Solving a Frequency Hopping CTF Challenge with Aliasing
At this years BSides Ottawa security conference, Clayton Smith was tasked with setting up a wireless "Capture the Flag" (CTF) competition. CTF competitions generally consist of a mystery signal that participants need to figure out how to decode with an SDR such as an RTL-SDR.
One CTF that Clayton set up was a frequency hopping challenge with several levels of difficulty. The signal consisted of a narrow band FM signal that constantly hopped between multiple fixed frequencies. The idea was to use whatever means possible to piece together that signal again so that the speech audio could be copied.
The first level had the audio signal hopping very slowly, so the speech could be pieced together manually by listening by ear to each channel it transmitted on. Subsequent levels had the signal hopping much faster, so they required some DSP work to piece everything back together.
In his post Clayton writes about three possible GNU Radio based DSP solutions to the problem. The first method he describes is an interesting method that abuses the effects of aliasing. Aliasing is a problem in SDRs when a signal can be folded on top of another, creating interference. However, this approach makes use of aliasing to purposely fold the hopping channels into one frequency, resulting in speech that can be copied.
The rest of his post explains two other methods that could be used as well. The second method involves treating the entire band consisting of the hopping signals as a single FM signal, then filtering it with a DC block. The third approach uses FFT to detect which channel is active with the highest power, then shifting that channel by it's offset.
Clayton also set up another CTF with gr-paint. The idea was to read text on a "painted" waterfall with ever decreasing text spacing that would eventually be too small to read on standard SDR programs like GQRX. Instead, the solution was to open the IQ data in a tool like Inspectrum or Baudline which has much higher FFT resolution.
