Helper at JFS. Triple Nine Society member. Views here are my own. ✞ 🇺🇸
USA
Joined April 2009
- Tweets4.7K
- Following2.8K
- Followers510
- Likes73.2K
Robert Rochte retweeted
In January 2016, the US Air Force decommissioned a single GPS satellite (SVN 23) and accidentally uploaded a 13.7-microsecond timing error into the broadcast navigation data. That 0.000013-second offset knocked BBC digital radio transmitters off the air for two days and broke police and fire dispatch networks across North America.
Today, an attacker with a software-defined radio can force that exact timing failure on a target building from across the street.
1. Why critical infrastructure relies on a 1970s radio signal
Cell towers, power substations, and stock exchanges all need their servers to tick in lockstep. Installing a commercial cesium atomic clock at every site costs roughly $65,000 per unit, so operators bolt a $200 GPS timing receiver to the roof instead.
That rooftop antenna listens to atomic clocks aboard 31 GPS satellites orbiting 20,200 kilometers above the Earth.
Civilian GPS L1 C/A was designed in the 1970s with no cryptographic authentication. Worse, by the time a satellite's radio signal travels 20,200 kilometers through space, it hits the Earth's surface at roughly -130 dBm (a tenth of a femtowatt). A 10-milliwatt transmitter plugged into a laptop in a parking lot is tens of millions of times stronger at the rooftop antenna than the real satellites in orbit.
2. Jam-and-spoof vs. synchronous time-walking
If an attacker uses an open-source tool like gps-sdr-sim on a $300 SDR to broadcast a fake timestamp that is an hour off, a modern timing receiver spots the sudden jump and switches to its internal backup oscillator.
To bypass that check, attackers use clock slewing, also known as time walking:
* Hard takeover (gps-sdr-sim): A basic attacker generates a pre-computed baseband file that starts at the current UTC second, transmits strongly enough to force the rooftop receiver to lose lock on the real sky and re-acquire the louder fake signal, and then plays back a programmed clock drift.
* Seamless carry-off (Synchronous spoofer): Against hardened receivers that alert on any signal drop, a more advanced spoofer uses a receiving antenna to track the live satellites in real time. It transmits a counterfeit signal matched to the exact code phase and Doppler shift of the real sky at the victim's antenna, ramps up its power by a few decibels to capture the receiver's Delay-Locked Loop (DLL), and pulls the timing pulse forward by 100 to 200 nanoseconds per second.
Because the drift stays inside the receiver's tracking threshold, the local clock slides smoothly away from UTC without raising a loss-of-lock alarm.
3. What breaks when a clock drifts by microseconds
Once a site's local clock drifts past a few microseconds, automated protection hardware starts shutting equipment down:
* 5G TDD cell tower mute (±1.5 microseconds): Most mid-band 5G networks use Time Division Duplexing (TDD), where towers transmit and receive on the exact same frequency by alternating time slots every few milliseconds. The 3GPP specification requires neighboring towers to stay synchronized within ±1.5 microseconds (a 3-microsecond maximum window between adjacent base stations). If a spoofed tower drifts past 1.5 microseconds, its 100-watt downlink burst transmits directly into the neighboring tower's uplink listening window, deafening the cell. To prevent cross-link interference, the baseband's synchronization watchdog automatically mutes the radio transmitter and drops every phone on the tower.
* 500 kV substation breaker trips (100 microseconds): High-voltage transmission lines use Line Current Differential Relays (ANSI 87L) at both ends of a wire to compare AC phase angles using GPS timestamps, while Phasor Measurement Units (PMUs) track grid stability across cities. Under IEEE C37.118, just 26.5 microseconds of timing error creates a 1% Total Vector Error on a 60 Hz line (31.8 microseconds on a 50 Hz grid). If an attacker walks one substation's GPS clock off by 100 to 200 microseconds, the differential relay sees a massive phantom phase shift between the two ends of the transmission line, assumes the cable has suffered a short circuit, and trips the main 500 kV breakers on a healthy power line.
* High-frequency trading halts (100 microseconds): Under European MiFID II RTS 25 rules, automated trading engines must timestamp every order within 100 microseconds of UTC. When the exchange's time-sync daemon detects that its GPS discipline has breached that 100-microsecond ceiling, compliance middleware halts order execution.
4. How infrastructure operators defend the clock
Upgrading an orbiting satellite constellation takes decades, so engineers harden the ground equipment across four layers:
* Galileo OSNMA and Chimera: Europe's Galileo constellation now broadcasts OSNMA (Open Service Navigation Message Authentication), which cryptographically signs the navigation data bits so a tool like gps-sdr-sim cannot forge satellite messages. Because an attacker can still record and delay genuine signed signals (a meaconing relay attack), newer systems pair data signatures with encrypted spreading-code markers like Galileo CAS and GPS Chimera.
* Multi-constellation and multi-band receivers: Timing receivers track GPS, Galileo, BeiDou, and GLONASS across both L1 and L5 bands simultaneously. Spoofing four constellations across multiple frequencies at once requires vastly more complex RF hardware.
* Anti-spoofing CRPA antennas: Critical sites use Controlled Reception Pattern Antennas (multi-element phased arrays) or choke-ring antennas that only accept signals arriving from high up in the sky and null out radio signals coming horizontally from a parking lot.
* PTP over fiber and rubidium holdover: Telecom and grid operators back up rooftop antennas with Precision Time Protocol (IEEE 1588v2) distributed over fiber-optic lines, paired with local Oven-Controlled Crystal Oscillators (OCXOs) or miniature rubidium atomic clocks. If the rooftop antenna drifts faster than the internal rubidium physics package allows, the timing card disconnects the GPS input and free-runs within 1 microsecond for up to 72 hours.
Robert Rochte retweeted
On the sixteenth of December 1960 a twelve-year-old boy was put on a table in a San Jose hospital, given electric shocks until he was unconscious, and had an ice pick hammered through the thin bone above each eye and swept from side to side through the front of his brain, because his stepmother had told the doctor he was defiant. The doctor's fee was two hundred dollars.
Howard Dully was a big, clumsy, daydreaming boy whose mother had died when he was five, and his father had married a woman called Lou who could not stand him. She took him to six psychiatrists. All six told her the problem was not the boy. The seventh was Walter Freeman, who had performed more lobotomies than any man alive, who drove between state hospitals in a van he called the lobotomobile doing them by the dozen in an afternoon, with no gloves and no surgical training, and who had once done twenty-five in a day. Freeman's notes on Howard, which Howard did not read for forty-four years, record the symptoms. He objects to going to bed. He turns the lights on when there is broad daylight. He does not react to love or to punishment. He has a savage streak. On that evidence, and Lou's signature, and two hundred dollars, Freeman wrote that the boy would benefit from a transorbital lobotomy and did it four days later.
Howard remembers the table. He remembers waking with two black eyes and a fever and no idea what had been done to him, because nobody told him, then or ever. His father never spoke of it. Lou put him into a state institution the following year, and the boy with the holes in his brain spent the next forty years in and out of asylums, juvenile halls, a jail, halfway houses and the street, drinking, drifting, never quite able to say why he was the way he was, with a photograph that existed somewhere of a doctor in a suit standing over a child with a steel spike in each eye socket.
At fifty-six, driving a school bus, he went to find out. He found his file in Freeman's archive at a university in Washington, in the doctor's own handwriting, and read for the first time what his stepmother had said and what the doctor had agreed to. He went to see his father, who was eighty, and asked him why he had let it happen, and his father said he had been bullied into it. Howard told the story on the radio in 2005 and five million people listened to a man weep over a piece of paper.
Walter Freeman was not a quack. He was a professor of neurology, the man who had brought the lobotomy to America, and the operation had won its inventor the Nobel Prize for Medicine in 1949. The journals published him. The hospitals booked him. The newspapers called it a miracle. He did it to three and a half thousand people, nineteen of them children, and he kept doing it until 1967, when a patient died on the table and the hospital took his privileges away, and he spent his last years driving the country in the van looking up his old patients to prove it had worked.
That is what settled science looked like from inside, to a twelve-year-old. A mother's complaint, an expert's confidence, a procedure with a prize behind it, two hundred dollars, and a lifetime nobody could give back.
The same institutions now tell you what your child should eat, in the same voice, with the same certainty, and the leaflet has a logo on it. Howard Dully is in his seventies and still cannot say what was taken. Nobody ever apologised.
Robert Rochte retweeted
My take on turning the ESP32-S31 into an SDR: up to 40 MS/s at 8-bit, VITA-49 over gigabit Ethernet, straight into gqrx.
github.com/alphafox02/s31-sd…
Robert Rochte retweeted
If an attacker parks outside your building with a $1,500 software-defined radio, a 5G smartphone will still drop its connection, connect to a fake 1991-era GSM tower, and hand over its permanent hardware identity in cleartext.
Every modern baseband modem still carries legacy 2G silicon for backward compatibility, and that 2G stack has no way to verify if a cell tower is real.
1. The architectural flaw: One-way tower trust
In 4G (LTE) and 5G, mobile networks enforce mutual authentication after the initial attach.
When your phone connects to an LTE tower, the network sends a random cryptographic challenge (RAND) alongside an Authentication Token (AUTN). Inside your SIM card, a secure processor checks that token against a 128-bit secret root key (K) burned in at the factory. If the tower cannot prove it shares that key with your carrier, the baseband drops the connection before any voice or text data flows.
In 2G (GSM), that check only runs in one direction.
When GSM was standardized in 1991, commercial software-defined radios did not exist. The protocol was built so the tower authenticates the SIM card to stop billing fraud, while the SIM card never authenticates the tower.
A 2G baseband processor will connect to any transmitter broadcasting a valid Mobile Country Code and a stronger signal (RXLev) than the surrounding towers.
2. How rogue base stations force the downgrade
Because a rogue tower cannot forge a 4G cryptographic signature, it forces the phone's baseband to abandon 4G and 5G entirely.
An attacker using an Ettus USRP B210 and a 10-watt RF power amplifier triggers this fallback in two ways:
* Selective RF jamming: The radio floods local 4G and 5G downlink frequencies with noise while leaving a 2G GSM frequency clean. When the phone loses its LTE signal, the baseband's cell reselection state machine scans all supported bands and locks onto the attacker's clean 2G beacon.
* Protocol downgrade injection: The attacker broadcasts a rogue LTE signal just long enough to catch the phone's tracking area update, then replies with an unauthenticated Tracking Area Update Reject (EMM Cause #7: EPS services not allowed) or an RRCConnectionRelease redirecting the modem straight to a 2G frequency.
The baseband assumes you walked into a dead zone and switches to 2G in about 10 seconds without prompting the user.
3. Identity theft, A5/0, and the SMS relay catch
Once the phone camps on the rogue 2G station, the attacker sends a standard Identity Request packet. The phone replies in cleartext with its 15-digit International Mobile Subscriber Identity (IMSI) and its hardware IMEI.
Next comes encryption. Normal 2G traffic uses the 64-bit A5/1 stream cipher, which can already be cracked in seconds using 2TB Kraken rainbow tables. Worse, the 3GPP specification (TS 44.018) requires every phone to obey a Ciphering Mode Command set to A5/0 (null cipher).
When the rogue tower sends A5/0, the phone turns off air-interface encryption completely. Any outgoing SMS or call from the victim's phone travels to the attacker's laptop as unencrypted GSM 7-bit bytes.
To intercept incoming two-factor SMS codes from a bank, the attacker has to go one step further. Because a rogue SDR in a car is not wired into your real carrier's core network, the bank's SMS won't route to the attacker's laptop automatically. Either the attacker uses a second radio to relay your phone's handshake back to the real carrier's 2G tower and cracks the A5/1 downlink key, or they simply jam 4G so your phone drops onto the real carrier's 2G tower and passively crack the A5/1 air traffic in Wireshark.
4. The modern defense: Cutting legacy silicon
You cannot patch a 1991 radio handshake without breaking backward compatibility, so OS vendors finally gave users a kill switch for the baseband:
* Android 12+ 2G kill switch: Android added the setAllowedNetworkTypesForReason API to the Radio Interface Layer (RIL). Turning off "Allow 2G" instructs the modem firmware to disable its GSM stack at the silicon level. If 4G is jammed, the phone stays in "No Service" instead of dropping to 2G.
* Android 14 & 15 null-cipher locks: Android 14 added a modem toggle to reject A5/0 null-cipher connections outright on supported hardware, and Android 15 added live system alerts whenever a tower requests an unencrypted connection or cleartext IMSI.
* iOS Lockdown Mode: Turning on Lockdown Mode disables the 2G baseband stack on iPhones.
* 5G Standalone (5G SA) SUCI: Even on 4G LTE, a phone still sends its IMSI in cleartext during the very first attach request before encryption starts. Pure 5G Standalone fixes this last gap: the SIM card uses ECIES public-key cryptography to encrypt your IMSI into a Subscription Concealed Identifier (SUCI) before a single packet leaves the antenna.
Robert Rochte retweeted
Most political conversations should start with the words:
"You are a mental communist. The world doesn't work like that."
Why?
Because the people who go into politics and journalism alike are the ones who have a model of the world in their head – and want to enforce it.
Every model is wrong. It is a model, not reality. But they are also the people with neither the humility nor the intelligence to recognize that. These people are proud.
The engineer tests his model against reality. When the bridge cracks, he changes the model. The farmer, the doctor, the shopkeeper, the mother of four – reality corrects them every single day.
The mental communist does the opposite. When reality doesn't fit the model, he changes reality. A new law, a new ministry, a new program – and when that fails too, a bigger one.
Hayek explained why the worst get on top: the power to plan other people's lives attracts those most certain they know how others should live, and the system rewards them for it. The humble don't run for office or write editorials. They build things.
In Poland we had a whole state run by people with a model of the world. The world didn't work like that. The shelves were empty.
So we need two things. Put people into politics who have met reality – who built something, ran something, paid for their own mistakes. And give whoever is in charge as little power as possible, because every model is wrong, and the damage grows with the power behind it.
The best politician is the one who knows his model is wrong – and therefore wants as little power as possible to enforce it.
So yes, start the conversation with this: "You are a mental communist. The world doesn't work like that."
Then show him how it does.
Pride – The Engineers of Human Souls.
Pride is not the craftsman’s satisfaction in good work. That kind of pride built cathedrals.
Pride is the certainty that you know better than other people how they should live.
Pride is looking at a society and seeing a machine – with yourself as the engineer.
Pride is impatience with reality. Reality is slow, messy, full of people who want different things. So pride replaces it with a plan.
Pride "loves" humanity and despises people. Humanity never argues back.
Pride is blind in one specific way: it cannot see what it does not know. Hayek called it the fatal conceit – the belief that a few clever people can know what millions know, each about his own work, his own family, his own street.
Pride wears the mask of compassion. "For your own good" – the most dangerous words in politics. C.S. Lewis warned that the worst tyranny is the one exercised sincerely for the good of its victims – because its enforcers sleep with a clear conscience.
Pride never admits a mistake. A failed plan was sabotaged, betrayed, underfunded – never wrong. So the next plan is bigger.
And pride never lives in its own design. The architect of the housing estate lives in the old town. The reformer of the school sends his children somewhere else. The planner never pays for his plan.
Now scale it up. Plato’s ideal city abolished the family among its rulers and told the people a useful lie. The French revolutionaries redesigned even the clock – ten hours a day; it lasted barely a year and a half. Trotsky promised that under socialism the average man would rise to the level of Aristotle, Goethe or Marx; what came out was a man queuing for bread and informing on his neighbor. Le Corbusier wanted to raze the heart of Paris for identical towers; his ideas shaped the grim estates on the edge of every European city – designed for a new man, inhabited by real ones. Today the same pride works in committees, redesigning language, the family and what children must learn about themselves. Quieter than a revolution. The same certainty.
The West’s best tradition starts from the opposite place. Socrates: the wisest man knows that he does not know. Chesterton: never take down a fence until you know why it was put up. Society is not a machine. It is a living thing – grown, not built. The statesman should be a gardener, not an engineer.
A free society does not abolish pride. It converts it: be as proud as you like of what you build – your house, your company, your family – and let reality judge it. The planner is proud of what he designs for everyone else, and never has to live in it.
The cure is the oldest one: know what you don’t know. And let people live their own lives.
Robert Rochte retweeted
🚨 30+ real estate agents. Different senders. Unique property inquiries. One phishing objective.
Proofpoint reveals how an attacker used personalized conversations and video meeting invites, including a link abusing Google's redirect service, to disguise phishing attempts.
Here's how the campaign worked: thehackernews.com/2026/10/ge…
Robert Rochte retweeted
Networking is basically your only shot at a job.
Build a network. Doesn’t even have to be in person. My current gig came from a Twitter fren.
Robert Rochte retweeted
Making the ASCII MMORPG of my dreams!
Right now, I’m mainly working on gameplay, but I’m also polishing the visuals.
Finally added a fake shadow for the character, made cloud reflections now that we have clouds, and fixed a bunch of little things.
Ansenjeo. #mmorpg #indiegames #ascii
Robert Rochte retweeted
The really swift and simple mode of attack on Marxian materialism and collectivism is simply pointing out that it is ugly, not proving that it is unpractical. It is in preventing people from desiring what the innovators think desirable, much more than in merely prophesying whether they can get what they desire.
Robert Rochte retweeted
Part 2, and my last post about my Shawn Ryan Show episode.
Last I heard, it had been edited. Then Shawn went on Diary of a CEO and described a woman whose interview he’d never release. That woman wasn’t me, unless he was lying.
But I never expected it to air, and here’s why:
I spent weeks prepping with Shawn’s team. I was booked to follow the money on TPUSA and the surveillance state, and naming names is what I do. I’m meticulous, and I never say anything I can’t prove. Then, right before we started filming, I was told I couldn’t name names. When I brought up who funds Flock Safety, the license plate cameras now in thousands of American towns, I was told not to say Andreessen Horowitz or Peter Thiel. You can’t follow the money without showing where the money flows. That’s when I realized this episode would never air, before we had even started.
So when I got home, I did what I do. I followed the money. And, turns out Shawn Ryan is invested in companies backed by the exact people I was told not to name, plus Israel.
(1) Anduril Industries: Ryan has been an investor since October 2025. Anduril started with surveillance towers and now builds drones and autonomous weapons. Peter Thiel’s Founders Fund led its June 2025 round, and Andreessen Horowitz co-led its $5 billion round in May 2026. Those are the two names I was told to leave out. In February 2026, Anduril’s founder, Palmer Luckey, made an undisclosed trip to Israel and met with Netanyahu and senior defense officials. By June, Anduril was setting up an Israel operation to sell to Israel’s Ministry of Defense. Shawn had Palmer on his show in February 2025 and invested eight months later.
(2) Shield AI: Ryan has been an investor since November 2025. It builds AI-piloted drones and fighter jets. Andreessen Horowitz led its first major round and has kept investing ever since. Shawn had its co-founder on the show the same season he invested.
(3) Sesh: Ryan has been an investor since August 2025. Its $40 million round was led by 8VC, the venture firm of Joe Lonsdale, who co-founded Palantir with Peter Thiel. Lonsdale was a guest on Shawn’s show on May 7, 2026, less than three months before I taped. Palantir signed a strategic partnership with Israel’s Ministry of Defense in 2024.
And Flock Safety, the company I came to talk about, is backed by Andreessen Horowitz, which led two of its rounds, and by Founders Fund, Peter Thiel’s fund.
So I was booked to expose who funds the surveillance state. I was told not to name Andreessen Horowitz or Peter Thiel. And the host has money in companies backed by Andreessen Horowitz, by Thiel’s fund, and by Thiel’s Palantir co-founder, including one that is building its business in Israel.
Then there’s the rest of it. Sarah Adams, his former network host, was messaging his team to keep me off (see Part 1 if you missed it). An IDF settlement contractor tagged the two of them together. Pro-Israel groups passed around her clip from his show as proof that Israel didn’t drive the war. And after his Diary of a CEO interview, accounts from the same network that spent the summer smearing me told everyone his “CIA woman” was me, citing “sources.” It wasn’t me. I never discussed a polygraph with Shawn Ryan, and it was never why I went on. So either he was talking about someone else, or somebody turned his story into a weapon against me.
Honestly, I don’t want the episode to air, and I told them so right after we taped, because it was a watered-down version of my work. How it all happened was a tough lesson learned for me in this industry. Now you know what was going on behind the scenes. If this episode doesn’t air, I can assure you it’s not because I’m a fraud. It’s because I won’t water down who funds the surveillance state, and I won’t sell out to protect anyone’s investments.
So there you have it.
Robert Rochte retweeted
The Tornado Cash case raises a key question:
Can software developers be held responsible for the open-source code they produce?
It could be the important tech-legal case of its time.
In his new documentary, @davidzmorris tells the full story and shows it's part of a recurrent theme of coder-vs-government faceoffs in history.
He previews the brilliant "Tornado Cash: Breaking Code" at Pubkey, NYC, next Wednesday.
luma.com/8v5af7ec
A sitting U.S. senator—sadly, *my* senator—saying she considers political intimidation a legitimate and desirable strategy.
This is not acceptable in a free country.
ON UCHICAGO CAMPUS: U.S. Senator from Michigan Elissa Slotkin hopes planned political prosecutions of republican leaders will scare young conservatives from getting involved in politics.
@ElissaSlotkin
Robert Rochte retweeted
The narrative space is an operational environment shaped by the words, deeds, and images of conflict participants.
Forces maneuver within this space to create relative advantage, preserve freedom of action, and influence behavior.
🧵Vincent Michel identifies cognitive isolation as the mechanism for gaining that advantage.
