Radio Protocols

• Radio Protocols
  • Why this matters
  • Software-defined radio in one page
    • IQ data
    • The three parameters
  • Identifying a modulation by eye
    • Tools
    • Choosing a radio
    • General-purpose SDRs
    • Tuned transceivers
  • The protocols
    • How hard is each one to capture?
    • The patterns worth carrying between them
  • Key takeaways
  • References

Why this matters

Every technique up to this point required touching the device. This one does not.

A radio link is an attack surface that extends as far as the signal does, against a target that has no way to know you are listening. And the constraints that make IoT radios cheap — tiny power budgets, kilobytes of RAM, no real-time clock, no reliable persistent storage — are exactly the constraints that make their security hard to get right.

⚠️ Receiving is not transmitting. Passive reception across most of the spectrum is legal in the US. Transmitting is licensed, and transmitting on bands you are not licensed for is a federal offence. The 915 MHz ISM band this course uses permits unlicensed operation under FCC Part 15 within power and duty-cycle limits. Stay inside them, transmit only with course hardware in lab, and never replay traffic from a device that is not yours.

Software-defined radio in one page

An SDR moves the demodulation into software. The hardware down-converts a slice of spectrum to baseband, digitises it, and hands you complex samples; what those samples mean is your problem, which is precisely why it is useful for protocols nobody has written a receiver for.

IQ data

Samples arrive as pairs — in-phase and quadrature — which together encode both amplitude and phase. A stream of real samples cannot distinguish a signal above the centre frequency from one below it; the quadrature component is what resolves the ambiguity. Practically: a “1 MS/s” SDR capture is one million complex samples per second, and each is two numbers.

The three parameters

Every capture is defined by three numbers, and getting them wrong wastes the capture:

Gain is the one beginners get wrong. Turned to maximum, the front end clips, and intermodulation products appear across the whole band as signals that are not there. Students then spend an afternoon chasing transmitters that do not exist. Set gain so the noise floor is visible and the strongest real signal does not saturate.

For a 125 kHz LoRa channel you need at least 125 kS/s by Nyquist, and realistically 250 kS/s or more for margin against filter roll-off at the edges.

Identifying a modulation by eye

Before demodulating anything, classify it. A waterfall and a time-domain amplitude plot get you most of the way:

The diagonal-sweep signature is diagnostic, and it is why LoRa is such a good teaching target: you can see the modulation in a waterfall, which makes the concept concrete in a way a constellation diagram does not.

Tools

Universal Radio Hacker is the right starting point. It demodulates with automatic parameter detection, lets you assign protocol fields by hand or infer them, handles custom encodings including CC1101 data whitening, and includes fuzzing and a stateful simulator. The USENIX WOOT ‘18 paper describes the design.

GNU Radio is the general signal-processing framework — a dataflow graph of blocks. More work than URH for protocol analysis, and the right answer when you need something URH does not do.

rtl_433 decodes hundreds of sub-GHz sensor protocols out of the box. Try it before writing anything: many “unknown” devices are already supported.

Choosing a radio

That software needs something to feed it, and the hardware divides into two categories that are easy to confuse and are not interchangeable.

General-purpose SDRs digitise a slice of spectrum and hand you the samples. They know nothing about protocols, which is the entire point: anything inside the tuned bandwidth is visible, including modulations nobody has identified yet. The cost is that you must do all the demodulation yourself, and that the cheap ones sample at 8 bits, which limits dynamic range — a strong signal nearby can bury a weak one you care about. Paying more mostly buys bits, duplex and an FPGA, in that order.

Tuned transceivers are single-purpose chips. A CC1101 does OOK/ASK, 2-FSK, GFSK, 4-FSK and MSK, at 0.6–600 kb/s, in three sub-GHz bands, and nothing else — it will never show you a LoRa chirp or a BLE packet, no matter what firmware you flash. In exchange it is cheap, runs from a battery, demodulates in hardware, and transmits a clean signal without you writing a line of DSP.

Everything below is one or the other, and the split is the first decision.

General-purpose SDRs

Costs are indicative for late 2026. Read the column as an ordering, not a quote.

What the extra money buys is not frequency coverage — everything from the HackRF up reaches 6 GHz, give or take a little at the bottom end. It buys four things, roughly in order of how often they matter:

• Four more bits. Twelve-bit samples against eight is about 24 dB more dynamic range. That is the difference between hearing a weak sensor two rooms away and having it buried under the strong transmitter on your bench — which is the single most common reason a capture that “should” work does not.
• Full duplex, two channels of it. 2×2 MIMO means transmitting on one chain while receiving on another, coherently. See the callout below: this changes which attacks are possible at all, not just how convenient they are.
• An FPGA you can program. The xA9’s 301 kLE Cyclone V will hold FFTs, correlators, decimation and demodulators, so the processing happens on the board instead of across the USB bus. This is the whole difference between the xA9 and the otherwise identical xA4, which has 49 kLE for around $540 — if you are not writing HDL, buy the xA4 and spend the difference on antennas.
• A better clock. A VCTCXO as standard, GPSDO as an option. It matters for anything with tight framing, and for LoRa symbol timing in particular.

For this course, none of that is required: an RTL-SDR does every receive-only exercise, and a HackRF covers the rest. The bigger radios are worth knowing about because published research assumes them — the B210 is the reference platform for UHD and most GNU Radio examples, and is the safe choice if you want someone else’s flowgraph to run unmodified. The bladeRF xA9 gives the most programmable logic per dollar. The LimeSDR sits between them on paper, with the caveat that Lime’s product line was declared end-of-life in 2022 and the USB Type-A board only returned to stock in March 2025 — verify availability before building a lab around one.

Tuned transceivers

⚠️ Duplex decides which attacks are possible, not merely convenient. Both HackRFs transmit or receive, never both at once. An attack that jams a receiver while simultaneously capturing the legitimate transmitter therefore needs either two radios or one full-duplex radio. That is why the Evil Crow RF v2 carries two independent CC1101s — and why a bladeRF, LimeSDR or B210 can do the same job in a single box, at ten to thirty times the price. Check the duplex column before assuming an attack you have read about will work with the radio on your desk.

The Flipper Zero deserves a note because students will bring them to class. Its sub-GHz side is a CC1101 — the same chip, the same three bands, the same modulation list as the Evil Crow — wrapped in a usable interface, so it is a genuinely good capture-and-identify tool. Two limits to understand before relying on it: transmission is restricted to frequencies permitted in the provisioned region, and the official firmware deliberately will not save or replay a rolling code. Its 2.4 GHz radio is the STM32WB55’s BLE core, not an nRF24, so the Unifying work needs an external module.

The protocols

Each of these has its own page with the radio layer, the data-security model, and the failure modes worked through in detail. This table is the map.

How hard is each one to capture?

This is the question that determines what you can actually do in an afternoon, and it has little to do with how secure the protocol is:

The patterns worth carrying between them

Six protocols designed by six independent groups, and the same handful of mistakes recur. Notice these as you read the detail pages — they are the actual content of the course, and the protocol specifics are the illustrations:

Bootstrapping is where key distribution fails. Zigbee shipped the default link key ZigBeeAlliance09 in a public specification. Z-Wave S0 wraps the network key under an all-zeros constant. In both cases the cryptography is sound and the first handshake gives everything away. The fix, in both, is a per-device secret delivered out of band — install codes, DSK QR codes — and that is also what Matter and WPA3 do.

Unauthenticated negotiation sets security to the weakest supported mode. WPA3 transition mode, Bluetooth’s BIAS downgrade, Z-Wave’s Z-Shave, Zigbee’s legacy joining. Supporting an old device and supporting an attacker are frequently the same code path.

Replay protection is state, and embedded devices are bad at state. Counters must survive power loss, so they live in flash, and flash wears out. Vendors write lazily, skip forward, or reset — and then choose availability over rejecting a rebooted node. This appears identically in LoRaWAN, Zigbee and Z-Wave.

Proximity is not authentication. Zigbee Touchlink enforces “nearby” with transmit power, which an amplifier defeats. Car keys and BLE proximity unlock have the same problem, which is why Channel Sounding had to be invented.

Headers must be plaintext, so metadata always leaks. Routing happens before decryption. Z-Wave HomeIDs, LoRaWAN DevAddrs, BLE addresses and TPMS sensor IDs are all readable with no key, and all enable tracking. Payload confidentiality is not privacy.

The keys are in a flash chip you can read. The most common real compromise in every one of these protocols is not cryptanalysis — it is recovering the key from unprotected storage. Everything in Dumping flash applies to all of them, and this is why the hardware half of the course is not separate from the radio half.

Key takeaways

• Radio attacks require no physical access, and the constraints that make IoT radios cheap are what make their security hard.
• Three parameters define a capture; gain is the one people get wrong, and saturation artifacts look exactly like real signals.
• Classify modulation from the waterfall before demodulating. LoRa’s diagonal chirps are unmistakable.
• Capture difficulty tracks channel width and hopping, not security: WiFi is the hardest to sniff and Z-Wave among the easiest.
• A general-purpose SDR sees anything but demodulates nothing for you; a tuned transceiver like the CC1101 does one modulation family well and is blind to everything else. Pick against the protocol, not the price.
• Duplex and bit depth matter more than tuning range. Simultaneous jam-and- capture needs two radios or one full-duplex radio; 12-bit samples buy ~24 dB of dynamic range over 8-bit, which is why weak signals vanish on a HackRF.
• Bootstrapping, unauthenticated downgrade, counter persistence, proximity as authentication, and plaintext headers are the five recurring failures. They are protocol-independent.
• Whatever the protocol, the keys are usually recoverable from flash.

References

• Universal Radio Hacker — https://github.com/jopohl/urh
• Universal Radio Hacker, USENIX WOOT ‘18 paper — https://www.usenix.org/system/files/conference/woot18/woot18-paper-pohl.pdf
• GNU Radio — https://www.gnuradio.org/
• rtl-sdr project — https://www.rtl-sdr.com/
• rtl_433 sub-GHz decoder — https://github.com/merbanan/rtl_433
• Great Scott Gadgets, HackRF One — https://greatscottgadgets.com/hackrf/one/
• Great Scott Gadgets, HackRF Pro — https://greatscottgadgets.com/hackrf/pro/
• Nuand bladeRF 2.0 micro — https://www.nuand.com/bladerf-2-0-micro/
• Ettus Research USRP B210 — https://www.ettus.com/all-products/ub210-kit/
• Lime Microsystems LimeSDR USB — https://limemicro.com/sdr/limesdr-usb/
• Texas Instruments CC1101 low-power sub-1 GHz RF transceiver — https://www.ti.com/product/CC1101
• Flipper Zero sub-GHz documentation — https://docs.flipper.net/sub-ghz
• inspectrum, offline signal analysis — https://github.com/miek/inspectrum
• IEEE 802.15.4 — https://standards.ieee.org/ieee/802.15.4/7029/
• OWASP IoT Security Testing Guide — https://owasp.org/www-project-iot-security-testing-guide/
• FCC Part 15 rules (47 CFR Part 15) — https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-15

Related course pages: WiFi · Bluetooth · Zigbee · Z-Wave · Thread and Matter · LoRa and LoRaWAN · Other IoT radios · Schedule · HW #4 · Lab 3

🛠️ Maintenance note: this page is now a map — the protocol detail, and the version claims that age with it, live on the individual pages, so check their maintenance notes rather than this one. What needs re-verifying here is the SDR tooling (URH and GNU Radio both move) and the capture-difficulty table, which shifts as cheap multiprotocol sniffers appear. The hardware table under Choosing a radio is the fastest-moving content on the page and should be re-checked every offering: the HackRF Pro was announced in mid-2025 and its firmware and price are still settling, every figure in the cost columns needs re-quoting, Flipper firmware capabilities change with each release (and differ sharply between official and community builds), and boards in the Evil Crow class appear and disappear quickly. The underlying point — general-purpose SDR versus tuned transceiver, and half-duplex versus two independent radios — outlives any particular product in the table.