This week we started shipping YARD Stick One, our
latest test tool for radio systems operating below 1 GHz. The first thing you
should know about it is that, unlike our popular HackRF
One, YARD Stick One is not a Software Defined Radio (SDR)
platform. Although we think that SDR is the overall best tool for the greatest
number of wireless applications, sometimes it is beneficial to have a simpler
tool for certain jobs.
The architecture of YARD Stick One is similar to Ubertooth One; it is a wireless transceiver IC on a
USB dongle. The IC takes care of digital modulation and demodulation, giving
you an easy-to-use interface for your own software running on the attached host
computer. YARD Stick One is the quickest and easiest way to start
experimenting with low speed digital wireless technologies including industrial
control systems, wireless sensor networks, smart meters, home automation
systems, garage door openers, and remote keyless entry systems.
The YARD Stick One story started when Travis Goodspeed introduced me
to the IM-Me
one snowy night at ShmooCon in 2010. He showed me how to use his GoodFET to program firmware on the
IM-Me, and we successfully tested radio transmission from the IM-Me in the
hotel bar. After returning home, I acquired an IM-Me, soldered up the GoodFET
Travis had given me (which was the first surface mount PCB I ever assembled),
and immediately set to work developing a spectrum
analyzer application which, to this day, remains perhaps the most useful
software available for the popular, hackable toy.
Months later, Travis and I presented Real Men Carry Pink
Pagers in which we encouraged others to use the CC1110-based platform for
testing and experimenting with digital radio communication systems. About a
year after that, atlas started showing people how to
use the CC1111, the USB-enabled version of the CC1110, to accomplish the same
things with a dongle connected to a laptop. His RfCat software allowed
people to do things in a few lines of Python that Travis and I achieved only by
compiling C for the 8051 microcontroller inside the CC11xx.
RfCat made experimentation with low speed digital wireless systems easier
than ever before, but it wasn't adopted as widely as I hoped it would be.
Probably the biggest reason for that is the fact that, for a long time, the
only way to get RfCat up and running was to buy a CC1111 development board,
assemble a GoodFET yourself, and then use the GoodFET to write RfCat firmware
onto the CC1111 board. It became apparent early on that we needed a device
designed specifically for RfCat, one that ships with RfCat firmware and is
ready to use. I designed the ToorCon 14 badge, which
was a great
success, but I wanted to make an even better platform available to the
YARD Stick One was intended to be the ideal platform for RfCat. In addition to
shipping with RfCat firmware, YARD Stick One is designed to operate effectively
over the entire frequency range of the CC1111. All of the previous CC1111
boards that I know of are designed to work in only one frequency band. For
example, you can get a CC1111 development board for 900 MHz or one for 433 MHz,
but, prior to YARD Stick One, you couldn't find a CC1111 board that worked well
in both those bands.
Where previous development boards have had built-in antennas, YARD Stick One
has an SMA connector that allows the use of higher performance external
antennas. It also has receive and transmit amplifiers for improved RF
performance. Like everything we make, YARD Stick One is open source hardware.
It took a long while to complete YARD Stick One and get it manufactured, but
we are finally shipping. Over the past couple years I've been able to get
pre-release boards out to atlas and a few other folks who are active in
wireless security research. For example, Samy Kamkar used YARD Stick One for
the remote keyless entry system
research that he presented at DEF CON in August.
To get started with YARD Stick One, I recommend atlas's videos along with several
written by early adopters of RfCat. You'll notice that, even though the users
of RfCat tend to be well versed in SDR, they find RfCat useful to get hacking
even faster on digital wireless communication systems.