In-situ recon: one device for RF capture and covert photography

During an authorized red team engagement, I entered a target facility posing as a contracted radio technician and used a single antenna pole to do two jobs at once: record the site’s RF spectrum and photograph its interior. A Moxon directional antenna for 868 MHz sat at the top of the pole, and directly beneath it — out of a casual observer’s line of sight — was the camera head of an endoscope. To anyone nearby I was measuring radio interference. In practice I was capturing LoRa traffic and looking through windows.

The cover story worked because every visible detail pointed the same way. A printed ID badge named a technician who did not exist, working for a company that did not exist either — except that the company had a real, functioning website, so a quick search by a suspicious employee resolved in my favour. The clothing, the backpack, and the measurement pole all matched what a field radio technician would plausibly carry.

None of the actual collection hardware was visible. A HackRF and additional SDRs stayed inside the backpack, wired to their own antennas, and the laptop that drove them was operated remotely by a second person I stayed in contact with over an earpiece. In my hand I carried a handheld vector network analyser (VNA) as a prop, ready to show a plausible “measurement” to anyone who asked.

The cover identity

A single laminated badge did most of the social-engineering work. It carried a first name, a photo, a job title in the local language (“Rádio Technik”), and the branding of a telecom-sector company. The company was fictional, but it was backed by a live website stood up for the engagement — which meant the badge survived the one check people actually perform: typing the company name into a search engine.

The badge was never meant to withstand a phone call to a real HR department. It was meant to lower the threshold for the first thirty seconds of contact, which in a physical intrusion is usually all that matters. Once someone has seen a plausible badge and a plausible reason to be on site, they tend to stop questioning and start giving directions.

The pole: one prop, two payloads

The pole is the centre of the whole approach. Mounted at the top was a Moxon directional antenna tuned for 868 MHz — the EU ISM band that LoRa devices use. A Moxon is compact, has a clean forward lobe, and looks exactly like the kind of odd-shaped antenna a field technician might wave around. Its directionality was the point: I could aim it at a wall or a rooftop and favour signals arriving from that direction.

Immediately below the antenna, clamped to the same pole, was the camera head of an endoscope. From more than a couple of metres away the two blur into a single “instrument on a stick”. The endoscope’s flexible cable ran down the pole to a small screen in my hand, so raising the pole to “measure” near a window put the camera at the height of that window.

Recording the spectrum

The RF side of the job was straightforward once the disguise held. The Moxon fed a HackRF in the backpack, and additional antennas fed further SDRs on the same laptop. That laptop was not mine to operate in the moment — a second operator drove it remotely while I walked the site, so my hands stayed free and my behaviour stayed consistent with someone doing physical measurements rather than someone watching a waterfall display.

We targeted the parts of the spectrum that mattered to the facility, with the LoRa traffic on 868 MHz as the primary object. Recording the raw spectrum instead of trying to decode on the spot let us do the real analysis afterwards, off site and without time pressure. Walking the perimeter and interior with a directional antenna also gave rough bearings on where specific emitters lived.

The VNA as a prop

The VNA earned its place without ever being used for real. If someone asked what I was doing, I could gesture at the screen and show a LOGMAG trace and a Smith chart for whatever antenna happened to be connected. Both plots look busy and authoritative to a non-specialist, and “I’m checking interference on this band” is a sentence almost no one challenges. The prop turned a potentially awkward question into a short, boring demonstration.

Covert photography

With the camera riding at the top of the pole, ordinary “measurement” movements became photography. Lifting the pole toward a window to “get a cleaner reading” pointed the endoscope through the glass; sweeping it along a façade produced a series of interior views. Because the whole motion was consistent with taking a measurement, the photography never read as photography — no phone raised, no obvious camera, no lingering.

This is the part worth dwelling on from a defensive standpoint: the covert capability was not a hidden gadget bolted on as an afterthought. It shared a body with the cover story. The same object that justified my presence was the object doing the collection.

What made it work

A few things let this succeed, and each is a place to intervene:

• The badge was trusted because the company resolved online. Verifying vendors against an internal, pre-agreed list — rather than a web search — removes that shortcut.
• “Measuring interference” is socially unchallengeable. Staff had no procedure for confirming a technician was expected, so any confident person with a pole passed.
• The pole was never inspected up close. From a distance, an antenna and a camera on the same mount are indistinguishable.

Disclaimer

This work was carried out as a written, contracted red team engagement with a defined scope and the client’s authorization. No third parties outside that scope were affected, tested, confronted, or interacted with in any way. The company, badge, and website described here were fictional elements created solely for the engagement, and the website was taken down once the engagement concluded.