Red Team SIGINT

Course overview

Have you ever had to deal with attacking an RF signal and tutorials on the Flipper Zero didn't get you anywhere?
Have you ever wanted to listen in to a security team's radio communications during a physical red team engagement?
Did you ever think covertly breaking into corporate vehicle fleets or garages should be in-scope, but didn't know how to approach this?
‍
Then this is the course for you.

In an increasingly wireless world we are surrounded by readily exploitable signals everywhere. Yet too often Red Team operations and pentests leave the RF spectrum unaddressed due to a lack of specialist knowledge and experience, especially when it comes to sensitive RF protocols not typically encountered in conventional enterprise and IoT contexts.

This practically-oriented course, taught by the Midnight Blue team known for their TETRA research, aims to equip security practitioners with field-relevant RF security knowledge and experience. While it thoroughly covers the fundamentals of RF, SDR, and SIGINT, it avoids math-heavy RF engineering with limited relevance to day-to-day operational reality.
‍
Instead, this course will provide attendees with a structured, step-by-step approach to the Signals Intelligence (SIGINT) cycle of targeting, identifying, collecting, processing, and analyzing Signals of Interest (SOIs). This includes the often cumbersome task of getting various special-purpose SDR tools to work on current systems.
‍
Attendees will learn how to exploit such signals with commonly available tooling through awareness of common risks and pitfalls in RF security. Where other SDR trainings tend to focus on enterprise and IoT RF protocols such as 4G/5G, WiFi, RFID, and BT, this training focuses on important but rarely addressed RF technologies such as automotive, aviation, marine, physical access control RF protocols and mission-critical radio (e.g. TETRA, DMR, P25) used by police, military, private security, and critical infrastructure.
‍
Hands-on exercises such as intercepting and decrypting handheld radio comms and breaking automotive security systems are alternated with thorough overviews of relevant RF protocols and their security posture as well as case studies of real-world RF attacks on railways, water utilities, drones, and police/military radios.

Day 1 - Block 1

Basics of SDR and SIGINT

• Introduction to Radio Frequency (RF), Software Defined Radio (SDR), Digital Signals Processors (DSPs)
• SDR theory of operation
• Overview of SDR hardware & software
• Antenna selection, tuning, positioning, physical proximity & vantage points
• Building and working with SDR software stacks: SDRangel, Gqrx, GNU Radio, Universal Radio Hacker (URH), DragonOS, Flipper Zero
• Signals Intelligence (SIGINT) cycle: Signal of Interest (SOI) targeting, identification, collection, processing and analysis on a budget

Day 1 - Block 2

Fundamentals of RF Security

• Security requirements in RF protocols
• RF Access Control: protocol classes; fixed code, rolling code, bidirectional systems
• RF Access Control: pitfalls and class-inherent issues
• Case studies: counter synchronization issues, global keys, cryptographic weaknesses
• Common RF risks and pitfalls: Jamming / anti-jamming, replay, relay, cryptanalysis, etc.
• Case studies: Automotive and physical access control RF systems: Remote Keyless Entry (RKE), Passive Keyless Entry (PKE), TPMS, gates, barriers, bollards, alarms, etc.

Day 2 - Block 1 & 2

Professional Mobile Radio (PMR) Security

• Introduction to Professional Mobile Radio (PMR) / Land Mobile Radio (LMR)
• Overview of digital PMR standards: TETRA, DMR, P25, dPMR/NXDN, TETRAPOL
• Geographic & use-case aspects (incl. examples of prominent & relevant users)
• Terrestrial Trunked Radio (TETRA): Technology deep dive; security, vulnerabilities.
• TETRA SIGINT tooling discussion
• TETRA case study: Real-world TETRA interception incidents
• Digital Mobile Radio (DMR): Technology deep-dive; overview, security, vulnerabilities.
• DMR SIGINT tooling discussion
• DMR case study: DMR usage and targeting in Russia-Ukraine war, Middle-Eastern conflicts, and Mexican cartels

Day 2 - Block 2

Drone, Aviation, Marine Security

• Aviation RF systems: ADS-B, ACARS/VDL, Unmanned Aircraft Systems (UAS) telecontrol and telemetry protocols, security aspects, video scrambling solutions
• Aviation case studies: Counter-UAS examples from the Russia-Ukraine war
• Marine, technologies, use-cases and case studies: on-board comms, RF in port / berching operations, emergency systems, etc.
• Marine case study: tracking & spoofing in piracy and sanctions evasions
• Tooling discussion: spectrum exploration and SIGINT, RF signal analysis, PMR (TETRA / DMR / P25), marine & aviation