News for hackers. Stuff that matters.

A comment on RCE over ham radio – Reverse shell via WinAPRS memory corruption bug. Parent comment

Re:RCE over ham radio – Reverse shell via WinAPRS memory cor... by rickostuff on Tuesday May 31, 2022 @01:44PM (#31572482)
I'm not familiar with DSD/mbelib but based on what I saw with a quick web search this sounds like a really interesting attack vector. I do want to perform some more research in this area, so thanks for the idea.
[ Parent | on HN ]
Re:RCE over ham radio – Reverse shell via WinAPRS memory cor... by jcims on Tuesday May 31, 2022 @01:52PM (#31572605)
Be sure to look at both the control channel and voice codecs. It's been a minute but IIRC there are a few open source implementations for both.

Finding a bug in RDS would be pretty funny - https://en.wikipedia.org/wiki/Radio_Data_System

[ Parent | on HN ]
Re:RCE over ham radio – Reverse shell via WinAPRS memory cor... by thereddaikon on Tuesday May 31, 2022 @02:52PM (#31573344)
There was an unintentional one earlier this year. Seattle's local NPR station bricked some Mazda infotainment sets by sending malformed data. https://arstechnica.com/cars/2022/02/radio-station-snafu-in-...
[ Parent | on HN ]
Re:RCE over ham radio – Reverse shell via WinAPRS memory cor... by ugjka on Wednesday June 01, 2022 @09:00AM (#31581185)
That wasn't RDS but HD radio's data stream
[ Parent | on HN ]
Re:RCE over ham radio – Reverse shell via WinAPRS memory cor... by Gordonjcp on Tuesday May 31, 2022 @06:47PM (#31575842)
I can't find it now, but in the olden days of the Internet I read an article about how an up-and-coming band had "hacked" RDS to switch radios to play their song when it was played out on the local station.

The local station had a UHF link from the studio to the TX site that was audio only, a very common setup in the mid-90s, and the RDS flag on the transmitter was switched "in band" by sending a burst of tones over the audio feed, right at the start of the traffic jingle. Slap the traffic announce jingle cart in, hit the button, tune starts with just three quick DTMF digits. Uh-huh, you're seeing where this is going, right?

So if you put those three DTMF digits at the start of your single... :-D

[ Parent | on HN ]
Re:RCE over ham radio – Reverse shell via WinAPRS memory cor... by jcims on Tuesday May 31, 2022 @07:48PM (#31576313)
I know this isn’t a substantive reply to your content but that’s amazing! I love it.
[ Parent | on HN ]
Re:RCE over ham radio – Reverse shell via WinAPRS memory cor... by rickostuff on Tuesday May 31, 2022 @07:57PM (#31576379)
I'm going to have to see what I can find about this incident. Sounds like the early days of phone phreaking. Awesome!
[ Parent | on HN ]