Thread

Various Projects Find Hidden SDR Capabilities in ESP32 Microcontrollers

288 points · 67 comments · nkw

mallets · 1790879919 · focus · HN ↗
So many $1 wireless ICs have a powerful "SDR", but will never be documented due to certification/compiliance/export-control reasons. The projects listed here rightly limited the scope to RX-only but Espressif might be forced to "patch" this away if arbitrary TX too is possible (or starts making headlines). Hope it doesn't come to that, more cheap options for RF-to-bits is always welcome.
On a technical note, not much I can find about the signal quality. Phase noise, images, DC Offset, etc. Have to get my hands on one, ESP32-S31 seems promising.
1. ErroneousBosh · 1790880388 · focus · HN ↗
  > The projects listed here rightly limited the scope to RX-only but Espressif might be forced to "patch" this away if arbitrary TX too is possible
  Why would they? It's perfectly legal to operate radio transmitters on any frequency you like, if you hold a suitable licence.
  1. mallets · 1790881086 · focus · HN ↗
    Legal for end-user, sure. But Espressif might run into trouble with regulators like FCC.
    ErroneousBosh · 1790887274 · focus · HN ↗
    Then sell them in the UK, where the FCC is entirely irrelevant.
    We treat RF like your lot treat Mexican fireworks.
    gamblor956 · 1790888296 · focus · HN ↗
    Our border control confiscates Mexican fireworks.
    Joker_vD · 1790924036 · focus · HN ↗
    And illegally entering Mexican immigrants too, yes. In practice, neither seems particularly effective.
    compiler-guy · 1790893879 · focus · HN ↗
    This would mean throwing away a giant market for what are generally pretty niche use cases. Very cool use cases, sure. But not worth giving all those sales up in favor of gray-market importers.
  2. ssl-3 · 1790883444 · focus · HN ↗
    It is legal for a person with an appropriate license, yes. But laws (in the US) about RF transmission differ from how many other laws are structured: We're only allowed to transmit what we have permission to transmit -- and by default, we're forbidden.
    But right now, I've got an ESP32 WROOM module on a dev board sitting in my windowsill reporting some sensor values over wifi.
    The WROOM itself is registered with the FCC[1]. If I stick to using the documented operation, then I have permission to use it in those documented ways. As a practical concept, I don't need a unique license to use it in the way that I am; I'm granted the ability to use it by Part 15 of the FCC rules.
    And that's pretty great: The hardware was inexpensive to buy and very easy to find. I was able to spin this sensor up very quickly and get moving on the software side that deals with those readings. It has been a very rewarding little project with a fantastic cost:benefit ratio.
    The fear being expressed here (which I don't necessarily subscribe to) is that things like this WROOM module will become less-available when/if methods to use it in undocumented ways are published and start becoming used.
    [1]: <a href="https://fccid.io/2AC7Z-ESPWROOM32" rel="nofollow">https://fccid.io/2AC7Z-ESPWROOM32
    ErroneousBosh · 1790887225 · focus · HN ↗
    The FCC is relevant in exactly one country in the world.
    [deleted] · 1790887609 · focus · HN ↗
    [deleted]
    TeMPOraL · 1790888168 · focus · HN ↗
    Other countries have equivalent organizations and they all tend to be in sync on this stuff.
    Borealid · 1790930323 · focus · HN ↗
    Unfortunately the use of the Wi-Fi 5Ghz spectrum is not at all in sync worldwide. See <a href="https://en.wikipedia.org/wiki/List_of_WLAN_channels#5_GHz_(802.11a/h/n/ac/ax/be/bn)" rel="nofollow">https://en.wikipedia.org/wiki/List_of_WLAN_channels#5_GHz_(8... and how meaningfully different the rules are for how you can set up your own home wireless network in different parts of the world...
    fc417fc802 · 1790937110 · focus · HN ↗
    Worse is the OEMs all gradually removing the ability to operate modems intended for general purpose devices as APs in the 5 GHz range. The trend is to lock the firmware to only reply as a client in those bands. Meanwhile it isn't uncommon to encounter cheap dedicated APs that operate under the incorrect regulatory domain for the country they're sold in. So the cure doesn't work yet we lose the ability for P2P outside of 2.4 GHz.
    (If they happen to be reading I'd like to offer a hearty fuck you to whoever at Intel and Qualcomm initially decided on these absurd policies.)
    diydsp · 1790942154 · focus · HN ↗
    Yep. Plus there are international, worldwide organizations bt those agencies; the ITU. Internatl Telecom Union.
    Prologue. We get it, GP hates the u.s.-centric view. Found on this american website.
    mmmlinux · 1790965675 · focus · HN ↗
    Not true. In some countries you can be prosecuted for just receiving signals.
    zoobab · 1790940652 · focus · HN ↗
    I created a new country Zooland where there are not RF regulations:
    <a href="https://www.zoobab.com/zooland" rel="nofollow">https://www.zoobab.com/zooland
    For the same reason, those regulations (FCC radio lockdown etc) stifle innovation in the SDR world.
    skinfaxi · 1790945919 · focus · HN ↗
    Is not some regulation necessary? Spectrum is limited. You seem to have thought a lot about this so curious about your perspective.
    smallmancontrov · 1790949868 · focus · HN ↗
    Spectrum used to be a lot more limited when frequencies had to be exclusive and baked into hardware designs. Now we have agile radios that can tx/rx across wide bands and dodge other peoples' traffic, so the motivation for exclusivity is a lot weaker. If you walk around with a spectrum analyzer you will see traffic voting with its feet and overwhelmingly choosing the free-for-all ISM bands because dodging other peoples' packets is easy compared to obtaining spectrum licenses around the world.
    So: the optimal regulatory approach changed, the laws didn't keep up, and now we have suboptimal regulation that isn't bad enough to spur a fix and vested interests (spectrum owners) who don't want it fixed so I expect it to continue for a very long time. So it goes. It's not great but if all the world's problems were as small as this one it would be a much nicer place.
    mmmlinux · 1790965737 · focus · HN ↗
    My spark gap transmitter doesn't care about your spectrum. Regulation is important.
    wewewedxfgdf · 1790888604 · focus · HN ↗
    >>"We're only allowed to transmit what we have permission to transmit -- and by default, we're forbidden."
    It is not true that by default you are forbidden to transmit. In fact there are quite open rules in some ways for transmissions. Whenever these discussions about transmission come up there's always people who, without really undrstanding, freak out about transmitting anything and declare that all tranmissions are illegal. Not so.
    USA hobbyists can legally transmit without a licence under FCC Part 15, but the limits are pretty low and depend on the frequency. AM, up to 100 mW into the final RF stage, with the antenna, feedline and ground limited to a total of 3 metres. FM maximum field strength of 250 µV/m measured 3 metres away. There are special cases, such as 49.82–49.90 MHz, where home-built transmitters can go to 100 mW on a 1 metre antenna. One-off home-built transmitters don't need FCC certification if for personal use not being sold.
    It's pretty interesting to read if you are a radio head: <a href="https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-15" rel="nofollow">https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A...
    <a href="https://www.ecfr.gov/current/title-47/section-15.209" rel="nofollow">https://www.ecfr.gov/current/title-47/section-15.209
    "operation within these frequency bands is permitted under other sections of this part, e.g., §§ 15.231 and 15.241."
    -->
    0.009-0.490Mhz 0.490-1.705Mhz 1.705-30.0Mhz 30-88Mhz 88-216Mhz 216-960Mhz Above 960Mhz
    ssl-3 · 1790890117 · focus · HN ↗
    We're granted permission to make the transmissions you speak of; it is otherwise deny-by-default. This is described right there at the top of your first link, in the first three paragraphs.
    It's broadly possible to sort any rule (or superset or subset of rules) into one of two different buckets:
    One bucket contains the rules about the things things we're not allowed to do. Like a firewall with a blacklist, whereby we can do whatever we want that explicitly isn't blacklisted. It is allow-by-default.
    The other bucket contains the rules about things that we are permitted to do. This is like a firewall with a whitelist, where we can do whatever the whitelist explicitly allows us to do and nothing more. It is deny-by-default.
    Drug laws in the USA are in the first bucket (blacklisting). Radio transmission rules in the USA are in the second bucket (whitelisting).
    (There is no third bucket.)
    Borealid · 1790930196 · focus · HN ↗
    I believe the default state, in the absence of any law whatsoever, is that you can do whatever you want. Nothing is forbidden by default. You could assault another person, and it would be legal absent a law forbidding it.
    Then there are laws that prohibit things like broadcasting radio signals without a license.
    Then within those very same laws there are exceptions allowing certain transmissions WITHOUT a license, in specific circumstances.
    The "default" is that things are legal unless they are made illegal, and I think it's pointless wordplay to try to argue the default state is somehow the law prohibiting unlicensed operation, and not the part of those same laws that allow unlicensed operation in particular bands with particular transmission power limits.
    I understand the point you're trying to make that some parts of U.S. law say that all not-explicitly-mentioned radio transmissions are unlawful, but that's not meaningfully different from drug policies that say that all "harmful substances" are unlawful and so forth. They all just boil down to what the law defines as being within its own scope.
    ssl-3 · 1790930361 · focus · HN ↗
    Yes.
    And in the United States of America, at least: Radio transmissions are illegal by law, except where permission is granted by law.
    (Try not to overthink it too much. A previous responder provided a citation that did not serve them well.
    This situation can seem ugly or fantastic or jubilant or something else -- and it can be changed! -- but it still is just is how it is.)
    fc417fc802 · 1790936653 · focus · HN ↗
    I think your analysis of the situation is correct. I just want to point out that what you are describing resembles a form of tyranny to me. Radio, flight, and food are all everyday domains that I appreciate absolutely require regulation for society to function smoothly however the FCC, FAA, and FDA have to be among the most anti-american institutions (or rather bodies of regulation) I can immediately think of.
    ssl-3 · 1790967190 · focus · HN ↗
    Maybe I'm an asshole sometimes and legal restraint is what keeps me from mounting a bunch of microwave oven magnetrons on a tower and killing the 2.4GHz ISM band for miles in any direction, or re-tuning my FM transmitter to step all over the aviation band just for the lulz.
    I can grow my own food. I can share it with my neighbors. In Ohio, at least, I can sell a ton of produce every day to random strangers at any price that we find to be mutually acceptable, and I can do this without any licensing, inspection, or sales tax burden.
    But I don't grow much of my own food; I never wanted to grow up to be a farmer.
    I mostly consume products of industrialized agriculture. The USDA, FDA, and FTC help to ensure that the national brands I buy from the grocery store contain what they say they do, and that they're safe to consume, and that I get something close to the amount of it that is printed on the label.
    When I buy a 5-pound bag of wheat flour from the grocery store today it weighs in at right around 5 pounds and is made from wheat. Yeah, there's some stragglers from other plants in the process and a completely non-zero number of insect parts and stuff, but it's not like there's a special department that grows bugs just to throw them into the mix. The goal is to simply produce and deliver wheat flour.
    There was a time when adulteration and substitution of food was common and deliberate. We used to bulk up flour using cheap minerals that we'd dig out of the ground that had zero nutrition, such as gypsum. This kind of thing serves as proof that companies are assholes when left to their own devices.
    I guess we could go back to letting them do just fucking-whatever again, but do you really want to have to analyze all of the food that you buy in order to gain knowledge of what's actually in there? (How else would you be able to make an informed purchasing decision?)
    Anyway, that sounds like a ton of work compared to paying a little extra to have other people do it for me, whereby I can just read the ingredients label and know with pretty good surety what's inside the bag.
    I live in a society. I make money doing things that I'm good at doing, and I use this money to pay people to do stuff that they're good at doing -- and to make sure that they're doing it right.
    fc417fc802 · 1790971371 · focus · HN ↗
    > Maybe I'm an asshole sometimes and legal restraint is what keeps me from mounting a bunch of microwave oven magnetrons on a tower ...
    That would be illegal regardless? Please note my earlier up front acknowledgement that these areas of society do indeed appear to require some amount of regulation. I never presented an argument for a laissez-faire approach.
    > I can grow my own food. I can share it with my neighbors. In Ohio, at least, I can sell a ton of produce every day to random strangers ...
    If you look into it more deeply I believe you will find that your mileage varies in some surprising and offensive ways.
    > The USDA, FDA, and FTC help to ensure that the national brands I buy from the grocery store contain what they say they do, and that they're safe to consume ...
    Certainly they do. (I never disputed the need for this BTW. In fact I explicitly acknowledged it. Are you sure you're actually responding to what I wrote? Like at all?) Although since you brought it up I'll point out that they also fail in a number of ways. Consider for example the long standing failure of the FDA to competently audit the composition of "supplements". Or recall that time that the consumers bringing a lawsuit for false advertising over "real juice" lost. If you simply ignore all the gaps then sure it can be made to look like we do a great job in the US.
    > I guess we could go back to letting them do just fucking-whatever again ...
    Yeah nowhere did I suggest that. The opinion that regulation of the commercial food supply is necessary and the opinion that the FDA as it currently stands is a flaming pile of shit aren't mutually exclusive.
    mmmlinux · 1790965605 · focus · HN ↗
    That sounds like a list of things your permitted to do, by the fcc.
  3. numpad0 · 1790914489 · focus · HN ↗
    Certified unlicensed radio equipment are required to be reasonably tamper resistant, so that reasonably everything that end users might do would be practically compliant even with a bit of malice. This is one of reasons why iPhone used to use pentalobe screws.
    They are not required to be as secure as credit card chips, but they also can't be wide open.
  4. amelius · 1790943197 · focus · HN ↗
    Think of this scenario. What if there is a botnet that these ESP32 modules become a part of, and they all start transmitting garbage, simultaneously ...
    (This is why you will never truly own your smartphone, even though you paid for every chip inside it)

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.