Welcome to AirTell Discussions!

[ncouture]

📡 AirTell: The Spectrum Has a Voice.

Welcome to Discussions.

"Hackers are artists. They don't always start with a complete plan; they can start with a stroke, paint a line, and extrapolate patterns from how their canvas responds to their actions. But our canvas is 2.4 GHz of unshielded air, microsecond timing deltas, and the unintended confessions of silicon."

---

⚡ Why We’re Here

Modern mobile operating systems tell the world that Bluetooth Low Energy privacy is solved by randomized MAC addresses. Anyone who has looked at raw IQ samples or microsecond-level link-layer timing knows better.

Across advertising intervals, deterministic scan request bursts, and proprietary payload anomalies, every device broadcasts an unmistakable digital body language.

AirTell was built to banish the single-dongle blind spots of legacy sniffers. By orchestrating synchronized multi-dongle CC2652 radios (via NCC Group's Sniffle) and in-memory virtual radio buses, we pair active stimuli with passive observers to expose, measure, and audit BLE tracking surfaces and protocol-level privacy leakage.

GitHub Issues are reserved for kernel panics, firmware lockups, UART framing desyncs, and code bugs.

Discussions is where the craft lives. This is our open RF salon—where exploit developers, RF hackers, reverse engineers, red-team operators, blue-team architects, and privacy governance leaders converge to push the boundary of link-layer analysis.

---

🧭 What Belongs Here (Pick Your Channel)

🎙️ 1. RF Tradecraft & Signal Forensics

Dissecting the physics and protocols of the air interface.

• Timing side-channels, inter-arrival jitter, and clock drift profiling.
• Reverse engineering proprietary manufacturer payloads (Apple Continuity, Google Fast Pair, SmartTags, bespoke IoT beacons).
• Sanitized .pcap teardowns, packet captures, and RF behavioral heuristics.

🛠️ 2. Hardware Rigs & Testbed Engineering

From breadboards to anechoic chambers.

• CC2652P/CC2652R1 / LaunchPad / Sonoff dongle configurations, firmware flashes, and UART bridge quirks.
• Custom SMA antenna mods, attenuators, faraday enclosures, and multi-radio physical topologies (Topology A, B, and C).
• Extending VirtualRadioBus and synthetic mock harnesses for headless CI testbeds.

⚔️ 3. Red Team Tradecraft & Stimulus Chains

Turning passive observation into deterministic audit.

• Active probing: crafted SCAN_REQ stimulus timing without breaking OPSEC or violating radio etiquette.
• Tracking persistence across MAC address rotation intervals.
• Chaining multi-dongle observers to pinpoint physical perimeter traversals.

🛡️ 4. Risk, Governance & Privacy Engineering

Bridging hacker tradecraft with rigorous empirical privacy science.

• Evaluating corporate device fleets against real-world tracking threats vs. paper compliance.
• Aligning AirTell telemetry with empirical privacy benchmarks and threat models.
• Threat modeling for executive protection, defense-in-depth, and air-gapped SCADA/sensitive facilities.

💡 5. Ideas, Feature Requests & Wild Experiments

• Dream features, protocol extensions, Wireshark dissector Lua scripts, Streamlit visualization enhancements, and machine learning models for fingerprint classification.

---

📜 Rules of the Airwaves

1. Craft Above Ego: Whether you just bought your first $10 CC2652 stick or you’ve spent 30 years doing SIGINT and defensive signal analysis, respect the curiosity. We teach, we mentor, we build.
2. Responsible Disclosure & Ethics: We operate under legitimate defensive, research, and authorized red-teaming mandates. Do not post operational target data, unsanitized surveillance captures containing sensitive personal identifiers, or actionable zero-day exploit payloads targeting critical infrastructure.
3. Signal over Noise: Back your theories with captures, logic, logs, or physics. Speculation is welcome, but reproducible telemetry is gold.

---

🎯 Roll Call: Introduce Yourself Below

Drop a comment below and let the community know where you sit on the wire:

Role / Craft: [Red Team / Exploit Dev / Firmware Eng / RF Enthusiast / GRC & Privacy / Student]
Current Hardware Rig: [e.g., 2x Sonoff Dongle Plus-E, TI CC2652RB LaunchPad, HackRF, Virtual Bus only]
Current Mission: [What are you looking to track, test, audit, or dissect with AirTell?]

The spectrum is unshielded, and the radios are listening. Welcome to AirTell.

[ncouture]

🎯 Roll Call: Introduce Yourself Below

Drop a comment below and let the community know where you sit on the wire:

Nick / Call Sign: ncouture is remote hackers
Role / Craft: AirTell maintainer / Software Systems Infrastructure Architect / RF Enthusiast
Current Hardware Rig: Unavailable
Current Mission: Auditing Android-to-IoT BLE exchanges and using AirTell to automate traffic capture and inject spoofed commands when proprietary smart devices refuse to cooperate on schedule

The spectrum is unshielded, and the radios are listening. Welcome to AirTell.