Software Defined Radio (SDR) and TTRPGs
Wherein it is explained that you should work SDR into your games and into your real life.
1. Radio: Get Results!
This is a somewhat long post, and to put the bottom line up front: Give your players a handheld Software Defined Radio. It cannot and will never be able to ACCESS THE MAINFRAME or anything super 1337 h4xxor like that, but it does give them a lot of new and unique ways to interact with the world around them. For examples, read on.
(I would also encourage you to get into software defined radio in real- life, because it gives you a lot of new ways to explore the world around you! There’s a lot to discover; many unique, strange, and temporary audio transmissions and miscellaneous waves which pop off and are fascinating to find.)
The Gist
Radios are cool, and you can do a lot with them. Software Define Radio (SDR), doubly so. For the uninitiated, radios and SDR are more than just listening to music and people talk - although you can do that, too (there are still interesting things happening on shortwave and HAM, and random signals you catch from all over the world).
To me, SDR is like an alternate dimension of deliberate and stray broadcasts that you tap into, like looking into another dimension filled with knowledge and things to mess with.
It used to cost big money just to get into a small slice of what SDR offers. Thousands for radio astronomy, hundreds of dollars for a very basic HAM setup, another fistful of dollars for shortwave, another fistful for CB radio, another small amount for basic FM/AM. With SDR, all the above frequencies and more are open to you for a relatively small amount of cash.
Entry point is not-very-tech-savvy and inexpensive (you can start with $35 USD and no radio theory). There are also many points of entry: you can start with a crummy laptop and an SDR dongle or you can build a dedicated device with Teensy or Raspberry Pi. For a little while, I even used an old HTC One M8 back in 2018 or so (though you can do it on any Android device, be it tablet or phone).
2. What Can You Do With It?
I got into SDR many years ago at the point described above (no radio theory and ~$25 USD). I’ve expanded a bit with some specialized hardware which makes it easier to be mobile with SDR. All I’ve managed to learn about radio theory is that there’s a lot of it and I’m dumb as shit. Your mileage may vary. But I’ve built some fun and useful gizmos in the meantime.
These days, I have a fun little device that uses a HackRF One hooked into a SharedBrained PortaPack H1 and a portable battery pack, which runs Mayhem firmware. The fun thing about a lot of these frequencies you’ll find is that they’re mostly unencrypted, or they transmit to/from devices which are unencrypted. I think it just never occurred to manufacturers that anyone would be listening, or else they deemed the occurrence to be low enough that it wasn’t cost effective to mitigate. After all, how many people are going around with SDR on their phone to bruteforce the 3 number PIN of TouchTunes in order to play songs on a bar’s jukebox without having to pay?
Anyway, this lack of foresight results in varying levels of “fun.” Some of which is harmless, and some of which is so radioactive I wouldn’t touch it with a 10-foot pole in a Faraday cage (like spoofing & rebroadcasting airplane IDs).
The big takeaway is that radios rule everything. This isn’t news for most of you, since nearly everyone has a cell phone and we all use networked devices.
However, the idea of “radio” has become somewhat dated because most of our devices are extremely tuned to a very, very narrow range of frequencies over very short distances. SDR widens and deepens the pool.
Here is a small slice of what you can do with SDR:
Receive pictures from the International Space Station (I apologize for the very cliche YouTube image in that link).
Unlock or start people’s cars (it’s terrifyingly easy, and I’ll use this as an example for integrating “collaborative hacking” at the table).
Create a low-key, low-tech internet using packet radio protocol.
Receive pager/beeper messages (still widely used by hospitals).
Transmit pager/beeper messages (to those same hospitals).
Broadcast announcements to CVS customers.
Set off those little pagers they give you at restaurants which let people know your table is ready (absolutely no reason to do this IRL except to be an asshole and make host/server’s lives harder - but in a TTRPG setting you can use it for creating lots of chaos).
Receive ADSB information (eg., where airplanes are).
Transmit ADSB information (ie, make yourself look like an airplane, complete with spoofed ICAO24 and lat/long data).
Overwhelm freqs with static or unstructured data (aka “radio jamming”).
Transmit bluetooth spam to crash people’s phones.
Oh, and you can listen to AM, FM, HAM, CB, emergency services dispatch, longwave, and shortwave radio.
Remember: you don’t need a license to listen/receive. But if you’re going to transmit, do so at your own risk!
3. At the Table
So, you’ve given your players a handheld SDR device. Since these devices exist on the market today, they’ll exist on the market tomorrow and hundreds of years from now (if society still stands) - but even better and more capable. Putting all our bullshit out there on radio waves will likely never change even 1000 years into the future.
Now, let’s talk about what’s involved in the tomfoolery described in the previous section. “Collaborative hacking” will become apparent when I discuss the legwork, and collaborative hacking is the name of the game because, at the end of the day, using the computer is the easy part. The real fun and adventure (and where you want table play to be) is all the stuff involved before someone pushes the big HACK button.
Let’s use the example of unlocking/starting someone’s car, because I can see this being used in a sci-fi setting to steal a spaceship.
I used this on my old car years ago (2012 Chevy Volt with the manufacturer’s unlock/remote start system) and my wife’s car (2018 Hyundai Sonata with an after-market unlocking/remote start system).
These are the hoops I had to jump through for both (and what can be used as the framework for adventure for players):
This is called a “man in the middle” attack.
Obtain the FCC ID of the vehicle’s transmitting device (the key fob).
Look up the ID in the FCC’s database to find out what freq it transmits on.
Ensure my antenna can receive and transmit the freq.
If not, make or obtain an antenna which can receive and transmit the freq. I didn’t know this information off the top of my head, so I had to look up the type of antenna I was using (vertical, telescoping antenna) and set it to the correct length using a vertical antenna calculator.
Be close enough to monitor the freq with my SDR (as you probably know, key fobs aren’t long range).
Press record on my SDR before the key fob transmits the unlock or remote start signal. Since I was the one pushing the button, that part was easy. If you were trying to passively catch the signal, you’d need to anticipate the action.
Once I recorded it, I simply played it back for the car, and it unlocked. Starting took a bit longer to nail down because I had to receive all three lock signals followed by the remote start signal, and sometimes there was enough interference that the signal wasn’t recorded clear enough, and so playing it back at the car did nothing.
As you can see, very little of this involves computers or code or super-hackery typing. The only “computer-stuff” involved is just pushing a button at the end a couple of times, which any moron like me can do.
This can be translated to an entire game session.
Scenario Gameplay Objective
Players are tasked with stealing a spaceship.
I imagine that a spaceship would have some kind of starting/booting procedure rather than a key turn, probably some kind of de-docking protocol with space traffic control which involves an encrypted handshake (to prevent any yahoo from yoinking a starship), and of course an on-board handshake between the pilot and the ship to begin the procedures described above.
Most of this can be accomplished ad-hoc with either a future-y fob similar to a license or ID car, or some kind of implant.
Disclaimer: you’ll obviously want to fill the following with interesting challenges, roadblocks, and encounters appropriate for your setting. This section isn’t meant to be a straight-up adventure to run, just the generic bones of what players need to do and how you can craft an adventure around the idea of collaborative radio hacking.
Part One: Legwork
Social engineer the Pilot and maneuver him into a position in which his futuristic key fob can be looked at/scanned to obtain the FCC (or similar broadcast governing authority in the future) ID. Stealing the key fob for keepsies would tip off that something was up.
Alternatively (or if the fob is an implant):
Players need to obtain the make and model of the spaceship to give them a range of fob frequencies used for that very specific type of spacecraft.
There are literally an infinite number of radio frequencies, and millions that these kinds of devices can broadcast on IRL today (maybe billions/trillions in the future with future-tech encoding), so just scanning without footwork would be fruitless. You need a range.
Players use their SDR device to scan the previously obtained freqs when the Pilot is near to find out what freq the fob is broadcasting on.
Unless players are very lucky and happen to scan into the freq at the exact time of transmission, this would capture an incomplete signal, so they’d need to follow the Pilot again in the future to capture the entire signal.
Part Two: Research and Application.
Find out what kind of antenna is compatible with the transmission.
Source the material to build the antenna (IRL its as simple as solder, SMA connector, and thick gauge copper wire, but in the future the antenna might require more rare parts or perhaps copper itself is just very difficult to find/expensive).
Build the antenna.
Part Three: The Run
Learn the Pilot’s schedule.
Through social engineering.
Or stealing company records.
Or following him around for a while.
Be close enough to record the broadcast without drawing a bunch of attention (people with unusual gadgets that have DIY antennas jutting out of them tend to draw suspicion, ask me how I know).
Return at a later time when it’s safe to steal.
Transmit, steal. Job done.
Complications
Every part of the way, things can go awry, which is where the adventure begins.
How do players even know where the Pilot keeps his key fob (if it’s not an implant)? If they’re trying to pickpocket, how do they know which pocket it’s in? If they’re trying to smooth talk him, how exactly do you bring up someone’s key fob in conversation? A simple “roll to persuade” isn’t going to cut it here, players themselves need to find a way to integrate this into the conversation. RP shenanigans ensue.
Is a central database of devices and assigned freqs maintained and publicly available? What if a secondary adventure is required just to obtain a list of which devices are assigned which frequencies?
And/or my favorite: maybe freqs are so overpopulated in the future that there are assigned hours for freqs used by certain devices? Now players need to find out the correct time to broadcast, which also affects the timing of their heist. Pick the wrong time, and suddenly Future Radio Cops are playing “fox hunt” with your group for broadcasting outside authorized hours.
The above can easily last an entire session, more if your players really get into the weeds on RP. A somewhat casual session if your players are solely focused on the mechanics.
Hacking is a group effort. Sure, you can have a hacker-player sitting alone by the ship with their cyberdeck, rolling dice if that works for your group. But if not, this approach to hacking makes the whole thing more interactive and turns hacking into a group effort. If you’ve got a character who specialized in hacking or computers in general, give them some “knowledge freebies” to avoid complications.
But the legwork and danger is still shared, and so the adventure is shared.
5. SDR to Enhance Adventures
You don’t have to center an entire heist around SDR, though you can as a way to introduce it. It can also be a really fun tool for your players to use to interact with the world. Remember that damn near everything we have emits radio waves of some kind. Re-transmitting those waves to their destination can yield interesting results.
Also remember that entire devices may not transmit/receive, but perhaps some buried, obscure component does - thereby introducing a potential vulnerability. It may not be an obvious ACCESS THE MAINFRAME component, but it can be just enough to get a foot in the door to cause absolute chaos when used creatively (see my example of using TPM in section 6 below).
To revisit things you can do today with SDR, and how they can be used at the table:
Recieve pager/beeper messages (still widely used by hospitals).
Players can use this to spy on emergency services and adjust their own routes accordingly (providing emergency services are responding to some kind of chaos they’ve caused).
Transmit pager/beeper messages.
Players can take a more active role in emergency response services. They can overwhelm, confuse, and/or reroute emergency services by using SDR to send mass beeper messages.
Broadcast announcements to CVS customers.
Obvious, right? Cause a little chaos at Space Wal-Mart by sending messages over the loudspeaker. Make all customers exit the store at once to jam up exits, make all employees report to a specific section of the store, etc.
Recieve ADSB information (eg., where airplanes are).
I imagine that, in the future, a similar tracking sytem is used for space flights. Easy enough to track a specific ship.
Transmit ADSB information (ie, make yourself look like an airplane, complete with spoofed lat/long data).
Players can use this to:
Pull a Kansas City Shuffle. Spoof a ship they’re going to steal, disable the transponder on the ship while the SDR transmitting spoofed data is sent along its merry way in an escape pod.
Overwhelm Space Traffic Control by creating dozens or hundreds of imaginary ships, many on a collision course with other ships. Mass chaos. Or create chaos by just mimicing the ID of all ships in the area, copy+pasted a dozen times over. Now it’s a house of mirrors for both STC and other airplanes - which ship is the real ship and which is just a ghost?
Overwhelm freqs with static or unstructured data (aka “radio jamming”).
Obvious. But what’s not obvious is that players will need a beefy power source and an antenna that can handle it. That’s an adventure all by itself.
Transmit bluetooth spam to crash people’s phones.
Basically, this just spams a bunch of bluetooth hotspots. If a person’s phone IRL has bluetooth turned on, it’s going to try to track these hotspots. The phone works itself to death trying to keep track of them all, even though they’re all fake. The phone freezes and shuts off. Players can use this to make sure they aren’t recorded or if they need a brief communication blackout. IRL, the problem is fixed when someone restarts their phone (and it’s been patched out of a lot of phones, but for the sake of fun, the exploit hasn’t been patched for Space Bluetooth 300.1).
The list above is just a small slice. You can also monitor (and change) utility meters, monitor (and change) tire pressure readouts (keep in mind, only the read-out is changed, not the actual tire pressure), you can force those TouchTune jukeboxes to play whatever song you like (in its library).
The point is, everything around us uses radio freqs to communicate with itself. An obvious observation. But the recurring thread I’m seeing with a lot of these exploits that are available today and aren’t getting patched out is that there are some aspects which engineers (or perhaps, those footing the bill) don’t find worth it to encrypt or introduce security to, and they are things which appear to be very minor. This is human nature, and will never change, even 1000 years into the future, or whenever your campaign takes place. And it is those very minor things which can be used to create huge problems.
6. Case in point as a modern day example:
Who cares if you can receive tire pressure information on a semi-truck? Who cares if you can change the read-out? The tire pressure itself doesn’t change, so it’s not like someone can explode or deflate tires. No physical harm is actually being done to the semi-truck. It’s a minor thing.
Well, someone can slowly lower the read-out in one or multiple tires on a semi. Doesn’t cause any damage, but it does make the driver to pull over on an empty highway so he can inspect his tires, because he believes they’re deflating - that’s what the computer is telling him!
Now someone has managed to stop the driver’s vehicle and they’ve gotten him outside of it on an empty stretch of highway, and they did it without doing anything violent or physically damaging to the truck. Dealing with dispatch, internal cameras, and tracking devices is another matter.
But those things are distant, and emergency service response times are long…
Killer post. Came for the SRD talk (I can't read), stayed for guerilla radio, and ecstatic for space game shenanigans.