[–] mathgenius link

That's why the osmo-fl2k page has the following text:

"Before transmitting any signals with an FL2000 device, it is strongly suggested that you check the resulting spectrum with a spectrum analyzer, and apply proper filtering to suppress any but the desired transmit frequency.

Operating a transmitter with the unfiltered FL2000 DAC output attached to an antenna outside a RF shielding chamber is dangerous. Don't do it!"

reply

[–] apcragg link

A radio amature most likely can't construct a bandpass filter with a high enough Q to filter out all of the spurs while still getting a usable signal. Releasing a tool like this and handwaving away interfearence concerns with an abstract refrence to 'proper filtering' is still iresponsible.

reply

[–] quickthrower2 link

Dangerous? Are we talking RF burns here?

reply

[–] tomfanning link

As in potentially disruptive to critical-to-life public safety systems, e.g. air traffic control, emergency services communications, I suppose.

Square waves = theoretically infinite harmonics at positive multiples of the fundamental frequency (in practice reducing with order of the harmonic)

Then there's in-band spurs / spurious emissions, different from harmonics.

reply

[–] ddalex link

I think we're talking jail time here.

reply

[–] _wmd link

The project page covers all of this, and takes the time to recommend various filtering strategies. It's not like this stuff is much worse than a faulty washing machine or hair dryer doing the same, or that the very same equipment under control of its official driver couldn't spew junk in exactly the same way

reply

[–] Johnythree link

The device generates a comb of the original baseband, repeated all the way up to VHF.

There is no way that a simple passive filter will pick out the wanted signal, while blocking all the others.

It would take a sophisticated multi-stage active filter to even come close.

The "very same equipment under control of its official driver" won't have an amplifier and antenna connected to its output. If it did, it obviously would fail its EMC test approvals process.

reply

[–] _wmd link

> The "very same equipment under control of its official driver" won't have an amplifier and antenna connected to its output. If it did, it obviously would fail its EMC test approvals process.

Forgive me, but this seems quite a blanket statement to make of the tens-hundreds of millions of VGA cable and LCD/CRT designs and design combinations in deployment for the past 30+ years around the world, equipment combinations that never did (and never will) undergo system testing to verify there aren't, in fact, thousands+ of unintentional transmitters deployed already, by people who haven't a clue about their aberrant devices.

It's not like you can't buy dirt-cheap $5 unshielded ultra long VGA extender cables by the literal truckload off AliExpress and eBay, and that you don't find such cables strung vertically to 640x480 projectors hanging off the ceiling of just about every conference center, lecture hall, hotel business suite or similar meeting venue known to man.

Meanwhile this project is explicitly about creating a transmitter in an environment where it is understood by every user upfront the result could be noisy

reply

[–] woah link

If there’s a need for spectrum enforcement, then people should be out doing it. There’s definitely enough money made from government granted spectrum monopolies to pay for it!

The idea that you’re pushing here, that there should be varying degrees of a radio equipment prohibition is anti-knowledge and only serves to strengthen the spectrum monopoly businesses.

reply

[–] simcop2387 link

Spectrum enforcement does happen. It usually takes a while to identify because there's usually not a large noise source or illegal transmitter. Instead it's usually malfunctioning equipment that's doing stuff it shouldn't.

Usually how enforcement happens is that someone complains that this one spot never gets a signal, or their phone always cuts out. Then the big players start getting involved to determine the problem and either get the fcc involved if needed or otherwise inform the offender to get I fixed.

That's how stories like this happen, https://www.engadget.com/2016/05/25/florida-man-fined-48k-fc...

EDIT: to add there's a lot of unintentional interference sources, neon signs are a typical culprit as they age, http://www.signindustry.com/neon/articles/2004-02-16-RadioFr...

reply

[–] Something1234 link

How do I make a complaint about this? There's one spot on my college campus that's completely dead.

reply

[–] asclepi link

Don't contact the FCC directly. Contact your cellular operator. They can investigate to see if it is a problem on their end. They will also contact the FCC if necessary.

reply

[–] bitwize link

Any ham will tell you that if you transmit outside the frequency or power ranges for which you're licensed, you'll be getting a call from the FCC.

reply

[–] f2n link

They will say that, despite it having no bearing in reality. The only time the FCC cares is if you're fucking shit up for others.

reply

[–] justin66 link

> The only time the FCC cares is if you're fucking shit up for others.

A friend who broadcast on an FM frequency that's unused locally (broadcasting family-friendly Christmas music, I might add) got shut down by the FCC, who sent out people out in the evening to have a chat with him. They care, even when you're not fucking shit up for others. I have no idea what experience you might be basing your statement on, but traditionally the local HAM guys will take offense at any little thing that comes to their attention and the FCC will be happy to follow up on it. (I know at least one local HAM who has lightened up a bit about this stuff over the years but I don't think the feds have)

When it comes to oddball noise, they'll act pretty quickly if there's someone like a busybody HAM to spell out to them exactly where the interference is coming from. Of course, plenty of times it's a HAM who is causing the interference...

reply

[–] marshray link

Yeah completely unrealistic thinking FCC is going to call you.

They send out certified letters. Here are a few:

https://transition.fcc.gov/eb/AmateurActions/Welcome.html

reply

[–] themodelplumber link

That guy in Idaho running a repeater on 146.520, national simplex calling frequency for VHF. Lol. Real genius there, I'll bet it took less than a week before a complaint was filed.

reply

[–] undefined link
[deleted]

reply

[–] gsich link

still using imperial units in 2018

reply

[–] tzs link

I've read several and didn't see any initial units. Could you be more specific?

reply

[–] hobbified link

Still being a worthless obnoxious piece of shit in whenever this is.

reply

[–] Johnythree link

Until your crummy transmitter interferes with some emergency Service. eg Police, Aircraft, etc.

Then they will be on your doorstep within hours. Complete with a search warrant and fines of thousands of dollars, along with a permanent criminal record.

reply

[–] f2n link

...yes, as I said, as long as you aren't fucking shit up for others. I thought I was very clear about that.

reply

[–] burntwater link

And how will you be sure that you're not fucking shit up for others?

reply

[–] ThrowawayR2 link

> If there’s a need for spectrum enforcement, then people should be out doing it.

At least in the US, there are already people doing it and anyone who gets caught is subject to massive fines, e.g.:

https://www.computerworld.com/article/2474412/data-privacy/g...

https://www.engadget.com/2016/05/25/florida-man-fined-48k-fc...

reply

[–] darkmighty link

Those are intentional jamming devices, I hope unintentional sideband interference wouldn't be treated remotely as harshly? The kind of power to achieve this kind of jamming would be pretty large too -- I'd judge at least 50W (depending on the jamming bandwidth I guess). A few miliwatts from an SDR transmitter isn't going to do much disruption. Not to mention there are pretty significant interference sources from defective devices mentioned elsewhere -- cheap usb power supplies, defective lightning, and more.

That said, anyone should indeed be filtering their output unless transmitting more than extremely low amounts of power (perhaps someone with radio experience could give a hand of thumb? Up to hundreds of microwatts sounds quite safe) as a matter of civility. Besides, you get to learn basic electronics by building a simple passive filter!

reply

[–] Johnythree link

There are two problems:

A few milliwatts can easily block the sensitive input of a Police Repeater on the other side of town.

FWIW, your "Hundreds of Milliwatts" are routinely used by hams to communicate world wide.

And no, a simple bandpass filter WILL NOT clean up this rubbish. Its output spectrum is the base-band signal repeated over and over, all the way up to VHF. It would take a very capable filter to pick out the single product required. This is NOT the way to design a clean transmitter.

It will not only cause interference, but it will interfere with EVERYTHING within range.

Most output filtering is a simple Low-Pass Filter which is designed to remove harmonics. But by definition, harmonics are an octave removed from the fundamental. This horrid device puts out a closely packed comb of spurii from DC to daylight. A simple passive filter will not even come close to cleaning it up.

You first start with a sound design, then add filters to clean up the last of any unwanted emissions. Not the other way around.

And because these faults have been well documented, this equipment would most definitely be classed as an "intentional jamming device".

reply

[–] darkmighty link

Thanks for the reply! I'm quite interested in this.

> FWIW, your "Hundreds of Milliwatts" are routinely used by hams to communicate world wide.

Read again, I've written "hundreds of microwatts" :)

And that's for a reasonably wideband signal! A narrowband signal with high power has a lot more potential to interfere with a specific application. I seriously doubt anything of that order specially with a rough bandpass (passive) filter around the frequency of interest can cause significant interference. Passive filters have <1 gain, so they shouldn't risk narrowband amplification of the weak signal. The background noise should be within this order of magnitude, no?

(I don't quite have the time to give numbers right now, but here's a source from quick googling: https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=7833115 -- the ambient noise should be on the other of .1 uW / GHz; at a few hundred meters away this competes with our wideband microwatt-scale transmitter?) I'll see if I can do some actual calculations later

reply

[–] kalleboo link

Here's an example of unintentional interference http://www.arrl.org/news/view/amateur-radio-sleuthing-pins-d...

> "The troublesome transformer was not replaced, but the building owner agreed to turn off the sign should problems arise"

reply

[–] jsjohnst link

> I'd judge at least 50W

GPS is quite easy to jam with very low power. Something as low as 500mW could easily disrupt a fairly wide area. The reason being that GPS signals are generally already below background noise as measured from the ground.

reply

[–] Uberphallus link

Indeed. When I was experimenting with GPS spoofing, an output of 20dBm (100mW) was enough to make devices think they were in the middle of the ocean in a 200m radius (line of sight). With a quickly improvised yagi antenna I was able to push it to 500m, even after losing 3dB from switching from circular to linear polarization(!). IIRC, GPS satellites have 25W transmitters, that's insanely powerful, but they're 20000Km away, so it's rather easy to overpower their signal from close due to the inverse-square law.

Even with the first tests with 10mW in my room, iPhones at my house picked up GPS signal to know the time and timezone, which caused my flatmates to miss appointments and many websites stopped working due to certificates being expired by "2030".

reply

[–] jsjohnst link

> IIRC, GPS satellites have 25W transmitters, that's insanely powerful, but they're 20000Km away

Both numbers are correct, but 25W isn’t “insanely powerful”. The spec for GPS satellites lists the antenna gain at 13dBi. 25W fed through a 13 dBi antenna is just shy of 500W EIRP. Sitting near me is a 2W 2.4ghz amp and a 24 dBi parabolic antenna. That combo is just over 500W EIRP. The reason you stated (distance) is the big factor, over 12,500mi, the free space path loss is huge (182dB assuming flat gains). 500W is just shy of 27 dBW, so 27-182 is -155, which is a very very very weak signal.

reply

[–] jdietrich link

The old AM border blasters were legitimately "insanely powerful". John R. Brinkley's XERA was transmitting at 1 megawatt EIRP back in the 1930s. It covered almost the whole of the US and parts of Canada, even on a crystal set.

Today, the Solt transmitter in Hungary operates at 2 megawatts.

https://en.wikipedia.org/wiki/Border_blaster

https://en.wikipedia.org/wiki/John_R._Brinkley#Brinkley_and_...

https://en.wikipedia.org/wiki/Transmitter_Solt

reply

[–] Uberphallus link

Yeah, my wording wasn't the best. It's insanely powerful, (the transmitter leaving the antenna aside) in this sense:

Low earth orbit satellites are much closer to the Earth, so transmitters need less power to cover the range with high quality signal. For example, NOAA satellites are able to send images of the earth at 5W that you can reliably receive with a dipole and a $5 amplifier.

Geostationary satellites are significantly higher, ~35000 Km, but stationary (duh), so they benefit from high gain, very directional antennas both on the satellite and the ground. They send high data and symbol rate signals for HD video of hundreds of channels, and each transponder sits at 15 to 150W (depending on many factors: band, area to cover, etc). They tend to have multiple transponders, though.

GPS satellites sit in the middle, pretty high up, so there's a ton of free space loss, in a non geostationary orbit, so high gain antennas are useless, plus receivers are supposed to be portable, hence there's no room for helix/axial antennas or arrays on the ground. So for this reason they have to ramp up the power to geostationary, TV broadcast levels, only to push a very, very slow data rate (50 bits/s).

reply

[–] asclepi link

https://transition.fcc.gov/Daily_Releases/Daily_Business/201...

This is a recent investigation that I found particularly intriguing. It involves a device used to monitor electric utilities that ended up interfering VZW's signal in Silicon Valley.

reply

[–] TaylorAlexander link

Here here!

reply

[–] apcragg link

That's a neat party trick and all but abusing spurious emissions/harmonics to broadcast in licensed spectrum without proper filtering is just plain irresponsible. At low power, with an unmatched antenna those signals /probably/ won't make it out of your house but it's not good practice to spew harmonics all over the spectrum, especially GSM bands. I also can't believe that they are working on increasing the TX power. Purposefully emitting all over the spectrum is both iresponsible and illegal.

reply

[–] OliverJones link

Heh heh. Back in the day when VRAMs cost a fortune I hacked low-level display software for a new frame buffer product in development.

The unshielded hardware lab prototypes emitted noise that stepped on the signal of the hardware team's favorite FM rock station. So they tweaked the clocks to be a little slower.

Then they forgot they did that.

Then benchmark time came around. And the new product wasn't up to spec. And tweaking it back up made it unreliable.

Ferrite cores and shielding boxes are your friends, and your investors' friends.

reply

[–] cushychicken link

Are you implying that you'd use this technology to steal lyrics from a church?

reply

[–] peterburkimsher link

"steal" implies ownership. Their translations aren't officially licensed. They refuse to share it because they don't want to be sued for making illegal translations. But that also means I can't sing along with them, because I can't read the Chinese characters on the screen (I need to copy-paste it to my app to translate it to pinyin). When humans aren't cooperative, I try to find ways to work with the machines to achieve the goal.

reply

[–] peterburkimsher link

Interesting! Researchers have successfully listened in to VGA signals using professional equipment [1]. Could the same be done with rtl-sdr receivers?

One application I can imagine is to build an osmo-fl2k transmitter that looks like a USB memory stick, ask someone to plug it into the projector computer at church, and then record the video stream with the lyrics. Most projectionists have been helpful and willing to share their PPT files so I can study Chinese, but some are refusing to share them because of copyright issues. The translated songs were not officially licensed, so they're refusing to distribute their data. It is usually possible to ask someone to plug in a USB device (e.g. "to charge"), so if that's a possible entry vector then it would interesting to develop the transmitter further.

[1] http://www.cl.cam.ac.uk/~mgk25/iss2006-tempest.pdf

reply

[–] asclepi link

> Nice, but where can I actually buy those things? A quick web search doesn't get me anywhere.

Plenty to be found on Amazon or eBay. See the coverage on the RTL-SDR.com blog[0] for a few links.

> EDIT: it looks like it's just the chipset and it's not sold directly - instead, one should look for devices based on it.

Yes, that's correct. You need a USB 3.0 to VGA adapter that is based on the Fresco Logic FL2000 chipset.

[0] https://www.rtl-sdr.com/osmo-fl2k-a-tx-only-sdr-hacked-from-...

reply

[–] Zardoz84 link

I just bought one on Amazon. Sadly, don't works out of the box on Linux, as the driver only works with a old version of the kernel.

PD: I bought as a cheap way to plug a old VGA monitor as a secondary screen, plus allow using it as a SDR transmitter is a nice extra.

reply

[–] d33 link

Nice, but where can I actually buy those things? A quick web search doesn't get me anywhere.

EDIT: it looks like it's just the chipset and it's not sold directly - instead, one should look for devices based on it. I wonder if they have any competition, or whether I can just safely assume that any USB3.0 to VGA dongle will work.

EDIT2: Also found this:

> If they are advertised with 2048 × 1152 maximum resolution and support for Mac OS X, or only have a USB 2.0 interface, they contain a DisplayLink chipset and are not compatible with osmo-fl2k! The price range for the FL2000-based adapters is $5-15, whereas the DisplayLink devices typically cost more than $25. Also note that devices sold with USB type C connector contain a different chipset (e.g. Realtek RTD2166) and are just DisplayPort to VGA converters.

reply

[–] adrianN link

Here are some plans to build your own LOS optical network: http://ronja.twibright.com/

Apparently you can get 10Mbps over a distance of a kilometer or so.

reply

[–] pjc50 link

Optical free space or optical fiber? In both cases, it's not the ADC that's the issue and you'd generally use an on-off modulation anyway.

reply

[–] DoctorOetker link

How about a cheap optical links? If there is a similar blank- and porchless VGA to USB3.0 ADC.

Let's consider the figure of 140MS/s x 3 (RGB) x 5 bits per sample (instead of 8 due to noise). then it would constitute about 2.1 Gb/s...

reply

[–] themodelplumber link

Thank you. So it's not like this by itself is going to enable some miraculous transceiver setup.

reply

[–] rasz link

no, its "range" is 0 to ~150MHz, the rest is just tricks with harmonics.

reply

[–] alexforster link

Not mentioned in the article: its range is apparently from UHF to 1.7GHz+

reply

[–] k0ngo link

The article doesn't mention it, but I think Fabrice Bellards PoC [1], in which he generated a valid DVB-T and PAL/SECAM carriers using a graphics card (2005), is very elegant and highly related prior art.

[1] https://bellard.org/dvbt/

reply

[–] RpFLCL link

This is a cool technique and super interesting. My little rtl-sdr dongle just became more powerful.

At the same time, I hope this doesn't result in abuse of the spectrum followed by tightened regulations on the cheap dongles.

Please be responsible

reply

[–] jsjohnst link

Why do you need Tx for an IMSI catcher? Also, a USB TV tuner won’t work for the receiving side either. You’ll need to step up into an actual proper SDR for that. Still easily sub $500, but sub $100 is a bit too far a stretch.

reply

[–] bigiain link

A $12 RTL-SDR USB stick will 100% work for most GSM rx (won't hit the 1900+MHz bands without a downconverter, but that's why you want tx - you'll use it to force the phone onto the 800-900MHz bands anyway, the top half of the 915MHz ISM band in the US if you have a HAM licence and are trying to not break _too_ many laws at once).

This DefCon talk: https://www.youtube.com/watch?v=fQSu9cBaojc

Gives a good overview of why you need tx to capture an IMSI - without forcing a handset into transmitting non-encrypted, you only get the TMSI (unless you can crack the crypto - and why bother, when a base station can instruct a handset to just not encrypt anything?)

reply

[–] gsich link

Easier if your target phone connects to you.

reply

[–] hwh link

You still need reliable clock sync / latency. Otherwise you can just announce, not communicate bi-directionally.

reply

[–] skykooler link

As I understand it, these VGA adapters need the bandwidth of USB 3 to function. Raspberry Pi only has USB 2 ports.

reply

[–] bigiain link

So one of these for tx and a usb tv tuner for rx, a Raspberry Pi running OpenBTS, and you've got yourself a sub $100 IMSI catcher...

reply

[–] Rjevski link

Wouldn’t you be able to use an RTL-SDR for the receive part, and thus, have a full-duplex SDR?

reply

[–] angry_octet link

Theoretically yes, but a HackRF One is US$300 and you will save an enormous amount of time. https://greatscottgadgets.com/hackrf/

reply

[–] Rjevski link

HackRF actually can’t be used with GSM as it’s half-duplex only and GSM requires full-duplex.

reply

[–] angry_octet link

It's neat, but practically speaking having a transmit only device isn't useful for GSM. Having to use filtering on the output is also a major pain.

It is perhaps more interesting for use as a data exfiltration technique. Simple devices, usually used without analysis, can punch out a signal which is easily decoded, with a simple (and seemingly accidental) antenna.

reply

[–] rasz link

reverse "VGA ADC" in what exactly?

reply

[–] DoctorOetker link

well you can buy video ADCs from parts suppliers (digikey etc, some parts are pretty cheap, but again, it was seldom clear if they could be used continuously or would refuse to work without proper VSYNC etc) or source them from older digital monitors/dvd players/VGA2HDMI etc (roughly anything that has a VGA in)

reply

[–] rasz link

fast ADC is not the problem per se, you can buy $10 ARM parts with 80MHz 12 bit ADC (LPC4370), pumping that data into computer fast enough is.

reply

[–] DoctorOetker link

such a scope would not be a raw part, but include an FPGA: summarize the triggered traces that happened since the last transfer to PC... alternatively speaking, consider the amount of information on the screen of an oscilloscope, thats a low color count, with relatively large areas of the screen unaffected, so 60fps of very compressible image data..

reply

[–] DoctorOetker link

I have often considered trying to reverse: using high resolution VGA ADC's to digitize for a cheap scope, but the effort involved seemed to high

reply

[–] quasarj link

Well, that's pretty cool!

reply