The Airspace Around Your Building Answers To Nobody
We walked a client site last quarter with a HackRF in a backpack and had a decent picture of their operations before we cleared the lobby. Not from their network or from a badge clone, but from the air. Their guard force was keying up on an analog channel in the clear, and inside a few hours we knew their shift changes, patrol timing, and the phrase they used to call the desk. Later in the engagement, we found a device periodically broadcasting that nobody in the building could account for. The client had spent real money on their overall physical and cyber security programs and had just completed a buildout of their SOC. They had spent nothing watching the one part of their facility that leaks in every direction and stops at no wall.
Why we stopped using off-the-shelf spectrum tools
On an engagement the spectrum is not a hobby, it is reconnaissance. We are there to find the rogue device the client does not know is transmitting, and to find the radios their own people carry so we can understand how the site actually communicates under pressure. Generic analyzers are built to show you a pretty waterfall or spectrum trace.
A single radio only ever sees one slice of the band at a time. Sweep too wide and you will walk right past a handheld that keyed up for half a second while your radio was looking somewhere else. Most tools hide that limitation behind a confident-looking display. Ours does the opposite. It tells you outright the shortest burst a given band plan can actually catch, so you know before you start whether your sweep is fast enough to see the traffic you care about. On a live site that number is the difference between a clean finding and a false sense of coverage.
The detection logic favors change over presence. What matters during analysis is the thing that just started, the handheld that keyed up for the first time, or the device beaconing on a pattern. The tool reads the noise floor from empty bins only, so a steady carrier never gets absorbed and lost. It then grades detections by how often they reoccur. The persistence display makes that visual. Steady activity burns in as a bright column and a one-off leaves a faint mark. A repeating emitter and a single burst are obvious at a glance instead of after an hour of log review.
The unglamorous work made it trustworthy. A frequency-axis error that placed signals at the wrong spot across the span. A scale mismatch between the display and the detector. A marker bug that could snap your click to a stray detection halfway across the band and save the wrong frequency, which on a real job means your second radio parks on nothing. Every one came off real hardware, and every one got reproduced against synthetic signals or captured IQ before we touched the fix. That is what the synthetic source and IQ replay were built for, so a bug found at 0200 in a hotel room becomes a repeatable test by morning.
The second radio changes what this is
Finding a signal is half the job. The other half is knowing what it carries. That is the new work for us that we just completed.
The analyzer now drives a second radio, a PortaPack running Mayhem, as a dedicated listening receiver. One radio sweeps and watches the band plan. Mark any frequency inside the app, hit Listen, and the second radio parks there and demodulates to its own headphone jack. This lets us monitor and intercept at the same time, from one screen.
The reason it took real engineering is a hardware fact most people never hit. A PortaPack only exposes its serial console in normal Mayhem mode, and that same mode shuts off the HackRF interface, so the device physically cannot sweep and listen at once. We work around it by using two radios and driving the listener over serial, checking its firmware capability the moment it connects and reading back every tune to confirm the hardware actually took the frequency before you trust it. No guessing whether it parked where you told it.
The rest is built to survive a fresh box on a strange network. It binds libhackrf directly through ctypes instead of dragging a compiled dependency that refuses to build against older firmware, so it runs against effectively any libhackrf from 2015 forward with nothing to compile. On first launch it checks its own device access, the driver, group membership, udev rules, and sets up what is missing, so it comes up clean instead of throwing permission errors in front of a client. And when a strong nearby transmitter compresses the front end and lifts an entire segment, the detector reads it as a level shift rather than painting the whole band as one giant false hit, which matters a great deal when you are working close to a site's own high-power gear.
We build this in the open. The analyzer ships as part of VA-PT, our vulnerability assessment and penetration testing toolkit we maintain at github.com/sec0ps/va-pt, so it installs alongside the rest of our field kit instead of living off in some one-off project. We would rather the tools that do this work be inspectable than take our word for what they do.
If you run RF on your own engagements you are welcome to pull it and see how it holds up on your hardware.
What you can run yourself before you call anyone
You do not need our tool to find out whether you have this problem. You need to spend a few hours listening to your own building.
Put a wideband receiver near your most sensitive space and watch the common bands your people actually use, the analog business channels, the license-free radios your guards and facilities crews carry, the 2.4 and 5 GHz noise your own gear generates. Count how many emitters you can identify by owner. Every one you cannot identify is a question that needs to be answered. Then listen to your guard and facilities traffic the way an outsider would. If you can understand a single word of it without a key, so can anyone sitting in the parking lot, and your patrol schedule is now public. Finally, walk the building at an off hour and look for anything transmitting on a clock, a steady beacon with no business being there, because that pattern is the signature of a device somebody left behind on purpose.
Most teams cannot get past the first step. They have no inventory of what transmits inside their own walls, which means they have no way to tell a rogue device from the furniture, and no way to know their personnel are broadcasting the plan in the clear. That is the seam. Physical security owns the doors, IT owns the network, and the spectrum in between belongs to whoever bothers to listen.
We are one of the few shops that will sit in that seam, sweep your airspace and intercept what it carries in the same visit, and tell you which signals are yours, which are leaking, and which should not exist at all.
Comments