Slashdot Mirror
Finnish Hacker Isolates Helicopter GPS Coordinates From YouTube Video Sounds
An anonymous reader sends a post by Finnish electronics hacker Oona Räisänen, who heard a mysterious digital signal in the audio accompanying a YouTube video of a police chase. The chase was being filmed by a helicopter. Räisänen wrote: "The signal sits alone on the left audio channel, so I can completely isolate it. Judging from the spectrogram, the modulation scheme seems to be BFSK, switching the carrier between 1200 and 2200 Hz. I demodulated it by filtering it with a lowpass and highpass sinc in SoX and comparing outputs. Now I had a bitstream at 1200 bps. ... The bitstream consists of packets of 47 bytes each, synchronized by start and stop bits and separated by repetitions of the byte 0x80. Most bits stay constant during the video, but three distinct groups of bytes contain varying data." She guessed that the data was location telemetry from the helicopter, so she analyzed it to extract coordinates. When she plotted them and compared the resulting curve to the route taken by the fleeing car in the video, it was a match.
i think i'm in love with this women.
never bring a twinkie to a food fight.
I'll be in the kitchen, making this woman a sandwich.
She washe one driving the car being chased by the police.
#DeleteChrome
There was a time, before we all lost our minds to Pong, Asteroids and Zelda (yes, I go way back) where we also spent time taking our world apart and figuring out how to make it better.
Oona rocks! She should be rewarded somehow.
BTW - the end of the article finally explains how a megahertz signal found its way onto the audio track.
Oona had better be glad she's Finnish. If she did that in the US, she could expect jack-booted thugs from Homeland Security bashing her door down. That data is SEKRET! The fact that it's only perceived as secret by said ignorant thugs because the marketing department of the vendor told them so is completely lost in the general panic. TUR'RISTS could FOLLOW the HELICOPTER! Beat to quarters and man guns!
I'd like to think I was exaggerating for effect, but judging by the past decade, I'm really not. The current security apparatus really is self-parodying.
(For those who want to bitch about how this perception runs contrary to Slashdot groupthink about the threat posed by that apparatus, I say only this: some of us are capable of projecting into the future. We want the spying and the blundering belligerence stopped because it might not always be blundering or incompetent. It still manages to be mortally dangerous even now. It could get much much worse.)
A story worthy of slashdot. Please post more of these (not being sarcastic).
Only the State obtains its revenue by coercion. - Murray Rothbard
So what? It was still fun, as in "this Youtube video contains more data than meets the eyes. Let's find out what it is."
As a ham radio enthusiast, I get the same pleasure decoding the bits of morse code that can be heard in movies from time to time: usually it's pretend morse code, but once in a while you hear a bit of a real transmission that's been overlaid onto the soundtrack by the sound engineer who didn't have a clue that what he used actually meant something totally unrelated to the movie.
In fact, I heard a CQ call followed by a callsign in a scifi B-movie from the 90s once, and sent a QSL card to the owner of the callsign in question. He answered me saying I was one of only 5 people to have done so over the years. How fun is that?
So yes, the code is known, there's nothing special about it, but she had fun digging out unexpected information, and I had fun reading about it. Stop being so jaded.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
0x80 is just a null byte with odd parity. What she apparently missed is that this is bog-standard Bell 202 AFSK (1200 baud) with 7 data bits and odd parity, and the data is ASCII. By throwing away the top nybble, she was throwing away the parity bit and the top 3 bits of the ASCII encoding of decimal digits. The fact that it was a parity bit should've been pretty obvious, since the top nybble flips between 0x3x and 0xbx in the pattern that you'd expect for a parity bit.
You can decode it with off the shelf software, throw away the top bit, and get back mostly ASCII:
./minimodem --rx 1200 -f ~/helicopter.wav | tr '\200-\377\r' '\000-\177\n'
$
### CARRIER 1200 @ 1200.0 Hz ###
282 0002.3
#L N390374 W09432938YJ
#AL #NA 282 0002.3
#L N390374 W09432938YJ
#AL #NA 283 0002.3
#L N390372 W09432928YJ
#AL #NA 283 0002.3
#L N390370 W09432918YJ
#AL #NA 283 0002.3
#L N390370 W09432918YJ
#AL #NA 283 0002.3
[...]
I'm actually surprised that she missed / didn't mention this, considering her experience with signals analysis and demodulation. This is pretty much as basic as telemetry data modulation gets! Then again, as a reverse engineer myself, sometimes we get caught up doing deep analysis of something that later turns out to be totally trivial :)