There is no cable.
There is still a connection.
The badge that opens a door. The sensor on a factory floor. The phone in your pocket. They all speak a language that travels through the air.
Most security work begins with something visible: an IP address, a website, a network cable. Radio-frequency security asks you to look one layer earlier. What happens before the packet reaches the network? Who can hear it, who can send it, and why does the system trust it?
This is the first field guide in Beyond the Wire: a journey from the physics of a signal to the security of the systems that use it. No RF background required. Just curiosity, careful observation, and permission to test.
Seeing a signal is not the same as understanding it. Understanding it is not the same as breaking its security.
- Read the basic properties of an RF signal
- Separate radio behavior from security claims
- Map a wireless system’s trust boundaries
- Plan a safe, evidence-led first assessment
A little physics. A lot of possibility.
Radio waves are electromagnetic waves. An antenna couples electrical signals to electromagnetic fields, and another antenna can couple some of that energy back into a receiver. You do not need a physics degree to start, but four properties make almost everything else easier.
Frequency
How often a wave repeats. Measured in hertz (Hz). At 433 MHz, the field oscillates about 433 million times each second.
Wavelength
The distance one cycle occupies in space. Higher frequency means shorter wavelength: about 69 cm at 433 MHz, versus 12.5 cm at 2.4 GHz.
Amplitude
The size of a wave’s variation. A receiver must separate the desired signal from background noise and other signals, not merely detect something strong.
Bandwidth
The span of frequencies a signal occupies. A 2.4 GHz center frequency does not mean a signal occupies 2.4 GHz of bandwidth.
λ = c / fWavelength = speed of light ÷ frequency.
Use hertz for f to get wavelength in metres.
A carrier alone has no changing message here. Higher frequency means a shorter wavelength; amplitude changes wave height, not wavelength.
A signal does not stop at the property line.
Distance usually reduces received power. Buildings absorb and reflect energy; metal and terrain can block it; multiple reflected paths can reinforce or cancel each other. Move an antenna a little and reception may change a lot. This is multipath fading, not necessarily a change in security.
In the ideal far-field free-space model with antenna gains held fixed, doubling distance adds about 6 dB of path loss. Real sites are not ideal free space. Frequency alone cannot tell you a device’s range: transmit power, antenna gains, obstacles, receiver sensitivity, and the required signal quality all matter.
Ideal free-space, far-field model. Both antenna gains are 0 dBi; extra losses are 0 dB. Walls, fading, interference, antenna orientation, and receiver sensitivity are not modeled. This is not a range or decodability guarantee.
Noise, dB, and the meaning of “strong.”
dB is a ratio; dBm is an absolute power level. 0 dBm means 1 milliwatt, not “no power.” A 10 dB increase is ten times the power; roughly 3 dB is twice the power. Negative dBm values are normal at a receiver.
Signal-to-noise ratio (SNR) compares the desired signal with noise. If a desired signal is −70 dBm and the noise in the same measurement bandwidth is −90 dBm, SNR is 20 dB. Compare measurements made with compatible settings: changing bandwidth changes the amount of noise you include.
When unwanted transmissions are included with noise, the relevant ratio is often SINR: signal power divided by interference-plus-noise power. Do not add independent dBm levels directly; convert powers to linear units before summing them.
From waves to information.
A radio wave is not inherently a command, a password, or a file. A system has to agree on how to turn information into a signal and how to recover it at the other end.
Encoding represents information using an agreed structure. Modulation maps that representation onto a carrier. In AM, amplitude varies. In FM, frequency varies continuously with the message. Digital FSK chooses between tones; PSK changes phase; QAM combines amplitude and phase states.
Return to the waveform lab and compare Carrier, AM, and FSK. Notice what changes, and what does not. A real protocol adds timing, framing, synchronization, error correction, and rules for how symbols become useful messages.
| Stage | What it establishes | What it does not establish |
|---|---|---|
| Detection | Energy is observed. | Who sent it or what it means. |
| Demodulation | A symbol representation can be recovered. | That protected contents are readable. |
| Decoding | Data is interpreted using known rules. | That encryption was defeated. |
| Decryption | Ciphertext is transformed with a key and algorithm. | That an action is authorized. |
Follow the whole system.
Imagine a wireless door sensor. A magnet moves, the sensor emits a message, a gateway receives it, and an application changes the door status. That short journey crosses several trust boundaries. Select a layer to examine its security question.
Can the device keep a secret?
Review firmware updates, key storage, debug access, secure boot where applicable, and what happens if a device is stolen. A strong radio protocol cannot compensate for exposed long-term keys.
An assessment that stops at the waveform misses the software that acts on it. A gateway could validate the radio message perfectly but forward it to an API that trusts the wrong tenant. A device could use a sound protocol but leak its keys through a debug port.
Ask questions that can be tested.
- Can an unauthorized device enroll or pair with the gateway?
- Does the receiver verify message origin and integrity before acting?
- Can a previously accepted “door closed” message be accepted again?
- Can a lost device be revoked without replacing every device in the building?
- Does the application validate both device identity and the operation’s authorization?
None of these questions assumes an attack will succeed. Each makes a security assumption explicit, so it can be checked against evidence.
Where trust breaks down.
“Wireless is insecure” is not a useful threat model. The useful question is: which security property could fail, under what conditions, and with what consequence?
Confidentiality
Can an unauthorized party learn sensitive information?
Integrity
Can a message be changed without detection?
Authenticity
Can the receiver verify the claimed sender?
Availability
Can the service operate when legitimate users need it?
Replay, spoofing, and jamming are different.
Replay reuses an old message. Spoofing presents a false identity or message as genuine. Jamming deliberately interferes with reception. They require different conditions and different defenses.
A message can be encrypted and correctly authenticated yet still be replayable. Freshness mechanisms—such as counters or challenge-response nonces—help establish that an accepted message belongs to the current interaction. The next lab makes that distinction visible.
Gateway ready. No messages received.
A software-only state machine: flags stand in for authentication outcomes, not real cryptographic verification. Real freshness controls must also handle counter persistence, device resets, wraparound, and out-of-order delivery. No device is contacted.
First send the captured packet, then replay it. With freshness enabled, the duplicate counter is rejected. Disable freshness and repeat: the message’s valid authentication tag is not enough. Then test a forged packet with message authentication on and off.
What a credible finding sounds like.
“A signal was visible near the device.”
“In the authorized test setup, the gateway accepted a previously accepted command and changed state because freshness was not enforced.”
Document equipment, environment, settings, expected behavior, observed behavior, impact, prerequisites, and limitations. A clear, bounded conclusion is more valuable than a dramatic claim.
Meet software-defined radio.
Software-defined radio moves many radio functions into configurable software. The hardware still matters: its antennas, filters, amplifiers, tuning range, and analog-to-digital conversion set real limits on what you can observe.
Many SDRs provide I/Q samples: two components that preserve amplitude and phase information. Software can filter, visualize, and demodulate these samples. An FFT transforms a block of samples into a frequency-domain view. A waterfall stacks those views over time.
Short bursts from low-power devices are common in this region. Allocations and permitted uses vary by country. This is an unshifted, single-sided real-signal FFT whose bins are mapped onto illustrative RF labels, not a physical I/Q capture. Exact Hann coherent-gain normalization gives a unit-peak coherent real tone 0 dBFS; this is a tone-amplitude scale, not power spectral density or calibrated dBm. The synthetic background is deterministic, not a measured thermal-noise floor. No radio is received or transmitted.
Read the display, not a story into it.
A spectrum plots frequency horizontally and signal level vertically. A waterfall adds time, with color encoding the display’s level scale. A persistent narrow trace may suggest a steady carrier. Short bursts suggest intermittent activity. Neither pattern, on its own, proves a particular protocol or a security issue.
The display above is synthetic. Its FFT is computed from generated samples, its frequency labels are illustrative, and its level scale is dBFS, not calibrated dBm. It accesses no microphone, SDR, or radio hardware.
Three settings beginners often mix up.
- 01Center frequency
- Where the receiver is tuned. Tuning does not identify a protocol or grant permission to record it.
- 02Sample rate & bandwidth
- How much signal can be represented and processed. For real-valued sampling, a band-limited baseband signal must fit below half the sample rate; complex I/Q sampling can represent a total span approaching the sample rate around its center. Practical filters reduce usable bandwidth.
- 03Gain
- Amplification in the receive chain. More is not always better: too much gain can overload the front end, creating misleading peaks and distortion. Compare captures with documented settings.
RTL-SDR
A low-cost, receive-only entry point. Check the specific model’s tuning range and supported bandwidth.
SDR++
A receiver application with spectrum and waterfall displays, supporting multiple hardware backends.
GNU Radio
A signal-processing toolkit for repeatable workflows, including entirely synthetic, hardware-free experiments.
Universal Radio Hacker
Tools for investigating supported signals and protocol structures in authorized research.
Your first responsible RF lab.
Start without transmitting. These browser simulations, synthetic files, and lawful sample recordings let you build intuition without affecting other systems. A receive-only SDR and a suitable antenna can come later.
- 01
Define what is allowed.
Write down the devices, location, time window, frequencies, data handling, permitted techniques, and stop conditions. Ownership alone does not override spectrum law.
- 02
Establish a repeatable baseline.
Use a synthetic signal or an authorized sample recording. Save center frequency, sample rate, gain, antenna, software version, and expected behavior. Change one variable at a time.
- 03
Separate each analysis step.
Record what is observed, then what can be demodulated, decoded, or verified. Keep unknowns explicit. A failed decode may be a receiver or configuration problem.
- 04
Test a security hypothesis safely.
Use owned test devices, offline files, simulations, or a compliant isolated setup. Review authentication, integrity, freshness, provisioning, revocation, and backend trust where authorized.
- 05
Report, remediate, and retest.
Keep only necessary evidence, explain practical impact, propose specific controls, and coordinate disclosure with the system owner. Retest within the agreed scope.
Progress is stored only in this browser. A checklist supports assessment planning; it is not proof of security.
From a radio observation to a defensible finding
Follow one door sensor through the radio, gateway, and application. Ask which claim each piece of evidence can actually support.
Case file: the signal outside the building
A facilities team owns a wireless door sensor and authorizes a receive-only survey of its test installation. You can observe a repeating burst outside the building. A colleague calls it an access-control bypass. That conclusion jumps across several untested boundaries.
- Observation
- Energy and a repeating-looking pattern are visible in the receiver’s observed span, using the documented settings. The source attribution may still need confirmation.
- Next question
- Does an appropriate, authorized analysis recover a frame? If it does, distinguish public identifiers, protected payload, integrity fields, and unknown bytes. A readable identifier is not necessarily a credential.
- Trust boundary
- The gateway, not the waterfall, decides whether a message is accepted. Review device enrollment, message authentication, freshness, and the application’s authorization separately.
- Bounded conclusion
- Signal activity was observed outside the expected boundary. Confirm attribution before claiming that this specific device’s coverage extends there. Whether the exposure creates a confidentiality or control weakness depends on requirements and further authorized evidence.
A physical exposure can justify a review without already being a proven exploit. Report both the observation and the unanswered question.
Case file: the valid message that should not be new
In an isolated software model, a gateway has accepted authenticated counter 42. The same bytes arrive again. The authentication tag may still be valid because the message has not changed; validity does not establish that the message belongs to the current interaction.
- Authenticity and integrity
- The tag supports origin and integrity claims under the protocol’s key and algorithm assumptions. A symmetric tag establishes evidence of key possession, not unique device identity when the same key is shared.
- Freshness
- A correctly designed counter or challenge scheme rejects an already accepted message. Counter state also needs rules for resets, persistence, rollover, and legitimate out-of-order delivery.
- Authorization
- Even a fresh, authenticated device message may request an action that this device is not allowed to perform. The service must still enforce the operation’s permission.
- Availability
- Rejecting replay does not eliminate interference or device failure. Recovery, redundancy, monitoring, and safe defaults solve different parts of the problem.
Encryption, authentication, freshness, authorization, and resilience are complementary controls. Do not treat any one of them as a universal wireless-security switch.
Questions worth keeping beside the experiment.
Is a device identifier a password?
Not automatically. An identifier names something; an authenticator provides evidence for a claim. A design that treats a publicly observable static identifier as sufficient authority may be weak, but you must establish how the actual reader, gateway, and application make the decision.
Does receive-only hardware make every experiment permissible?
No. Reception, recording, decoding, retention, and redistribution may each have legal or privacy restrictions. Written permission also has a scope. Prefer synthetic signals and approved sample files when the real-world boundary is uncertain.
What should a useful finding contain?
State the control and expected behavior, exact authorized setup, prerequisites, repeatable observed result, practical impact, evidence, limitations, and remediation. Separate an observation from an inferred cause, and do not assign impact to a deployment you did not assess.
Put the chapter to work.
Three controlled assignments connect the explanation to a repeatable observation. Record a prediction, change one variable, compare the result, and check the reasoning.
Separate frequency from amplitude
Predict which controls change wavelength and which change only the displayed height.
Procedure
- Start near 433 MHz and note the wavelength.
- Move frequency to 2,400 MHz without changing amplitude.
- Keep frequency fixed and change amplitude. Compare the height and wavelength.
Expected observation
The free-space wavelength is about 69.2 cm at 433 MHz and 12.5 cm at 2.4 GHz. Changing amplitude alone leaves wavelength unchanged.
Read the related chapterExperiment record
Predictions, observations, and answer-check progress stay in this browser. Export before clearing site data. Do not enter secret keys, credentials, or unrelated communications. Passing a check is a learning result, not a certification or real-world security finding.
Check your signal.
Before you move on, test the three distinctions that matter most. This is a learning check, not a certification; every answer includes an explanation.
Seeing the signal is only the beginning.
The air may be invisible, but its trust boundaries are not. RF physics explains what a receiver observes. Signal processing helps recover structure. Security assessment asks whether the complete system trusts the right devices and protects the right actions.
Stay curious about the signal.
Stay precise about the evidence.
Go to the source.
Adapted and expanded from your Beyond the Wire — Part 1 manuscript. The browser labs and additional explanations are teaching models, not equipment measurements. Consult your national communications regulator for current local rules.
Original source archive202 source paragraphs retained separately.
The edited reading edition above includes the technical clarifications and corrections. This Word document is preserved as supplied for provenance; its wording, illustrations, code formatting, and external setup advice are not silently rewritten. Treat it as an unedited source archive, not a second corrected edition.
Download the original Word documentFirst, understand the wave.
RF fundamentals: frequency, propagation, bandwidth, antennas, and sampling.