Decentralized Communications: Deep-Dive into APRS and Ham Radio Security

Decentralized Communications: Deep-Dive into APRS and Ham Radio Security

Speakers: Ankur Tyagi, Mayuresh Dani

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=4S4EYnzrak4

Reading time: ~8 minutes

TL;DR

APRS (Automatic Packet Reporting System) and Meshtastic represent two fundamentally different approaches to decentralized, infrastructure-independent communication — one optimized for range and open situational awareness, the other for privacy and modern mesh networking. Ankur Tyagi and Mayuresh Dani delivered a technically grounded exploration of both protocols, their security models, and practical guidance for the security community on when and how to use them.

Introduction

Most people think about communications infrastructure only when it fails. A natural disaster, a power grid attack, or a remote wilderness expedition can strip away cellular and internet connectivity in minutes, leaving users with no reliable way to reach help or maintain situational awareness. It was exactly this scenario — a "fire sale" style collapse of communications infrastructure, as illustrated by the 2007 film Die Hard 4.0 — that Tyagi and Dani used to open their BSidesSF 2025 talk on decentralized communications.

Their interest wasn't purely theoretical. Tyagi described purchasing a Ducati motorcycle and immediately looking for a covert, hard-to-detect GPS tracker that wouldn't be as obvious as an Apple AirTag. That search led him to Meshtastic, and from there to a deeper investigation of both Meshtastic and the older, amateur-radio-based APRS system. The result is a comparative security analysis of two protocols that, while rarely discussed in mainstream security circles, underpin emergency response networks, community infrastructure, and — increasingly — privacy-conscious off-grid communication.

APRS: The Original Packet Radio Network

▶ Watch: APRS architecture and security model (08:00)

APRS — Automatic Packet Reporting System — was introduced in 1982 by Bob Bruninga to map high-frequency Navy position reports. It operates as a data mode for licensed amateur (ham) radio operators, transmitting digital packets over radio frequencies that carry position reports, weather data, telemetry, status updates, and short text messages. In North America, the primary APRS frequency is 144.390 MHz.

The protocol uses the AX.25 packet format over FM voice channels, encoding digital data in a way that is fully human-readable in cleartext. Digipeaters (digital repeaters) extend range by forwarding packets across their RF coverage area; IGates (Internet Gateways) bridge the RF network with the public internet, allowing APRS traffic to be aggregated and visualized on mapping sites like aprs.fi.

The security model of APRS is, by design, completely open. FCC Part 97 regulations explicitly prohibit encryption on amateur radio frequencies — everything must be transmitted in cleartext, and anyone with suitable equipment can listen in. Authentication is limited to an operator's FCC-assigned call sign. A numeric password is derived from the call sign via a simple hashing algorithm, but — as Tyagi demonstrated — this calculation is publicly documented, trivially reproducible in a bash script, and can be computed for any known call sign (all FCC registrations are public records). There is, effectively, no technical barrier to impersonating another amateur radio operator on the APRS network.

The resulting risk profile is stark: spoofing carries high risk (anyone can transmit as anyone else), eavesdropping is an intentional design feature, jamming is a moderate risk from any high-power transmitter in range, and man-in-the-middle attacks are possible at IGate and internet gateway points.

Meshtastic: Modern Mesh Networking with Encryption

▶ Watch: Meshtastic protocol architecture and encryption (22:01)

Meshtastic, which emerged in 2019 and has seen explosive community adoption since, represents the other end of the spectrum. It is open-source firmware running on ESP32 microcontrollers (and recently nRF52 and RP2040 platforms), operating on license-free ISM bands using LoRa (Long Range) modulation — specifically, chirp spread spectrum — which provides significantly better noise resistance than FSK and similar techniques.

The architecture is a fully distributed mesh: every node can relay packets for every other node. Messages propagate a default of three hops, meaning each packet is forwarded up to three times before being dropped. This hop limit prevents network congestion while providing meaningful range extension. Nodes with internet connectivity can bridge the mesh to the broader internet via MQTT, creating a hybrid topology similar to APRS's IGate system.

Crucially, Meshtastic supports AES-256 encryption for message payloads. The protocol maintains two key types: a shared channel key (hardcoded in firmware for the global default channel, making world-chat accessible to all Meshtastic users out of the box) and user-generated private channel keys for group or one-to-one communications. Packet headers are always transmitted in cleartext, but payloads can be fully encrypted. The packet format is identifiable by its protobuf-based "M$" magic header.

The security risk profile contrasts sharply with APRS: spoofing is significantly harder (impersonating a node requires possessing its private key), eavesdropping risk is low when encryption is enabled, and replay attacks — which were a vulnerability in older firmware — have been patched in the 2.5 firmware release. As of the presentation, six CVEs had been published for Meshtastic firmware, including CVE-2025-2497, a remote code execution vulnerability. Users were strongly advised to upgrade to version 2.5 or later.

Security Comparison: APRS vs. Meshtastic Side by Side

▶ Watch: Side-by-side security model comparison (32:02)

| Property | APRS | Meshtastic |

|---|---|---|

| Frequency band | Amateur radio (licensed) | ISM bands (license-free) |

| Range | Wide (line-of-sight + digipeaters) | Shorter without mesh extension |

| Encryption | Prohibited by FCC Part 97 | AES-256 (optional but recommended) |

| Authentication | Call sign + trivially computable password | Device key pairs |

| Spoofing risk | High | Low (requires private key) |

| Eavesdropping | By design | Low if encryption enabled |

| Replay attacks | Moderate | Patched in 2.5 firmware |

| Licensing requirement | FCC Technician or higher | None |

The presenters were careful to frame this not as "one is better" but as a use-case-driven choice. APRS excels for wide-area situational awareness, weather monitoring, and scenarios where open information sharing is desirable — weather reports don't need to be encrypted. Meshtastic is the clear choice when privacy, encryption, and accessibility (no license required) are priorities.

Practical Guidance and Recommendations

▶ Watch: Recommendations for users and implementers (34:02)

For APRS users, the speakers emphasized understanding the protocol's inherently open nature and treating all APRS transmissions as public information. IGate and TNC implementations should be kept patched, as these internet-bridging components introduce attack surface beyond the RF layer. Organizations using APRS for emergency coordination should have procedures that account for the inability to authenticate or encrypt traffic.

For Meshtastic users, the key recommendations were:

• Enable encryption by default. Meshtastic makes encryption optional, but there is no meaningful reason to leave it off — battery impact in testing was negligible.
• Manage key distribution out-of-band and securely. The protocol has no built-in key exchange mechanism. Creating a private channel requires sharing the key through another channel — and WhatsApp or other unverified consumer messaging is not an appropriate medium for this.
• Rotate channel keys periodically and secure physical devices against tampering.
• Update firmware. With a known RCE (CVE-2025-2497) in older versions, staying current is not optional.
• Understand the global default channel. The AQ== key (base64-encoded default channel key) is hardcoded into all Meshtastic firmware. Any "private" communication on this channel is readable by every Meshtastic device in range.

For security researchers interested in getting hands-on: Tyagi demonstrated live APRS with a Baofeng radio connected to a TNC (Terminal Node Controller) adapter and showed Python code for connecting to the APRS-IS internet gateway via a simple socket program — a minimal barrier to entry for experimentation. Meshtastic hardware starts at accessible price points, with some devices under $50.

Notable Quotes

"APRS is not just a vehicle tracking system. It's a tactical real-time information exchange mechanism — and in a grid-down scenario, this is your means of reaching out and connecting to the world."

— citing Bob Bruninga, APRS inventor ▶ 12:00

"APRS and Meshtastic are not voice-enabled — all you can send is text data. But the use cases are pretty wide. It's a very generic mechanism to share text-based data."

— ▶ 18:01

"If you would like secure, encrypted, and private by default communications, Meshtastic is the choice. If you would just like to broadcast — for example, weather reports that don't always need to be encrypted — you can choose APRS."

— ▶ 38:03

Key Takeaways

• APRS is open by law, not just by design. FCC Part 97 prohibits encryption on amateur radio frequencies. Anyone with a radio can receive APRS traffic, and call sign authentication is trivially bypassable — treat all APRS traffic as public.
• Meshtastic's encryption is a meaningful differentiator but must be explicitly enabled and properly keyed. The global default channel key is universal; only user-generated private channels provide true confidentiality.
• Key exchange is the hardest unsolved problem in Meshtastic deployments. The protocol provides no in-band mechanism for key exchange. Out-of-band key sharing must use a secure, trusted channel.
• Both protocols fill real gaps in communication infrastructure resilience. For emergency preparedness, understanding both — and knowing when to use each — is increasingly relevant for security professionals.
• Firmware hygiene matters. CVE-2025-2497 (RCE) in older Meshtastic firmware is a concrete reminder that embedded radio devices carry software vulnerabilities just like any other connected system.