Top
Best
New

Posted by RamboRogers 10/24/2024

Show HN: RF Hunter – Find hidden cameras and other devices(github.com)
This project is an RF Signal Scanner built using an ESP32, AD8317 RF detector, and various other components. It's designed to detect and measure RF signals in the environment and display the signal strength on an OLED display. It's useful to find hidden cameras, wiretapping devices, and other RF-enabled devices.
594 points | 175 comments
danbruc 10/24/2024|
Fun fact, you can actually detect semiconductor devices even if they are powered off and hence emit no radiation unless the design took specific precautions. This works by illuminating a region with high frequency electromagnetic radiation and then listening for the effects that PN junctions have on the reflected radiation due to their nonlinearity. [1]

[1] https://en.wikipedia.org/wiki/Nonlinear_junction_detector

amelius 10/24/2024||
> Thousands of diodes were mixed by the Soviets into the building's structural concrete, making detection and removal of the true listening devices by its American occupants nearly impossible.

Wow ...

alwa 10/24/2024|||
I wonder if it would be feasible, with modern techniques and sufficient motivation, to map where the “background” diodes ended up setting in the concrete; then to measure newer sweeps against that baseline.
mxuribe 10/24/2024||||
That's called playing the long game, and playing it quite cleverly!
daveguy 10/24/2024||
Not really. It makes it clear from the first attempted sweep they altered construction -- the opposite of a long game.
krisoft 10/24/2024||
That depends on what the game is. For example if they wanted the embassy to stay in their old already compromised premises they achieved that. (for about twenty years at least.) If they wanted the USA to spend a lot of money they also achieved that.
emmelaich 10/24/2024||
They knew about the devices in 1985, a few years after construction started in 1979 and construction didn't finish till 2000. They probably knew earlier than 1985. So it probably wasn't a big deal and would've cost the SU a lot and they were less able to afford it.
krisoft 10/25/2024||
> They knew about the devices in 1985, a few years after construction started in 1979 and construction didn't finish till 2000.

That happened due to the bugs found. This is the point I'm making. If your goal was to keep them where they were already are (Mokhovaya House) then the bag full of diodes mixed into the concrete did that perfectly for like 15ish years.

> They probably knew earlier than 1985.

Doesn't change that argument.

> So it probably wasn't a big deal and would've cost the SU a lot and they were less able to afford it.

We are talking about a few bags of diodes vs rebuilding three stories of the building with imported workers. This was a very cost efficient attack.

inglor_cz 10/25/2024||||
Several days ago, a long interview with the former Czech ambassador to Moscow, Vítězslav Pivoňka, appeared in Czech newspapers. Unfortunately it is mostly paywalled. [0]

As you could expect, bugs everywhere, but some were used for intimidation. E.g. he says, on a weekend morning, we were still in bed with my wife, when a cuckoo started cuckooing out of a wall. Yeah, it was a bug, and it was meant to emit sound and make you more nervous: "we know about everything that happens in your bed".

He said that the Russians never cross the red line of actually physically manhandling diplomats, but as far as bugs and psychological pressure go, there is nothing off-limits.

[0] https://denikn.cz/1549047/deptali-ho-kukanim-a-ponizovali-ha...

hoistbypetard 10/24/2024|||
Yeah!

It also makes me suspect that the device would not be super-useful in most environments today because our homes and offices have false positives littered all over the place. Such a countermeasure would be unnecessary now.

gorjusborg 10/24/2024|||
> our homes and offices have false positives littered all over the place

Sure, but location matters. Searching weird (for electronics to be), but line-of-sight places (like a bookcase) you might still have a good signal to noise ratio.

Teever 10/24/2024|||
Now you've got me wondering how common embedded RFID price tags are.

As I understand it clothes from Uniqlo have RFID tags in them.[0]

https://www.morerfid.com/uniqlo-rfid-tags/

nullc 10/27/2024|||
it's not just electronics cause positives-- corroded metal does too, anything that forms a semiconductor can get detected.
diggan 10/24/2024|||
> useful in most environments today because our homes and offices have false positives littered all over the place

Like the structural elements in your house/apartments have something similar to diodes in them, or what are you referring to?

mannykannot 10/25/2024|||
I had a vague recollection that rectifiers for battery chargers were once made out of stacked layers of oxidized copper disks, and then, in the article danbruc linked to, I saw this:

Note that other semi-conducting materials, such as a rusty nail or an oxidised piece of metal, also generate harmonic frequencies and may there­fore cause an NLJD to generate a false positive.

https://www.cryptomuseum.com/df/tscm.htm#nljd

It turns out that the rectifiers in question were copper - cuprous oxide - lead sandwiches:

https://hackaday.com/2022/04/20/copper-rectifying-ac-a-centu...

hoistbypetard 10/25/2024|||
I think a lived-in place has enough stuff in and near the walls to make this kind of scan less than useful. We have things hanging on the walls that'd distort it. Maybe an empty one would be OK now, but I think the ecobees all over the place would even distort it for those.
danbruc 10/24/2024|||
Here [1] are some pictures and additional details on NLJDs. You can get your own, for example the Orion 2.4 [2] for USD 15.2k (free shipping) [3].

[1] https://www.cryptomuseum.com/df/tscm.htm#nljd

[2] https://reiusa.net/nljd/

[3] https://spyassociates.com/orion-2-4-non-linear-junction-dete...

stavros 10/24/2024||
Oh good, I really wasn't prepared to pay the $7 for shipping that.
AlanYx 10/24/2024|||
Are nonlinear junction detectors still state-of-the-art for detecting hidden devices when powered off? Does anyone know if alternatives like electronic noses (to detect chemical signatures associated with IC packaging) and magnetic anomaly detection increasingly used for this?
7bit 10/25/2024||
[flagged]
transpute 10/24/2024||
2018, "Low budget consumer hardware espionage implant", 220 comments, https://news.ycombinator.com/item?id=40363704 & https://news.ycombinator.com/item?id=20190251 & https://news.ycombinator.com/item?id=15676737

2019, "Airbnb Has a Hidden-Camera Problem", 50 comments, https://news.ycombinator.com/item?id=24324300

2019, "How to find hidden cameras in your AirBnB", 300 comments, https://news.ycombinator.com/item?id=20457419

2023 repro of "Great Seal Bug" (1952): mechanical microphone, no power source, data exfiltrated via external directed microwave beam, https://www.youtube.com/watch?v=NLDpWrwijE8

Try measuring the RF emissions of:

  USB hubs
  AC power strips
  SSD enclosures
  monitors
transpute 10/24/2024||
Thanks for making this public. What's the ballpark BOM cost?

Could a directional antenna help with locating RF sources? There's some older work ("WokFi") on parabolic antennas for WiFi, https://web.archive.org/web/20140802123553/http://www.usbwif...

Here's another circuit design for AD8317, https://g8rwg.uk/articles/noise-meter-ad8317/

> The AD8317 module I’m using has the logarithmic slope set to 22mV/dB. I used the output of a Viavi JD785 at different frequencies to check the slope and dynamic range of the device. Linearity and dynamic range at 1GHz and 3.5GHz is good and as expected drops off at 144MHz and 6GHz.

pragmatick 10/24/2024||
> What's the ballpark BOM cost?

https://github.com/RamboRogers/rfhunter/blob/master/rfhunter... contains amazon links. About $100 although many of the required components come as packs.

bobmcnamara 10/24/2024||
Generally, directionality is tricky to do handheld over a wide bandwidth.

Another approach is a phased rx array, could even be as few as 2 antennas, and from that you get a bearing too.

amatecha 10/25/2024||
May I introduce you to: the Log-periodic dipole array antenna[0], allowing quite a broad response range with decent directionality in a single antenna. There's probably a practical limit to just how broadband you can make one, but just from a quick search I found one commercially-available antenna[1] that covers 120mhz-2.5ghz, for example.

[0] https://en.wikipedia.org/wiki/Log-periodic_antenna

[1] https://ara-inc.com/product/lpd-tactical/

bobmcnamara 10/26/2024||
Didn't read it, but it's going to be poor directivity for that meager bandwidth.

If you're going to go with that wide of a beam why not use a single element and wave it around?

I should also mention the third trade off, size, plays into this tool.

yftsui 10/24/2024||
The most effective way would be use a Thermal Camera, because a normal "hidden camera" you get from eBay will consume around 5 Watts - a significant heat dissipation.

For others, probably just get an off the shelf TinySA?

garblegarble 10/24/2024||
Another way to detect hidden cameras is optical augmentation, using reflections to locate lenses; this can detect cameras that aren't currently on / actively transmitting.

Some paper and product references:

- (PDF) http://s3.amazonaws.com/arena-attachments/1381379/c3a4e75132...

- https://www.spycatcheronline.co.uk/product/camera-detector/

- https://www.ijser.org/paper/Lens-Detection-System-using-Opti...

- https://patents.google.com/patent/US20090237668A1/en

rapjr9 10/25/2024|||
Look for "bug detector" on eBay, there are lots of RF and optical camera detectors and they are fairly cheap. They work, at least so far as detecting steady streams of WiFi data, and cellphone transmissions, I've tried a couple of them:

https://www.ebay.com/sch/i.html?_from=R40&_trksid=p4432023.m...

The optical camera detectors work based on a simple idea, red LED's are used to create a circular pattern of light and you look through a red filter at your space. A camera lens is concave and symmetric so it reflects the LED's in the same circular pattern. Blink the LED's. Look through the red filter and scan around the room. Anything that reflects a discernable circular blinking LED pattern is a lens or lens like. Basically it makes it easy to see everything that reflects light symmetrically back at you. Move around a little and anything with a lens will stand out. It only works with fairly large lenses though, a pinhole camera would not be detectable.

Their RF detectors have adjustable sensitivity and indicate amplitude of the signal. Good enough to track the transmissions back to the source, though they don't provide any frequency information. Range is somewhat limited so you have to move around a room to scan it.

TinySA works well for detecting RF sources also. I don't know what the exact update rate is but the one I have seems to update at least a few times per second. It's a little tedious to use, the RF spectrum is big and you'll find quite a few spikes from sources in it and you have to zoom in on each one to get the exact frequency and observe how it behaves (or maybe there is a way to select a peak of interest? I haven't played with it much.) You'll find FM radio stations, cellular communications, cordless phones, and lots more.

Most people are not going to be finding surveillance bugs in their homes or offices. However these things are useful for understanding what your RF environment is like or troubleshooting RF devices. Might be good for telling if your smart appliance is spying on you, for example if the detector beeps every time you change channels on your TV.

mschuster91 10/25/2024||
> Most people are not going to be finding surveillance bugs in their homes or offices.

Sadly, hidden cameras, microphones or other forms of espionage in the workplace are rare but not unheard-of in the recent past, e.g. Wal Mart [1] or Lidl in Germany [2]. Any shop with a tradition of union-busting I'd assume to be filled with all possible sorts of surveillance by default. On top of that come the sex pest cases like [3] - and these have exploded in the last years now that tiny bugs can be had for tiny amounts of money on Alibaba and whatnot.

[1] https://en.wikipedia.org/wiki/Labor_spying_in_the_United_Sta...

[2] https://www.spiegel.de/wirtschaft/stasi-methoden-beim-discou...

[3] https://www.nn.de/erlangen/erlanger-chef-filmt-kolleginnen-m...

Cthulhu_ 10/24/2024|||
That camera detector is pretty pricey; I once saw a low-tech solution that was basically a dyed card that you had to put in front of your phone camera with the light on, the light reflected by the camera lens would become very visible.

Of course, only a matter of time - if they don't already exist - before there's cheap spy cameras without a reflecting lens, like a solid state camera of sorts. I believe some years ago they were experimenting with that as an alternative to a front facing camera on phones.

RamboRogers 10/24/2024|||
TinySA looks cool! I want one.

I made a thermal camera https://github.com/RamboRogers/M5StickCPlus2-AMG8833-Thermal...

blincoln 10/25/2024|||
A thermal imager does make detection of most electronics very easy if they're powered on:

https://www.beneaththewaves.net/Photography/Images/Thermal_I...

When I travel, I use mine to sweep the room.

transpute 10/24/2024||
> TinySA

What's the frequency range and scanning speed of TinySA?

ghostpepper 10/24/2024||
This is cool. Is is all point-to-point wired inside? I can't imagine a PCB design would be too difficult if all the RF stuff is handled by the IC.
RamboRogers 10/24/2024|
yeah, it's just soldered up to the pins. More details here: https://blog.matthewrogers.org/b/8BCF175A-6CC6-4E61-8310-A91...
01100011 10/24/2024||
What I really want is something that detects any EMF above 60Hz.

When I was a kid I used to hook a coil of wire and a diode to a piezo earphone. I then listened to the emissions of various devices in my house. My Amiga 500 was particularly interesting.

I ran across a few projects that do the same thing but add an opamp and recording so you can generate sounds for electronic music.

banku_brougham 10/24/2024||
Can you give more detail so I can do this with my kid? I'm a not a hardware person but handy enough I think. How would I connect the diode to the coil? By coil do you just mean wound-up wire or is this an electronics component?
sardines 10/25/2024||
I haven't made one (much less with a kid) but I think the term to search for is "foxhole radio" or "crystal radio". Good luck!
anthomtb 10/24/2024|||
> any EMF above 60Hz.

Isn't that effectively all the EMF? You may be missing a prefix.

Edit: huh, turns out these frequencies do have some applications: https://en.wikipedia.org/wiki/Super_low_frequency

01100011 10/24/2024||
Anything above 0Hz radiates. EMF is short for 'electromagnetic field' which even DC produces, so I guess I could have worded it better.

In any case, I would want to detect the emissions from the CPU, memory bus and SD card traffic. Not all cameras are WiFi. Sure, that won't detect passive listening devices or other advanced techniques, but most people now are worried about video and that will have certain characteristic emissions.

Edit: Something like CamRadar, presented here: https://dl.acm.org/doi/10.1145/3569505

dmicah 10/24/2024|||
Check out: https://store.lom.audio/collections/elektrosluch-accessories
jdthedisciple 10/24/2024||
Genuinely curious: What do you expect to hear from your CPU or GPU?
dekhn 10/25/2024|||
In most cases it's a collection of different sounds including clicking and humming. In the case of my GPU it's a high pitched whine (inductor noise). You can create music by running specific instructions.
danparsonson 10/24/2024|||
Eeeeeeeeeeeeeeeeeeeeeeee!
declan_roberts 10/24/2024||
A way easier solution to this is to turn off all of the lights and look around with your phone camera.

The phone camera will pick up the bright IR lights that hidden cameras use to illuminate the room-- wireless or not.

Obviously this only works if the camera uses IR lights, but pretty much all of the sneaky ones do.

Ballas 10/24/2024||
Most phone cameras have pretty steep IR cut filters these days. The front camera on most phones still don't, so you have to use that.

That said, most of these spy cameras don't have IR illuminators...

runjake 10/24/2024|||
Lies. :-)

Somewhere in my HN comment history from a while back is a response to a person claiming that modern phone cameras can’t detect IR illumination and remotes.

I took a bunch of modern iPhones and Android phones, from colleagues in an IT dept, and demonstrated they can in fact see a bunch of different IR remotes and illuminators with the rear camera.

I could find zero cameras that could not see the IR.

I’m not sure where people got the notion they couldn’t.

pwg 10/24/2024|||
The ultimate answer is "it depends". And upon what it depends is the particular IR wavelength the camera emits to "illuminate" a scene in IR for night photography.

My cell phone's back camera will show IR light from IR remote controls (I've used it for just that to verify that a remote is transmitting). But I also have an outdoor IP camera with IR illumination in my back yard. The same cell phone camera sees zero IR emitted from the outdoor IP camera (even though it quite well lights up a fairly broad area of the yard at night).

So for my phone, if a 'spy cam' were using the IR wavelength the IP camera uses, I would never know it was present by using the phone camera. If it used something closer to the wavelength used by IR remotes, yes, then the 'spy cam' would light up via the phone camera.

lightedman 10/24/2024||||
"I’m not sure where people got the notion they couldn’t."

I make IR devices. My phone is the only one in the warehouse that can pick up their emissions - everyone else's cameras have IR filters with what appears to be a sharp ~750nm cutoff. I'm the only one that will pick up 800-1064nm with my cheap Samsung, and so I'm the only one doing the testing on those diode assemblies.

runjake 10/24/2024||||
Update: here's the comment: https://news.ycombinator.com/item?id=40513967
Ballas 10/25/2024||||
Ok, I'll admit that I have not tested that many phones, but all the phones I had in the last ~8 years would not detect my remotes unless I used the front camera. That could very well be because all the remotes I tested operate on 940nm instead of 850nm (the two common options), and the IR filter in my devices are so that it would cut the one but not the other. Or that they just have a much lower power level. Either way, most modern phones that double as cameras will have an IR cut filter of some sort, otherwise some photos appear weird - like the red glow from a fire will appear purplish-white.
JKCalhoun 10/24/2024|||
Guessing because they read that CCD's have IR filters on them.
deknos 10/24/2024|||
do you have examples of cameras or smartphone which do not have IR filters?
Ballas 10/24/2024|||
I don't but it's easy to test, just pick up a TV remote and press a button while pointing it towards the camera. It should look like a flashing white LED.

I should also mention that both IR illuminators and TV remotes are usually either 850nm or 940nm, I have not looked into that aspect of it. I imagine that it's possible that your camera can detect one but not the other...

botanical76 10/24/2024|||
Thanks, I had no idea about this.

My Google Pixel 8a doesn't show anything on either camera, but my friend's front camera did! It shows up light purple.

ddingus 10/24/2024|||
My phone goes up to 980nm and it is a Note 9.

Both front and rear cameras work.

The light shows up as a pinkish purple.

lightedman 10/24/2024||||
Easy test - check your black levels against someone wearing a black fabric or a reflective black surface. If you get a fair bit of grey in the image, odds are very great that you don't have an IR filter installed.
karlkloss 10/24/2024|||
Raspberry Pi sells a camera especially without IR filter.
amatecha 10/25/2024||
For anyone curious, that would be the "NoIR" camera: https://www.raspberrypi.com/products/pi-noir-camera-v2/
alwayslikethis 10/24/2024|||
Most of the bright IR lights you find on typical surveillance cameras actually visibly look a little red. I wouldn't think the same lights would be used if the intention is to spy in secret.
declan_roberts 10/24/2024|||
That's exactly right, and part of that is because they're cheap and put off some visible light.

Thankfully the perverts who put this stuff in airbnbs just go to amazon and search and buy cheap stuff, which is easy to detect.

kube-system 10/24/2024|||
The lower wavelengths like 850nm IR LEDs are visible. Some cameras use higher wavelengths like 940nm IR LEDs and they aren't.
RamboRogers 10/24/2024||
Well, maybe - it would need to have ir enabled. This also detects listening devices etc.
mbreese 10/24/2024||
Would this also be able to detect something like a camera that saves videos to an SD card to be retrieved later? Something that doesn't use WiFi or a radio?

That's the main limit I see, but I'm wasn't sure if it such a device would still generate enough RF intrinsically w/o a radio.

ddingus 10/24/2024||
Maybe those could be found with a parabolic antenna and possibly an amp, ideally one with a limited range one can control via software.

Once a few common signals are known, the software could do programmed patterns to ferret out easy ones.

coin 10/24/2024||
Title is misleading. It only detects RF. A hidden camera could record to storage for later upload in which case wouldn’t be transmitting continuously.
KeplerBoy 10/24/2024||
Depends on the sensitivity of the device. It might be possible to pickup the EMF of the camera, even if it's not actively broadcasting.

Every current carrying trace is an antenna.

killingtime74 10/24/2024|||
That would only be practically useful in an environment devoid of all other electronics. How would one tell between the non-transmitting spy cam and normal household electronics
KeplerBoy 10/24/2024||
By having some spatial/angular resolution. You'd need a large directional antenna or multiple antennas to have something similar to a phased array radar, but passively (i.e. listening only).
satori99 10/24/2024|||
What you really need is a Non-Linear Junction Detector. These can detect an unshielded device with transistors, even if it's off.

https://en.wikipedia.org/wiki/Nonlinear_junction_detector

RamboRogers 10/24/2024||
It doesn’t say “all”, it also doesn’t detect a someone in the closet, unless they’re transmitting.
ujikoluk 10/24/2024||
I have long dreamt about building a portable phased array for this purpose, but additionally using the phase difference between receivers to visualize where the transmission source is.

In effect a camera into the RF world!

transpute 10/24/2024|
Could be combined with AR, https://hackaday.com/2019/01/09/smartphone-app-uses-ar-to-vi...

DIY radio telescope tuned to 2.4Ghz WiFi, https://www.youtube.com/watch?v=g3LT_b6K0Mc

Image of physical building overlaid with RF sources, https://www.facebook.com/thethoughtemporium/posts/2162600763...

> When I made the first video and photoshoped my impression of what I thought this would look like, I never imagined it would actually be this close. It's official, our telescope can map the wifi in a building as if it were any other form of light.

ujikoluk 10/24/2024||
Oh neat! Yes that's the kind of imagine I want to see
thih9 10/24/2024|
Does anyone have a personal experience with finding a hidden camera in an AirBnB?
binarymax 10/24/2024||
Yes, but it was obvious and I didn’t use equipment. It was in Jan 2020 at an Airbnb “hotel” in Nashville. There were two smoke detectors in the room. One of them was not like the other. I wrapped it in toilet paper. I left it wrapped so the owners knew that I knew, but I didn’t bother reporting it because I rarely used Airbnb and it was a last minute trip. And then the pandemic hit and that was that.
JKCalhoun 10/24/2024||
> There were two smoke detectors in the room. One of them was not like the other.

I imagine too that the other was not like the one. ;-)

RamboRogers 10/24/2024|||
I found someone with a pen recording me. They left it on the desk, and I took it by mistake. I found it in my kit and realized it was a spy device.... yikes.
lynx23 10/24/2024||
Well, not in an AirBnB, but... Already years ago, they found one in the ladies room at work...
More comments...