1---2name: rf-signal-analysis3description: Analyze wireless and radio frequency security in applications, protocols, and hardware. Covers WiFi, Bluetooth/BLE, RFID/NFC, Zigbee, LoRa, cellular, and SDR-based analysis. Use when auditing IoT devices, wireless protocols, access control systems, or any RF-enabled infrastructure.4---56## When to Use78- IoT devices with wireless connectivity (WiFi, BLE, Zigbee, LoRa, cellular)9- Wireless protocol implementations and custom RF protocols10- Physical access control systems (RFID badges, NFC readers, garage doors)11- Bluetooth peripherals (keyboards, locks, medical devices, fitness trackers)12- WiFi infrastructure (access points, captive portals, enterprise WPA)13- Cellular and baseband components (modems, SIM provisioning, SMS gateways)14- Any RF-emitting device or system (sub-GHz remotes, key fobs, TPMS sensors)15- Embedded firmware that handles wireless communication stacks1617## Protocol Attack Surface1819### WiFi (802.11)20| Vector | Description |21|--------|-------------|22| WPA2 PSK | PMKID capture, 4-way handshake capture, offline dictionary attack |23| WPA3/SAE | Dragonblood side-channel and downgrade attacks |24| WPA2-Enterprise | EAP identity theft, evil twin with RADIUS impersonation |25| Captive Portals | MAC spoofing, DNS tunneling, portal bypass |26| Deauthentication | Client disconnection, DoS, forced reconnection to rogue AP |27| Evil Twin | Rogue AP with matching SSID, credential harvesting |28| KRACK | Key reinstallation attacks on 4-way handshake nonce reuse |29| PMKID | Clientless attack against AP, hashcat-crackable |3031### Bluetooth / BLE32| Vector | Description |33|--------|-------------|34| Pairing Vulnerabilities | Just Works passkey bypass, MITM during pairing |35| GATT Enumeration | Service/characteristic discovery, read/write unprotected attrs |36| Relay/Replay Attacks | Proximity relay (e.g., car unlock), captured GATT writes |37| KNOB Attack | Key negotiation entropy reduction to 1 byte |38| BIAS Attack | Impersonation via role switching during secure connection |39| BLE Sniffing | Advertisement channel capture, connection following |40| MAC Randomization Bypass | Tracking via advertising data fingerprinting |4142### RFID / NFC43| Vector | Description |44|--------|-------------|45| Badge Cloning | EM4100/HID 125kHz long-range read and duplicate |46| Mifare Classic | Nested attack, hardnested, darkside key recovery |47| HID iClass | Standard key looper, elite key diversification attacks |48| DESFire | Side-channel key recovery on older implementations |49| Replay Attacks | Captured credential replay on access controllers |50| NFC MITM | Relay between card and reader (NFCGate) |51| Skimming | Long-range unauthorized credential reads |5253### Zigbee / Z-Wave54| Vector | Description |55|--------|-------------|56| Default Trust Center Key | Well-known ZigBee HA key (5A 69 67...) |57| Touchlink Commissioning | Factory reset and re-pair to attacker network |58| Key Sniffing | OTA key transport capture during join |59| Z-Wave S0 Downgrade | Force insecure inclusion, capture network key |60| Z-Wave S2 | DSK interception during inclusion ceremony |6162### LoRa / LoRaWAN63| Vector | Description |64|--------|-------------|65| ABP vs OTAA | ABP uses static session keys, vulnerable to key reuse |66| Frame Counter Reset | Device reset replays previously seen frames |67| Session Key Reuse | ABP keys persist across sessions, enable decryption |68| Join-Accept Replay | Replay captured OTAA join responses |69| Bit-Flipping | Unencrypted FPort/FOpts manipulation |7071### Cellular72| Vector | Description |73|--------|-------------|74| IMSI Catching | Fake base station, device identity capture (Stingray) |75| SS7 Exploitation | Location tracking, SMS interception, call redirect |76| SIM Swap | Social engineering carrier to transfer number |77| Baseband Attacks | RCE via malformed RRC/NAS messages |78| 2G Downgrade | Force device to GSM, no mutual authentication |79| VoLTE | SIP/RTP interception on LTE voice channels |8081### Sub-GHz (ISM Band)82| Vector | Description |83|--------|-------------|84| Garage Doors | Fixed code capture and replay (300-433 MHz) |85| Car Key Fobs | RollJam (jam + capture rolling code), relay attack |86| TPMS Sensors | Spoofed tire pressure to trigger warnings (315/433 MHz) |87| ISM Band Jamming | Broadband noise on 315/433/868/915 MHz |88| ASK/OOK Replay | Simple modulation schemes trivially replayed |8990## Tool Reference9192### SDR Hardware & Software93| Tool | Purpose |94|------|---------|95| HackRF One | TX/RX 1 MHz–6 GHz, 20 MHz bandwidth |96| RTL-SDR | RX-only dongle, 24–1766 MHz, low cost recon |97| YARD Stick One | Sub-GHz TX/RX (< 1 GHz), ISM band attacks |98| GNU Radio | Signal processing flowgraph framework |99| Universal Radio Hacker | Protocol analysis, demod, decoding, fuzzing |100| SDR++ / GQRX | Real-time spectrum visualization |101102### WiFi Tools103| Tool | Purpose |104|------|---------|105| aircrack-ng suite | Monitor mode, capture, deauth, crack WPA |106| bettercap | MITM framework, WiFi deauth, evil twin |107| hostapd-mana | Rogue AP with EAP credential capture |108| hcxdumptool | PMKID and handshake capture (clientless) |109| hcxtools | Convert captures to hashcat/JTR format |110| wifite2 | Automated WiFi audit wrapper |111112### Bluetooth Tools113| Tool | Purpose |114|------|---------|115| Ubertooth One | BLE and classic BT sniffing (2.4 GHz) |116| btlejack | BLE connection hijacking and sniffing |117| gatttool / bluetoothctl | GATT service enumeration and interaction |118| nRF Connect (app/desktop) | BLE scanning, GATT browser, DFU testing |119| Bettercap BLE module | BLE enumeration and write injection |120| CrackLE | Crack BLE Legacy Pairing (Just Works/passkey) |121122### RFID Tools123| Tool | Purpose |124|------|---------|125| Proxmark3 (RDV4) | Multi-frequency RFID read/write/emulate/sniff |126| Flipper Zero | Sub-GHz, RFID, NFC, IR, iButton swiss army knife |127| libnfc | Open-source NFC library and utilities |128| mfoc / mfcuk | Mifare Classic offline/unknown key cracking |129| ACR122U | USB NFC reader for desktop analysis |130131### Signal Analysis132| Tool | Purpose |133|------|---------|134| Wireshark | 802.11, BLE, Zigbee protocol decode |135| inspectrum | Spectrogram analysis and signal measurement |136| baudline | Real-time FFT signal analysis |137| SigDigger | Qt-based signal analyzer with inspectrum-like features |138| rtl_433 | Decode OOK/FSK protocols from ISM band devices |139140## Audit Methodology141142### Phase 1: RF Reconnaissance143- Perform broadband spectrum sweep (SDR + GQRX/SDR++)144- Identify active frequencies, modulations, duty cycles145- Catalog all wireless interfaces on target devices146- Map wireless network topology and access points147- Document regulatory bands in use and transmission power148149### Phase 2: Protocol Enumeration150- Identify protocols on discovered frequencies (WiFi, BLE, Zigbee, proprietary)151- Enumerate advertised services (GATT, SSIDs, PAN IDs, device names)152- Fingerprint firmware versions and chipset identifiers153- Map protocol state machines and message sequences154- Identify supported security modes and negotiation behavior155156### Phase 3: Authentication Analysis157- Test pairing and association mechanisms for weaknesses158- Attempt default/well-known key access (Zigbee HA key, HID iClass standard)159- Evaluate key derivation and entropy (PRNG seeding, key length negotiation)160- Test credential storage on device (flash dump, JTAG/SWD extraction)161- Assess mutual authentication requirements (or lack thereof)162163### Phase 4: Traffic Analysis164- Capture and decode protocol traffic (Wireshark, URH, rtl_433)165- Identify cleartext or weakly encrypted data transmissions166- Analyze session management (frame counters, sequence numbers, nonces)167- Look for information leakage in metadata, headers, or advertisements168- Correlate traffic patterns with device behavior169170### Phase 5: Injection & Manipulation171- Replay captured frames and assess acceptance (replay protection)172- Inject crafted packets to test input validation173- Attempt protocol downgrade attacks (WPA3→WPA2, S2→S0, BLE SC→Legacy)174- Fuzz protocol parsers with malformed frames175- Test jamming resilience and failover behavior176177### Phase 6: Persistence & Lateral Movement178- Assess post-compromise persistence on wireless devices (firmware implants)179- Test pivot from wireless to wired network segments180- Evaluate OTA update mechanisms for hijacking potential181- Check for mesh network propagation of compromised keys182- Document trust relationships between wireless components183184## Code Review Patterns185186When reviewing source code for RF/wireless implementations, flag:187188- **Hardcoded Keys**: Encryption keys, PINs, or network credentials in source/firmware189- **Weak Randomness**: Use of `rand()`, `millis()`, or predictable seeds for nonces/keys190- **Missing Replay Protection**: No frame counter, sequence number, or timestamp validation191- **Cleartext Transmission**: Sensitive data sent without encryption over RF192- **Weak Key Derivation**: Short keys, no KDF, or insufficient PBKDF2/scrypt rounds193- **Missing Mutual Authentication**: Device trusts any peer without verifying identity194- **No Firmware Signature Verification**: OTA updates accepted without code signing195- **Static Session Keys**: ABP-style fixed keys that survive device reboot196- **Insufficient Key Rotation**: Long-lived symmetric keys without renegotiation197- **Debug Interfaces Left Open**: JTAG/SWD/UART enabled in production firmware198199## Related Skills200201- `reverse-engineering` — Firmware extraction, binary analysis, protocol RE202- `entry-point-analyzer` — Identify attack entry points across system boundaries203- `iot-device-provisioning` — Secure device onboarding and credential management
plurigrid