new software called TETRA Trunk Tracker. The software works in conjunction with the TETRA demodulator plugin for SDR#. It works by using two dongles, one to monitor a TETRA trunking channel, and the other to decode voice audio, although a single receiver mode is also available which works with a reduced and fixed bandwidth.

TETRA Trunk Tracker
TETRA Trunk Tracker

The post reads:

TETRA Trunk Tracker will follow calls on a TETRA network.

TETRA Trunk Tracker reads DATA that is output from the SDR# plug-in TETRA Demodulator (by TSSDR) via the 'Network Info' calls log window.

It interprets this DATA to determine when a call is set-up, then instructs SDR# (VC) to move to the carrier (frequency) that the call will be on.

It will also watch out for other PDUs to determine when a SSI starts or completes transmissions and when calls are complete (Released).


  • A basic call recording (All or Selective call recording).
  • Display current call details with list of seen SSIs for that call. (SSI populate as they TX).
  • GSSI holding - will only allow calls with selected GSSI to be heard.
  • Call lockout based on GSSI. Can be unchecked in list to lockout GSSI.
  • Call Priority. (Only normal version)
  • GSSI weighted 0-9, 9 is highest. If on active call and other call event occurs, if new call has higher
  • priority then will switch to it.
  • Collect/Save all seen GSSIs with Labels and Priority, By Network.
  • Collect/Save seen SSIs with Labels and Last seen Date/Time, By Network.
  • Set a call time-out. Returns to idle state if call does not see a release PDU
    after X time in seconds.
  • Log call events to screen and file, if enabled.
  • Log raw CC and VC PDU messages as seen by the 'TETRA Demodulator' plug-in, if enabled.
  • Log GSSI daily call activity. (Simple version does not play calls when this is selected)
  • Set base frequency via UI.
  • Set CC park carrier # via UI.
  • Set VC park carrier # via UI.
  • Suppress some PDUs. (unchecked is mainly for testing only)
  • Suppress lockout messages.
  • Sort SSI and GSSIs/Lockouts (by GSSI). This only occurs on start-up.
  • Country Code label, defined via file (shown as menu item)
  • Network label, defined via file (shown in tool tip where MNC,LA is in 'Call Details' panel)
  • Location Area label, defined via file (shown in tool tip where MNC,LA is in 'Call Details' panel)
    Only shown when Network label used.
  • Ignores Encrypted PDUs (with no reference to them)
  • Set a seen GSSI priority via UI.
  • Update a seen GSSI/SSI label via UI.
  • Call active indicator.
  • Restore SDR# windows to a defined position.

If the TETRA Demodulator does not work for you this program will do nothing to change that.

This is the third release of this program. (TETRA Trunk Tracker v0.99.6)
And 2nd release for (TETRA Trunk Tracker v0.99.6s - Simple)

Two versions are available:

  • Normal (Uses 2 SDR# and 2 Dongles) with TETRA Demodulator and Net Remote plug-ins
  • Simple (Uses 1 SDR# and 1 Dongles with some features not available) with TETRA Demodulator and Net Remote plug-ins

Backup your "Tetra-trunk-tracker.dat" settings file.
Then delete "Tetra-trunk-tracker.dat" as it has changed and old one will cause error on load.

Some work as gone into trying to make TETRA Trunk Tracker easier to run once the initial setup has been done.

A MCC (Country Code) label file is included for your convenience "TETRA_mcc.txt".

It has only been tested on Windows 7 - Professional SP1 (32 bit), English

You MUST have a PC that is capable of running SDR# x 2 with the TETRA plug-in. (Not overloaded CPU usage.)

It is in alpha stage. This means is may contain errors that may cause issues with the other programs it
works with. i.e. crashing them or itself.

The TETRA plug-in currently been developed by TSSDR is also in early development. Because of this
any changes made in plug-in releases most likely will break this program.

I have created it to suit my needs. And it currently works for me with the TETRA network I monitor.

I make no claim that it will work for other networks.

Please read the provided files for set-up and usage:

  • TTT_set-up_manual.pdf
  • TTT_Features_and_Usage.pdf

I have tried to be as thorough as possible with the documentation to explain usage and features.
I believe any questions can be answered by reading these files.
These files most likely are not complete and contain errors and are not laid out as good as they could be.

It only works with the provided TETRA plug-in supplied in zip. (2018-June-06).
This version uses a custom compiled version of 'Net Remote' supplied in zip

It is only meant to be a temporary solution until something better comes along.

Hopefully all goes well for you setting it up.

Download link

MD5 HASH 6f33fcf9662573b77e177e899793b9f9

Video showing starting it and it running
Video showing starting it and it running - Simple version

The post New TETRA Trunk Tracker for use with SDR# and the TETRA Demodulator Plugin appeared first on rtl-sdr.com.

Testing out the New Airspy HF+ Preselector

The Airspy team have recently been working on a preselector retrofit product for their HF+. The Airspy HF+ already has excellent dynamic range and sensitivity, but by adding a preselector they seek to improve performance enough to claim that the HF+ is as good as or even better than much more pricey SDRs like the Perseus by achieving dynamic range figures of more than 105 dBm.

A preselector is a filter or bank of filters that attenuates out of band signals. This is useful as radios can desensitize if an unwanted signal comes in too strongly. For example, if you are tuned to the 20m band, but there is a very strong MW signal, the SNR of your desired 20m band signal might be reduced. Radios with a natural high dynamic range design like the Airspy HF+ are less affected by this problem, but for the strongest of signals use of a preselector can still help.

The Airspy HF+ preselector needs to be soldered directly onto the HF+'s PCB, and once installed it automatically switches bands using GPIO expansion ports controlled automatically via tuning in SDR#, so no external switching is required.

The expected pricing of the HF+ preselector is US$49, and it will be ready for sale in a few weeks.


We received a prototype of the filter a few days ago and have been testing it out. From measurements on a VNA, we found that the preselector features four bands of operation:

  • 0 - 5.2 MHz
  • 5.2 - 10 MHz
  • 10 - 17 MHz
  • 17 - 30 MHz

Insertion loss appears to be mostly below 3 dB with fairly steep skirts especially on the lower side. The top three filters do an excellent job at blocking out the broadcast AM band. Below are some VNA plots that show the filter responses.



The preselector comes in a small 3.2 x 1.7 cm sized PCB that is fully covered with a metal shielding can. To install it you need to carefully solder it onto the HF+ PCB. This can be a little tricky since the pads are so small, but if you're experienced with soldering it shouldn't be an issue.

  • First you need to open the HF+ and remove R3 from the HF+ PCB, which is a zero ohm resistor.
  • The preselector PCB can then be positioned and the two IN and OUT pads soldered in place.
  • Then you'll also need to connect the power and 2x GPIO lines to the preselector using wires.
  • Now you need to bridge the two shielding CANs with a thick bit of wire. We simply used two cuts of copper solder braid to do this.
  • Finally is also recommended to update the HF+ firmware to the latest version and download the latest version of SDR#.

Once soldered in place the preselector is ready to use, and the HF+ cover can be put back on. It is expected that the commercially sold versions of the preselector will come with detailed installation instructions. 

In the first photo below we removed the shield to see what was inside, and the second photo shows it installed on the HF+ PCB.


Using it on a RTL-SDR V3

Whilst the preselector is designed for the Airspy HF+, there's no reason why it couldn't also be retrofitted onto other SDRs, such as our RTL-SDR V3, for use in improving direct sampling mode performance.

The V3 has spare GPIO ports that can be used to control the filter, and 5V for powering the filter could be tapped off the PCB as well. Currently we're considering making a breakout PCB for the filter than might aide with this.

We did a quick test with the preselector connected to the RTL-SDR V3 running in direct sampling mode, and as expected performance is much better, especially above 5 MHz once the second filter kicks in. This is because the second, third and fourth filters all heavily attenuate the MW broadcast AM band, which is the main source of overload issues on HF.

The follow screenshots show how much the filter was able to reduce the signal strength of AM broadcast when the second 5.2 - 10 MHz filter was turned on. This reduction was enough to prevent overload on all the higher bands.

Prelector OFF

Prelector OFF

Prelector ON

Prelector ON

Prelector OFF

Prelector OFF

Prelector ON

Prelector ON

HF+ Results

For the HF+ we tested by injecting a strong signal into two HF+ SDRs, one with the filter installed and the other without. The HF+ with the filter was routinely able to withstand much higher signal powers without any signs of overload occurring, and no degradation due to insertion loss was observed.

The screenshots below show an experiment with a weak desired signal injected at 14.2 MHz, and a strong unwanted signal being injected at 1.5 MHz. With the unwanted signal at 5 dBm, the filtered HF+ showed no signs of overload, whilst the unfiltered HF+ had the AGC kick in to increase the front end attenuation, reducing the signal strength by about 20 dB and raising the noise floor.

Filtered HF+

Filtered HF+

Unfiltered HF+

Unfiltered HF+

Other Reviews

Other reviewers have also received the preselector and have been testing it. Fenu radio has uploaded a short review, and plans to write more in the future. He's also made his HF+ with preselector available for public use via SpyServer (details in his post). In the video below Leif SM5BSZ reviews the preselector and runs through several tests while comparing it against the Perseus. His results seem to show that the Persues gets a +25 dBm IP3, whilst the HF+ with the latest firmware and preselector is able to obtain a respectable +10 dBm IP3. 



For most people, the dynamic range of the HF+ is probably already more than enough, but if you are receiving very strong signals, the preselector can help get you get more performance out of the HF+. Of course the preselector cannot help if you have strong signals within the filter bands.

If you're looking to get the most out of your HF+ then the filter at only $49 is a pretty good deal. Just take note that you'll need to open the HF+ and be comfortable with soldering onto the PCB. 

The post Testing out the New Airspy HF+ Preselector appeared first on rtl-sdr.com.

KiwiSDR TDoA Direction Finding Now Freely Available for Public Use

A few weeks ago we posted about some experimental work going on with Time Difference of Arrival (TDoA) direction finding techniques on KiwiSDR units. The idea is that public KiwiSDRs distributed around the world can be used to pinpoint the physical locations of any 0 - 30 MHz transmitter using the TDoA technique.

The KiwiSDR is a US$299 HF SDR that can monitor the entire 0 - 30 MHz band at once. It is designed to be web-based and shared, meaning that the KiwiSDR owner, or anyone that they've given access, can tune and listen to it via a web browser over the internet. Many public KiwiSDRs can be found and browsed from the list at sdr.hu or by signal strength and location on this website.

One thing that KiwiSDRs have is a GPS input which allows the KiwiSDR to run from an accurate clock, as well as providing positional data. Time Difference of Arrival (TDoA) is a direction finding technique that relies on measuring the difference in time that a signal is received at over multiple receivers spread out over some distance. In order to do this an accurate clock that is synchronized with each receiver is required. GPS provides this and is able to accurately sync KiwiSDR clocks worldwide.

Just recently all KiwiSDRs were pushed with a beta update (changelog) that enables easy TDoA direction finding to be performed with them. Since many KiwiSDRs are public, this means that right now anyone can browse to a KiwiSDR web interface and start a direction finding computation. You don't even need to own a KiwiSDR to do this so this is the first freely accessible RF direction finding system available to the public.

KiwiSDR TDoA Interface
KiwiSDR TDoA Interface. Locating a STANAG Signal Source.


Running a TDoA job is as simple as using the KiwiSDR OpenWebRX GUI interface to select a signal and choose two or more receivers to use in the calculation.

If you want to try this out then it's easiest to start with VLF/LF stations as these signals tend to propagate to receivers directly via ground wave. HF sky wave signals are a bit more difficult to locate as they tend to skip and bounce around the atmosphere, so it is difficult to determine exactly where they are coming from. But if you know the rough location of the transmitter, you can select KiwiSDR receivers close to it, which will ensure that the signals are received directly, and not via sky bounce.

To get started follow these steps (and we also recommend reading the Help text, which is available by clicking the 'Help' button on the TDoA extension):

  1. Open a KiwiSDR that can receive some signals that you are interested in locating. You can browse KiwiSDRs by map and signal strength quality on this website.
  2. With the 'extension' drop down menu in the bottom right controls window choose TDoA and double check that the receiver modulation mode is set to 'IQ'.
  3. You should now see a map on the top half of the screen. This map displays all KiwiSDRs in the world that have GPS enabled and thus can be used for TDoA.

    The map also displays several known transmitters in white with green markers that can be used as TDoA practice. Clicking on a known transmitter will automatically tune the KiwiSDR to that station.
  4. Tune to the signal that you are interesting in locating. Make sure that the receiver bandwidth covers the signal.
  5. Now you need to find two or more KiwiSDRs on the map that can receive the signal that you're interested in locating. (Two will give you a line of possible locations, whilst three may allow you to pinpoint the signal. But we recommend starting with only two or three first as more receivers can cause the calculation to fail).
    To test and see if a KiwiSDRs from the map can receive the signal, double click on its marker. This will open the selected KiwiSDR in a new browser window, with it tuned to the station of interest. If you have a rough idea on where the transmitter is located, try to select KiwiSDRs such that they surround the transmitter.
  6. Once you've found a KiwiSDR that receives your signal of interest, close the second KiwiSDR receiver window that you just opened, and go back to the original KiwiSDR window. Now instead of double clicking just click once on the KiwiSDR pin on the map that you confirmed reception with. This will add that KiwiSDR to the window in the bottom left. This window displays the KiwiSDRs that will be used in the TDoA calculation.

    Make sure that it shows "XX GPS fixes/min" beside a selected KiwiSDR. If you get an error, remove that KiwiSDR and choose another.
  7. When you've found two or more KiwiSDRs that receive the signal of interest, position the map to where you'd like the TDoA result heat map to be displayed. The positioning of the KiwiSDR map will determine where the TDoA heat map plot is displayed.

  8. Click the 'submit' button to begin the TDoA calculations. The KiwiSDR server will gather 30 seconds of samples from each of your selected KiwiSDRs, and then run the TDoA algorithm on the KiwiSDR server. The whole process should take about 1-3 minutes to complete.
  9. Once completed you can view the results by using the drop down menu next to the submit button to choose the 'TDoA Map'
KiwiSDR TDoA Results
KiwiSDR TDoA Heat Map Results. Located a STANAG Signal Source in France.

The KiwiSDR TDoA feature is still in testing and can be a little buggy. If you get "Octave Error", try refreshing the KiwiSDR page and trying again with different receivers. Sometimes you'll also get an error saying that the GPS of a KiwiSDR hasn't updated in a while. In this case just remove that receiver and choose another one. We also find that if you're zoomed too far out on the map, the TDoA algorithm will sometimes return 'Octave error'. Try zooming in a bit closer to the approximately expected location. KiwiSDRs can also only support four simultaneous users at a time, so during peak periods it's possible that some may become busy.

Over on the KiwiSDR forums Martin G8JNJ has also provided a list of helpful tips that he's discovered. 


We tested the new TDoA feature a few times. Below are some examples of the results we achieved.

USA: NLK @ 24.6 kHz.

This is a Naval transmitter located in Seattle, Washington. With three receivers surrounding the transmitter, we were able to get a pretty close location marker, that is confirmed with the known location.


Europe: DCF77 Time Beacon @ 77.5 kHz.

This is a German long wave time beacon transmitter. Again with three receivers we were able to pinpoint the signal fairly accurately.

DCF77 Located with KiwiSDR TDoA
DCF77 Located with KiwiSDR TDoA

Australia: Local MW Radio Station @ 549 kHz.

Here we tried to locate an Australian MW station. Unfortunately in Australia there is a lack of KiwiSDRs, and of the ones that are there, only three had GPS enabled and could receive the MW station, and two of those were right next to each other. With only effectively two stations we could only obtain a line of possible locations. Comparing with the known location plotted on Google Maps we confirmed that the transmitter is indeed located on the line.

ABC Western Plains Australian MW Radio Station
ABC Western Plains Australian MW Radio Station

We also tested a few signals at higher frequencies. As mentioned previously, anything above VLF/LF/MW (ie the HF bands) is a lot more difficult to locate since the signal can bounce around the atmosphere and can case extra delays to occur in the signal arrival time. The extra delays can cause problems with the time of arrival measurements. Thus for these signals it's important to find receivers close to the transmitter.

So when locating an HF signal that is in a completely unknown location we recommend starting with only two or three receivers, checking the heat map, and slowly adding more receivers in the hot parts of the heat map and removing receivers that turn out to be in the cooler areas. This way you can slowly narrow down the receivers to ones that are closer to the signal source, and are thus more likely to receive the signal directly, rather than via atmospheric bounces.

The Buzzer (UVB-76)

Using this technique we attempted to locate the source of the Buzzer (UVB-76), a Russian numbers station at 4.625 MHz. Eventually we came to the results shown below. According to the heat map the buzzer appears to be located somewhere in the vicinity of St. Petersburg. Back in 2014 the numbers station researchers at Pyiyom.org received an anonymous tip from a member citing a transmitter location just north of St. Petersburg. The TDoA heat map results seem to confirm that the anonymous tipper is correct.

The Buzzer (UVB-76)
The Buzzer (UVB-76) TDoA Heatmap compared against the known location

Final Words

Right now the biggest problem right now appears to be the lack of KiwiSDRs around the world. The more active KiwiSDRs there are, the better the direction finding results can be. At the moment Northern Europe and the USA are fairly well represented, but the rest of the world is not. Asia, Africa, Russia and South America are especially lacking. Also not all KiwiSDRs are utilizing the GPS feature. If you are running a KiwiSDR please consider activating the GPS option. Another issue is that many KiwiSDRs suffer from poor reception on all bands.

In the future we expect this feature to only improve, with the people behind it, John Seamons and Christoph Mayer, working hard to improve results. For example one possible future improvement is utilizing ray-tracing techniques to try and take into account delays caused by sky-bounce propagation.

If you want to purchase a KiwiSDR and contribute to the worlds first freely accessible TDoA system, you can purchase it immediately on Amazon or Seeed Studios for $299, or wait for a sale to occur on massdrop.com, where it is often discounted by up to US$100.

The post KiwiSDR TDoA Direction Finding Now Freely Available for Public Use appeared first on rtl-sdr.com.

Exposing Hospital Pager Privacy Breaches

It has been a known open secret that for years many hospitals have been transmitting sensitive patient data over the air completely unencrypted via their pager network. With a simple ultra cheap radio such as an RTL-SDR, or any other cheap radio scanner such as a Baofeng, it is possible to eavesdrop on this sensitive data with very little technical knowledge required. Hospitals appear to be reluctant to upgrade their systems despite clearly being in violation of HIPAA privacy regulations in the USA.

Recently, @WatcherData has been trying to bring attention to this ongoing security breach in his home state of Kansas, and last month was able to get a news article about the problem published in the Kansas City Star newspaper. Over on Twitter he's also been actively documenting breaches that he's found by using an RTL-SDR to receive the pager messages.

Interestingly, publicity generated by @WatcherData's newspaper article has brought forward a hostile response from the hospital in question. Over on Reddit /r/legaladvice, a forum where anyone can ask legal advice questions, @watcherdata posted the following:

I discovered some time ago that hospitals throughout my region of the US are sending messages to physician pagers that include the name, age, sex, diagnosis, room number, and attending physician. These can be seen by anyone with a simple RTL SDR device, and a couple of free programs.

This seems like a massive HIPAA violation. So I contacted the main hospital sending out most of the information, and they were extremely grateful. I got a call within a day from a high level chairman, he explained their steps to remediate, that their auditors and penetration testers missed it, and that they would have it fixed within a week. Sure enough, they started using a patient number and no identifiable information in the pages. A couple of other hospitals have fixed their systems too, after I started contacting them via Twitter.

Early on in this process, I contacted my local newspaper. They reached out to the hospital in question, and were met with a "very hostile" response. They immediately deflected from any HIPAA violations and explained that I (the source) am in violation of the Electronic Communications Privacy Act of 1986.

This was enough to scare me off completely. I've nuked all log files from my systems and stopped collecting data. The reporters want to know how I would like to proceed. Originally, I was going to get full credit for the find in their article. But now, I at least need to be anonymous, and am thinking about asking them not to run the story at all.

Among the replies there doesn't seem to be consensus on whether simply receiving pager messages in the USA is legal or not.

In the past we've seen similar attempts to bring attention to these privacy breaches, such as an art installation in New York called Holypager, which simply continuously printed out all pager messages that were received with a HackRF for gallery patrons to read.

HolyPager Art Installation. HackRF One, Antenna and Raspberry Pi seen under the shelf.
HolyPager Art Installation. Printing pager messages continuously.

The post Exposing Hospital Pager Privacy Breaches appeared first on rtl-sdr.com.

New GNU Radio Block for Decoding Meteor M2 Images

Thank you to Reiichiro Nakano for submitting news about his work on converting the Pascal based meteor_decoder software into a C++ GNU Radio block. meteor_decoder is a decoder for the Meteor M2 weather image satellite. Meteor M2 is a Russian weather satellite that transmits images down in the digital LRPT format. This provides much higher resolution images compared to the NOAA APT signals. With an RTL-SDR, appropriate satellite antenna and decoding software it is possible to receive these images.

Reiichiro works for Infostellar, which appears to be a Japanese company aiming to connect satellites to the internet via distributed and shared ground stations. It appears to be somewhat similar to the SatNOGs project. Reiichiro writes:

Just wanted to share a simple project I built for my company Infostellar, in the past week. I converted https://github.com/artlav/meteor_decoder to C++ and placed it within a GNURadio block for direct decoding of Meteor M2 images. It's a sink that expects soft QPSK demodulated signed bytes. Once the flowgraph stops running, it parses out received packets and dumps the received Meteor images in a specified location. 

The block is part of our Starcoder repository and can be installed from here (https://github.com/infostellarinc/starcoder/blob/master/gr-starcoder/lib/meteor_decoder_sink_impl.cc ).

The post New GNU Radio Block for Decoding Meteor M2 Images appeared first on rtl-sdr.com.

Noise Cancellation using Linrad and the Phase Coherent Capabilities of an RSPduo

The RSPduo is the latest product from SDRplay, and it's main defining feature is it's dual RX channels. The two channels allow you to simultaneously listen to two stations that may be at opposite ends of the spectrum. Of course the same could be done cheaper with two separate RSP1A devices, however the advantage of the RSPduo is that the two channels are phase coherent. This opens up a lot of technical possibilities such as active noise cancelling/spatial filtering of an interfering signal or unwanted RF noise.

The basic idea behind phase coherent noise cancelling is that you have one antenna pointed towards your signal of interest, and the other pointing towards the interfering signal or coupled to the unwanted noise source. The unwanted signal/noise can then be subtracted from the signal of interest, resulting in a cleaner signal. This can only be done if the two channels are phase coherent like they are on the RSPduo.

Over on YouTube and his blog, ICAS Enterprises has been experimenting with noise cancelling on his RSPduo [Part 1] [Part 2]. The blog is entirely in Japanese, but all the relevant screenshots are in English, and we have provided Google Translated links. SDRplay have also provided a description of the process on their blog. The idea is to use Linrad to process the sound output of the two RSPduo channels from SDRuno. Linrad has capabilities that allow you to subtract two signals from one another.

In his experiments he receives a known 50 MHz CW beacon, and then injects an interfering test signal into the system. Then using Linrads 'signal adaption' feature he is able to completely remove the interference. 

RSPduoでのノイズキャンセルの実験 - Linrad使用
RSPduoでのノイズキャンセルの実験 - Linrad使用

The post Noise Cancellation using Linrad and the Phase Coherent Capabilities of an RSPduo appeared first on rtl-sdr.com.

Июль 2018
Пн Вт Ср Чт Пт Сб Вс
« Июн