How to manipulate a radio controlled clock via speaker

Caution: By playing these audio files, you may cause electromagnetic disturbances. This might be illegal, so it is advisable not to do that besides you really know what you're doing. I discourage from misuse the described effect. This article and program is only made for research.

A few month ago I presented my project, where I received the radio signal of the time signal radio station DCF77 with just a notebook and an old piece of a headphone cable.

The transmitter is located near Frankfurt in Germany and sends the current time to radio controlled clocks within a radius of several 1000km.

Now I want to show you how a computer can also send and not just receive this signal.

The signal will be "sent" through the speaker output. You won’t need a cable. All you need is a notebook (alternative: a flux capacitor ;-) ) to set radio controlled clocks nearby to any desired time. The internal speaker (or any speaker) can influence the receiver module of the clock. The speaker of my personal notebook can control clocks in a range of approximately 60cm. I guess a bigger sound system with amplifier can reach up to several meters.

There are no special requirements for the computer, except it must have a sound card with a sample rate of 192000 Hz (but this is common today). The operating system is not really important. Of course it doesn't have to be a notebook, it can be a normal workstation too.

Technical

DCF77 sends the signal with a relative low frequency of 77.5kHz. A sound card with 192 kHz is able to generate a frequency with up to 96 kHz. Humans cannot hear this frequency (and speakers shouldn't generate big acoustical waves here). However, the amplifier and magnet of the speaker get a high-frequency current and act like an antenna. This creates a magnetic field. The receiver module of the clock interprets the generated carrier of the sound card as original DCF77 signal and tries to decode it.

The encoding of the signal is very easy and is publicly documented. I wrote a small C program which generates several minutes of the signal and saves it as WAV file. You can play the file with any media player (e.g. VLC).

Ususally a radio controlled clock only syncs every few hours. You can trigger the sync by removing the batteries for a few seconds (some clocks also have a sync button). To get the best possible result you have to set your system volume to 100%. The volume in VLC shouldn't be over 100%. The signal would get overdriven and a higher bandwidth by software, so that the result would be worse.

The cool thing with the hack is that you can use nearly every player with 192 kHz as transmitter. You cannot hear (nearly) the transmission. This means you could use this as an attack. Webbrowser provide several methods to play sound, so the visitor of a website could unconsciously become a jamming transmitter. I tried to make a proof of concept for this, but the WebAudio API of Chrome seems to be buggy at the moment and Firefox only provides me with a sample rate of 44.1 kHz.

But I guess that are just some small problems (please tell me, when you implemented that for a browser :-) ).

If you want to reproduce it: Please make sure your system supports 192 kHz (on Windows you can find the setting in the Control Panel) and your radio controlled clock is next to your speaker. You have to wait a few minutes until your clock accept your time signal after you triggered the sync. With my test clock it takes around 3.5 minutes. So best practice is to generate a 10 minutes long audio file.

Download

To avoid everyone having to setup a audio file generator to test this I uploaded a test file. Just play it with VLC:
Download (dcf77.wav)

Download of the generator (tested on Windows and Linux):
Download (timegen-0.4-src.zip)
Download (timegen-0.4-bin-win.zip)

Example:
timegen -o dcf77.wav -t 2015-10-21.16:29 -m 10

When you play dcf77.wav now and your clock is syncing is next to the speaker it should adopt your time. Caution: Maybe it's not legal in your country to play this file.

Thanks to all who helped me with that project! If you have any questions please write me an email. And don't get caught when you manipulate the clock of your boss :-)