A determined 'hacker' decrypts RDS-TMC

http://windytan.blogspot.fi/2013/05/a-determined-hacker-decrypts-rds-tmc.html

by emhart • 13 years ago

352 45 13 years ago

windytan.blogspot.fi

Man, her blog is full of awesomeness. All kinds of cool little projects on there.

jared314• 13 years ago

I wonder what her lead time on each post is. Is she really productive, or does she have a lot of projects in a pipeline and we see the built up list of results? Either way, I feel unproductive just reading it.

rwg• 13 years ago

I get a seriously bittersweet feeling reading her blog since some of the things she's doing are eerily similar to little "just for the hell of it" projects I did in college many, many moons ago. (Transmitting data with IR LEDs driven by my sound card, using audio tapes to store data, playing with signal processing using audio from FM radio stations captured with my WinTV card, writing everything in Perl [5.005], ...)

I wish I still had the desire to just play around with such things again... :-\

eksith• 13 years ago

Getting back into a hobby to get away from another frustration doesn't always work, cause then your heart's not in it. That's just escapism.

Sometimes the desire is just a matter of achieving momentum. I've let my hobby desk collect dust (figuratively speaking; my OCD wouldn't allow it) until I come across something that piques my interest and I plug in Ye Olde soldering iron and fiddle around. Might do that a few days, fall into a lull and then suddenly pick up and follow through.

reeses• 13 years ago

You may want to look in other areas. I was "collecting" watches[1] for years before I realized that I wanted to make watches. Because there was a 'purpose', I found myself with a desire to do more electronics projects to support my hobby.

My knowledge in that area (and software) gives me the leverage to make cheap-but-adequate tools that would cost $15-50k or more from watchmaker tooling companies.

[1] Basically, using my annual watch "budget" to buy a watch that had some unique or unusual attribute, not really collecting in the traditional sense.

nitrogen• 13 years ago

Indeed. This is my new favorite blog. I wish I knew more people locally with this kind of curiosity and ability.

kybernetyk2• 13 years ago

Yeah, added it to my RSS feed. (And it has been a while since I added something.)

_b8r0• 13 years ago

I've been trying to get her to submit to 44CON[1] for over a month. I get the impression she might not feel like she can fill 45 minutes from the comments but I'd still want to try and get her over. Her blog is absolutely amazing though, one of the best I've seen in a long time.

[1] http://44con.com

andrewcooke• 13 years ago

the coolest bit by far is RDS was decoded from intermodulation distortion in the radio's Line Out audio caused by the stereo demuxer circuitry. :o)

sillysaurus• 13 years ago

decoded from intermodulation distortion in the radio's Line Out audio

I wonder if this is a fairly common side channel attack? The most common in the domain of digital crypto is time (e.g. all password inputs must take equal time to check vs a given password, otherwise you leak info about the password) but distortion seems an obvious attack vector against analog crypto. Though I don't know if it's merely obvious in hindsight, as are most things.

akira2501• 13 years ago

No, she used the distortion to decode the specific subcarrier that holds the RDS information. This had nothing to do with the decryption, as the data decoded at this step would include regular RDS/RDBS data along with the _encrypted_ TMS data.

The decryption is performed in a second step. The reason she had to do it this way is because most radios do not provide a convenient way to get at the subcarrier data.

jrockway• 13 years ago

This isn't an attack, it's just using the cheap FM radio and a sound card like a software-defined radio.

kbuck• 13 years ago

There's more about the discovery of the RDS data here: http://windytan.blogspot.fi/2013/04/how-i-discovered-rds.htm...

(there's also a couple links at the end of this article discussing how she modified her radio to provide a digital interface for the data)

raverbashing• 13 years ago

The frequency shifting of the stereo signal must be doing exactly that, shifting everything down and not filtering

RDS at 57k she says? Stereo signal (or better, the L-R information) is at 38k (double band suppressed carrier, so the carrier would be at 38k). So 57 - 38 = 19k!

http://en.wikipedia.org/wiki/FM_broadcasting#Stereo_FM

L0j1k• 13 years ago

I have been in love with her since the modem image. <3

joyeuse6701• 13 years ago

No doubt about it, that is awesome. I wish I had the time... correction I probably always have the time, but none of the patience to do something like this alone on the side. I'll definitely bookmark her blog.

cantankerous• 13 years ago

Super cool post. I'm glad there are people in the world working on these things, at least in a hobby capacity and sharing with the rest of us. I worry that doing something like this might get one in all kinds of stupid trouble with somebody in a hot minute (especially in the US). Can't say my fears are well-founded, if only so through the various hyped up horror stories you hear about hackers getting in legal trouble for unforeseen reasons.

Regardless, I wish her all the best!

jimktrains2• 13 years ago

http://www.phrack.org/issues.html?issue=64&id=5 is another hacker going at it as well, from 2007. It includes a little more information about the protocol, but doesn't touch on listening to encrypted versions.

simcop2387• 13 years ago

As simple of an operation as this is, I wonder how hard it would be to brute force this without knowing the location. If you assume that the location values must all be within some distance of each other, I suspect you could iterate though all 65k keys fairly quickly and find the tightest group of them and it would likely be the right one. This makes me want to get some kind of thing going to decode them and try it myself.

rdl5• 13 years ago

It was funny/sad that people commenting on her blog assumed she was male due to the topic.

kybernetyk2• 13 years ago

I assumed the same. Then when I scrolled up to see who the author was I was pleasantly surprised that it's a woman who writes about this. (You usually only get to read meta-social-stuff posts from women.)

The bigger surprise was that she was self taught. (The surprise would be just as big if the author was a man.)

ars3• 13 years ago

Or people did not know, and were indifferent to, her gender and used the male pronoun because that is the correct grammatical structure when the gender is unknown.

I certainly never pay the slightest bit of attention to the gender of people I read. Does it make any difference?

rdl5• 13 years ago

On someone's personal blog, if you're going to comment, and the person's name and photo is right there, it's about the same as addressing a female in person as "Sir" (or in this case, "dude")

derleth2• 13 years ago

> used the male pronoun because that is the correct grammatical structure when the gender is unknown.

According to the prestige dialect, yes. Not according to most of the more common dialects of English.

eXeP• 13 years ago

Well it's funny/sad if the commenters are not finnish, because 1919 windy@pentti~/koodi/redsea ) ./redsea.pl | grep TMC

Pentti is a finnish males' name not a womans' name, I was really confused when I found out in comments she is she not he.

windytan• 13 years ago

Pentti is my computer.

rdl5• 13 years ago

Making reasonable assumptions about that customized prompt:

Her host is named Pentti. Her username is windy. Her files are in ~/koodi/redsea (koodi = code).

(I usually have "ryan" as a username on unix hosts, so rather than putting my username in the prompt on every line, I just put a % if it's that, or a # for root, or ! for something nonstandard (like a role account, or one of the systems where I don't have my normal username.))

ck22• 13 years ago

Whew, she is in Finland.

In the USA, Carmen Ortiz would be sending in cops to shoot their dog and seize their computer.

veeti• 13 years ago

You're talking about the same Finland where the police force:

- writes its own search warrants

- raids gardening stores because their equipment "could be used" to grow illegal drugs

- tries to charge people with wiretapping for recording them during a home visit

- conducts body & home searches in the middle of the streets based on inaccurate drug dog detections

- falsely blocks informative sites about our internet blocklist for years without any accountability or response

- and raids 8-year olds for downloading a couple of songs

It's just as shit here as it is there.

ck22• 13 years ago

Wow. Has it always been that way or did it change in recent history?

I guess I am thinking of Norway with the 20-year maximum murder sentence.

MertsA• 13 years ago

Towards the bottom I had to look back at the top to make sure you said Finland and not America.

pizza• 13 years ago

Scary exceptions do make for scary generalizations...

A determined 'hacker' decrypts RDS-TMC

Related Stories