Paging all radio curious hackers!

Paging all radio curious hackers!

Speakers: Paul Tagliamonte (Hacker)

Conference: DistrictCon

YouTube: https://www.youtube.com/watch?v=2EgNs88Ombo

Overview

In "Paging all radio curious hackers," Paul Tagliamonte delivers an engaging and highly accessible talk demonstrating how to reverse engineer a common, off-the-shelf restaurant pager using readily available software-defined radio (SDR) tools. Tagliamonte, a software engineer with no professional RF background, aims to demystify the often-intimidating world of radio frequency communication, showing how a curious hacker can uncover and exploit proprietary protocols. The talk meticulously walks through the process of capturing, analyzing, and ultimately replaying RF signals, culminating in a live demonstration of controlling a pager.

This presentation is particularly significant because it empowers individuals without deep electrical engineering or RF expertise to explore the unseen signals that permeate our environment. By breaking down complex RF concepts into understandable steps, Tagliamonte highlights the pervasive insecurity of many everyday devices that rely on simple, unauthenticated radio communication. For security professionals and enthusiasts, the talk serves as a practical blueprint for beginning RF reverse engineering, revealing how simple curiosity, combined with open-source tools, can expose fundamental vulnerabilities in widely deployed systems.

Background

▶ Watch: Introduction: Demystifying RF for Software Engineers (0:00)

The genesis of this exploration stemmed from a simple, everyday observation: Paul Tagliamonte, while waiting for a breakfast sandwich, found himself holding a TD 158 restaurant pager and wondered how it worked and whether its communication was secure. This common scenario—a proprietary device communicating wirelessly—often presents a black box to the average user, deterring investigation due to perceived complexity. Tagliamonte's goal was to make this area more accessible, especially given the established tools and methodologies available for Wi-Fi and Bluetooth, which are often absent for more opaque RF protocols.

The initial steps involved acquiring the pagers and their base station, then consulting the user manual. This revealed fundamental operational details: pagers are tied to a base station, each having a unique three-digit ID (up to 999), implying a 10-bit storage requirement. The manual also outlined basic commands: calling a pager (causing it to ring), sending a "turn off" command (pager ID 0), and various function calls to adjust settings like beep duration or vibration intensity. Tagliamonte intentionally set his base station ID to 55 (binary 110111) to easily distinguish its bit pattern later, avoiding common default values like 1, 2, or 3.

A crucial breakthrough came from inspecting the back of the pager, which, for regulatory compliance, featured an FCC identifier. This ID is a public record, allowing access to official filings that often contain invaluable technical specifications. Leveraging the website fcc.report, Tagliamonte located relevant documents, including diagrams and charts detailing the pager's operation. These filings confirmed the operating frequency as 433.92 MHz, precisely the center of the 400 MHz ISM (Industrial, Scientific, and Medical) band, a common frequency for low-power, short-range devices. The diagrams further hinted at a serial data-like signal, suggesting a relatively straightforward modulation scheme. This initial information provided a solid foundation, transforming the proprietary black box into a tractable reverse engineering challenge.

Key Findings

▶ Watch: Leveraging FCC Filings for Initial Device Information (4:00)

The core discovery was the precise characterization of the TD 158 pager's radio protocol, revealing a simple yet effective On-Off Keying (OOK) modulation scheme. This means data is transmitted by turning the radio carrier wave on and off for varying durations, akin to Morse code. The key findings include:

• Modulation Scheme: The pagers utilize On-Off Keying (OOK), where the presence or absence of a carrier wave (or different durations of its presence) encodes bits.
• Symbol Timing: Each fundamental unit of data, or symbol, has a consistent duration of 858.462 microseconds. Within this symbol, bits are represented by varying the "on" time of the signal:
• A short burst (representing a 0) lasts approximately 214.5 microseconds (one-quarter of the symbol duration).
• A long burst (representing a 1) lasts approximately 643.5 microseconds (three-quarters of the symbol duration).
• The remainder of the symbol duration is "dead air" (carrier off).
• Message Structure: Each transmission sequence begins with a preamble, a series of short bursts (zeros) designed to wake up the receiving pager. This is followed by multiple repetitions of the data packet, spaced by six symbols of padding (approximately 5.15 milliseconds). This repetition serves as a basic form of resiliency, as the protocol lacks more advanced error correction.
• Data Packet Format: The main data packet is 26 bits long and consistently structured:
• Base Station ID (10 bits): The first 10 bits encode the unique identifier of the transmitting base station (e.g., 55). This makes sense given the manual's mention of a three-digit ID (0-999).
• Argument / Pager ID (10 bits): The next 10 bits typically represent the target pager's ID or a numerical argument for a function. This also aligns with the three-digit pager ID range.
• Command (6 bits): The final 6 bits encode the specific action to be performed, such as "call," "turn off," or other function settings. These commands were determined through empirical observation by triggering different actions and analyzing the resulting bit patterns.
• Protocol Commonality: A significant finding was the widespread use of this simple OOK protocol. Tagliamonte noted that not only did two different sets of restaurant pagers use the exact same encoding, but even his personal Christmas tree lights, controllable via RF, employed the identical protocol, highlighting the potential for broad application of this reverse engineering technique.

These findings collectively demystify the proprietary protocol, transforming an unknown RF signal into a fully understood and reproducible digital message format.

Technical Deep Dive

▶ Watch: First Breakthrough: Deciphering Base Station ID (10:00)

The process of reverse engineering the pager protocol involved a systematic approach of signal capture, visualization, analysis, and generation, primarily utilizing Software Defined Radio (SDR) and open-source tools.

The journey began with an SDR, a versatile device capable of tuning into specific radio frequencies and digitizing the received signals. Tagliamonte used a HackRF (and mentioned Ettus USRPs for higher-end work, and Pluto SDR as another high-value option), setting it to capture raw RF data. When a pager was activated, the SDR recorded IQ samples to disk. IQ samples are pairs of values (representing in-phase and quadrature components) that describe the amplitude and phase of the radio signal over time. While the speaker intentionally kept the detailed physics of IQ samples brief, he explained them conceptually as time-series readings of power, similar to reading an analog pin on a microcontroller at high speed.

To interpret these raw IQ samples, the open-source tool Inspectrum was employed. Inspectrum acts like an "Audacity for RF," allowing visual inspection of the captured spectrum. By loading the IQ capture file and setting the correct sample rate (e.g., 2 mega samples per second), Tagliamonte could visualize the radio bursts. The spectrogram clearly revealed distinct patterns:

• A preamble: An initial series of short, repetitive bursts, serving as a wake-up signal for the pagers.
• Data packets: Following the preamble, distinct blocks of varying burst lengths, indicating encoded information.

Crucially, Inspectrum allowed for precise timing measurements. By zooming into the data packets, Tagliamonte measured the duration of each "symbol" (the smallest unit of data transmission) to be 858.462 microseconds. Further granular measurement revealed two distinct burst lengths within each symbol:

• Short bursts: Approximately 214.5 microseconds (one-quarter of the symbol).
• Long bursts: Approximately 643.5 microseconds (three-quarters of the symbol).

The remaining duration of the symbol was silent (carrier off). This observation strongly suggested an On-Off Keying (OOK) scheme where one duration represents a 0 and the other a 1.

Initial demodulation by eye was performed by assigning 0 to short bursts and 1 to long bursts. Applying this assumption to the first observed data packet, the first 10 bits decoded to 55, which matched the base station ID Tagliamonte had manually configured. This immediate correlation provided strong validation for the 0/1 assignment.

To fully map out the protocol, an iterative process of data capture and analysis was undertaken. Tagliamonte repeatedly triggered different actions from the base station (e.g., "call pager 1," "call pager 2," "turn off," "function 1," "function 2") while continuously recording the RF output. By comparing the resulting bit patterns, he systematically identified the message structure:

• The first 10 bits consistently represented the Base Station ID.
• The next 10 bits varied according to the pager number or argument entered, confirming their role as the Pager ID / Argument.
• The final 6 bits remained constant for specific commands (e.g., all "call" commands had the same 6-bit sequence, regardless of pager ID), identifying them as the Command bits.

With the protocol fully understood, the next challenge was signal generation. This involved writing Python code to construct the exact sequence of IQ samples required to transmit a desired message. The target sample rate for transmission was 2 mega samples per second (Msps). To translate the measured timings into sample counts:

• One-quarter of a symbol (214.5 µs) at 2 Msps translates to approximately (214.5 10^-6) (2 * 10^6) = 429 IQ samples.
• A basic carrier_wave was represented by sending [127, 0] IQ pairs (max amplitude for an 8-bit signed integer).
• dead_air was represented by [0, 0] IQ pairs.

Python helper functions were then crafted:

• zero_symbol: Generates 429 carrier_wave samples followed by 429 * 3 dead_air samples.
• one_symbol: Generates 429 * 3 carrier_wave samples followed by 429 dead_air samples.
• bits_to_iq(number, length): Takes a number and its bit length, then iterates from the most significant bit (MSB) to the least significant bit (LSB). For each set bit, it appends one_symbol samples; for each unset bit, it appends zero_symbol samples.
• encode_message(base_id, argument, command): Concatenates the IQ sample lists generated by bits_to_iq for the 10-bit base ID, 10-bit argument, and 6-bit command.
• call(base_id, pager_id): The high-level function that orchestrates the entire transmission. It first generates a preamble (26 bits of zeros), then the encoded message. To ensure reliable reception, it mimics the observed behavior of the base station by repeating the data packet five times, separated by six symbols of dead_air padding.

Finally, the generated IQ samples were piped to stdout, which could then be directed to an SDR for over-the-air transmission or saved to a file for verification in Inspectrum. Re-examining the generated signal in Inspectrum confirmed that the timings and bit patterns perfectly matched the original captured signals, validating the reverse engineering effort and the Python implementation.

Demo / Proof of Concept

▶ Watch: Discovering the Full 26-Bit Message Protocol (12:00)

The culmination of the reverse engineering effort was a compelling live demonstration that proved the efficacy of the derived protocol and the generated signals. Paul Tagliamonte showcased a practical setup consisting of:

• A Python script containing the logic for encoding messages and generating IQ samples, as developed during the technical deep dive.
• A HackRF software-defined radio, connected to his laptop, serving as the transmitter.
• A physical restaurant pager, specifically pager number six, placed on the podium.

With the audience watching, Tagliamonte executed his Python script, instructing the HackRF to transmit the generated IQ samples corresponding to a "call pager six" command. The result was immediate and undeniable: the pager on the podium sprang to life, ringing and vibrating as if it had received a legitimate signal from its original base station. This successful activation provided a clear and impactful proof of concept, demonstrating that the proprietary protocol had been fully understood and could be reliably replicated.

Beyond the restaurant pager, Tagliamonte also highlighted the broader applicability of his findings. He mentioned that he had successfully applied the same reverse engineering techniques and the derived OOK protocol to control his own Christmas tree lights. He even allowed friends to remotely control his Christmas tree's on/off and dimming functions over the internet, using a similar SDR setup. This illustrates that the simple OOK protocol is not unique to restaurant pagers but is a common, often insecure, communication method found in various low-cost, short-range consumer devices. The demo effectively transformed abstract technical analysis into tangible, real-world control, underscoring the power of accessible RF hacking.

Defensive Implications

▶ Watch: Q&A: Recommending SDR Hardware for Beginners (20:00)

The detailed reverse engineering of the TD 158 restaurant pager protocol, while presented as an exercise in curiosity and accessibility, carries significant defensive implications for individuals and organizations relying on similar RF-enabled devices. The primary takeaway is the inherent insecurity of simple, unauthenticated, and unencrypted RF protocols prevalent in many everyday devices.

Firstly, the protocol's reliance on On-Off Keying (OOK) and fixed, clear-text message structures means that anyone with an SDR can easily capture, analyze, and replicate these signals. There is no authentication mechanism to verify the sender's identity, nor any encryption to protect the message content. This makes these systems highly vulnerable to:

• Spoofing: An attacker can easily impersonate a legitimate base station, sending arbitrary commands to pagers. In a restaurant context, this could mean repeatedly calling pagers, turning them off, or triggering non-existent functions, causing confusion and disruption.
• Denial of Service (DoS): By continuously broadcasting "turn off" commands or jamming the frequency with noise, an attacker could render the paging system inoperable. This could disrupt restaurant operations, potentially leading to lost revenue or customer dissatisfaction.
• Unauthorized Activation: As demonstrated, activating pagers from an arbitrary SDR is trivial. This could be a nuisance or, in more sensitive environments (e.g., specific industrial paging systems), could trigger unwanted alerts or actions.

The speaker's anecdote about the policy roundtables using restaurant pagers at the conference itself underscores the potential for mischief or disruption when such insecure systems are deployed in public or semi-public venues. While Tagliamonte explicitly stated he couldn't endorse malicious use, the ease of exploitation is clear.

For defenders, the implications are straightforward:

• Awareness: Understand that any device communicating wirelessly without explicit mention of strong security features (like encryption, digital signatures, or secure pairing) is likely vulnerable to basic RF reverse engineering and spoofing.
• Risk Assessment: Evaluate the criticality of systems relying on such protocols. For non-critical applications (like basic restaurant pagers), the risk might be acceptable. For applications where disruption, impersonation, or unauthorized access has higher consequences, these protocols are wholly inadequate.
• Secure Alternatives: For critical applications, prioritize devices that employ robust security measures. This includes:
• Encryption: To protect the confidentiality of messages.
• Authentication: To verify the sender's identity and prevent spoofing.
• Frequency Hopping Spread Spectrum (FHSS) or Direct Sequence Spread Spectrum (DSSS): While not a security measure in itself, these can make jamming or targeted interference more difficult than a fixed-frequency OOK signal.
• Secure Pairing Mechanisms: To establish trusted relationships between devices.
• Physical Security: For devices using these simple protocols, consider physical security measures to prevent unauthorized access to the base station or pagers themselves, as a compromise of one can lead to compromise of the system.

In essence, the talk serves as a stark reminder that "security by obscurity" for RF protocols is a myth. Given the accessibility of SDRs and analysis tools, any unencrypted and unauthenticated wireless signal can be easily probed and potentially exploited, necessitating a shift towards more robust security architectures for any application where integrity and confidentiality are paramount.

Key Takeaways

• RF Reverse Engineering is Accessible: Even without a formal RF engineering background, individuals with software skills and curiosity can effectively reverse engineer proprietary radio protocols using readily available SDRs and open-source tools like Inspectrum.
• FCC Filings are Goldmines: Regulatory compliance documents (found via FCC IDs on devices and websites like fcc.report) often contain crucial initial information, including operating frequencies and signal diagrams, significantly bootstrapping the reverse engineering process.
• Simple OOK is Pervasive and Insecure: Many common, low-cost wireless devices (e.g., restaurant pagers, remote controls, smart home gadgets) rely on basic, unauthenticated On-Off Keying (OOK) protocols that are easily captured, analyzed, and replayed, posing significant security risks.
• Iterative Analysis is Key: The process involves capturing diverse signal types (e.g., different commands), visually analyzing their patterns and timings, and incrementally building a map of the protocol's structure (preamble, IDs, commands).
• SDRs Enable Both Capture and Generation: Software-defined radios are powerful tools for both passively listening to the airwaves (capturing IQ samples) and actively transmitting custom signals, allowing for full control and exploitation of discovered protocols.
• Security by Obscurity Fails: The ease with which these proprietary protocols were reverse engineered demonstrates that obscurity is not a security measure. Devices relying on unencrypted and unauthenticated wireless communication are inherently vulnerable to spoofing and denial-of-service attacks.

About the Speaker(s)

Paul Tagliamonte is a software engineer with a strong background and active involvement in the free and open-source software (FOSS) community. Throughout his career, he has held various software engineering roles, none of which were directly related to radio frequency (RF) technology. Tagliamonte openly emphasizes his lack of formal RF qualifications, positioning himself as a "software engineer with a little bit of curiosity on the security end" and "as little radio knowledge as possible." This perspective is central to his talk's goal: to make RF exploration feel more accessible and less intimidating for other "radio curious hackers" who may not have specialized RF expertise. His passion lies in demystifying complex technical subjects and encouraging others to explore areas often perceived as closed or proprietary.