Amazon Sidewalk Network Traffic Analysis with Software-Defined Radio

Analyzing Amazon Sidewalk Internet of Things Network Traffic using Software-Defined Radio and GNU Radio Introduction Results Background • Internet of Things (IoT): wireless (radio) communication protocols between small smart devices/sensors • security/automation • e.g. Amazon Sidewalk and Long Range (LoRa) protocols Step 11: Finding Data Packets in Time Step Research Goal • Create proof of concept for analyzing IoT wireless signals by reverse engineering Amazon Sidewalk wireless protocol • Reverse Engineering: examining the output to understand its construction • Why is this research important? • Analyze IoT traffic patterns • Evaluate IoT security/privacy Challenges • IoT protocols proprietary with little documentation publicly available • Signals are: • Sparse/short in time domain • Separated on different frequency channels • Encoded with variable encoding schemes • Received data packets are sparse • Want packets to be back-to-back in the time dimension • Input: raw signal capture • Power Squelch block: threshold on signal energy to detect sections with valid data • Output: file of back-to-back packets Step 2: 2 Detect packet frequency channel Step and convert to digital Part 1: Recovering data bits on known fixed channel • Shift to known channel and filter • Latch onto preamble alternating bits as a clock • Use clock to find bit boundaries and determine if each is a 1 or 0 Manual (Inspectrum) Automatic (GNU Radio) Methodology This project focuses on building a platform to analyze Software-Defined Radio (SDR)-captured waveforms using the GNU Radio Companion. Software Setup • OS: Ubuntu (Linux) • Both native Ubuntu and a prebuilt Docker file were tested • Collaboration: GitHub Repository • Software Tools: • GNU Radio: Flowgraph-based programmable radio design Part 2: Finding the channel • Input: analog packets from Step 1 • Polyphase Channelizer block: • Divides bandwidth into multiple channels • Routes inputs to proper channels • Replicates bit recovery (part 1) on each channel • Output: digital binary data • Sublime: Python/C++ editor • Universal Radio Hacker (URH): AIlike signal reverse engineering • CRC RevEng: Python-evoked tool for reverse engineering Cyclic Redundancy Check (CRC) error correction codes • This research demonstrates both manual (Inspectrum + Python) and automatic (GNU Radio / Universal Radio Hacker) reverse engineering methods • Manual: easier to grasp at first • Automatic: better for large-scale operations • We have captured and analyzed wireless signals of the Amazon’s FSK radio and YoLink’s LoRa protocols using Inspectrum: • Identifying carrier frequencies • Measuring protocol bandwidths, bitrates, and preamble/packet lengths • Finding a pattern in the channel hopping sequence • Detecting individual packets • Retrieving packets’ bitstream automatically • Attempted to reverse engineer CRC (cyclic redundancy check) using Reveng tool • Future work on Sidewalk FSK reverse engineering: • Finding exact CRC algorithm • Implementing real-time GNU Radio receiver with packet sink block that validates CRC • Real-world Application • Understanding how IoT signal bursts operate • Evaluating difficulties in processing wireless signals • Analyze/visualize IoT traffic 9 channels; each Recovers bits like known channel (Step 2 part 1) Step 33: Find and extract payload from binary Step • Inspectrum: Spectrogram (frequency versus time) for recorded radio signals; analyzes modulation of waveforms; generates decoded bitstream Discussion/ Conclusions CRC (Cyclic Redundancy Check) detection: Python / CRC RevEng: Universal Radio Hacker (URH): • Python code loops through • URH can generate and check possible payload lengths and CRCs by testing different CRC payload/CRC positions for 4 parameters and other different binary data strings checksums • Feeds to CRC RevEng to find • Representations such as bit, CRC that matches hex, and ASCII viewable in • Also try: URH can also be used to help • Different CRC lengths identify CRCs • Invert CRC bits (bitwise XOR)