SCADA Decorder

Status
Not open for further replies.

KC2CQD

Member
Feed Provider
Joined
Aug 14, 2009
Messages
100
Location
Angola, NY
Maybe this is the wrong place for this but here goes.

Erie County, NY Sewer Authority uses SCADA systems to monitor things like flow rates and other data.
I've found a nearby hit at 159.330 MHz.
I've tried looking around for software to decode the data burst but have had zero luck.
Does such a decoder exist and if so, where can it be found?
 

1268

Member
Premium Subscriber
Joined
Jun 11, 2005
Messages
487
My question would be why would you need that information? Because it's used in the operation of a public water & sewer system you could very well be crossing some lines trying to decode those transmissions.
 

KC2CQD

Member
Feed Provider
Joined
Aug 14, 2009
Messages
100
Location
Angola, NY
A surprisingly number of people here are stubbornly not curious (yet monitor fire and police).
Well, I have a TRL-SDR and I find signals all over the place.
I've got applications for ADS-B, ACARS< AIS and such. I even joined ATCS Monitor for railfanning.
So of course, I hear the Sewer Authority SCADA and just wanna see just how much shi*t flows down hill :p
 

chrismol1

P25 Trucking!
Joined
Mar 15, 2008
Messages
1,369
My honest answer to that question is simple curiosity. Nothing more, nothing less.
Don't ask about scada on here, you'll be called a terrorist its not the first on here related to monitoring water data. I'd be interested too, simply to see what exactly is involved. Pump pressure? water flow? I'm not exactly sure what it would show. Some folks equate it with listening to fast food orders, why bother.
Many people interested in decoding all forms of signals for the hobby of scanning radio signals they come upon. Unfortunately some talks of terrorism related concerns which is interesting coming from a site with a focus on monitoring emergency services
 

KC2CQD

Member
Feed Provider
Joined
Aug 14, 2009
Messages
100
Location
Angola, NY
Don't ask about scada on here, you'll be called a terrorist its not the first on here related to monitoring water data. I'd be interested too, simply to see what exactly is involved. Pump pressure? water flow? I'm not exactly sure what it would show. Some folks equate it with listening to fast food orders, why bother.
Many people interested in decoding all forms of signals for the hobby of scanning radio signals they come upon. Unfortunately some talks of terrorism related concerns which is interesting coming from a site with a focus on monitoring emergency services
I hear ya!
 

iMONITOR

Silent Key
Joined
Sep 20, 2006
Messages
11,156
Location
S.E. Michigan
I am curious as to why you say this? Any reason in particular it should be encrypted?

A substantial amount of critical infrastructure is controlled by SCADA devices. Power plants, water & sewer, flood control, oil & gas/pipelines, mass transit, food production, traffic lights, manufacturing systems, ETC. If they susceptible to hackers and tampering results could be catastrophic! It's not something you want to play with and doing so in today's political climate could be considered is an act of terrorism.
 

kf8yk

Member
Joined
May 3, 2003
Messages
838
I've tried looking around for software to decode the data burst but have had zero luck.
Does such a decoder exist and if so, where can it be found?

SCADA is somewhat of a generic term and does not refer to a particular radio protocol. In fact SCADA can be transmitted across many communication mediums including radio, analog wireline, digital wireline, Ethernet or fiber. Complex SCADA systems often use a mix of communication mediums.

Most modern SCADA data radios use proprietary encoding methods and only the same make and model of radio will communicate. Some SCADA systems use the data bearing capabilities of standardized formats like P25 or DMR, especially if there's an existing voice system to piggyback on. Older systems often used Bell 103 or 202 compatible modems. As you can see there's no standard SCADA decoder because there's no such thing as a 'standard' SCADA system.

The data transmitted across the communications link is often Modbus, DNP3 or some proprietary format. Assuming you could decode this data you're not going to find any kind of descriptive text in the messages. Messages would be something like "Set coil 17 on" or "Input register 5=0x1F40". Without having access to the facility documentation it's going to be tough to correlate these I/O points to real world values.

As other have noted many of these systems are implementing encryption on the communications links. Most current data radios for the SCADA market include encryption built in. External encryption devices can be inserted between the data radio and the RTU to retrofit existing installations.
 

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,564
Well, I have a TRL-SDR and I find signals all over the place.
I've got applications for ADS-B, ACARS< AIS and such. I even joined ATCS Monitor for railfanning.
So of course, I hear the Sewer Authority SCADA and just wanna see just how much shi*t flows down hill :p

And I have looked at things (figured out the codig myself) as obtuse as institution clock broadcast at 72 MHz and 460's MHz just to goive an example. (Yes, also done ADS-B, ACARS, AIS, and various INMARSAT modes.) Add in monitoring TPMS (tire pressure monitoring systems), home weather stations, my electric and water meters. Personally, often more interesting than listen to the dead air between public service transmissions.
 

stantorres

Member
Joined
Feb 22, 2008
Messages
80
Location
Auburn Hills, MI
My understanding is that if you decoded it you would just get a bunch of numbers. For example, 0123 01 might mean that sensor #123 is reporting status is 01. If someone closed that valve it might transmit 0123 02. But there would be no way for you to know what 0123 was and no way to know if status 01=open and 02=closed or if it was full/empty, hot/cold, high/low or whatever. Could be a light bulb, a lawn sprinkler, a toaster oven, the parking lot lights at the courthouse, or who knows.
 

mmckenna

I ♥ Ø
Joined
Jul 27, 2005
Messages
26,577
Location
United States
We had a SCADA system (irrigation control) pop up on one of our repeater inputs a few years back.
The group that uses the repeater are a pretty tech savvy bunch. One of them streamed it out of their SDR and decoded it (it's was nothing fancy, just some data format I can't recall). All you'd see would be a bunch of meaningless numbers. Unless you know exactly what system/format/etc they are using, there usually isn't headers describing what the fields are in the data stream. It's just raw data fed out of one system and back into a computer. None of the data did me any good in figuring out who it was, still took a lot of driving with a Yagi and an insane amount of luck to find them.

As for security, SCADA is used in both directions. It can measure water levels, but it can also be used to turn pumps on/off, open/close valves, etc. Intelligent users would make sure that someone with a BaoFeng couldn't get into the system and start messing with things.
 

chrismol1

P25 Trucking!
Joined
Mar 15, 2008
Messages
1,369
And I have looked at things (figured out the codig myself) as obtuse as institution clock broadcast at 72 MHz and 460's MHz just to goive an example. (Yes, also done ADS-B, ACARS, AIS, and various INMARSAT modes.) Add in monitoring TPMS (tire pressure monitoring systems), home weather stations, my electric and water meters. Personally, often more interesting than listen to the dead air between public service transmissions.
Whats that software? Oh man, thats gonna be my new jam. Forget dental associates offices. I want to become a self appointed tire pressure monitor. Set it up by the road or roam the parkings lots wielding my mighty magic power and have the dirt on everyone's tire status. Your tire privacy is no longer private
 

MUTNAV

Active Member
Premium Subscriber
Joined
Jul 27, 2018
Messages
1,464
Whats that software? Oh man, thats gonna be my new jam. Forget dental associates offices. I want to become a self appointed tire pressure monitor. Set it up by the road or roam the parkings lots wielding my mighty magic power and have the dirt on everyone's tire status. Your tire privacy is no longer private
I assume your trying to be mocking, but they do have reprogramming devices for tire pressure monitors, when tires are replaced, sometimes the shop doesn't do a good job setting them when a tire is replaced.

Maybe it could be like the illegal game "trolling for tailights", when you get into a pack of cars that are speeding, set off every-ones radar detector, and count how many brake lights you see. Except you would have to set up near a tire shop, and see if they get increased traffic when tire pressure monitoring systems malfunction when passing by.

BTW, both of which are / would be stupid games.

Thanks
Joel
 

MUTNAV

Active Member
Premium Subscriber
Joined
Jul 27, 2018
Messages
1,464
Already answered, but to put it in plain language, injecting malicious commands into such systems could lead to destroyed equipment and/or destroyed lives.
Ok... in plain language with an example,

the SCADA system on a coal fired power plant was hacked years ago and supply inlet systems were opened and exhaust systems shut off, resulting in the destruction of a portion of the plant... (I can't find the reference for this, I remember it from years ago. SCADA is widely considered to be a way for malicious "powers" to damage the United States, that's why people get concerned when questions are asked about them, even if the questions have a curious origin.


Thanks
Joel
 

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,564
Whats that software? Oh man, thats gonna be my new jam. Forget dental associates offices. I want to become a self appointed tire pressure monitor. Set it up by the road or roam the parkings lots wielding my mighty magic power and have the dirt on everyone's tire status. Your tire privacy is no longer private

RTL433 will decode TPMS and home weather stations.
 
Status
Not open for further replies.
Top