When I started with HF in amateur radio (below 30 MHz) in
August 2014 making PSK31
contacts on the 10 meter band
the number of sunspots was falling, the maximum frequency for ionospheric
propagation was falling and therefore the possibilities of making contacts on
the 10 meter band were dropping.
In 2022 we are in the rise of the number of sunspots as part of solar cycle
25. And this year there are clearly moments where I can get interesting
contacts on the 10 meter band.
Today I had some time to play radio in the morning and I got contacts with
China, India, UK bases on Cyprus, Macedonia and Hong Kong. The contacts were
in FT8 mode.
It is nice to see this. Radio amateurs who have been active for years will
tell you about the good times when you can make contacts on the 10 meter band
during the day with minimal means. Now I am enjoying this myself and having
fun all over the world.
On 9 December this year was the annual SURFcert Capture The Flag (CTF) event.
The end result is that team "I'm not a robot" from Radbout University Nijmegen won
with the most points.
When I participate in a CTF, I like to keep notes and write about my
experiences and what I learned solving the challenges. Being on the 'other'
side creating the challenges is as much fun, but while creating the challenges
you have to be really silent about it. For me personally it is extra
challenging because one of the regular SURFcert CTF players works with me in
the same team.
But sometimes designing a challenge and making it happen gives the same great
feeling as actually solving it! This was the case with the challenge that
ended up as Scan the radio on the SURFcert CTF. The name of
the challenge was somewhat confusing by design: there was a challenge which
was designed to make people use a 1990s style ghettoblaster radio,
there was a challenge mentioning 'broadcast' which was actually about
names of wifi networks and this challenge. All three were marked 'physical'
with a description of the challenge.
For this challenge I wanted to create an NFC tag that could be read easily.
I found out information can be put in NFC tags using the NDEF standard (NFC
Data Exchange Format) which has options to embed URLs, options to start
certain apps or simple strings. I wanted a simple string with a flag as
our flag format was SCF2022- plus 32 characters uppercase. I found out the
developer of proxmark is working on NDEF support but it is all quite new.
At this point I was worried I had to write my own code and use parts from a
fresh library to get an NDEF message on a card. I did bring some MiFare classic
cards home to test on. But searching for information I came across
NDEF and Magic Mifare Cards with the very important remark:
My suggestion would be to get an Android phone
with nxp reader chip (there are many) and use tagwriter from NXP to format and
write ndef data to the Mifare classic chip.
I do have NFC TagWriter by NXP
on a smartphone, I just haven't used it a lot.
And indeed it was really easy to create an NDEF dataset with a string,
write this to a MiFare classic and read this with an Android phone with NFC
support, even without opening the NXP TagInfo application.
So that was an easy challenge to make, a lot easier than I first thought.
Or was it? The final test would be to read this on an Apple iphone too.
And there came the snag, the Apple iphone doesn't work with MiFare classic
tags somehow. But the person who helped me test it had another tag with an
NDEF message on it, and that worked fine. So the conclusion was that another
type of tag would work better. Luckily one of the other people of the team
creating the SURFcert CTF has a big collection of NFC tags and it turned
out the tag given out by Tweakers reads fine on Android and iphone.
So that's how the 'scan the radio' challenge was to notice the clearly not
from 1992 tweakers tag on the ghettoblaster radio, scan it with the standard
NFC support in a smartphone or use NXP TagInfo and find the flag.
While creating this challenge I also tried writing information to the tags
which were given out / sold about 15 years ago which looked like a circle with
a hex serial number. I always assumed they were just a serial number to look up
in a database. But they turned out to be actual NDEF tags with the hex serial
number on the outside as an URL:
For the tag with 04B7CC193E2580 on the outside: protocol 01 http://wwwuri field ttag.be/m/04B7CC193E2580
But ttag.be has changed owners since this was active and it's now
redirecting to 609.es which is a real-estate agent in Spain. I guess
everybody who scans a round tag with a serial number wonders how they end up
with a real-estate agent.
Last weekend was the CQ World-Wide DX Contest CW
and I participated in that contest on parts of Saturday and Sunday. I ended
with 189 contacts. Daytime I worked on the 10 and 15 meter bands and when those
started to dry out I switched to the 20 meter and 40 meter amateur bands.
Most of the time I chased stations in search+pounce mode
but I also called CQ on the 15 meter band on Sunday afternoon. I will need
to practise more with calling CQ: stations came to me at higher speeds than I
was used to with running PA900UTR and if I didn't
decode the callsign and reacted immediately some give up fast.
But my morse is improving, even at contest speeds and I got a nice number
of countries in the log. Even countries I didn't have in morse before:
PJ2 Curacao, PJ4 Bonaire, CX Uruguay, 3B8 Mauritius, CN Morroco, SV9 Crete.
Of those Mauritius is a completely new country in amateur radio for me.
I put in some extra effort to get those new countries in the log, with other
stations that I know are confirmed countries I give up after a few tries and
try to get another call in the log. Radio contesting is about the numbers: both
number of contacts and the multipliers. In this contest the number of CQ zones
and countries is the multiplier, so I optimise a bit for that number. And I
suspect a lot of the other contestants do the same.
The overview of my single operator multi band effort:
This was one of those contests where I had it all planned beforehand to
participate, made sure everything was working optimally and had it marked in
the family calendar. Normal things like weekend shopping still needed time,
but the family wasn't surprised I spent a lot of time behind the radio.
From a perspective of security research I only touched the surface of the
security research on the Corinex CXWC-HD200-WNeH and the
Cab.Link CLS-D4E2WX1
by finding default credentials for telnet.
To get a further insight I need to first enumerate the network attack surface
completely. What services are running, what programs run those services.
The ultimate step would be to build an emulation environment where I can run
the programs from the routers under my control and find out about the programs
and get a first few steps into reverse engineering. With qemu it is possible to
emulate MIPS systems on x86 hardware, so I can build a test environment.
It would need some work to get old enough versions of code and kernels to
create a compatible environment. The Corinex router mentions compilation in
2012 but with Linux kernel 2.6.21 which was released 25 april 2007. The
Cab.Link router mentions compilation in 2013 but uses Linux kernel 2.6.31 which
was released 9 september 2009.
After getting a good look at the
Cab.Link CLS-D4E2WX1
from the outside it was time to void the warranty and open the box. The
two screws are hiding under the little rubber feet at the front side and
after removing those two screws the case opens with a bit of jiggling.
This device has an external 12 volt 1 ampere power supply.
Chips found on the board:
Qualcomm QCA7411L-AL3C - Homeplug AV / IEEE 1901 the ethernet over cable interface I guess
I also see an extra board (leftside of the picture, blue) where the u.fl cable
to the wifi antenna starts. It has a few larger chips but those have a label
over them. I guess one of them must be the CPU because I haven't seen a chip
with that function yet.
The makers of the Cab.Link CLS-D4E2WX1 were kind enough to include 4 pins
labeled J30 (bottom left of the picture) which are a very obvious candidate for
being the uart port. Again the process for find GND, TX, RX and Vcc was done
and the right pins found. With the board in front and the J30 readable the pins
are from left to right TX, RX, GND and 3.3 volt. I name the TX and RX pins from
the view of the system, so I see data transmitted on TX and I send data to RX.
I was planning to make some morse contacts this weekend but when I had time
to turn on the radio on Saturday afternoon there was a lot of contest traffic
on the morse parts of the bands. This turned out to be the
LZ-DX contest.
This was a chance to get some CW contest practise done. This is a CW and SSB
contest but I concentrate on CW contesting at the moment. I found out TLF the
contest logger supports the LZ-DX contest out of the box so I could start fast.
Propagation wasn't cooperating very well but I did get contacts in the log.
The final result:
The earlier Ethernet over Cable modem/router I poked at didn't come alone,
from the same source I also got a Cab.Link CLS-D4E2WX1 cable modem/router.
Doing a search for it finds actual listings for trying to order them
wholesale: Buy Wholesale China 7400-eoc Slave Modem, Separate Tv And Ethernet From One Cable, 4 Ethernet Ports Output & 7400-eoc Slave Modem at USD 127 | Global Sources
and Eoc Male Slave 4 Ethernet Port With Wifi - Buy Eoc Esclavo Product on Alibaba.com.
Both listings call it an EOC slave. Given the terminology I expected EOC
master devices to exist as well and I soon found out those exist and can be
pricey. So I'm not going to spend money on this subject, but I may be
interested in recycling an EOC master unit.
The unit has one external wifi antenna, 4 ethernet ports, external power
supply 12V and 9 leds. The cable connection is via 2 female F connectors with
one labeled 'Cable' and one labeled 'TV'. I do notice the case has a lot of
ventilation holes.
On the underside is a label with the manufacturer name, model name, a
default equipment management IP 10.10.1.250, a Wireless Network Name
'wifi' and the EOC and Wifi Mac addresses as numbers and barcodes, and
the serial number as number and barcode. The unit has four little rubber
feet (full LRF support) and two of those are hiding screws to open the unit.
On switching the Cab.Link router on I indeed see a wifi network appear with the
name 'wifi' which on connecting gives me an IPv4 address in the 192.168.1.x
range with the default gateway 192.168.1.1.
Cab.Link CLS-D4E2WX1 router underside
The Cab.Link router has a web interface listening on port 80. It directly asks
for http authorization but using admin/admin for username and
password gets me right in. Up until now I haven't found any reference to PLC or
EOC in the webinterface.
The Cab.Link also has a telnet server running on port 23. It greets me with
an OpenWRT banner but the first few attempts at finding username/password do
not let me in:
$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
WARNING: telnet is a security risk
OpenWrt login: admin
Password:
Login incorrect
OpenWrt login: root
Password:
Login incorrect
OpenWrt login:
A comment on irc made me have a look at the logs for my haproxy system to get
an idea whether any weird vulnerability scan came by. No special vulnerability
scan showed up, but my attention was drawn to a number of lines like:
If there is one of two of these lines from one address, it is a sign of a
client which can't finish the SSL negotiation. With my site that probably means
and old client which doesn't understand LetsEncrypt certificates without an
extra certification path.
But this is quote a number of SSL errors from the same IPv6 range in a short
time. I wondered what was behind this and did a bit of testing, until I found
it's simple to cause this by doing an SSL test. For example with the famous
Qualys SSL test
or with an ssl scan tool. This is logical: ssltest uses a lot of different
negotiations to test what actually works.
I closed the case of a vulnerability in the Corinex CXWC-HD200-WNeH
with a confirmation from the vendor that this is a device completely out of
support. Which confirms the public information I found
when I started looking into this device.
This was all related to the course in hardware hacking I took and applying
the new knowledge.
So now I can look back on this experience and think about my future here.
Hardware hacking has serious links to my current job as technical security
specialist. In my work I regularly have to look at vulnerabilities and assess
the chance and impact of misuse of the vulnerability. With hardware hacking
I find vulnerabilities by researching hardware. This helps me understand the
chance and impact factor of other vulnerabilities.
There is also a link to my education: part of that was MTS electronics. I
learned how to solder, before SMD components were a thing and I think I got
some explanation about switching mode power supplies at the end. As I got into
computers I didn't do much with this education but the last years in amateur
radio have made me get out the soldering iron again.
There is a clear link to my hobby of amateur radio. My interest in amateur
radio is linked to wanting to know how things actually work. Hardware hacking
is also done with RF signals so I may get into more RF related hardware
hacking.
My current thought is that I want to continue in this subject. It's given me
joy: getting into a device in new and unexpected ways gives joy! I have learned
new things. I noticed I need to feed the brain regularly with new information
and actually learning something new is much better brainfood than browsing
social media. At the same time social media is the way to learn
more about this subject and interact with other people interested in this
subject. I ended up on /r/hardwarehacking on reddit
and already learned from others and shared some of my own insights!
There is the thing about RFID/NFC security. I have looked into this in the
past, mostly by getting the tools to peek into the MiFare classic cards. I am
considering going further with this area of hardware hacking. Prices of hacking
tools for this area like the proxmark3 or the flipper zero are above the 'nice
to try a few things' level. On the other hand I think I could have loads of fun
there, and the overlap with amateur radio is very clear.
At the end of this bit of writing: thanks to people who share their hardware
hacking experiences on-line! Thanks to Jilles
Groenendijk, Router Archeology: Sitecom WL-330 - Habbie's journal,
@Flashback Team on youtube,
Make Me Hack on youtube,
and Boschko Security for sharing
their stories and knowledge.
Since passing the morse
exam I have continued working on my morse skills. As one of the reasons for
wanting to learn morse was to be able to participate in morse radio contesting
I still want to increase my speed and accuracy in copying callsigns.
Exercising with tools like lcwo.net and
Morse Runner helps improve
these skills.
But I'm also working on these skills 'on-air'. At the radio club I've done
morse activations of special call PA900UTR
a few times and that went ok. I don't get all the calls right the first time
but it is a good experience and it's working out.
Last weekend was the CQ World-Wide DX Contest CW and I participated in that contest on parts of Saturday and Sunday. I ended with 189 contacts. Daytime I worked on the 10 and 15 meter bands and when those started to dry out I switched to the 20 meter and 40 meter amateur bands. Most of the time I chased stations in search+pounce mode but I also called CQ on the 15 meter band on Sunday afternoon. I will need to practise more with calling CQ: stations came to me at higher speeds than I was used to with running PA900UTR and if I didn't decode the callsign and reacted immediately some give up fast. But my morse is improving, even at contest speeds and I got a nice number of countries in the log. Even countries I didn't have in morse before: PJ2 Curacao, PJ4 Bonaire, CX Uruguay, 3B8 Mauritius, CN Morroco, SV9 Crete. Of those Mauritius is a completely new country in amateur radio for me. I put in some extra effort to get those new countries in the log, with other stations that I know are confirmed countries I give up after a few tries and try to get another call in the log. Radio contesting is about the numbers: both number of contacts and the multipliers. In this contest the number of CQ zones and countries is the multiplier, so I optimise a bit for that number. And I suspect a lot of the other contestants do the same. The overview of my single operator multi band effort:
Band 160 80 40 20 15 10 QSO's 0 0 28 33 108 20 Cty 0 0 18 22 31 10 Zone 0 0 5 8 11 6 Pts: 344 Mul: 111 Score: 38184This was one of those contests where I had it all planned beforehand to participate, made sure everything was working optimally and had it marked in the family calendar. Normal things like weekend shopping still needed time, but the family wasn't surprised I spent a lot of time behind the radio.
Last weekend was the 
