October 29, 2026

SPECTER: Leaking Data from Air-Gapped Computers by Toggling USB Power States

This October, researchers Hyeongjun Choi, Ji Hyuk Jung and Ji Won Yoon from Korea University and 78ResearchLab in Seoul have published a paper describing "SPECTER", a covert channel that leaks data from air-gapped computers by repeatedly switching the power state of attached USB devices. This first requires installing malware with root or administrator privileges, which then controls power via the operating system's suspend or disable/enable controls. No modification to the peripheral's hardware or firmware is needed.

Three receiving methods were demonstrated, with one being RF based. The first method uses a phone plugged into the port, which then simply logs its charging state as on/off binary data. The second method uses a connected mouse, webcam or USB hub whose status LEDs can be watched by a person or camera. The final method uses a HackRF One with a near-field loop probe to pick up the switching emissions at around 5 MHz. Data rates are only 0.2 to 1 bit per second, so the channel is only useful for short secrets like passwords or keys.

We note that so far, the RF method was only tested with the probe touching the USB cable. This project is similar to USBee, which we posted about in 2016, where an unmodified USB device was also turned into a transmitter via malware. The difference is that USBee requires a data transfer USB device like a thumb drive to be connected, whereas SPECTER can use any connected USB device, even those that are charge-only.

SPECTER RF Receiver Setup with a HackRF One and Loop Probe

Vote

October 29, 2026

SimTX: A Multiplayer Shortwave Radio Simulator with Realistic Propagation and rtl_tcp Support

Recently, we came across SimTX, an open-beta multiplayer shortwave radio simulator. Everyone shares the same simulated band, so whatever one user transmits from their virtual station can be picked up by anyone else, simulated propagation permitting. The website suggests running a pirate station, making your own numbers station, or just tuning around and listening.

For realism, the ionosphere is based on IRI-2020 climatology with live ionosonde data assimilated on top, groundwave and noise follow ITU-R models, and every link passes through a Watterson fading channel with Doppler, multipath and storms. Users can transmit from a mic, an audio file or raw IQ from GNU Radio in modes including AM, SSB, CW, NFM, WFM, WSPR and FT8, and can even launch and track their own satellites.

To receive, the SimTX app runs a local rtl_tcp bridge, so SDR++ or any other rtl_tcp-capable SDR program can tune the simulated band as if it were an RTL-SDR, without any real radio hardware. The app runs on Windows, macOS, and Linux, and accounts are created via Discord. The software does not appear to be open source. The demo video below shows a song broadcast from a simulated Amsterdam and received 1145 km away in Budapest.

This may be useful for playing around with and seeing what different TX/RX variables and propagation effects do to signal reception.

We broadcast a song through a simulated ionosphere

Watch this video on YouTube

Vote

October 29, 2026

Thermal Noise Communication: Sending Data Without a Carrier Signal, with an RTL-SDR as the Receiver

Thank you to RTL-SDR.COM reader Andrea for writing in and pointing us to a recent Stanford University press release about Zerina Kapetanovic and her team's research on "thermal noise communication", a way to send data wirelessly without generating any RF signal at all.

With this communication method, the transmitter simply switches its antenna between two loads, such as a dummy load and an open circuit, which the receiver sees as slightly "hotter" or "colder" thermal noise that encodes binary data. The study claims that a conventional RF transmitter uses up to 1,000 times more energy, making this a possible alternative to RFID tags and low-power wireless sensors.

Our reader Andrea also pointed out that the receiver in one of Zerina Kapetanovic's earlier experiments on the same topic was built around an RTL-SDR. Back in 2022, Zerina Kapetanovic and her team published a paper (pdf upload) demonstrating the idea at 1.42 GHz. Their receiver was a horn antenna, two LNAs with about 84 dB of combined gain, a bandpass filter, and an RTL-SDR, with processing on a laptop or Raspberry Pi. The transmitter was a simple RF switch connected to an antenna and switched between a 50 Ohm dummy load or ground. They achieved a data rate of up to 26 bps and a range of up to 7.3 m at 5 bps, and built a solar-powered, battery-free transmitter that sent indoor temperature readings over five days.

A new paper (not available freely yet) from Kapetanovic and her team builds on this idea and improves the data rate to the kilobit-per-second range, and adds capacity measurements and error correction, which was a limitation of their earlier experiment. The paper and press release also explain why this idea works at room temperature, making the analogy that the receiver's LNA works as a sort of 'electron refrigerator', slowing down electrons and making them appear colder.

We are unsure if the new setup still uses an RTL-SDR. However, readers who have built a Hydrogen line radio telescope have already built a nearly identical setup to the 2022 paper. In the press release Kapetanovic notes that "We've built a system that others could very easily implement", so this may be an interesting experiment to try for anyone who already has an H-line setup.

The thermal noise receiver setup from the 2022 paper

Vote

October 29, 2026

An Unofficial Bilingual English and Chinese User Guide for SDRplay’s SDRconnect Software

Thank you to BG7BAG for writing in and sharing a free user guide for SDRconnect, SDRplay's multi-platform software for their RSP series of SDRs, which we've covered several times before. SDRplay only provides a "Quick Start" guide and a few application notes for SDRconnect, so BG7BAG wrote a full manual from scratch, based on daily use with an RSPdx-R2.

The guide is written side by side in English and Chinese, with a shared glossary of SDRconnect's interface terms, so it may be most useful to Chinese-speaking SDRplay users, for whom there is no official manual. It is based on SDRconnect V1.0.10 and includes a quick start section, a 22-chapter manual covering topics like remote operation, troubleshooting and PPM calibration, and an advanced guide on HDR mode, notch filtering, IQ recording and scheduling.

BG7BAG also shared his HAM Radio Atlas, a free map of over 12,000 amateur radio repeaters on the 2m, 1.25m and 70cm bands, searchable by location, callsign and band. Repeater data currently covers the USA (26 states), Australia, China, Austria and New Zealand, with a province-by-province list for mainland China.

AI Disclaimer: We note that this guide appears to have been written with the help of AI.

Vote

October 29, 2026

FalconSDR: An Open-Source RTL-SDR Scanner and Recorder with Automatic Whisper Transcription

Thank you to Rafał for writing in and sharing his open-source project FalconSDR, a free scanning and recording program he's been working on over the last few months. Rafał notes that after getting into RTL-SDR listening, he found that popular SDR programs didn't have the scanning and recording features he wanted.

FalconSDR can scan multiple bands or channels, even when they are far apart, with separate settings for each band and a blacklist for skipping birdies and unwanted channels. A "recency boost" feature sends the scanner back to channels with recent activity, and it can record multiple transmissions at once. Recordings go into a searchable library and can optionally be transcribed to text with Whisper. In hybrid mode, a server handles recording and a PC handles transcription.

The interface runs in a browser, either locally or on a headless server, so you can reach it from a PC or phone on your network. RTL-SDRs are supported natively, and Rafał has tested the program for months with an RTL-SDR Blog V4. Other SDRs work via SoapySDR. Linux and Windows 11 have been tested, but the macOS builds are marked as experimental. The code is open source under GPLv3 and available on GitHub.

AI Disclaimer: While the author does not disclose it, the repository includes an AGENTS.md file described as "Guidance for AI coding agents working in this repository", so it is our opinion that this software may be coded with the help of AI.

Vote

October 29, 2026

OrcSDR Update: SSTV, ACARS and Offline Maps Come to the Standalone ESP32-P4 RTL-SDR App

Back in September, we posted about OrcSDR, open-source firmware that runs an RTL-SDR directly on the ESP32-P4 microcontroller-based M5Stack Tab5 tablet, with no PC or Raspberry Pi needed. Erik Elfstrom has now written in again to share that OrcSDR v0.5.0-beta.1 (release notes) is out, with several new features and a lot of stability work.

The main additions are SSTV reception and a dedicated ACARS dashboard. SSTV images are drawn directly on the touchscreen and saved to the SD card, and the ACARS dashboard shows live messages and aircraft lists. Erik has tested SSTV with Robot36, PD120, and Scottie S1 on various RTL-SDR models. Offline maps have also been added to the LoRa/Meshtastic, ADS-B, and FT8 dashboards. There is also a new 'Dead Air' dashboard for logging RF and audio activity, and Erik notes that despite the Halloween timing, it is not a ghost detector.

Erik also notes that a lot of work has gone into fixing layout issues, redraw flicker and memory pressure, and there is now a guided first-run setup. The software is still in beta, and Erik says that not every issue is gone yet. The update can be installed with M5Burner or the browser installer, and the code is open source under AGPL-3.0 and available on GitHub.

AI Disclaimer: The OrcSDR README notes that the project was created with "extensive AI assistance".

Vote

October 28, 2026

OrbitNight: A Free Browser-Based Satellite Pass Viewer with Antenna Rotator Control via Web Serial

Thank you to the OrbitNight team for writing in and sharing their "OrbitNight satellite radar", a free browser-based pass viewer for any satellite in the catalog. It can also point an antenna rotator straight from the browser over USB using Web Serial, so you don't need to install anything.

The radar page shows a polar plot of the pass track, live azimuth and elevation readouts, and an AOS/LOS countdown. A radio tab lists downlink and uplink frequencies taken from SatNOGS. For rotator control, it supports Yaesu GS-232 compatible controllers (including K3NG and ERC) and EasyComm II controllers like those used on SatNOGS stations connected over USB serial, or Bluetooth on Android. It also has an azimuth offset setting and a 1 degree deadband.

The site works in Chrome and Edge on desktop, and rotator control needs a browser that supports Web Serial. It's free and needs no sign-up. The team notes that there is no 450 degree or flip mode yet, and they'd like to hear from anyone who tries it with a real rotator. If you track LEO satellites with a directional antenna and an RTL-SDR, this could be a simpler option than setting up Gpredict and Hamlib. We note, however, that we couldn't find an open-source codebase.

Vote

October 28, 2026

sdrtop Update: Wi-Fi Airtime Tools, POCSAG Pager Decoder and Native Airspy R2 Support

Earlier this month we posted about sdrtop, a Rust-based SDR bench instrument that runs in a terminal and is aimed at measurement rather than listening. Viktor László (MusiThang on GitHub) has now written in again to share several updates. Viktor notes that the goal is still to "make radio signals and the measurements behind them inspectable, rather than hiding everything behind a decoded result."

The biggest additions are new Wi-Fi tools. sdrtop can now survey 2.4 GHz channels 1 to 13 and name the least busy one, inspect a single channel frame by frame at three time scales, and show a channel's airtime use second by second. These tools need 20 Msps, so you need an SDR like the HackRF. There is also a new POCSAG pager decoder written from the ITU standard without external libraries. Viktor tested it over the air by transmitting with a HackRF and PortaPack Mayhem and receiving with an Airspy R2.

The Airspy R2 is now natively supported too. Its gain staging follows the R2's Linearity and Sensitivity gain curves, and sdrtop warns you before the tuner clips. RTL-SDRs are still fully supported, and native support for the SDRplay RSP1B and Airspy HF+ Discovery is in progress. The code is open source under the GPLv3 and available on GitHub.

AI Disclaimer: The project's CREDITS.md file notes that Claude Code was used for implementation, architecture discussion and problem-solving.

Vote