AI
Why Compromised Mesh Radio Security Costs Lives
goTenna Pro devices form mesh networks without fixed infrastructure, which is why first responders depend on them when hurricanes or earthquakes knock out 5G and LTE. Katrina and Helen are two examples cited. An attacker who breaks the encryption can modify messages, spoof messages, or shut down communications entirely. The users are medical responders, law enforcement, and military. Their lives depend on those links staying intact and unmodified.
29 Vulnerabilities and One 9.6 CVSS Finding
The team has assessed goTenna products for several years and found 29 total vulnerabilities: six in the B1, four in the Mesh, and more in the ATAC and Pro. The vulnerability presented here carries a CVSS score of 9.6, compromising full confidentiality, integrity, and availability. They discovered it after DEF CON 2024, reported it to the vendor with CISA support, and patches shipped in September and October 2024. The tool releasing alongside this talk is called goat.
The Flaw: Unauthenticated Public Key Updates
goTenna Pro uses ECDH to derive a shared encryption key, stored in gotenna_key_encryption.xml on the phone. The flaw is in the key exchange messages. Both the public key request and the response carry no authentication. Sending one forged request with the target’s GID in the unencrypted metadata causes the device to silently overwrite its stored public key. The researchers confirmed this with a rooted phone: one packet changed the key, no notification to the user.
Building the Attack: Two SDRs and a Packet Counter
Two software-defined radios are the only hardware required: one to receive, one to transmit. GNU Radio with the GR10 block captures goTenna Pro traffic. GIDs are visible in unencrypted metadata. The attacker generates a fresh keypair, increments the packet counter above any previously seen value, and transmits a forged key injection. The protocol rejects replays but accepts any new counter value, so the counter is trivially satisfied. After injection, the attacker holds both sides of the shared key and controls every message.
Live Demo: GPS Coordinates Rewritten Mid-Flight
Bob sends Alice a request for GPS coordinates. Before Alice replies, the script poisons both sides of the communication. Alice sends her real coordinates. The attacker intercepts, decrypts with the stolen keys, substitutes different coordinates, re-encrypts as Alice, and delivers the forged message to Bob. Alice’s phone shows a delivery check mark. Bob received nothing real. The live demo sent coordinates differing by one digit, enough to redirect a medevac or resupply run to a wrong location.
Defenses: Key Authentication and Anomaly Detection
The core fix is proper key authentication. Keys should never update silently. Devices should prompt before accepting a new key for any peer, or at minimum log the event. Maintaining key version history catches the restore-and-cover-tracks technique: if the same peer key appears for the third time, that is a signal. RF signal power anomalies, specifically strength variations between two static devices, can indicate a relay in the path. Pre-mission key baselines give operators something to check afterward.
Q&A
Was visual confirmation from the device indicator light necessary to know the key injection succeeded? No. The capture software shows received transmissions directly, and the packet counter visible in unencrypted metadata confirms delivery without requiring sight of the light. ▶ 41:34
Notable Quotes
It’s always the implementation, not the cryptography. Erwin “Dollarhyde” Karincic · ▶ 7:27
False security is worse than no security quite honestly. Woody · ▶ 19:13
us look at that like we have full decryption of this remotely updated without any authentication. Woody · ▶ 13:42
Key Takeaways
- Key exchange must authenticate both request and response; accepting unauthenticated updates enables full message interception.
- RF range for this attack reaches 55 miles on VHF, well beyond visual detection of an attacker.
- Restoring original keys after manipulation leaves no trace in device logs, making forensic detection nearly impossible.
About the Speaker(s)
Erwin “Dollarhyde” Karincic is a security researcher specializing in hardware and software reverse engineering, binary analysis, and exploit development across multiple processor architectures. He implements RF waveforms using SDRs for security applications, designs and fabricates antennas, and has a background in TCP/IP networking and worldwide secure communication systems. He holds OSCP, OSCE, OSWE, OSEE, and CCIE Enterprise Infrastructure certifications and is pursuing a PhD at Virginia Commonwealth University. He is a staff member at RF Hacker Sanctuary and a member of Security Tribe.
Woody owns Weathered Security and brings 20 years of active duty special operations experience to his work with software-defined radios and the RF spectrum. He presented the first goTenna exploit talk at the RF Wireless Village and the first attack against Ford Raptor key fobs with the RaptorCaptor exploit. He is a staff member at RFHacker Sanctuary, a member of Security Tribe, and has appeared on Hak5 discussing novel device attacks.