433 MHz Doorbell RF Replay Hack
Cybersecurity & RF Hacking

433 MHz Doorbell RF Replay Hack

Case Study DetailsID: doorbell-hacking

Name

Muhammad Ahsan

ID

F2019376007

“Hack 433 MHz Devices with a Raspberry and a RTL-SDR Dongle”

Hack 433 MHz Devices with a Raspberry and a RTL-SDR Dongle

Wireless things frequency is between 300MHz to 433MHz we find a frequency with the help of RTL-SDR Dongle

In this project we hack a Doorbell

We get frequency with RTL-SDR Dongle on AIRSPY SDR software

We get frequency of Doorbell at 433.912.500 we note this frequency where Doorbell rings

Then we connect our RTL-SDR Dongle with Raspberry

We connect RTL-SDR Dongle with raspberry pi to Do reply attack

We do reply attack using rpitx software in raspberry pi

We get this software from github

Source https://github.com/F5OEO/rpitx

Then we installed this software with these commands

git clone https://github.com/F5OEO/rpitx

cd rpitx

./install.sh

What kind of functions this software can perform

Now we know the frequency of the doorbell we execute the command to record the the frequency and then we reply that frequency

We use this command

“ rtl_sdr -s 250000 -g 40 -f 433912500 wiredoorbell_ring.iq ”

rtl_sd : which device we use

  • s 250000 : sample rate
  • g 40 : gain
  • f 433912500 : frequency

wiredoorbell_ring.iq : file name where records are.

recording frequency of doorbell

For reply attack we use ./sendiq command

What kind of functions this command can perform

Then for reply attack we use this command

“ ./sendiq -s 250000 -f 433912500 -t u8 -i wiredoorbellring.iq ”

  • s 250000 sample rate
  • f 433912500 frequency
  • t u8 file formate
  • i wiredoorbellring.iq recorded file

“Then our doorbell rings without button just with the help of this command only”

The

End

Project Summary

Brief Description

Intercepted, recorded, and replayed radio frequency transmissions of a sub-GHz wireless doorbell to ring it programmatically.

Methodology Summary

Scanned RF doorbell button frequency at 433.91 MHz using an RTL-SDR dongle and Airspy SDR. Saved raw IQ transmission data. Hooked up a Raspberry Pi transmitter and utilized rpitx (sendiq) to broadcast the recorded wave.

Results & Performance

Successfully triggered the doorbell chime without physical interaction, highlighting security flaws in fixed-code RF transmitters.

Tech Stack

RTL-SDRRaspberry Pirpitx RF ToolGqrxSub-GHz Replay
Author:Muhammad Ahsan
Date:2025 - 2026
Class:security