Show HN: RF Hunter – Find hidden cameras and other devices
167 comments
·October 24, 2024danbruc
Fun fact, you can actually detect semiconductor devices even if they are powered off and hence emit no radiation unless the design took specific precautions. This works by illuminating a region with high frequency electromagnetic radiation and then listening for the effects that PN junctions have on the reflected radiation due to their nonlinearity. [1]
[1] https://en.wikipedia.org/wiki/Nonlinear_junction_detector
amelius
> Thousands of diodes were mixed by the Soviets into the building's structural concrete, making detection and removal of the true listening devices by its American occupants nearly impossible.
Wow ...
alwa
I wonder if it would be feasible, with modern techniques and sufficient motivation, to map where the “background” diodes ended up setting in the concrete; then to measure newer sweeps against that baseline.
null
mxuribe
That's called playing the long game, and playing it quite cleverly!
daveguy
Not really. It makes it clear from the first attempted sweep they altered construction -- the opposite of a long game.
inglor_cz
Several days ago, a long interview with the former Czech ambassador to Moscow, Vítězslav Pivoňka, appeared in Czech newspapers. Unfortunately it is mostly paywalled. [0]
As you could expect, bugs everywhere, but some were used for intimidation. E.g. he says, on a weekend morning, we were still in bed with my wife, when a cuckoo started cuckooing out of a wall. Yeah, it was a bug, and it was meant to emit sound and make you more nervous: "we know about everything that happens in your bed".
He said that the Russians never cross the red line of actually physically manhandling diplomats, but as far as bugs and psychological pressure go, there is nothing off-limits.
[0] https://denikn.cz/1549047/deptali-ho-kukanim-a-ponizovali-ha...
hoistbypetard
Yeah!
It also makes me suspect that the device would not be super-useful in most environments today because our homes and offices have false positives littered all over the place. Such a countermeasure would be unnecessary now.
gorjusborg
> our homes and offices have false positives littered all over the place
Sure, but location matters. Searching weird (for electronics to be), but line-of-sight places (like a bookcase) you might still have a good signal to noise ratio.
diggan
> useful in most environments today because our homes and offices have false positives littered all over the place
Like the structural elements in your house/apartments have something similar to diodes in them, or what are you referring to?
danbruc
Here [1] are some pictures and additional details on NLJDs. You can get your own, for example the Orion 2.4 [2] for USD 15.2k (free shipping) [3].
[1] https://www.cryptomuseum.com/df/tscm.htm#nljd
[3] https://spyassociates.com/orion-2-4-non-linear-junction-dete...
stavros
Oh good, I really wasn't prepared to pay the $7 for shipping that.
AlanYx
Are nonlinear junction detectors still state-of-the-art for detecting hidden devices when powered off? Does anyone know if alternatives like electronic noses (to detect chemical signatures associated with IC packaging) and magnetic anomaly detection increasingly used for this?
7bit
Admit it! That paragraph was taken from a techno babble generator ;)
transpute
2018, "Low budget consumer hardware espionage implant", 220 comments, https://news.ycombinator.com/item?id=40363704 & https://news.ycombinator.com/item?id=20190251 & https://news.ycombinator.com/item?id=15676737
2019, "Airbnb Has a Hidden-Camera Problem", 50 comments, https://news.ycombinator.com/item?id=24324300
2019, "How to find hidden cameras in your AirBnB", 300 comments, https://news.ycombinator.com/item?id=20457419
2023 repro of "Great Seal Bug" (1952): mechanical microphone, no power source, data exfiltrated via external directed microwave beam, https://www.youtube.com/watch?v=NLDpWrwijE8
Try measuring the RF emissions of:
USB hubs
AC power strips
SSD enclosures
monitorskshahkshah
I lost a keyfob a long while ago. I wonder if this could help me find it?
transpute
Thanks for making this public. What's the ballpark BOM cost?
Could a directional antenna help with locating RF sources? There's some older work ("WokFi") on parabolic antennas for WiFi, https://web.archive.org/web/20140802123553/http://www.usbwif...
Here's another circuit design for AD8317, https://g8rwg.uk/articles/noise-meter-ad8317/
> The AD8317 module I’m using has the logarithmic slope set to 22mV/dB. I used the output of a Viavi JD785 at different frequencies to check the slope and dynamic range of the device. Linearity and dynamic range at 1GHz and 3.5GHz is good and as expected drops off at 144MHz and 6GHz.
pragmatick
> What's the ballpark BOM cost?
https://github.com/RamboRogers/rfhunter/blob/master/rfhunter... contains amazon links. About $100 although many of the required components come as packs.
bobmcnamara
Generally, directionality is tricky to do handheld over a wide bandwidth.
Another approach is a phased rx array, could even be as few as 2 antennas, and from that you get a bearing too.
amatecha
May I introduce you to: the Log-periodic dipole array antenna[0], allowing quite a broad response range with decent directionality in a single antenna. There's probably a practical limit to just how broadband you can make one, but just from a quick search I found one commercially-available antenna[1] that covers 120mhz-2.5ghz, for example.
yftsui
The most effective way would be use a Thermal Camera, because a normal "hidden camera" you get from eBay will consume around 5 Watts - a significant heat dissipation.
For others, probably just get an off the shelf TinySA?
blincoln
A thermal imager does make detection of most electronics very easy if they're powered on:
https://www.beneaththewaves.net/Photography/Images/Thermal_I...
When I travel, I use mine to sweep the room.
garblegarble
Another way to detect hidden cameras is optical augmentation, using reflections to locate lenses; this can detect cameras that aren't currently on / actively transmitting.
Some paper and product references:
- (PDF) http://s3.amazonaws.com/arena-attachments/1381379/c3a4e75132...
- https://www.spycatcheronline.co.uk/product/camera-detector/
- https://www.ijser.org/paper/Lens-Detection-System-using-Opti...
rapjr9
Look for "bug detector" on eBay, there are lots of RF and optical camera detectors and they are fairly cheap. They work, at least so far as detecting steady streams of WiFi data, and cellphone transmissions, I've tried a couple of them:
https://www.ebay.com/sch/i.html?_from=R40&_trksid=p4432023.m...
The optical camera detectors work based on a simple idea, red LED's are used to create a circular pattern of light and you look through a red filter at your space. A camera lens is concave and symmetric so it reflects the LED's in the same circular pattern. Blink the LED's. Look through the red filter and scan around the room. Anything that reflects a discernable circular blinking LED pattern is a lens or lens like. Basically it makes it easy to see everything that reflects light symmetrically back at you. Move around a little and anything with a lens will stand out. It only works with fairly large lenses though, a pinhole camera would not be detectable.
Their RF detectors have adjustable sensitivity and indicate amplitude of the signal. Good enough to track the transmissions back to the source, though they don't provide any frequency information. Range is somewhat limited so you have to move around a room to scan it.
TinySA works well for detecting RF sources also. I don't know what the exact update rate is but the one I have seems to update at least a few times per second. It's a little tedious to use, the RF spectrum is big and you'll find quite a few spikes from sources in it and you have to zoom in on each one to get the exact frequency and observe how it behaves (or maybe there is a way to select a peak of interest? I haven't played with it much.) You'll find FM radio stations, cellular communications, cordless phones, and lots more.
Most people are not going to be finding surveillance bugs in their homes or offices. However these things are useful for understanding what your RF environment is like or troubleshooting RF devices. Might be good for telling if your smart appliance is spying on you, for example if the detector beeps every time you change channels on your TV.
mschuster91
> Most people are not going to be finding surveillance bugs in their homes or offices.
Sadly, hidden cameras, microphones or other forms of espionage in the workplace are rare but not unheard-of in the recent past, e.g. Wal Mart [1] or Lidl in Germany [2]. Any shop with a tradition of union-busting I'd assume to be filled with all possible sorts of surveillance by default. On top of that come the sex pest cases like [3] - and these have exploded in the last years now that tiny bugs can be had for tiny amounts of money on Alibaba and whatnot.
[1] https://en.wikipedia.org/wiki/Labor_spying_in_the_United_Sta...
[2] https://www.spiegel.de/wirtschaft/stasi-methoden-beim-discou...
[3] https://www.nn.de/erlangen/erlanger-chef-filmt-kolleginnen-m...
Cthulhu_
That camera detector is pretty pricey; I once saw a low-tech solution that was basically a dyed card that you had to put in front of your phone camera with the light on, the light reflected by the camera lens would become very visible.
Of course, only a matter of time - if they don't already exist - before there's cheap spy cameras without a reflecting lens, like a solid state camera of sorts. I believe some years ago they were experimenting with that as an alternative to a front facing camera on phones.
RamboRogers
TinySA looks cool! I want one.
I made a thermal camera https://github.com/RamboRogers/M5StickCPlus2-AMG8833-Thermal...
transpute
> TinySA
What's the frequency range and scanning speed of TinySA?
01100011
What I really want is something that detects any EMF above 60Hz.
When I was a kid I used to hook a coil of wire and a diode to a piezo earphone. I then listened to the emissions of various devices in my house. My Amiga 500 was particularly interesting.
I ran across a few projects that do the same thing but add an opamp and recording so you can generate sounds for electronic music.
banku_brougham
Can you give more detail so I can do this with my kid? I'm a not a hardware person but handy enough I think. How would I connect the diode to the coil? By coil do you just mean wound-up wire or is this an electronics component?
sardines
I haven't made one (much less with a kid) but I think the term to search for is "foxhole radio" or "crystal radio". Good luck!
anthomtb
> any EMF above 60Hz.
Isn't that effectively all the EMF? You may be missing a prefix.
Edit: huh, turns out these frequencies do have some applications: https://en.wikipedia.org/wiki/Super_low_frequency
01100011
Anything above 0Hz radiates. EMF is short for 'electromagnetic field' which even DC produces, so I guess I could have worded it better.
In any case, I would want to detect the emissions from the CPU, memory bus and SD card traffic. Not all cameras are WiFi. Sure, that won't detect passive listening devices or other advanced techniques, but most people now are worried about video and that will have certain characteristic emissions.
Edit: Something like CamRadar, presented here: https://dl.acm.org/doi/10.1145/3569505
jdthedisciple
Genuinely curious: What do you expect to hear from your CPU or GPU?
dekhn
In most cases it's a collection of different sounds including clicking and humming. In the case of my GPU it's a high pitched whine (inductor noise). You can create music by running specific instructions.
danparsonson
Eeeeeeeeeeeeeeeeeeeeeeee!
ghostpepper
This is cool. Is is all point-to-point wired inside? I can't imagine a PCB design would be too difficult if all the RF stuff is handled by the IC.
RamboRogers
yeah, it's just soldered up to the pins. More details here: https://blog.matthewrogers.org/b/8BCF175A-6CC6-4E61-8310-A91...
declan_roberts
A way easier solution to this is to turn off all of the lights and look around with your phone camera.
The phone camera will pick up the bright IR lights that hidden cameras use to illuminate the room-- wireless or not.
Obviously this only works if the camera uses IR lights, but pretty much all of the sneaky ones do.
Ballas
Most phone cameras have pretty steep IR cut filters these days. The front camera on most phones still don't, so you have to use that.
That said, most of these spy cameras don't have IR illuminators...
runjake
Lies. :-)
Somewhere in my HN comment history from a while back is a response to a person claiming that modern phone cameras can’t detect IR illumination and remotes.
I took a bunch of modern iPhones and Android phones, from colleagues in an IT dept, and demonstrated they can in fact see a bunch of different IR remotes and illuminators with the rear camera.
I could find zero cameras that could not see the IR.
I’m not sure where people got the notion they couldn’t.
pwg
The ultimate answer is "it depends". And upon what it depends is the particular IR wavelength the camera emits to "illuminate" a scene in IR for night photography.
My cell phone's back camera will show IR light from IR remote controls (I've used it for just that to verify that a remote is transmitting). But I also have an outdoor IP camera with IR illumination in my back yard. The same cell phone camera sees zero IR emitted from the outdoor IP camera (even though it quite well lights up a fairly broad area of the yard at night).
So for my phone, if a 'spy cam' were using the IR wavelength the IP camera uses, I would never know it was present by using the phone camera. If it used something closer to the wavelength used by IR remotes, yes, then the 'spy cam' would light up via the phone camera.
Ballas
Ok, I'll admit that I have not tested that many phones, but all the phones I had in the last ~8 years would not detect my remotes unless I used the front camera. That could very well be because all the remotes I tested operate on 940nm instead of 850nm (the two common options), and the IR filter in my devices are so that it would cut the one but not the other. Or that they just have a much lower power level. Either way, most modern phones that double as cameras will have an IR cut filter of some sort, otherwise some photos appear weird - like the red glow from a fire will appear purplish-white.
runjake
Update: here's the comment: https://news.ycombinator.com/item?id=40513967
JKCalhoun
Guessing because they read that CCD's have IR filters on them.
lightedman
"I’m not sure where people got the notion they couldn’t."
I make IR devices. My phone is the only one in the warehouse that can pick up their emissions - everyone else's cameras have IR filters with what appears to be a sharp ~750nm cutoff. I'm the only one that will pick up 800-1064nm with my cheap Samsung, and so I'm the only one doing the testing on those diode assemblies.
deknos
do you have examples of cameras or smartphone which do not have IR filters?
Ballas
I don't but it's easy to test, just pick up a TV remote and press a button while pointing it towards the camera. It should look like a flashing white LED.
I should also mention that both IR illuminators and TV remotes are usually either 850nm or 940nm, I have not looked into that aspect of it. I imagine that it's possible that your camera can detect one but not the other...
karlkloss
Raspberry Pi sells a camera especially without IR filter.
lightedman
Easy test - check your black levels against someone wearing a black fabric or a reflective black surface. If you get a fair bit of grey in the image, odds are very great that you don't have an IR filter installed.
alwayslikethis
Most of the bright IR lights you find on typical surveillance cameras actually visibly look a little red. I wouldn't think the same lights would be used if the intention is to spy in secret.
declan_roberts
That's exactly right, and part of that is because they're cheap and put off some visible light.
Thankfully the perverts who put this stuff in airbnbs just go to amazon and search and buy cheap stuff, which is easy to detect.
kube-system
The lower wavelengths like 850nm IR LEDs are visible. Some cameras use higher wavelengths like 940nm IR LEDs and they aren't.
RamboRogers
Well, maybe - it would need to have ir enabled. This also detects listening devices etc.
mbreese
Would this also be able to detect something like a camera that saves videos to an SD card to be retrieved later? Something that doesn't use WiFi or a radio?
That's the main limit I see, but I'm wasn't sure if it such a device would still generate enough RF intrinsically w/o a radio.
ddingus
Maybe those could be found with a parabolic antenna and possibly an amp, ideally one with a limited range one can control via software.
Once a few common signals are known, the software could do programmed patterns to ferret out easy ones.
coin
Title is misleading. It only detects RF. A hidden camera could record to storage for later upload in which case wouldn’t be transmitting continuously.
KeplerBoy
Depends on the sensitivity of the device. It might be possible to pickup the EMF of the camera, even if it's not actively broadcasting.
Every current carrying trace is an antenna.
satori99
What you really need is a Non-Linear Junction Detector. These can detect an unshielded device with transistors, even if it's off.
killingtime74
That would only be practically useful in an environment devoid of all other electronics. How would one tell between the non-transmitting spy cam and normal household electronics
KeplerBoy
By having some spatial/angular resolution. You'd need a large directional antenna or multiple antennas to have something similar to a phased array radar, but passively (i.e. listening only).
RamboRogers
It doesn’t say “all”, it also doesn’t detect a someone in the closet, unless they’re transmitting.
ujikoluk
I have long dreamt about building a portable phased array for this purpose, but additionally using the phase difference between receivers to visualize where the transmission source is.
In effect a camera into the RF world!
transpute
Could be combined with AR, https://hackaday.com/2019/01/09/smartphone-app-uses-ar-to-vi...
DIY radio telescope tuned to 2.4Ghz WiFi, https://www.youtube.com/watch?v=g3LT_b6K0Mc
Image of physical building overlaid with RF sources, https://www.facebook.com/thethoughtemporium/posts/2162600763...
> When I made the first video and photoshoped my impression of what I thought this would look like, I never imagined it would actually be this close. It's official, our telescope can map the wifi in a building as if it were any other form of light.
ujikoluk
Oh neat! Yes that's the kind of imagine I want to see
thih9
Does anyone have a personal experience with finding a hidden camera in an AirBnB?
binarymax
Yes, but it was obvious and I didn’t use equipment. It was in Jan 2020 at an Airbnb “hotel” in Nashville. There were two smoke detectors in the room. One of them was not like the other. I wrapped it in toilet paper. I left it wrapped so the owners knew that I knew, but I didn’t bother reporting it because I rarely used Airbnb and it was a last minute trip. And then the pandemic hit and that was that.
JKCalhoun
> There were two smoke detectors in the room. One of them was not like the other.
I imagine too that the other was not like the one. ;-)
RamboRogers
I found someone with a pen recording me. They left it on the desk, and I took it by mistake. I found it in my kit and realized it was a spy device.... yikes.
lynx23
Well, not in an AirBnB, but... Already years ago, they found one in the ladies room at work...
taeefnajib
That's fascinating! Did you check the accuracy?
This project is an RF Signal Scanner built using an ESP32, AD8317 RF detector, and various other components. It's designed to detect and measure RF signals in the environment and display the signal strength on an OLED display. It's useful to find hidden cameras, wiretapping devices, and other RF-enabled devices.