HackRF One and Software-Defined Radio: How to Listen to Everything the Wireless World Forgot to Encrypt

There is more information in the air around you right now than most people realize. The conversations between aircraft and air traffic control. The exact position of every commercial flight within 300 miles. The pager messages going to hospital staff. The temperature readings from your neighbor's wireless sensor. The handshake between a car and its keyfob. Weather satellite imagery at 137 MHz. The system information frames from every GSM cell tower in range.

Most of this is being transmitted without encryption, because the systems that send it were designed before anyone considered that consumer hardware capable of receiving and decoding them would cost under $300.

The HackRF One is a software-defined radio that covers 1 MHz to 6 GHz in half-duplex mode. It does not just receive - it can transmit. At its price point (around $300 new, less secondhand), it is the most capable entry-level SDR available. Paired with GNU Radio, GqRx, or any of the dozens of purpose-built decoders, it makes the invisible visible.

//What Makes SDR Different

Traditional radio hardware is built for a specific frequency and modulation scheme. Your FM radio receives 88-108 MHz using wideband FM demodulation. Your car's keyfob receiver listens at 315 or 433 MHz using OOK (On-Off Keying). Each is purpose-built, implemented in analog hardware, and not reconfigurable without physical modification.

Software-defined radio moves almost all of that logic into software. The SDR hardware handles a small number of tasks: tuning to a center frequency, downconverting the RF signal to baseband, digitizing it via an ADC, and streaming the raw I/Q samples to a computer. Everything else - demodulation, decoding, filtering, visualization - is software that runs on a general-purpose CPU or GPU.

The implication is that the same piece of hardware can receive FM radio, decode aircraft transponders, visualize pager traffic, and demodulate GSM system information - just by changing the software. The HackRF One running GqRx looks like a spectrum analyzer. Running dump1090, it's an ADS-B receiver. Running multimon-ng, it's a pager decoder. Running gr-gsm, it becomes a GSM protocol analyzer.

//The ADS-B Revelation

ADS-B (Automatic Dependent Surveillance-Broadcast) is the system that replaced radar as the primary means of tracking commercial aircraft. Every commercial flight is legally required to broadcast its ICAO address, callsign, position, altitude, velocity, and heading on 1090 MHz - unencrypted, unauthenticated, in the clear.

This is genuinely remarkable. Anyone with a $25 RTL-SDR dongle and a laptop running dump1090 can track every commercial aircraft within line-of-sight range in real time. The data is so accessible that websites like FlightAware and FlightRadar24 are largely built from crowdsourced SDR feeds contributed by hobbyists with roof antennas.

What an ADS-B Frame Contains

Each ADS-B message is 112 bits of Mode S data. The ICAO 24-bit address in every message is unique to the aircraft and maps to the aircraft's registration in publicly available FAA and EASA databases. This means that watching traffic on 1090 MHz does not just show you anonymous aircraft - it shows you registered tail numbers, which map to operators, routes, and in many cases, owners.

//Pager Networks: Still Broadcasting in 2024

Pager networks operating on POCSAG and FLEX protocols transmit in the 150-160 MHz range. Many large hospitals, emergency services, and utility companies still rely on them for reliability reasons: pagers work in areas where cellular signal fails, they have extremely long battery life, and the infrastructure is independent of commercial networks.

The security posture of most pager networks is: no encryption, no authentication, no acknowledgment. A POCSAG message is broadcast to every pager on the network. Any receiver listening on that frequency can read it.

In practice this means that an SDR tuned to a hospital's pager frequency, running multimon-ng or a PDW decoder, will display a real-time feed of hospital pages - nurse calls, code alerts, patient transport requests, physician callouts. Researchers documented this extensively in 2015-2019. Many hospitals are aware of it. Most have not changed their infrastructure because the cost of a network-wide pager system upgrade is substantial.

//ISM Band: 433 MHz and the Unencrypted World

The 433.92 MHz ISM band is a free-for-all. No license required, low power, shared with everyone. This is the frequency of cheap wireless doorbells, wireless temperature sensors, garage remotes, car tire pressure monitors, remote controls for wireless power sockets, and hundreds of other consumer devices. Almost none of them use encryption.

The rtl_433 tool - which works with RTL-SDR dongles as well as HackRF - can decode hundreds of protocols operating in this band automatically. Point it at 433 MHz and it will identify and decode temperature sensors, rain gauges, motion detectors, power consumption monitors, and remote controls without any manual configuration. The tool is an exercise in how much unencrypted data is floating through the air in a typical residential neighborhood.

Tire Pressure Monitoring: Tracking Without GPS

TPMS sensors broadcast a unique vehicle ID with every pressure update, typically every 30-60 seconds while driving. Because the ID is unique and persistent, a network of SDR receivers positioned along a road could track the movement of individual vehicles without any GPS involvement. The sensor broadcasts: here is vehicle ID 0xA3F211B4, here is my pressure, here is my temperature.

Researchers demonstrated this as a privacy concern over a decade ago. The automotive industry has not changed the TPMS protocol to add rotating identifiers. The capability still exists.

//GSM System Information

GSM (2G) networks are still operational in many countries as a fallback for voice calls and SMS. The broadcast channel of a GSM base station transmits system information messages unencrypted - these include the cell tower's location area code, cell ID, neighbor list, and configuration parameters.

The gr-gsm GNU Radio toolkit can decode this broadcast information with an SDR. The practical use for researchers is cell tower mapping - identifying which towers cover an area, their parameters, and their relationships to each other. This information is useful for understanding how cell-based location tracking works and for identifying rogue base station (IMSI catcher) interference.

//The Hardware

The HackRF One (Great Scott Gadgets) covers 1 MHz to 6 GHz with 20 MHz instantaneous bandwidth and 8-bit ADC resolution. It is a half-duplex device - it can transmit or receive, but not simultaneously. Maximum transmit power is around 10-15 dBm depending on frequency. It connects via USB 2.0 and is fully open source - both hardware schematics and firmware.

For receive-only use, the RTL-SDR Blog V3 is a common starting point at around $25 - it covers 500 kHz to 1.75 GHz and is sufficient for FM radio, ADS-B, pager decoding, and most ISM band work. The HackRF is the upgrade when you need transmit capability, wider frequency range (especially above 1.75 GHz), or higher ADC resolution.

Antenna selection matters significantly. A telescoping whip covers general use. A dedicated ADS-B antenna (1090 MHz ground plane) dramatically improves aircraft coverage. A directional Yagi is needed for signal hunting and targeted intercept work. The hardware is only half the capability.

//GNU Radio and the Tool Ecosystem

GNU Radio is the foundational SDR framework - a visual dataflow programming environment where signal processing blocks (source, filter, demodulator, sink) are connected into processing pipelines. The learning curve is steep but the capability ceiling is very high. Most advanced SDR applications are either built in GNU Radio or include a GNU Radio component.

For immediate productivity: GqRx (spectrum analyzer and receiver), SDR++ (cross-platform, excellent for general reception), SDR# (Windows), dump1090 (ADS-B), multimon-ng (POCSAG/FLEX pager, AFSK1200, DTMF), rtl_433 (ISM band sensor decoding), and CyberChef (general signal analysis and decoding). Most of these work with both RTL-SDR and HackRF hardware.

The signal analysis skills that SDR builds transfer directly to penetration testing, wireless security research, and hardware security - understanding how devices communicate is the prerequisite to understanding how to protect or exploit that communication.