May 5, 2026

Student Arrested in Taiwan for using SDR and Handheld Radios to Halt Four High Speed Trains with TETRA Hack

The Taipei Times has reported that a 23-year-old university student in Taiwan has been arrested after using a software-defined radio and hand held radio to hack into Taiwan High Speed Rail Corporation's (THSRC) internal radio communications and halt four trains mid-service.

Chinese-language coverage from UDN and Newtalk fills in some details omitted in the English Taipei Times article. The system the student compromised is TETRA, and at 23:23 on April 5, 2026, the student transmitted a "General Alarm" (GA) signal, the highest-priority TETRA alert, which automatically instructs trains in the area to switch to manual emergency braking. Four trains were stopped for 48 minutes. THSRC's radio system has reportedly been in service for 19 years with seven verification layers, but parameters were apparently never meaningfully rotated over that period.

Police describe the suspect as buying an SDR online, connecting it between an antenna and a laptop, capturing THSRC traffic, and decoding the relevant parameters in software, then programming those parameters into one of his eleven handheld radios. A 21-year-old friend also allegedly supplied some critical THSRC parameters. The actual details of the 'hack' aren't entirely clear from the news articles. We suspect that the THSRC TETRA system is simply unencrypted, and that the student was able to spoof a legitimate signal. It's also possible that the THSRC TETRA system used TEA1 encryption, which is known to be broken.

Police located the student through a combination of network-side TETRA logs and CCTV. When the THSRC control center called back to verify the alarm, the person on the other end gave contradictory answers and then powered the radio off, prompting THSRC to audit their handheld fleet, confirm every issued radio was accounted for in its storage locker, and report to police that the parameters had been cloned.

Base station logs from the THSRC TETRA infrastructure (which record which sites received the uplink, with multi-site signal strength narrowing the origin) were used to localize the transmission source, and CCTV from around the coverage area was then used to identify the student and trace him to his rental unit. Search warrants on 28 April seized 11 handheld radios, a laptop, and the SDR.

He is currently out on NT$100,000 (3,200 USD) bail and faces up to ten years under Taiwan's Railway Act and Criminal Code, with an unconvincing "had it in my pocket and accidentally pressed the button" defense.

Stories like this are a reminder that experimenting with operational safety-of-life radio systems carries serious legal consequences. Back in 2016, we covered the case of Dejan Ornig, a Slovenian university student who used an RTL-SDR and the open source Osmocom TETRA decoder to discover that his country's police TETRA terminals were running unauthenticated, despite official documents stating otherwise. After seven years of court hearings, he ended up with a seven-month suspended sentence. More recently, we posted on the End of Train (EoT) vulnerability, where a security researcher demonstrated that an SDR can replicate the unauthenticated braking command on US freight trains.

A Taiwanese High Speed Train (Source: https://en.wikipedia.org/wiki/File:THSR_700T_TR17_20130907.jpg)

Translated news graphic from https://udn.com/news/story/7315/9475450

Vote

May 5, 2026

SatDump V2 Image Product Expressions YouTube Tutorial

Thank you to Paul Maine, who has submitted a new SatDump tutorial to us that he has uploaded to his YouTube channel. The new tutorial is the fourth in a series focused on SatDump V2.x. In an earlier post, we showed Paul's three previous tutorials.

His SatDump V2.x Part 4 video provides an introduction to SatDump’s “Image Product Expressions”. The video begins with satellite calibration units and descriptions, and includes Albedo, Brightness Temperature, and Radiance. The video then discusses satellite sensors, providing examples. The GOES-19 Satellite and its Advanced Baseline Imager are used in the examples.

Color RGB Images can be created using various satellite bands and Image Product Expressions to produce very beautiful and useful satellite imagery.

E 27 SatDump v2.x Part4 Image Product Expressions

Watch this video on YouTube

Vote

May 4, 2026

L-Band Weather Imagery Soon Coming Back to Western Europe via Elektro-L3

Thanks to weather satellite enthusiast 'Heja Ali' who wrote in to share some welcome news. On February 12, 2026, Roscosmos successfully launched Elektro-L No.5 aboard a Proton-M rocket from Baikonur Cosmodrome, the fifth in the Elektro-L series of Russian geostationary weather satellites (following No.1 in 2011, No.2 in 2015, No.3 in 2019 and No.4 in 2023). Like its predecessors, it carries an unencrypted 1691 MHz L-band downlink with both LRIT and HRIT imagery.

The interesting consequence for amateur satellite enthusiasts is what happens next. Per SatDump's satellite list, L5 is now commissioning at 76°E (L3's old slot), L4 is operational at 165.75°E, and the European slot at 14.5°W is currently held by L2, which has lost its L-band transmitter to a power supply failure. Once L5 is fully operational, L3 is expected to drift west to 14.5°W to replace L2, finally restoring an unencrypted geostationary L-band downlink to the UK, Ireland, Iceland, Portugal, western France, and Spain for the first time since EUMETSAT switched off Meteosat HRIT in 2018.

The Electro-L 1691 MHz signal is easily received by an RTL-SDR Blog V3 or V4, LNA, and a modest 65 cm dish. Our Discovery Dish with the L-band weather satellite feed is a good choice, with existing users in southern Europe routinely pulling Elektro-L3 at 5 to 6 dB SNR using SatDump (which only needs around +1 dB to decode).

There is no firm public timeline yet for L3's drift west, but if you are in far-western Europe and have been waiting on a geostationary L-band satellite to become available, now is a good time to start planning for the receive hardware.

Receiving Electro-L Satellite Imagery With SatDump

Vote

May 4, 2026

P25-Survey: A Tool for Scanning and Logging P25 Control Channels with an SDR

Over on GitHub, programmer blantonl has released p25-survey, a Python tool that scans a frequency range with an RTL-SDR, Airspy or HackRF and identifies any P25 control channels present. For each one found, it logs the WACN, System ID, NAC, RFSS ID and Site ID, the full IDEN_UP band plan, neighbor sites with resolved frequencies, and signal quality metrics including RSSI, BER and decode rate.

The tool also has an optional RadioReference cross-reference mode that annotates results with the RR system name and site description, flags frequency offsets versus the database, and generates a Markdown submission report for data not yet in RadioReference. An auto-gain feature sweeps gain values on each confirmed control channel and recommends the optimal setting for your SDR and location based on BER.

Vote

May 4, 2026

Portable ADS-B Receiver Firmware for the ESP32-P4 Based LILYGO T-Display-P4 with RTL-SDR

Over on GitHub, John Stockdale has released ADS-B Scope – T-Display-P4, a portable open source 1090 MHz ADS-B firmware for the LILYGO T-Display-P4, which is a smartphone-shaped handheld microcontroller with a 4" touchscreen, GPS, SD card, SX1262 LoRa, and a USB 2.0 host port, built around the dual-core 360 MHz RISC-V ESP32-P4.

The most interesting bit is that John has written a custom USB host driver that allows an RTL-SDR to plug directly into the T-Display-P4. Neither a Pi nor a laptop is needed in the chain. The driver supports the Blog V4/V3 with software bias-tee control and Mode-S demodulation (adapted from dump1090), which runs in real time alongside an on-device aircraft table and radar scope (range rings, trails, helicopter silhouettes). The firmware also implements adaptive gain control, a 587K-record OpenSky aircraft database cached in PSRAM, SD card CSV logging, USB hot-plug, OTA updates, MQTT telemetry, and a WebSerial companion app at adsb-scope.offx1.com with live map, 3D view, CSV replay, and firmware flashing.

In addition to all that, the firmware also runs a Meshtastic-compatible mesh radio on the SX1262 (with PKI DM decryption and MQTT gateway forwarding) and an MP3 player through the onboard ES8311 DAC. John reports ~30 nm range from Oakland, CA on a 7" telescopic antenna, decoding 15–30 messages per second with 12–30+ aircraft tracked.

Vote

April 28, 2026

Detecting Hidden GPS Trackers via Electromagnetic Unintentional Emissions with a HackRF

Researchers from Hunan University, Boise State, and UT Arlington have published a paper called "GPSBuster" (PDF link), demonstrating how a HackRF One can sniff out covert GPS trackers by their unintended electromagnetic radiation. Hidden trackers are hard to find since they only receive satellite signals and may store coordinates locally rather than transmit. Instead of looking for transmissions, GPSBuster targets side-channel leakage from the tracker's mixed-signal SoC, specifically the coupling between the quartz oscillator, local oscillator, and mixer used to downconvert the 1575.42 MHz L1 signal.

The team found that an active tracker leaks two characteristic spectra: a low band around 26 to 104 MHz and a high band around 1545 to 1625 MHz, each with a strong peak and evenly spaced harmonics. The low band reflects coupling between the quartz oscillator (typically 26 MHz) and the IF, while the high band contains LO plus IF spacing that always sums to 1575.42 MHz, giving a database-free detection rule. The setup consists of a HackRF, an NFP-3 near-field probe, and a 35 dB LNA. The use of the near-field probe means that sweeping the probe over an area to find the tracker is necessary, and the maximum detection range was 0.61 m.

Tested against the top 10 trackers available on a popular online marketplace, GPSBuster hit a 98.4% detection rate, working through plastic, cotton, canvas, and leather, and alongside phones, laptops, and speakers. It also extended to L1+L5 modules like the Quectel LC29H series, and even metal-shielded chips still leaked enough via PCB traces to be picked up.

Covert GPS Tracker Detection with a HackRF and Near Field Probe

Vote

April 28, 2026

Bending the Flipper Zero’s CC1101 Into an APRS Transmitter

Over on GitHub, Richard YO3GND has released a Flipper Zero APRS TX application that pushes the device's onboard CC1101 radio into transmitting Bell 202 AFSK, despite FM not really being what that chip was designed to do.

The author is upfront that this is very impractical: it is transmit-only, the transmitted signal is imperfect and not recognized by some APRS hardware (software decoders seem to work well), and the joystick text entry is painful.

The implementation builds the full APRS stack on the Flipper itself, handling packet type construction, AX.25 framing, and waveform generation in software, and supports status, position, bulletins, and direct APRS messages. There are also some low-level settings exposed in the UI, including 300 baud operation, preamble length, and lead-in tuning, alongside the standard APRS settings.

While this may be impractical for any real use case, the idea of implementing the protocol properly on a constrained device is an interesting read.

Flipper ham - An experimental APRS transmitter

Watch this video on YouTube

Vote

April 28, 2026

Fixing a Locked-Up RTL-SDR 700 km Away Using uhubctl USB Power Cycling

Over on Medium, Jugy depin has shared a useful troubleshooting write-up describing how they recovered a frozen RTL-SDR on a remote Raspberry Pi station located 700 km away, with no physical access available. The dongle had stopped responding with usb_claim_interface error -6 and Failed to open rtlsdr device #0 errors, while still showing up in lsusb.

After ruling out the usual suspects, such as DVB drivers, conflicting processes, permissions, and even a full reboot, they concluded that the RTL2832U had locked up at the USB hardware level. To make things worse, they discovered that a Raspberry Pi reboot from the terminal does not actually power-cycle its USB ports.

The fix was to use uhubctl to cut and restore power to only the specific port the SDR was plugged into, after first carefully identifying which port that was (so as not to accidentally kill the Ethernet port and lose remote access entirely). The commands shown in the post performed a true hardware-level reset equivalent to unplugging and replugging the dongle, and rtl_test confirmed the device came back cleanly.

Jugy recommends that anyone running remote SDR stations either build uhubctl into a healthcheck script or add a smart plug for unattended recovery.

Vote