Tracking North Korean Numbers

My Aussie mate, Mark Fahey, has spent a number of years studying the Democratic People’s Republic of Korea.  He passes on the following information about North Korean “spy numbers” stations:

“The Pyongyang numbers (designated V15) have either become less regular or changed their schedule since March. Its been a few months since I have personally received them – but I also haven’t been specifically tuning in for them lately so maybe I have simply missed noticing a timing change.

“If you want to find the North Korean numbers, they are read out in a block between songs within the regular programing of the Pyongyang Pangsong radio station. The choice of music immediately before the number block seems to indicate which recipient agent the transmission is directed to. For Agent 27 “We Will Go Together with a Song Of Joy” is played, whereas Agent 21’s song is “Spring of my Hometown.”

“The announcements typically take between 5 to 10 minutes to read dependent on the number of digits passed. The transmission schedule is variable; in early 2017 the broadcast alternated with a cycle of one week on Thursday night at 12:45AM Pyongyang Time (1615 UTC) and the following week on Saturday night at 11:45PM Pyongyang Time (1515 UTC).

“Pyongyang Pangsong can be heard on these shortwave band frequencies (it is also on MF & FM on the Korean peninsular):

3250 kHz Pyongyang 100KW Transmitter
3320 kHz, Pyongyang 50KW Transmitter
6400 kHa Kanggye 50KW Transmitter”

If you’re interested in learning about what life is like “Behind the Curtain“, Mark has compiled a detailed multimedia publication based upon his actual observations inside North Korea.  It is available at no cost via iTunes.

Monitoring NextGen ATC (on the cheap!)

A key component of next generation air traffic control is Automatic Dependent Surveillance – Broadcast (ADS-B). The current FAA mandate is for all included aircraft to output ADB-B transmissions no later than January 1, 2020. But you don’t have to wait to receive and map ADS-B. There is a lot of air traffic to be seen.

dump1090 as viewed via a remote web browser.

Some folks are using complete downloadable images that are set up to feed flight tracking services such as FlightAware. If you’re interested in doing this, The SWLing Post recently featured an article that you’ll enjoy. I wanted to explore whether I could use some items already on hand to see a map of overhead aircraft on any computer on my home network.

I pulled out an older Raspberry Pi Model B and a 4 GB SD-Card and installed a copy of Raspbian Jessie Lite. The Model B has been retroactively called a Raspberry Pi 1 Model B. It is equipped with 512 MB of RAM, two USB ports and a 100mb Ethernet port.

I decided to use a spare older RTL-SDR stick based on the RTL2832U and R820T chips. This USB device comes with a small antenna that I hoped would be good enough to get me started. It is not in any way optimized for the 1090 MHz signals that are used by ADS-B and is roughly 19 parts per million (ppm) off frequency. It cost a bit over $10 at a hamfest a couple of years ago. The designs have improved since the early models were offered. Newer models include a TCXO (thermally compensated crystal oscillator) for stability and accuracy.

I needed software to take signals from the RTL-SDR stick and plot them on a map. That software is “dump1090”, originally written by Salvatore Sanfilippo. I added an install stanza to the Makefile, along with a systemd service file, for a smooth system install. I also needed to install the RTL-SDR USB drivers. The complete installation runs “headless”, meaning no monitor, keyboard or mouse need be connected. Remote management can be done via ssh.

First, bring the Raspbian Jessie installation up to date.

sudo apt-get update
sudo apt-get upgrade

Add some needed packages.

sudo apt-get install git cmake libusb-1.0-0-dev

Compile and install RTL-SDR drivers.

git clone git://git.osmocom.org/rtl-sdr.git
cd rtl-sdr
mkdir build
cd build
cmake ../ -DINSTALL_UDEV_RULES=ON
make
sudo make install
cd ~
sudo cp ./rtl-sdr/rtl-sdr.rules /etc/udev/rules.d/

Prevent native DVB-T drivers from loading.

cd /etc/modprobe.d
sudo vi blacklist.conf

Add blacklist dvb_usb_rtl28xxu to the file and save. You may now reboot. After the system comes back online, plug in your RTL-SDR device and the driver should load. You may test by running rtl_test -t. If the device is properly seen by the driver you should see the following:

Found 1 device(s):
  0:  Realtek, RTL2838UHIDIR, SN: 00000001

Using device 0: Generic RTL2832U OEM
Found Rafael Micro R820T tuner
Supported gain values (29): 0.0 0.9 1.4 2.7 3.7 7.7 8.7 12.5 14.4 15.7 16.6 19.7 20.7 22.9 25.4 28.0 29.7 32.8 33.8 36.4 37.2 38.6 40.2 42.1 43.4 43.9 44.5 48.0 49.6 
[R82XX] PLL not locked!
Sampling at 2048000 S/s.
No E4000 tuner found, aborting.

Don’t be concerned by the “No E4000 tuner found” message. The E4000 is an older chipset that is no longer used by today’s RTL-SDR devices.

Compile and install the dump1090 code.

https://github.com/K2DLS/dump1090.git
cd dump1090
make
sudo make install
sudo systemctl daemon-reload

Configure dump1090 options.

cd /etc/default
sudo vi dump1090

Here’s what I placed in the file.

# Default settings for dump1090.
DUMP1090_OPTS="--quiet --net --lat xx.xxxxx --lon -yy.yyyyy --ppm 19 --gain -10"

–quiet runs in the background
–net starts a webserver so that you can access via a web browser
–lat set to YOUR decimal latitude (negative for South)
–lon set to YOUR decimal latitude (negative for West)
–ppm if you know the ppm tolerance of your device (otherwise omit)
–gain -10 which sets gain automatically

A full parameter list can be reviewed by typing dump1090 --help.

With an antenna connected you can perform a quick device check by typing dump1090 --interactive. If all is well you’ll see a screen like this:

Hex     Mode  Sqwk  Flight   Alt    Spd  Hdg    Lat      Long   Sig  Msgs   Ti/
-------------------------------------------------------------------------------
A39D11  S                                                         6     1    4
A25D36  S                     1775                                7     4    3
AAA593  S                     2575  205  075                      7     2    7
A25238  S                                                         4     1   12
A0480B  S                    19650                                8    28    3
ACF4DD  S                     3825                                7     2   14
A41F61  S           FDX3018   2800  211  025   40.428  -74.332   23    83    0
A6FFFE  S     1753  LXJ550   30475  371  226                      8    63    0
C060B3  S                     4625                                6    14    1
ACF69B  S                    23250                                6    25    1
A2D27C  S                    24000                               13    42    2
A0BF90  S                     9500  249  257                      5     3    9
A7D30A  S                    40000                                8   111    1
AE0192  S           SPAR958  32675                               22    93    0
ACC040  S                     7825                                8   146    2
ACA5DF  S                    26600                                6    79    0
A80C7B  S                     4550                                9   108    1
A7CC00  S                     7825                               35   123    0
ACF841  S     1507           14425                               50   132    0
A8C802  S           NKS149   23575  332  216   39.995  -74.262   12   160    0
A61949  S           UAL1105   2725                               14    60    0
AC2E20  S     1006           19925                               22   130    0
AB766A  S           DAL1526   8525  216  038   40.444  -74.213   81   249    0
AA4440  S                     5400  253  066                      6     6   13

Control-C exits this screen.

Now start the dump1090.service.

sudo systemctl start dump1090.service

If all goes well, a netstat -an will show that there is a binding to port 8080.

tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN

Now you can start up a web browser from any computer on your home network and see a map of planes overhead. If your router supports internal dynamic DNS you can name the RPi and access via something like http://skynet:8080. Alternatively, use the IP address, which can be obtained via ifconfig.

eth0      Link encap:Ethernet  HWaddr b8:27:eb:12:34:56  
          inet addr:192.168.1.123 Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::1234:5678:8765:abcd/64 Scope:Link
          inet6 addr: fd68:bee:1f21:2221::5/128 Scope:Global
          inet6 addr: fd68:bee:1f21:2221:1234:5678:8765/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:990830 errors:0 dropped:418120 overruns:0 frame:0
          TX packets:323700 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:87491798 (83.4 MiB)  TX bytes:207659746 (198.0 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

In this case, the URL would be http://192.168.1.123:8080.

Once the map appears, re-position it to your part of the world and enjoy learning about what is flying overhead. You can enhance your enjoyment by listening to your closest airport tower or air traffic control frequencies on a scanner. These transmissions use amplitude modulation (AM) and can be monitored an another RTL-SDR stick or a scanner, even a relatively old model.

Bad Mobile Device Manners In-Flight

Yesterday, a cacophony of irritating noises permeated my brain on board an otherwise pleasant United flight from Orlando to Newark.

Some airlines think they have improved service by providing free entertainment streaming on personal mobile devices. And of course, in-flight wifi is becoming ever more commonplace. Actually, what the airlines have done is saved a bundle of money on maintaining those personal seat back screens. They’ve also created a major new source of in-flight irritation.

The problem is not the airlines per se, but the inconsiderate and ill-mannered behavior of un-civil society members on board.

Let me make things clear. If your child is playing a game on their mobile device, turn off the sound. I don’t want to hear the bloops and beeps.

If you are watching a video, turn off the sound or use headphones. I am not interested in your video, no matter what it is.

If you are texting inflight I don’t want to hear a chime, buzz, or bell each time you receive a message. Turn them off.

If you are listening to music, use headphones and keep the volume at a level so that I don’t have to listen to your music. I don’t want to hear it no matter how good you think it is.

Cabin crews — please add a blurb to your in-flight announcements regarding courteous use of personal entertainment devices. Require use of headphones with any sound generating device. If you hear or see someone violating this request (which ought to be a rule) instruct the violator about expected behavior. Don’t ignore it to the point where I need to call you over to deal with it.

Hertz German Rental and a Slight Scuff(le)

I reserved an automotbile rental for the June stay in Friedrichshafen with Dollar. The rental was actually fulfilled by Hertz. I expected to pay about €92 for a weekend rental, including taxes.

The vehicle dropoff was on a Sunday morning at the sleepy Bodensee Flughafen and was unattended. I dropped off the keys as instructed. The vehicle was left in perfect condition.

When the charge came through about a week later, it was for over US $400. I was mystified and miffed. I had not (yet) been contacted by Hertz about any issues.

I contacted Dollar via their customer service web form, referencing my initial reservation number. No one from Dollar bothered to return my contact request about the billing discrepancy. When I returned home, about a week after the car was dropped off, I contacted Chase to dispute the excess charge.

Hertz in Germany billed me €290 for this!
Hertz in Germany billed me €290 for this!
Then, after a few more days, a letter arrived from Germany. The letter claimed €290 in damage to their vehicle. Nonsense. I probably did not drive it more than 15 km during the whole stay and there were no incidents. So, I reported the claim to Chase’s car rental insurance program.

I finally, after some weeks, received a photo of the damage. Just nonsense. As you can see, it is a minor scuff that a US car rental company would never be concerned about.

Be careful. If you rent a car in Germany, do a complete walk around and either take their insurance or have your own. Kudos to Chase and their United Explorer Card for having my back and paying the claim on this one with no trouble at all.

Transparency and International Funds Transfer

In June I attended the Ham Radio 2016 show in Friedricshafen, Germany.  I had the opportunity to purchase a nice, compact digital transceiver.  The Hytera PD365 cost surprisingly less than it would in the USA.  And, as a bonus, I could get the 19% Value Added Tax (VAT) refunded once I brought it home.

Sort of…

There are shops around the world that are setup to make the tax refund easy and will rebate it directly to your credit card.  Not so with Difona Communications GmbH, but they were able to provide a tax refund form at the show.  I had to get it stamped by customs upon leaving the European Union and then mail it back to the vendor in Germany.  They paid the refund via international wire transfer.

Here is where the fun began.  I received about $14 less than expected and set about trying to find out where the difference went.  It was not easy.  There is no transparency in such transactions.  I had to call my bank more than a handful of times before I could get to someone knowledgeable enough to assist.

Early calls revealed that the funds came in as US dollars via the Automated Clearing House (ACH).  The ACH received the funds from Fed Global.  What is Fed Global?  The Federal Reserve Bank.  The Fed suffers from a complete lack of transparency and will not speak to the consumer at all.  Kudos to those in Congress who want to audit the Fed.  I’m with you.

Anyway, after several weeks, numerous calls, and a case filed with the Consumer Financial Protection Bureau, I received an answer.

Fees were deducted from the amount that the vendor paid to me.  The vendor — Difona — indicated that this is what should be done at the time of the transfer.  Difona did not disclose this to me when I sent them an inquiry asking for documentation on the transaction.  Had this been disclosed, it would have saved me and others a lot of time spent on calls and emails to research the discrepancy.

Caveat emptor!

Hytera PD365 compact DMR radio
Hytera PD365 compact DMR radio
Still, I purchased a good piece of merchandise at less than 2/3 of the USA cost.  I learned that in the case of a VAT refund, it is better to deal with Global Blue particpating merchants.  Otherwise, expect to pay an undocumented and substantial fee for a wire transfer and expect no documentation or transparency.