Rf Signal Analysis

When to Use

• IoT devices with wireless connectivity (WiFi, BLE, Zigbee, LoRa, cellular)
• Wireless protocol implementations and custom RF protocols
• Physical access control systems (RFID badges, NFC readers, garage doors)
• Bluetooth peripherals (keyboards, locks, medical devices, fitness trackers)
• WiFi infrastructure (access points, captive portals, enterprise WPA)
• Cellular and baseband components (modems, SIM provisioning, SMS gateways)
• Any RF-emitting device or system (sub-GHz remotes, key fobs, TPMS sensors)
• Embedded firmware that handles wireless communication stacks

Protocol Attack Surface

WiFi (802.11)

Bluetooth / BLE

RFID / NFC

Zigbee / Z-Wave

LoRa / LoRaWAN

Cellular

Sub-GHz (ISM Band)

Tool Reference

SDR Hardware & Software

WiFi Tools

Bluetooth Tools

RFID Tools

Signal Analysis

Audit Methodology

Phase 1: RF Reconnaissance

• Perform broadband spectrum sweep (SDR + GQRX/​SDR++)
• Identify active frequencies, modulations, duty cycles
• Catalog all wireless interfaces on target devices
• Map wireless network topology and access points
• Document regulatory bands in use and transmission power

Phase 2: Protocol Enumeration

• Identify protocols on discovered frequencies (WiFi, BLE, Zigbee, proprietary)
• Enumerate advertised services (GATT, SSIDs, PAN IDs, device names)
• Fingerprint firmware versions and chipset identifiers
• Map protocol state machines and message sequences
• Identify supported security modes and negotiation behavior

Phase 3: Authentication Analysis

• Test pairing and association mechanisms for weaknesses
• Attempt default/​well-known key access (Zigbee HA key, HID iClass standard)
• Evaluate key derivation and entropy (PRNG seeding, key length negotiation)
• Test credential storage on device (flash dump, JTAG/​SWD extraction)
• Assess mutual authentication requirements (or lack thereof)

Phase 4: Traffic Analysis

• Capture and decode protocol traffic (Wireshark, URH, rtl_433)
• Identify cleartext or weakly encrypted data transmissions
• Analyze session management (frame counters, sequence numbers, nonces)
• Look for information leakage in metadata, headers, or advertisements
• Correlate traffic patterns with device behavior

Phase 5: Injection & Manipulation

• Replay captured frames and assess acceptance (replay protection)
• Inject crafted packets to test input validation
• Attempt protocol downgrade attacks (WPA3→WPA2, S2→S0, BLE SC→Legacy)
• Fuzz protocol parsers with malformed frames
• Test jamming resilience and failover behavior

Phase 6: Persistence & Lateral Movement

• Assess post-compromise persistence on wireless devices (firmware implants)
• Test pivot from wireless to wired network segments
• Evaluate OTA update mechanisms for hijacking potential
• Check for mesh network propagation of compromised keys
• Document trust relationships between wireless components

Code Review Patterns

When reviewing source code for RF/​wireless implementations, flag:

• Hardcoded Keys: Encryption keys, PINs, or network credentials in source/​firmware
• Weak Randomness: Use of rand(), millis(), or predictable seeds for nonces/​keys
• Missing Replay Protection: No frame counter, sequence number, or timestamp validation
• Cleartext Transmission: Sensitive data sent without encryption over RF
• Weak Key Derivation: Short keys, no KDF, or insufficient PBKDF2/​scrypt rounds
• Missing Mutual Authentication: Device trusts any peer without verifying identity
• No Firmware Signature Verification: OTA updates accepted without code signing
• Static Session Keys: ABP-style fixed keys that survive device reboot
• Insufficient Key Rotation: Long-lived symmetric keys without renegotiation
• Debug Interfaces Left Open: JTAG/​SWD/​UART enabled in production firmware

Related Skills

• reverse-engineering — Firmware extraction, binary analysis, protocol RE
• entry-point-analyzer — Identify attack entry points across system boundaries
• iot-device-provisioning — Secure device onboarding and credential management