Hacking a microwave detector

This message is really directed at Mr. Liebermann, but I'll ask it
publically so anyone else can reply if they wish (and because it is bad
form to email someone out of the blue using an address you obtain off a
newsgroup).

I was reading thru some old posts on this newgroup, and I came across
one that Jeff Liebermann posted about some tools that may be helpful in
debugging wireless networks. One of them was a Microwave Leak Dectector
sold by Comfort House.

He implied that he hacked one to add an antenna to it to better pick
up microwave leakage. But the pics he had a link to didn't have a pic
of the actual hack, nor any directions on how to do the hack.

So I went on over to the dealer linked, and took a look at the device
in question. Low and behold, I already own it! A little over a month
ago, I worked on a project that I was supposed to go to various
people's homes and see how much of a leak the average microwave had.
The client supplied me with the same model (near as I can figure from
the pics on the dealers web site, I don't actually know where mine was
purchased, it was just sent to me to use and the client didn't want it
back when I was done).

I have no idea how well it works, it is the only one I've ever used,
but in my testing, it only seemed to have a range of a few inches from
the microwave. But I was also surprised to find that very few
microwaves leaked (I tested about 75, and only 2 ever set off its
alarm, most registered nothing, or very low values)... so it is
possible this one just doesn't work correctly. It doesn't detect my WAP
at all (Linksys WRT54G), and I keep forgetting to test it against my
laptop (which has once again been left at work so I can't test it right
now).

So I'm curious if Mr. Liebermann would be kind enough to write up a
quick and dirty set of directions to hack it (you know, what kind of
antenna to use, where do I solder it to the logic board, do I need to
remove anything or jumper anything, or whatever... I know my way around
the basic tools, although I have no experience or access to an
oscilloscope, so if one is needed, I'm SOL). I was going to guess that
you remove whatever is missing in the first pic, and attach the antenna
there... but I opened mine to find that whatever is missing, is missing
on mine. So then I wasn't sure if that first pic was supposed to show
the available antenna connection points, or if it was just a close up
of the board. I'd be happy to just slap an antenna on there, but I
figured I'd ask first, just in case doing so really opens a portal to
the 3rd plane of hell (which is fine too, but I want to know if I
should be prepared to do some demon bashing)

Of course, this assumes I have the correct model unit. I think the
original post was from some time in 2004, and the unit I have is
stamped with Feb 15 2005, so it may be a different or revised model.
The info says it an MD-2000 Digital Readout Microwave Leakage Detector.
And the guts of it look the same as his 2nd pic (or at least in all the
important ways, mine has a few more numbers stenciled on it, but all
the parts appear to be the same).


So any directions, hints, or tips Mr. Lieberman (or anyone else) feels
like tossing my way would be appreciated.

-chris

(standard spelling disclaimers apply until I can get a newsreader that
offers spell check... not likely to happen any time soon)

On Thu, 28 Apr 2005 03:19:09 GMT, chris <(E-Mail Removed)> wrote:

>This message is really directed at Mr. Liebermann, but I'll ask it
>publically so anyone else can reply if they wish (and because it is bad
>form to email someone out of the blue using an address you obtain off a
>newsgroup).

Yep. I try to answer questions in newsgroups and mailing list for
free because everyone learns from the answers (even if they are
wrong). I also kinda enjoy being helpful. However, if you want
personal consulting, where only one person benfits from my efforts, be
prepared to pay for my exhorbitant consulting rates.

>He implied that he hacked one to add an antenna to it to better pick
>up microwave leakage. But the pics he had a link to didn't have a pic
>of the actual hack, nor any directions on how to do the hack.

Guilty as charged. Original photos, before I stuck on the dipole at:
| http://pics.80211junk.com/Microwave%...tor/index.html
The diode detector is at the far left labelled "C2" on the chip and
"D1" on the board. I thought I had a photo after I added the dipole.
I guess not. Sorry.

>I have no idea how well it works, it is the only one I've ever used,
>but in my testing, it only seemed to have a range of a few inches from
>the microwave.

Yep. It's not very sensitive. Even with an external dipole antenna,
it would only detect my BEFW11S4v4 router up to about 6 inches.
Without the antenna, it had to be right up next to the antenna to
detect anything. Considering the power levels involved, I'm not
suprised.

Incidentally, if you have a 2.4GHz cordless phone, try putting the
handset inside the oven, close the door, and punch the "call" button
on the base unit. The phone will probably beep. So much for
microwave oven shielding.

>So I'm curious if Mr. Liebermann would be kind enough to write up a
>quick and dirty set of directions to hack it (you know, what kind of
>antenna to use, where do I solder it to the logic board, do I need to
>remove anything or jumper anything, or whatever...

Sure. The first problem is finding the detector. My fabulous
carpentry abilities resulted in 6 bookshelves, 8ft long, all peeling
off the wall, and dumping everything onto the floor and table.
| http://pics.80211junk.com/drivel/mess02.jpg
That was after I cleared off the shelves, brackets, and upper layer of
books. One of my laptops was on the table and got rather bashed in.
The detector is under there somewhere. I'm still cleaning up the
mess.

>of the board. I'd be happy to just slap an antenna on there, but I
>figured I'd ask first, just in case doing so really opens a portal to
>the 3rd plane of hell (which is fine too, but I want to know if I
>should be prepared to do some demon bashing)

Nothing exotic. Just two pieces of wire. I stuck a capacitor in
series with each element to keep the DC off the antenna, but using
insulated wire will work as well without the capacitors. I'll try to
find the beast this weekend, make a few changes (i.e. start over) and
post some photos. Bug me if I forget.


--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831.336.2558 voice http://www.LearnByDestroying.com
# (E-Mail Removed)
# (E-Mail Removed) AE6KS

In article <(E-Mail Removed)>, Jeff
Liebermann <(E-Mail Removed)> wrote:

> >This message is really directed at Mr. Liebermann, but I'll ask it
> >publically so anyone else can reply if they wish (and because it is bad
> >form to email someone out of the blue using an address you obtain off a
> >newsgroup).
>
> Yep. I try to answer questions in newsgroups and mailing list for
> free because everyone learns from the answers (even if they are
> wrong). I also kinda enjoy being helpful. However, if you want
> personal consulting, where only one person benfits from my efforts, be
> prepared to pay for my exhorbitant consulting rates.

Ditto, but not so much on newsgroups myself. I'm not sure why, but I
just don't tend to post to newsgroups very often. In fact, this is my
first run back at it in a few years (I used to participate in a
FileMaker Pro group a long while back, I think I was still on dialup
back then). But I do spend a good deal of time on mailing lists, and it
always irks me when list members email me directly. For some reason, I
feel like they are trying to get free consulting when they do that, yet
if they ask the same question via the list, I chime in with an answer
happily. Go figure.

> Yep. It's not very sensitive. Even with an external dipole antenna,
> it would only detect my BEFW11S4v4 router up to about 6 inches.
> Without the antenna, it had to be right up next to the antenna to
> detect anything. Considering the power levels involved, I'm not
> suprised.

Even right against the antenna I don't pick up anything. (tested it on
my operating ch 11, as well as Ch 8 and Ch 9, didn't bother with any
other channels after those three failed to be seen).

Hey, maybe I should stick a high gain parabolic dish on it and use it
as my wifi tracker.... any idea how much play there is in the pickup
spectrum? The unit says it is calibrated to 2450 MHz, since that sits
between ch 8 and 9, will there be enough play to grab things from Ch 1
thru 11? Or is there a way to expand its spectrum?

> Incidentally, if you have a 2.4GHz cordless phone, try putting the
> handset inside the oven, close the door, and punch the "call" button
> on the base unit. The phone will probably beep. So much for
> microwave oven shielding.

I do... VTech, some early model of multi-handset to single base thing,
I think it is still on the market, works REALLY well, doesn't bother my
wireless, but totally screws up the old X-10 2.4 GHz cameras.

I'll have to see what happens when I put it in the microwave.

> Sure. The first problem is finding the detector. My fabulous
> carpentry abilities resulted in 6 bookshelves, 8ft long, all peeling
> off the wall, and dumping everything onto the floor and table.
> | http://pics.80211junk.com/drivel/mess02.jpg
> That was after I cleared off the shelves, brackets, and upper layer of
> books. One of my laptops was on the table and got rather bashed in.
> The detector is under there somewhere. I'm still cleaning up the
> mess.

Lovely... looks about like my office after I trip over one of my piles
of crap. Usually resulting in me spewing a number of obscenities, while
my coworkers down the hall roll out a chorus of laughter (not a day
passes that one of them doesn't comment on my death trap of an
office... if they would stop breaking things, I'd have time to catch up
on the work and clear out some of the mess!)

> Nothing exotic. Just two pieces of wire. I stuck a capacitor in
> series with each element to keep the DC off the antenna, but using
> insulated wire will work as well without the capacitors. I'll try to
> find the beast this weekend, make a few changes (i.e. start over) and
> post some photos. Bug me if I forget.

Thanks muchly!!!


-chris

chris wrote:
> This message is really directed at Mr. Liebermann, but I'll ask it
> publically so anyone else can reply if they wish (and because it is bad
> form to email someone out of the blue using an address you obtain off a
> newsgroup).
>
I guess for a once off its fine , truthfully though if finances permit
take a look at a Promax MC-577 for a real toy :_)
Had mine about 20 months and certainly earned its keep .

On Thu, 28 Apr 2005 15:51:46 +1000, atec <(E-Mail Removed)> wrote:

>I guess for a once off its fine , truthfully though if finances permit
>take a look at a Promax MC-577 for a real toy :_)
> Had mine about 20 months and certainly earned its keep .

Made for CATV. Promax MC-577 stops at 2150 MHz and doesn't cover
2.4GHz. Did you modify it in some way to use it? Downconverter
perhaps?
http://www.promaxprolink.com/mc577.htm
$1742 list.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 AE6KS 831-336-2558

Jeff Liebermann wrote:
> On Thu, 28 Apr 2005 15:51:46 +1000, atec <(E-Mail Removed)> wrote:
>
>
>>I guess for a once off its fine , truthfully though if finances permit
>>take a look at a Promax MC-577 for a real toy :_)
>> Had mine about 20 months and certainly earned its keep .
>
>
> Made for CATV. Promax MC-577 stops at 2150 MHz and doesn't cover
> 2.4GHz. Did you modify it in some way to use it? Downconverter
> perhaps?
> http://www.promaxprolink.com/mc577.htm
> $1742 list.
>
Yes its a little modded , although out of the box it does go 2.4 with
reduced sensce , and its not a catv rather a sat box...

In article <(E-Mail Removed)>, Jeff
Liebermann <(E-Mail Removed)> wrote:

> Incidentally, if you have a 2.4GHz cordless phone, try putting the
> handset inside the oven, close the door, and punch the "call" button
> on the base unit. The phone will probably beep. So much for
> microwave oven shielding.

I tried this tonight. Looks like my microwave is properly shielded. The
phone didn't respond to the page while the microwave door was closed. I
opened it, and a moment later, the phone started chirping away like it
should.

I've seen this experiment mentioned in other places, so I'm guessing
either it is an "old wives tale" that people keep spreading without
actually trying (from what I've read of your postings, I find it hard
to believe you would be guity of that), or, my microwave is in the
minority of proper ones.

Although, like I mentioned previously, when I did the microwave leak
test at homes around the area, I was surprised at how few appeared to
leak much in the way of anything. So maybe the cordless phone trick is
a combo of the two... it naturally works for people with bad
microwaves, but many others spread the info without having tried it
themselves. (I try not to be that way if I have a choice, I like to try
things out first hand... eventually I'll try hacking WEP just so I can
see how easy or difficult it really is)


-chris

Jeff Liebermann <(E-Mail Removed)> wrote:
>| http://pics.80211junk.com/Microwave%...tor/index.html

I take it the internal antenna is those two solder points next to it
(ie: on the other side of the board)?

>insulated wire will work as well without the capacitors. I'll try to
>find the beast this weekend, make a few changes (i.e. start over) and
>post some photos. Bug me if I forget.

Lots of interest here, please keep us in mind!

chris <(E-Mail Removed)> wrote:
>as my wifi tracker.... any idea how much play there is in the pickup
>spectrum? The unit says it is calibrated to 2450 MHz, since that sits
>between ch 8 and 9, will there be enough play to grab things from Ch 1
>thru 11? Or is there a way to expand its spectrum?

I suspect that the antenna is the only tuned thing in the circuit, so
it's pretty wide-band...