Module 1: Basics
This part will provide essential reminders from the Hacking with SDR courses and advance into LoRa aspects, showing all important properties to understand, how to spot this kind of signal, and analyze it with the power of Software-Defined Radio:
- SIGINT basics around LoRa
- LoRa PHY properties and characteristics
- Capturing and decoding basic LoRa packets
- Real-world cases using unsecured LoRa PHY communication
- Signal identification and analysis techniques
Module 2: LoRaWAN
After examining basic LoRa PHY communications, we advance to discussing LoRaWAN radio and network security models and angles to exploit them:
- Case studies of industrial systems
- Monitoring frequency bands and traffic patterns
- LoRaWAN security mechanisms and encryption
- Attacks on cryptographic keys
- Deciphering encrypted communications
- Attacking the protocol stack and infrastructure
- Join procedures and device provisioning vulnerabilities
Module 3: Meshtastic
Meshtastic is a fascinating concept used to create different kinds of nodes with simplicity through a dedicated mobile app. Leveraging LoRa PHY, it is common to see mesh networks spanning 2 km or more, providing a great way to reach connected objects, enable long-distance chatting, and accomplish tasks without operator infrastructure:
- Context and architecture of Meshtastic networks
- Security mechanisms and encryption protocols
- Default band plans and custom frequency configurations
- Attacking encrypted communications and key management
- Mesh topology analysis and network mapping
- Privacy considerations and anonymity attacks
Module 4: Drones
Drones can use different protocols, but here we focus on ELRS (ExpressLRS) using LoRa, which is interesting as it is used by most FPV pilots, especially budget setups:
- Introduction to ELRS protocol and implementation
- Monitoring control and telemetry channels
- Analyzing and interacting with drone communications
- Flight control protocol analysis
