When the researchers at Security Innovation decided to probe the radio security of a commercial sports scoreboard, they expected to find weaknesses.
What they did not expect was how straightforward those weaknesses would be to exploit, or how effectively a GPIO Labs low noise amplifier would extend the reach of their attack.
© Security Innovation
The Challenge: Gaining Radio Control at Distance
Security Innovation's hardware security team had been spending over eighteen months investigating attacks at the physical layer, probing the radio signals that carry commands between wireless controllers and the devices they operate.
Their target was a Score9 commercial scoreboard, the kind found in youth sports facilities and amateur leagues across the country. The scoreboard accepted radio commands from a handheld controller operating in the 915-923 MHz ISM band, the same unlicensed spectrum used by IoT sensors, LoRa networks, and other short-range wireless devices.
© Security Innovation
The team had already completed the signals intelligence phase of the project: capturing and recording the scoreboard's RF traffic using a HackRF One software-defined radio, decoding the proprietary OOK (on-off keying) modulation scheme, and reverse-engineering the command format by observing how signals changed when buttons were pressed.
© Security Innovation
With the protocol decoded and replicated in GNU Radio running on a laptop, they had a working software-defined transmitter capable of generating arbitrary scoreboard commands.
The remaining problem was practical: could they actually deliver those commands at a distance, with enough signal power to override the legitimate controller?
The Solution: HackRF One, GPIO Labs LNA, and a Custom Yagi
To build an attack platform capable of projecting their signal reliably at range, the team assembled three components. The HackRF One provided wideband transmit capability across the ISM band. A Yagi-Uda directional antenna for 922 MHz, custom-built from copper wire and wooden sticks sourced from a home improvement store, concentrated the transmitted energy in a tight beam toward the scoreboard. And a GPIO Labs low noise amplifier connected the two, boosting the signal to near the ISM band's legal maximum power limits.
© Security Innovation
The combination of the directional antenna's gain and the LNA's amplification gave the team a transmitted signal that completely dominated the legitimate controller. Their GNU Radio modulator, driven by the reversed-engineered command protocol they had decoded in earlier phases of the research, could now issue commands to the scoreboard from a significant distance, far enough to constitute a realistic real-world threat rather than a proximity demonstration.
The Result: Complete Control, Including Stealthy Attacks
The attack worked immediately. With the amplified, directional signal, the team's Python code and GNU Radio modulator outpowered the real controller and took complete control of the scoreboard. This allowed them to demonstrate several attack scenarios, including their described favourite: a "Fast Clock Attack" in which the game clock is accelerated just enough to shave meaningful seconds from a period without triggering obvious suspicion from spectators or officials.
The research demonstrated not just a vulnerability in this specific scoreboard, but a repeatable methodology for finding and exploiting similar weaknesses in any wireless device using unencrypted, unauthenticated radio protocols in the ISM bands. The GPIO Labs LNA was part of the signal chain that made those attacks practical at real-world distances rather than a controlled bench distance.
Broader Implications
Security Innovation's scoreboard research is a concrete illustration of why ISM band device security deserves the same scrutiny given to IP network security. The 915 MHz ISM band is home to building automation systems, industrial sensors, remote controls, smart meters, and a wide range of critical and semi-critical infrastructure, all operating under the same fundamental assumption of frequency sharing and without any mandated authentication requirement.
The GPIO Labs LNA used in this research is available as a catalog part for both security researchers and system designers who need to understand the real-world signal reach of their own 915 MHz hardware before it's deployed.
We also recommend the use of a 915 MHz low pass filter at the output of this LNA for harmonic/spurious suppression to meet regulatory spectral mask requirements.
Understanding how a low-cost amplifier and directional antenna can extend a transmitter's effective range is the first step toward designing systems that are genuinely resilient against exactly this class of attack.
Read the entire article by Security Innovation
Note: Any transmission described in this content requires appropriate licensing and regulatory compliance in your jurisdiction. Always verify local rules before operating.
Security Innovation is a cybersecurity firm specializing in security testing, training, and research. The scoreboard research was conducted as a responsible security investigation to surface vulnerabilities and improve the security posture of commercial wireless devices. The full methodology documented across the three-part series is archived here.
