A More In-depth Look at the Tunisian RTL-SDR Espionage Story

The Africa Report, an online newspaper specializing in African stories recently ran a story titled "A Tunisian spy story". The story discusses the circumstances behind the mysterious arrest of a UN expert in Tunisian, supposedly for having used an RTL-SDR dongle as part of his research into violations of the UN arms embargo on Libya. See our previous post for the original details.

The Africa Report story gives a more in depth look at what happened during his arrest and what is happening in Tunisia. If you're interested in following this story, this is a good read.

An RTL-SDR aircraft tracker, which can be purchased legally on the internet, is composed of an antenna and a USB key. There are smartphone apps that have similar functionalities that allow you to track commercial flight routes. Can it be that this object, found in his home, is the sole piece of evidence used by the Tunisian courts to justify the detention of United Nations (UN) expert Moncef Kartas for espionage, as his defence claims?

Kartas, who is German-Tunisian, was officially mandated in 2016 by the UN to lead an investigation into violations of the arms embargo on Libya. His carefully selected team was appointed by the UN secretary general and were due to draft a report in June. Kartas’s arrest disrupted those plans.

Kartas was arrested as he walked off a plane on 11 April in a theatrical scene at Tunis airport involving around 10 security agents. He is now awaiting trial in his cell in Mornaguia prison. Accused of “treason” and “spying for a foreign power”, he faces the death penalty. Fortunately for him, Tunisia has banned that punishment.

Rumours are running high around the activities of a security company he co-founded and the role of a second man who was also arrested. But several pieces are missing from the puzzle. The versions of the Tunisian authorities and the UN are completely different, as is the information supplied by the defence and that supplied by the prosecution. Saying it is “very concerned”, the UN is calling for the researcher’s release, pointing out that the lifting of his immunity is illegal.

[Read More]

UPDATE: Kartas was recently freed on bail.

Tweet
Share94
Reddit
Vote
Email
94 Shares

SignalsEverywhere: P25 Trunking with Just One RTL-SDR and DSDPlus Fastlane

Over on YouTube Corrosive from the SignalsEverywhere channel has uploaded a new video showing us how to set up P25 trunking and decoding with DSDPlus Fastlane and only a single RTL-SDR.

Normally two dongles are required to follow a P25 trunking system. One dongle continuously receives the trunking channel, and a second tunes to the voice channel chosen by the trunking channel. However, the latest DSDPlus Fastlane has a feature that allows one only dongle to be used. It works by tuning back and forth between the control and voice channel. The disadvantage is that trunking information could be missed while tuned to a voice channel, so some calls could be missed.

RTL SDR Setup P25 Trunking With 1 SDR and DSDPlus FastLane

Tweet
Share96
Reddit
Vote
Email
96 Shares

Osmocom Now Releasing Weekly Windows Binaries for RTL-SDR and Osmo-FL2K

Osmocom is the open source team behind the RTL-SDR driver project and the Osmo-FL2K discovery. In a recent announcement they have noted that they are now publishing weekly binary builds for the RTL-SDR and Osmo-FL2K projects. This means that Windows users are now able to test the latest driver updates without having to compile them manually. Laforge writes:

While Osmocom in general is a very much Linux-centric development community, we are now finally publishing automatic weekly Windows binary builds for the most widely used Osmocom SDR related projects: rtl-sdr and osmo-fl2k.

You can find the binaries at The actual builds are done by roox who is building them using MinGW on OBS, see

The status of the osmocom binary publish job, executed once per week from now on, can be found at https://jenkins.osmocom.org/jenkins/view/All%20no%20Gerrit/job/Osmocom-OBS_MinGW_weekly_publish/

As a reminder, if you've ever enjoyed the RTL-SDR or Osmo-FL2k projects, you can thank Osmocom for bringing them to us for free by donating to them at Open Collective. The drivers are the root of all that we can do with RTL-SDR and FL2K, so it is only fair to thank them.

Tweet
Share45
Reddit
Vote
Email
45 Shares

Stratux 1090 MHz + 978 MHz Diplexer Now Available

Recently the company Stratux released a new ADS-B/UAT diplexer PCB. This is useful if you have a single antenna and want to feed two RTL-SDR dongles, with one receiving 1090 MHZ ADS-B and the second receiving 978 MHz UAT. The filter consists of a splitter and two SAW filters.

ADS-B is short for Automatic Dependant Surveillance Broadcast and is used to help track aircraft in the sky. It is transmit at 1090 MHz and the signal contains aircraft data such as the location, speed, altitude and aircraft call sign. ADS-B is utilized worldwide.

UAT is short for Universal Access Tranceiver and is transmit at 978 MHz. Like ADS-B it is used to keep track of aircraft, however UAT is only available in the USA and only for aircraft that fly below 18,000ft. It is a little cheaper and unlike ADS-B, UAT transmissions can also contain weather and traffic data.

US aircraft owners/operators that fly below 18,000ft can choose to install either UAT or ADS-B transmitters in their aircraft, so in the US a complete monitoring solution needs to monitor both 1090 MHz and 978 MHz.

The Stratux Diplexer board is currently available on Amazon for $24.99.

Stratux Diplexer for 1090 MHz ADS-B and 978 MHz UAT.
Stratux Diplexer for 1090 MHz ADS-B and 978 MHz UAT.
Tweet
Share128
Reddit
Vote
Email
128 Shares

Demonstrating HFDL Reception with a Cloud-IQ SDR and MultiPSK

Over on YouTube user Shortwave Bavaria has uploaded a video that demonstrates HFDL reception. HFDL is short for High Frequency Data Link and is a signal used by aircraft to communicate short messages with ground stations over long distances. It is often used in place of VHF ACARS when flying over oceans.

In his video Shortwave Bavaria uses a 26.5m end fed wire, and a Cloud-IQ SDR. But we note that any HF capable SDR can be used to receive HFDL. SDR-Console V3 is used as the receiver, and MultiPSK Professional edition as the decoder. Many HFDL messages contain location data, so aircraft can be plotted on a map and he demonstrates this using Google Earth. In the video he notes how amazing it is that flights from across the globe can be received with his set up.

Amazing Decoding HFDL reception with SDR over central Europe

Tweet
Share54
Reddit
Vote
Email
54 Shares

Spoofing Aircraft Instrument Landing Systems with an SDR

Recently Arstechnica ran an in depth story about how a $600 USRP software defined radio could be used to trick an aircraft that is making use of the Instrument Landing System (ILS). ILS is a radio based system that has been used as far back as 1938 and earlier. It's a very simple system consisting of an array of transmitter antennas at the end of a runway and a radio receiver in the aircraft. Depending on the horizontal and vertical position of the aircraft, the ILS system can help the pilot to center the aircraft on the runway, and descend at the correct rate. Although it is an old technology, it is still in use to this day as a key instrument to help pilots land especially when optical visibility is poor such as at night or during bad weather/fog.

Researchers from Northeastern University in Boston have pointed out in their latest research that due to their age, ILS systems are inherently insecure and can easily be spoofed by anyone with a TX capable radio. Such a spoofing attack could be used to cause a plane to land incorrectly. In the past ILS failures involving distorted signals have already caused near catastrophic incidents.

However, to carry out the attack the attacker would require a fairly strong power amplifier and directional antenna lined up with the runway. Also as most airports monitor for interference the attack would probably be discovered. They write that the attack could also be carried out from within the aircraft, but the requirements for a strong signal and thus large power amplifier and directional antenna would still be required, making the operation too suspicious to carry out onboard.

Wireless Attacks on Aircraft Landing Systems

Tweet17
Share122
Reddit
Vote
Email
139 Shares

Hermes-Lite: A Low Cost Amateur Radio SDR Made from A Repurposed Cable Modem Chip

The HPSDR Hermes SDR is an open source amateur radio SDR transceiver project that was released as far back as 2011. More recently Steve Haynal has been working on a Hermes-Lite project which is intended to be an opensource open hardware low cost amateur radio HF transceiver which is based on the HPSDR Hermes SDR project software and FPGA DSP implementation.

The Hermes-Lite is able to be very low cost (less than $300) because it is based on the AD9866 chip which is a mass produced RF front end (LNA + ADC & DAC) used in cable modems. Because it is a mass produced commodity, the chip only costs approx. US$35-$25 on Mouser depending on quantity. The chip has a 12-bit 80 MHz ADC and DAC, meaning that if used without any analog mixer front end (like in the Hermes-Lite) it can receive the entire spectrum between 0.1 to 38 MHz all at once.  

The Hermes-Lite is also a lot more than just the RF chip, as it contains a set of switched RF filters and a 5W power amplifier for TX. It also interfaces with a PC via Ethernet and has a built in FPGA for DSP processing.

Recently Steve presented at the FOSSi Foundation Latch-Up conference on May 4-5, and a YouTube recording of his presentation is shown below.

[First seen on The SWLing Post]

Hermes-Lite: Amateur Radio SDR

Tweet
Share56
Reddit
Vote
Email
56 Shares

Vela Pulsar Glitch Detected with RTL-SDR Based Radio Telescope

On February 1st 2019 the HawkRAO amateur radio telescope detected a "glitch" during it's observations of the Vela Pulsar. A pulsar is a rotating neutron star that emits a beam of electromagnetic radiation. If this beam points towards the earth, it can then be observed with a large dish or directional antenna and a radio, like the RTL-SDR. The Vela pulsar is the strongest one in our sky, making it one of the easiest for amateur radio astronomers to receive.

Pulsars are known to have very accurate rotational periods which can be measured by the radio pulse period. However, every now and then some pulsars can "glitch", resulting in the rotational period suddenly increasing. Glitches can't be predicted, but Vela is one of the most commonly observed glitching pulsars.

The HawkRAO amateur radio telescope run by Steve Olney is based in NSW, Australia and consists of a 2 x 2 array of 42-element cross Yagi antennas. The antennas feed into three LNAs and then an RTL-SDR radio receiver. He has been observing the Vela pulsar for 20 months.

His observations indicate that Vela glitched and spun up by 2.5PPM at 14:09 UTC on Feb 1, 2019. He claims that this glitch detection is a first for amateur radio astronomy as far as he is aware.

If you're interested in Pulsar detection, check out a few of our previous posts on the topic.

The HawkRAO Amateur Radio Telescope Vela Glitch Detection
The HawkRAO Amateur Radio Telescope Vela Glitch Detection (Blue graph on the right indicates the glitch detection)
Tweet
Share190
Reddit
Vote
Email
190 Shares