This beacon probably does the same, but I argue that this is not a security problem because the system security relies on the NAS encryption and integrity.

Read more: destevez.net/2026/01/v16-...

I have found a report from a security researcher that has opened a similar beacon and obtained access to a debug serial port, finding that it transmits unencrypted data in a UDP packet.

Then, every 100 seconds it transmits a data packet using the control plane CIoT EPS optimization which I explained in the previous post.

I decode all the uplink transmissions in the recording and analyze the packets with Wireshark. What I see is that the beacon registers to the cell network 40 seconds after power on in a rather run of the mill way.

It saves them from the need to establish a full data plane connection as in regular LTE.

Read more: destevez.net/2025/12/deco...

The beacon uses something called control plane CIoT EPS optimization to transmit a user data message encapsulated in a NAS message as soon as it completes an RRC connection. This is a mechanism intended for IoT devices that transmit a small amount of data.

Blind decoding of NPUSCH transmissions without access to the scheduling grants in the downlink is tricky, because we have to guess many parameters, including the RNTI. I show how with some cleverness and some brute force searches of reduced complexity these can be found.

In this post I analyze a recording of the B20 band NB-IoT uplink of a V16 beacon, showing how to decode the NPUSCH and obtain MAC PDUs that we can inspect in Wireshark.

It's a good read if you want to learn about RISC-V trap handling, and how LLVM turns Rust code into assembly and performs move elimination optimizations.

Read more: destevez.net/2025/12/note...

Most of the recordings have a problem regarding a huge receiver frequency drift, as shown here. This limits the sensitivity of the acquisition algorithm.

Read more: destevez.net/2025/12/firs...

This takes a minute to do and benefits everyone. Thank you for your support!

I occasionally see SatYAML files shared in social media or forums, but it is hard to keep track of them in this way. If you have a SatYAML file that works for a given recording, please send a pull request to get it upstreamed, linking the recording you used to test it.

The telemetry packets contain many interesting strings with log messages, which appear to be generated by a Linux system running Rocket Lab's MAX flight software.

Read more: destevez.net/2025/11/deco...

Head over to github.com/maia-sdr/plu... to download the firmware and to github.com/maia-sdr/mai... for updated information about connecting to an Android phone.