Software-Defined-Radio (SDR) Replay Attack · Hacking Project

Capture and successfully replay a wireless control signal against an owned test device and characterize whether the protocol resists replay.

**The problem**
A vast range of wireless devices — garage doors, car key fobs, industrial remotes, alarm sensors, and legacy telemetry — transmit fixed or weakly-protected RF commands that can simply be captured and re-transmitted. Without rolling codes, authentication, or timestamps, these systems are trivially defeated by a replay attack using inexpensive SDR hardware. Many product and OT teams have never assessed their RF attack surface, and few students can safely demonstrate the risk end to end.

**What you'll build**
Build a lawful, lab-contained SDR replay framework that captures a target's RF transmission, characterizes its modulation and encoding (OOK/ASK/FSK, timing), and replays or demodulates/re-encodes it to reproduce a command against a controlled test device. Extend to detection of rolling-code vs. fixed-code schemes, and pair the attack with defensive analysis: recommending rolling codes, challenge-response, and RF intrusion detection. All work stays within legal, shielded, ISM-band and owned-device constraints.

**Objective** — Capture and successfully replay a wireless control signal against an owned test device and characterize whether the protocol resists replay.

**Expected outcome** — An SDR capture-analyze-replay toolkit, a documented successful replay against a controlled device, and a defensive report on rolling-code/challenge-response mitigations plus legal/RF-safety notes.

**Difficulty** — Advanced — requires RF/DSP fundamentals, SDR toolchains, modulation analysis, and strict legal/spectrum discipline.

**Primary category** — Wireless/RF Security; Secondary = IoT Security, Penetration Testing, Signal Analysis

**Security domains** — Primary = Red Team; Secondary = Security Research, Blue Team (RF monitoring), Threat Intelligence (wireless), DevSecOps (product RF testing)

**Technical focus** — RF capture, modulation/demodulation (OOK/ASK/FSK), signal replay, protocol reverse engineering, rolling-code vs fixed-code analysis, sub-GHz ISM band, GNU Radio flowgraphs, RF intrusion detection, spectrum/legal compliance

**Core technologies** — Languages: Python, C++ (GNU Radio blocks); Frameworks/Libraries: GNU Radio, gr-osmosdr, Universal Radio Hacker (URH), rtl_433, NumPy/SciPy; Security Tools: HackRF One / RTL-SDR / LimeSDR, Flipper Zero (context/sub-GHz), Inspectrum, GQRX; Cloud/Infra: local RF lab, Faraday/shielded enclosure, antennas; AI/Data: signal classification datasets, optional ML modulation recognition; Databases: signal-capture store (IQ files), SQLite metadata

**Where it's valued** — Automotive (keyless entry/RKE), industrial remote controls and OT telemetry, physical security/alarm vendors, consumer IoT, red-team and RF security consultancies

**Careers it builds toward** — RF/Wireless Security Researcher, IoT/Hardware Penetration Tester, Red Team Wireless Specialist, Product Security Engineer (RF), Signals/SIGINT-adjacent Analyst

**Framework alignment**
• MITRE ATT&CK: Network Sniffing (T1040) and Adversary-in-the-Middle (T1557) at the RF layer; Hardware Additions (T1200) for the SDR interface; ICS ATT&CK Wireless Compromise (T0860) and Wireless Sniffing (T0887) for OT/industrial remotes.
• NIST CSF 2.0: Identify (RF/wireless attack surface), Protect (validating anti-replay controls), Detect (RF intrusion detection design). Strong Identify + Protect.
• OWASP: OWASP IoT Top 10 (I5 Insecure network/wireless communication, I4 Lack of secure update, I9 Insecure defaults); Web/API Top 10 N/A.
• CIS Controls v8: Control 12 (Network Infrastructure — wireless), Control 13 (Network Monitoring and Defense — RF anomaly detection), Control 4 (Secure Configuration of wireless controls).

**Innovation** — Improved Existing Solution — SDR replay is well documented, but a structured capture-analyze-replay framework with rolling-code detection and a defensive/IDS angle is a polished, portfolio-strong build. Scores: Innovation 6/10, Startup 5/10, Enterprise-Readiness 7/10, Patent = No.