7 ms·
Transmit Radio Signals via Ethernet
- _joel 6y agoWould the cable length affect the tuning or is 125MHz specific to just the switching on the silicon?
- zsellera 6y agoI think what happens is the transformer inside the rj45 connector couples a litte of the differential mode signal (that should not radiate significantly) to all wires in the cable harness (common mode), which will radiate. You can select the cable length so it resonates well, acting like a good antenna, but bad antennas radiate as well (worse efficiency). A few mV of noise is quite well detectable from 10m of distance.
- _joel 6y agoThanks for that explanation, makes sense.
- jcims 6y agozsellera covered the mechanism of transmission very well. The 125MHz frequency is specifically coming from the Ethernet standard, as its essentially the operating frequency of each pair in typical hundred megabit and gigabit Ethernet. 10Mbps Ethernet operates at 10MHz. By flipping the port speed between 100 and 10Mbps they are essentially toggling the 125MHz oscillator. I don't think anything is intentially generating the frequency of the tone you hear, it's just intermodulation products of the noise and the LO in the receiver.
- dkdk8283 6y agoThere’s a transformer inside the rj45 connector?
- detaro 6y agoIn the device, often integrated into the socket.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- zsellera 6y agoAs someone recently participated in an EMC measurement, I really don't understand how anyone passes these tests without some kind of cheating (using double-shielded, very expensive industrial cables + hacking with functional earthing).
- avian 6y agoI've spent months and sleepless nights trying to get a product through the EMC certification. It's certainly possible but it's time consuming and expensive. With a shoestring engineering budget and a product that needs to be on the shelves in a month? Not really. I'm sure many devices on the market are not compliant. I follow lists of products removed from market for non-compliance and there are plenty each week. But the fact is that, if you're not in one of the categories that are under special scrutiny (aerospace, automobile, medical, etc.) or do something grossly incompetent (e.g. interfere with a mobile operator or someone else with a similar power to put you into the regulatory spotlight) you're unlikely to get into trouble for shipping a non-compliant device. Make someone's Wi-Fi a bit slower and a bit more packet-lossy? Chances are nobody will care. It's a sad state of affairs really because pervasive radio interference is just making things worse for everyone.
- deleted 6y ago[deleted]
- semi-extrinsic 6y agoYeah, I remember in the early 2000s we had a wireless RCA audio/video transmitter, bought at a local electronics store, that played absolute havoc with the WiFi in our house as well as several neighbours. Another classic example is early cellphones that you would pick up on stereo systems etc. - "dat-dara-dat-dara-dat-dara-dat-dara-daaaaaa" going out in full blast.
- avian 6y agoThe effect of GSM phones on analog audio equipment was actually an oversight in defining the standard. Fully compliant equipment had that effect. Some years back when I had some small involvement in new EU regulations that case was actually given as an example of how, even after many reviews, some forms of harmful interference can only become apparent after a technology is already widely deployed.
- hansjorg 6y agoVery nice, could be used for exfiltration with some tuning. The most advanced example of this kind of inadvertent transmission I've seen is Fabrice Bellards DVB-T transmitting with a standard VGA card: https://bellard.org/dvbt/ https://bellard.org/dvbt/
- skunkworker 6y agoI was thinking the same thing, have it exfil a secret key out of a server room (theoretically). I also got reminded about the method to send data from one computer to another over low frequency sound https://www.extremetech.com/computing/171949-new-type-of-audio-malware-transmits-through-speakers-and-microphones https://www.extremetech.com/computing/171949-new-type-of-aud...
- jcims 6y agoAlso through HDD noise https://arstechnica.com/information-technology/2016/08/new-air-gap-jumper-covertly-transmits-data-in-hard-drive-sounds/ https://arstechnica.com/information-technology/2016/08/new-a...
- norrius 6y agoI love how a (metaphorically) air-gapped system can be attacked (literally) through the air. Maybe the truly critical things should also be vacuum-gapped (and put into Faraday cages while we're at it)?.. But the system still has some connection to the outside world, right? That means we could run some heavy GPU load and measure the variation in its power consumption, which apparently has been tried before: https://www.helpnetsecurity.com/2018/04/13/data-exfiltration-via-power-lines/ https://www.helpnetsecurity.com/2018/04/13/data-exfiltration... Along these lines, the excess heat has to go somewhere, so maybe one could measure the variation in the work of the coolant system. I couldn't find any research about it right away (BitWhisper is similar, but a bit different), but I trust someone has already tried that.
- JosephRedfern 6y agoRelated Reading: https://hackaday.com/2018/04/23/spoofing-cell-networks-with-a-usb-to-vga-adapter/ https://hackaday.com/2018/04/23/spoofing-cell-networks-with-...
- coderjames 6y agoPlease don't try this at home! 118 MHz - 137 MHz is a protected Aviation band across the globe for airplanes to communicate with air traffic control. We already have enough industrial noise problems in this band; please don't contribute to pollution of protected spectrum. You will be interfering with the safe operation of the airspace. See: https://en.wikipedia.org/wiki/Airband https://en.wikipedia.org/wiki/Airband
- 4gotunameagain 6y agoThis does not magically increase the power radiated by an ethernet cable or somehow change the base frequency of the interference. Furthermore, the power levels are very low. If you check the link at the bottom, he is using a directional (Moxon) antenna to receive this faint signal. If this could somehow pose an issue with anything, it would have been caught in EMI testing of all network equipment sold
- londons_explore 6y agoEMI testing only tests a product during typical use. It's very possible to transmit illegal power levels with software mods, or even carefully crafted data packets in some cases.
- derefr 6y ago> or even carefully crafted data packets Unless you’ve made custom PHY hardware for those data packets to be pushed onto the line through, your data packets are going to be line-coded to ensure that the signal is self-clocking. Which basically precludes boosted harmonics.
- JosephRedfern 6y agoDoes EMI testing consider "atypical" uses like this one? I'd assumed that they only tested normal use cases. I'd consider (wrongly, perhaps?) changing speed of a NIC several times per second to be an atypical use.
- jcims 6y ago
- flerchin 6y agoIn college we had an I2C to ethernet adapter on our drone testbed that caused all sorts of RF interference for us. We eventually wrapped the whole fuselage in a farraday cage so that the datalink and flight controls wouldn't be overwhelmed. It was responsible for transmitting data at a 1 Hz rate, and we could visualize the interference on a spectrometer over a broad range of Rf at exactly 1 Hz. Anyway, we totally could have made a transmitter out of that thing.
- jcims 6y ago(Note: As coderjames points out this could be dangerous tinkering. There is typically steady-state noise at 125MHz from Ethernet so it's not that we're putting more energy into the spectrum with this, but adding signal in the form of morse code could draw a lot of attention/distraction to pilots and ATC in the area.) FWIW very brief example of 125MHz tone loss when going to 10MHz demonstrated here when my slow internet gets done uploading: (Unpleasant sound warning) https://youtu.be/JmyA5QEtAxA https://youtu.be/JmyA5QEtAxA
- Dahoon 6y agoIf your Ethernet emissions can be picked up by pilots or air traffic control, your are doing something wrong on purpose.
- jcims 6y agoSure but I could see this being used as a side-channel attack to exfil data from a customer in a red team assessment. Practitioners love little tools like this. Also I'm not talking about 30 miles away...but if a completely intact cable can be detected with a directional antenna from 100m, an intentionally buggered patch cable installed at a client site for this purpose could pose a bigger concern for pilots in the area. (edit: I might be more tuned in to this (har har) because I live in the flight path of a medical helicopter that flies over at ~500' almost daily.) Ham folks can seem a bit hair-triggered chicken littles with RF hygiene but it's the product of decades of fighting noise from people that aren't aware of the externalities of their actions.
- zsellera 6y agoJust out of curiosity: the tone appearing is me connecting my CE-certified Dell computer to a CE-certified Asus router, using a standard cat5-e cable. https://ibb.co/0rxKq6L https://ibb.co/0rxKq6L (CubicSDR ran on the same DELL machine, however both tones disappeared after disconnecting the antenna from the SDR)
- zw123456 6y agoOf course, on the RPI there is the good ole GPIO4 abuse: https://tutorials-raspberrypi.com/build-raspberry-pi-radio-transmitter/ https://tutorials-raspberrypi.com/build-raspberry-pi-radio-t... Works a lot better and has been around a long time.
- xncl 6y agoFrom reading the comments there it seems newer RPi (>3) don't work for this or mangle the GPIO port in some way to prevent this. I do have some 3s lying around so I may try this soon.
- jcims 6y agoI used this to jam mobile phones by tx'ing on a harmonic of the band they were using (CDMA iirc)
- PragmaticPulp 6y agoClever hack, but a lot of people are misinterpreting what’s going on here. These devices emit some very low level of 125MHz energy during normal operation. This software is simply turning that on and off, but not doing anything to increase the amount of emissions. Presumably the 125MHz emissions are within the FCC allowed envelope anyway, so this isn’t doing anything to exceed normal emissions limits. This only works in a quiet RF environment, as noted in the README. There is no need to be concerned about this signal reaching aircraft or otherwise interfering with normal transmissions.
- jcrawfordor 6y agoAviation radios on aircraft are typically 25w and ground stations the same to somewhat higher... and operations are generally line of sight and using analog AM modulation, which gets along nicely with CW. From a practical perspective (rather than regulatory), it is difficult to imagine miliwatt CW transmissions causing any meaningful problem with aircraft operations. Most radio systems used on aircraft are not really all that sensitive anyway, the most touchy thing would be the glideslope/localizer but it's only used at fairly short ranges and with fairly high power levels. This could perhaps cause a slight deflection of the ILS but that's assuming it's very close to the runway and at high power. This paper discusses security of the ILS system against tampering, which is generally the most "touchy" thing that aircraft use and the main interference concern: https://www.usenix.org/system/files/sec19-sathaye.pdf https://www.usenix.org/system/files/sec19-sathaye.pdf That's all sort of besides the point anyway as nav aids use the lower end of the aviation band, 125MHz is used for AM voice where the interference would be, at worst, audible but not strong enough to cause problems unless reception was already extremely marginal. Or to put it differently, two pilots hitting their PTT at the same time is already causing far more disruption to operations in the 125MHz range than this thing ever would.
- tyingq 6y ago125Mhz is the frequency you get with 100 base tx. It's basically the baud rate of 100mb plus the 5 bits to encode 4 bits overhead. 100 * 5/4 = 125. As you mention, this is toggling the expected 125Mhz on and off. It's not noise, it's "the signal".
- 6y ago
- austincheney 6y agoUsing an Ethernet line toner on a hot line in certain areas of Kuwait generates output from a local AM radio station.
- zeckalpha 6y agoThe original Ethernet used similar hardware as ham radio. AlohaNet predates it of course, but Thicknet used local RF loops.
- bserge 6y agoBillion dollar idea - RoI, Radio on Internet!
- vitplister 6y agoPreviously posted here: https://news.ycombinator.com/item?id=25012469 https://news.ycombinator.com/item?id=25012469
- ChuckMcM 6y agoThis is a neat side channel attack for data exfiltration. The author is a radio amateur (Poland) and would do well to look at FT8 or other error correcting CW modulations other than simple Morse code. I would estimate you could pick up a signal at nearly a kM using such a scheme.
- aussieguy1234 6y agoWhile this may not be of practical use for most of us, spy agencies and the like would be interested in this or and other ways to exfiltrate data from air gapped networks that are not connected to the internet.