\documentclass[a4paper]{article}

\usepackage{graphicx}
\usepackage{keystroke}
\usepackage[margin=1in]{geometry}
\usepackage{hyperref}
\hypersetup{colorlinks,linkcolor=blue, urlcolor=blue}

\usepackage{multicol}
\usepackage{color,soul}
\usepackage{tcolorbox}
\usepackage{listings}
\usepackage{amssymb}

\usepackage{parskip}

\lstset{
  basicstyle=\ttfamily,
  columns=fullflexible,
  frame=single,
  breaklines=true,
  postbreak=\mbox{\textcolor{red}{$\hookrightarrow$}\space},
}

\begin{document}

\begin{center}
	\begin{minipage}[t]{0.5\textwidth}
		\begin{flushleft} \large
			CyBoK - Student Notes 
		\end{flushleft}
	\end{minipage}%
	\begin{minipage}[t]{0.5\textwidth}
		\begin{flushright} \large
			Joshua Curry and Denis Nicole
		\end{flushright}
	\end{minipage}\\[1cm]

	\begin{minipage}{1\textwidth}
		\LARGE Laboratory for wireless remote control
	\end{minipage}\\[1cm]

	\begin{minipage}[t]{1\textwidth}
		\begin{flushleft} \large
		This version has been prepared for\\
    either offline use under COVID-19 restrictions\\
    or live use in a laboratory.
		\end{flushleft}
	\end{minipage}\\[1cm]
\end{center}

{\noindent\bf This laboratory will teach you how to receive and decode radio signals, akin to those commonly used by IoT devices. Utilising a LimeSDR Mini, you will decode a modulation scheme. You will then form a payload to attack your IoT device, and you will have an opportunity to explore how to combine this with fuzzing to compromise multiple IoT devices.
}

\section*{Submission Instructions}

For each numbered section in each task, please write what you did, what you learnt, and
aim to answer each sub-question on the template provided. You should aim to write no
more than 100 words per numbered section, with a total of around 1000–1200 words. Bullet
points or brief sentences are fine; there is no need to write an essay, What matters is the
content, and the understanding that you are showing.



\section*{Getting Started}

During this laboratory, you will utilise two main pieces of software. The first of these, \emph{SDR Console}, is a universal Software Defined Radio client for Windows. Being compatible with most major SDRs and very simple to use, we will utilise this for basic spectrum monitoring and visualisation.

\emph{Universal Radio Hacker} is a very useful piece of software for analysing digital signals. We will be using this to intercept and replay digital signals to a common ``Garage Door Opener''-type IoT device. It imposes a potentially counter-intuitive workflow which may lead to something of a ``steep learning curve''.

Both of these pieces of software are available on the laboratory machines. You can also install them on your own Windows system.

\textbf{It is recommended to use the virtual machine image in the lab to get started quickly.}

\section*{Task 1 - Understanding the target device}

You have been issued a standard radio controlled relay module and fob as part of this laboratory. Remove the top cover of the relay board, but \textbf{do not attempt to dismantle the fob}. You may unscrew the relay board from the bottom cover if you wish, but reinstall it before continuing.

Using this information:

\begin{enumerate}
\item Identify the relay board and describe its components.
\item Without inspecting the keyfob, calculate the operating frequency of the relay board.
\item What is the operating frequency of the keyfob? Is this legal in the United Kingdom?
\item Arrange to supply the appropriate power to the board utilising the bench apparatus. What voltage is used?
\item Select appropriate resistors, and connect four LEDs so that they turn on when the corresponding relay is engaged, Show your circuit.
\item Power the system, and check and record the current consumption. If necessary, follow the appropriate learning sequence to provision the relay board for the keyfob, then check that relay ``A'' operates with the remote control.
\end{enumerate}

With your relay board now confirmed working, we will use a LimeSDR Mini to monitor the spectrum in which the device operates.

First, you will need to use the provided SMA connector to build a $\lambda/4$  antenna for the frequency you identified above. If you have not yet been risk assessed to use the laboratory soldering irons, please consult the laboratory technicians. With your antenna built, screw it gently into the \textbf{RX} port on the LimeSDR. Do not use a spanner! You are now ready to begin using the SDR to investigate your IoT Relay.

\section*{Task 2 - Spectrum Monitoring}

For this task we will be using SDRConsole, a windows-only utility which facilitates spectrum monitoring using the LimeSDR.


\begin{enumerate}
\item Establish the best PC USB port to use with your SDR. Are some ports more or less noisy than others? Why?
\item What is the exact frequency on which the garage door opener transmits?
\item Do other traces appear when you push the button? Which, and why? Take an appropriate ``screen capture''
\item Can you learn anything by listening to the audio output from SDR Console? What?
\end{enumerate}

You may be able to see from the waterfall, and hear on the audio output, that this is an on-off keyed signal.

\section*{Task 3 - Capture, Analysis and Replay}

For this next task, you will need to use \href{https://github.com/jopohl/urh}{Universal Radio Hacker}, an open-source tool for analysing digital signals. The x64 Windows installer can be found at\\ 
\href{https://github.com/jopohl/urh/releases/download/v2.9.2/Universal.Radio.Hacker-2.9.2-x64.exe}{https://github.com/jopohl/urh/releases/download/v2.9.2/Universal.Radio.Hacker-2.9.2-x64.exe}.\\ 
If SDRConsole is already working with your LimeSDR Mini, you should not need to install or configure any additional software.

\subsection*{Capture the signal}

Open Universal Radio Hacker by selecting the icon on the Desktop. 

In order to capture your signal, make sure that the \textbf{SDRConsole is closed} so that URH can access the radio device, then select \emph{File → Record Signal…}.

There are a variety of options on this page; you will want to set the following:

\begin{itemize}
	\item Device: LimeSDR
	\item Device Identifier: \textit{Press the refresh button and this should populate.}
	\item Antenna: Wide (RX\_W)
	\item Frequency: About 500kHz  below the frequency you identified above. 
	\item Sample Rate and Bandwidth: By default these will be 2MSps (2MHz Bandwidth) which should be fine.
  \item Gain: 70 is a good initial value
  \item DC Correction: On
\end{itemize}

When happy, press the ``Start'' button to begin capture. The command trace will show in the bottom left, and you will need to wait approximately 10 seconds for the capture to begin.

When happy that you have captured your signal, press ``Stop'' to end.

Then, press ``Save'' to save the capture to disk. Give it a useful name; you might include the button you pressed on the garage door opener.

When happy, close the capture window and your trace will populate in the ``Interpretation'' tab of Universal Radio Hacker. You can take multiple captures; these will show up underneath each other as part of the interpretation tab.

\subsection*{Replay the signal}

Now that you have a signal captured, you can use the LimeSDR to play back an exact replica and see if the device recognises it. 

First, move your antenna from the `RX' port to the `TX' port.

In the \emph{Interpretation} tab, press the small play button ($\blacktriangleright$) above the filename of the trace you wish to replay. This will open the transmission window where, again, you will need to set the following:

\begin{itemize}
	\item Device: LimeSDR
	\item Device Identifier: \textit{Press the refresh button and this should populate.}
  \item Channel: TX1
  \item Antenna: Band 1 (TX\_1)
	\item Frequency: The same frequency that was used for receiving.
	\item Sample Rate: The same sample rate that was used for receiving.
	\item Gain: 50 is a good initial choice
	\item Repeat: Change this from "Infinite" to e.g. 5.
\end{itemize}

You may need to place the receiver close to the LimeSDR for this to work. You may also need to re-capture the original signal you are replaying, if it is too noisy.\\

Questions:
\begin{enumerate}
\item How effective is this kind of attack? 
\item What advantages and disadvantages do replay attacks have compared with fully reconstructing the signal?
\item Would this type of attack work on a wireless car key?
\end{enumerate}


\subsection*{Task 4 - Analysis of the Signal}

Traces can be manipulated by using the mouse to select regions of the trace, and unwanted information can be deleted with the delete key. The mouse wheel is used to zoom, and the Y scale can be adjusted at the right hand side of the trace. \\

Questions:
\begin{enumerate}
\item What is the repeating unit of the signal? What is the bit period?
\item What is the duration of a single  bit within a message?
\item Can you identify the encoder chip that is used? 
\item Does the chip identity help you to modify your answer to 4.1?
\item Can you modify the messages to operate button ``B''?
\item Using the chip information, how many different ID codes are supported by this system?
\item How many repeats of the message are required to trigger a relay?
\item To what frequency is the receiver \emph{actually} tuned?
\item If you were not able to capture a signal from a target system, what is the maximum amount of time it would take to fuzz every ID code combination for a single relay channel, and thus open the door without a keypad?
\end{enumerate}

\end{document}