Controlling IoT devices with crafted radio signals

### The Physical Mechanics of Wireless Transmission At 00:00, Caleb Madrigal opens with a hands-on exploration of the physical layer in consumer wireless communication. Rather than treating radio signals as abstract network packets, Madrigal emphasizes that all digital wireless signals are simply analog electromagnetic waves modulated to represent binary ones and zeros. By understanding modulation at the physical layer, security researchers can reverse-engineer and manipulate wireless devices without requiring proprietary documentation.

### Signal Capture and Spectrum Characterization At 05:20 and 10:15, Madrigal demonstrates capturing over-the-air signals from commercial 315 MHz and 433 MHz smart home RF remotes using an inexpensive RTL-SDR receiver paired with GQRX. He exports the raw radio frequency recordings into Audacity to visually inspect the waveform in the time domain. Madrigal explains Amplitude Shift Keying (ASK) and On-Off Keying (OOK), demonstrating how the presence or absence of a carrier wave corresponds directly to digital pulses.

### Reverse Engineering Binary Frames and Pulse Timings At 16:47, the speaker dives into packet framing and timing analysis. By measuring the microsecond duration of high and low pulses in the captured audio waveform, he uncovers the device's encoding scheme. He breaks down the preamble sync pulses, the unique 20-bit device identification code hardcoded into the remote, and the specific functional command bits assigned to toggle relay switches on and off.

### Crafting and Transmitting Exploitation Signals At 22:30 and 27:10, Madrigal transitions from passive reception to active signal injection. Using Python scripts and Software-Defined Radio hardware (such as HackRF and Yard Stick One), he synthesizes the precise timing pulses calculated during reverse engineering. He demonstrates transmitting custom RF signals to reliably actuate wireless power outlets across the room, highlighting that the target devices lack rolling codes, replay protection, or cryptographic authentication.

### Demystifying SDR for the Hacker Community Concluding around 31:57, Madrigal encourages attendees to overcome their intimidation of Software-Defined Radio. He points out that basic sub-GHz radio reverse engineering requires only accessible math, curiosity, and open-source tooling. By viewing the electromagnetic spectrum as an open software canvas, security enthusiasts can audit the security of millions of unencrypted smart devices deployed throughout everyday environments.

(AI summary — Gemini 3.8 Flash)