Cuban Numbers Station in HM01 mode

By PY4ZBZ  on 24-01-2013   rev. 27-03-2013     Em português aqui

 

What is a Numbers station ?

Encrypted content of a TXT message transmitted in RDFT 

Format of a typical transmission

Transmissions sequences

Schedule for HM01

Reception via WebSDR and with SDR Console on WWW

Numbers stations video clips

 

On 24-01-2013, on 16.180 MHz, between 21:35 and 21:50 UTC, and to my great surprise, I heard an AM broadcast from a numbers station, that used the program of my authorship, with the old RDFT system (Redundant Digital File Transfer) : DIGTRX !

The group Enigma2000 classifies  this transmission as HM01, why it is a Hybrid Mixed of V02a (voice) and SK01 (RDFT) 

 

This screen shot is from DIGTRX receiving this station, in RDFT mode, on 1/24/2013, and decoding the file 22235071.TXT: 

 

Spectrogram of the modulating signal from the Cuban numbers station. Each digital RDFT transmission is preceded by 5 numbers spoken by a female voice, and the typical two-tone (tune) from DIGTRX on 1180 and 1520 Hz. Are visible also the 10 different tones "Start or L3C" and "Stop or T3c", exclusivity of the DIGTRX program, to automatically record (Start) the audio from digital  RDFT signal between them, then decodes it automatically (Stop):

 

 Here is the audio from this transmission. It can be demodulated by anyone using DIGTRX, and it contains the file 22235071.TXT. Simply enable sound card stereo mixer and play the file with the media player or similar! (Note: DIGTRX 3.11 does not work in Win7, in that case use the 2.14D download here)

The following video shows DIGTRX decoding the audio from the numbers station:

 

 

This station has been reported several times, and long ago, as using DIGTRX: 

See clicking here : Cuban DIGTRX Numbers 9/13/07

Here also is a DIGTRX screen shot, on page 84 in Enigma 2000 Newsletter En43.

DIGTRX is also cited in The SWLing Post

 

Here are two examples of files transmitted in HM01 as text and decoded by me:

65272461.TXT  e  22235071.TXT

But they are not simple plain text files, but they are encoded and encrypted files !

Can anyone decrypt them? 

 

On 01/26/2013 I listened again on 16.180 MHz at 21:30 UTC but with a weak signal. At 23:30 UTC on 17.540 MHz listened to and decoded multiple files: 07381515.TXT, 71637521.TXT and 01548510.TXT. See the sequence of RDFT transmissions, with numbers spoken before each one, in the  following spectrogram: 

 

On 01/29/2013 I listened again on 17.540 MHz between 23:00 and 23:50 UTC, and I decoded 7 files. Only 6 different files are repeated sequentially, about 5 times, to allow automatic block error correction ​​by DIGTRX . See at the following picture the files received. The thrue sequence of the files was:  17527626   40740465   40037714    07381515   86070161   34140043:

The spoken identification of the files was respectively:

53385  66431  72263  46854  33331  87401

The contents of these files (download here) is apparently encrypted in a pseudo-random way: 

 

The following figure shows the spectrum and spectrogram of the beginning of an AM broadcast of the RDFT signal!. You can notice the poor quality of the transmission signal by scattering RDFT beyond 2300 Hz and up to 3600 Hz, the IMD distortion on tune signal, that should provide only two tones, and the hum of 60, 120 and 180 Hz visible on each side of the carrier. (Some broadcasts are of better quality) :

 

Watch the following videos:

This is my FT100D with a dipole antenna for 14 MHz receiving HM01: 

 

 

This is my SDR-IQ receiver and Spectravue with a dipole antenna for 14 MHz receiving HM01:

 

 

 

Format of a typical transmission

 

On 31.01.2013 22:56 to 23:55 UTC ont 17,540 kHz AM, I copied a complete transmission, having the following structure: 

1 - Starts with a repeated sequence of 8 groups of 6 numbers (female voice) with 5 digits each:

53387  66433  72265  36761  33333  87403

This sequence of numbers informs the sequence of  the RDFT transmissions. 

2 - Then follows a sequence of 5 repeated RDFT transmissions, each with 6 TXT files of about 1 kbyte and with a 8 digit number name, and identified by the 5 digit numbers spoken in item 1:

voice : 53387    RDFT : 17527626.TXT

voice  : 66433    RDFT : 40740465.TXT

voice  : 72265    RDFT : 40037714.TXT

voice  : 36761    RDFT : 88374124.TXT

voice  : 33333    RDFT : 86070161.TXT

voice  : 87403    RDFT : 34140043.TXT

3 - Then follows a sequence of 5 repeated groups of six numbers (voice)  (the same as in item 1 above):

53387  66433  72265  36761  33333  87403

4 - Ends with the same RDFT sequence of item 2 above .

So, in the range of just under an hour,  each TXT file is transmitted 10 times!

These 6 files received with DIGTRX can be downloaded here.

 

Transmission sequences

Interestingly, the numbers in voice (5-digit) increases by one every day, but the corresponding TXT files have the SAME name (an 8-digit number) and the SAME encrypted content. The least significant digit (LSD) of the spoken number (5 digits) is nothing more than the number of repetition of the broadcast session. 

There are 2 sessions per day: one in the morning whit up to 7 transmissions, and another in the evening with up to 6 broadcast transmissions, schedules here. In each broadcast of nearly an hour, only 6 different TXT files are transmitted and repeated 10 times. Normally, the transmissions at evening (n) are repeated on the next morning (m). Randomly, zero, one or more files are new files (LSD = 1) and replace some older files (LSD> 1).

 

n   29-01-2013 :  53385   66431   72263   46854   33331   87401

n   30-01-2013 :  53386   66432   72264   ?????   33332   87402

n   31-01-2013 :  53387   66433   72265   36761   33333   87403

n   01-02-2013 :  36411   66434   72266   36762   33334   87404

n   02-02-2013 :  34412   66435   72267   36763   33335   87405

n   03-02-2013 :  34412   66435   72267   36763   33335   87405

m  04-02-2013 :  36417   87245   88875   78322   28804   68663

n   04-02-2013 :  36418   87246   80876   78323   28805   68664

n   05-02-2013 :  34231   87247   27521   78324   44501   68665

m   06-02-2013 :  34231   87247   27521   78324   44501   68665

n   06-02-2013 :  34232   53641   27522   78325   44502   68666

n   07-02-2013 :  34233   53642   27523   78326   44503   68667

m   08-02-2013 :  34233   53642   27523   78326   44503   68667

n   08-02-2013 :  34234   53643   27524   08251   44504   68668

n   09-02-2013 :  34234   53643   27524   08251   44504   68668

m  10-02-2013 :  34235   53644   27525   08252   44505   56231

n  10-02-2013 :  34236   53645   27526   08253   44506   56232

m  11-02-2013 :  34236   53645   27526   08253   44506   56232

n  11-02-2013 :  81551   53646   27527   08254   44507   56233

n  12-02-2013 :  81552   53647   07861   08255   54301   56234

m  13-02-2013 :  81552   53647   07861   08255   54301   56234

n  13-02-2013 :  81553   38511   07862   08256   54302   56235

m  14-02-2013 :  81553   38511   07862   08256   54302   56235

n  14-02-2013 :  81554   38512   07863   32561   54303   30071

m  15-02-2013 :  81554   38512   07863   32561   54303   30071

n   15-02-2013 :  81554   38512   07863   32561   54303   30071

m  16-02-2013 :  81555   38513   07864   32562   54304   30072

n   16-02-2013 :  81556   38514   07865   32563   54305   30073

m   17-02-2013 :  81556   38514   07865   32563   54305   30073

n   17-02-2013 :  64611   38515   07866   32564   54306   30074

m   18-02-2013 :  64611   38515   07866   32564   54306   30074

 

 

 

Schedule for HM01 (QRG in kHz and QTR in UTC)

  Each broadcast lasts for around 55 minutes (pause from min. 25 to 30), and start at UTC time indicated in the table:

UTC   Sun M T W Th F Sat
QRG kHz Dom Seg Ter Qua Qui Sex Sab
05 5855 x x ? ?   ?  
12120     ?   ?   ?
14375       ? ?   ?
06 10345 x x x x   x  
14375         x   x
07 9330 x x   x   x  
13435     ?   x   x
08 9065 x x   x   x  
09 9240 x x x x   x  
12120     ?   x   x
10 5855-9155 x x   x   x  
12180     x   x   x
16 11435 x x x x x x ?
17 11530 x x x x x x x
18 11635 x x x x x x x
21 11635 x x   x   x  
16180     x   x   x
22 10715 x x   x   x  
17480     x   x   x
23 11530 x x   x   x  
17540     x   x   x

In February 2013, lines 09 to 23 UTC were confirmed by me. Others are to be confirmed.

 

 

 

Decoding files with DIGTRX via audio mixer and tuning to the Wide-band WebSDR at the University of Twente: 

 

  Remote Reception (via WWW Network) with SDR Console tuning the SDR-IQ of W1NT: 

 

 

 

Numbers stations video clips :

 

 

 

 

See more information about numbers stations here: ENIGMA2000.

Vejam também : Sinais estranhos em HF

 

73 de Roland

.