ARDOP vs VARAHF

[shithubsucks]

The VARA HF modem is proprietary and specific to the Microsoft Windows operating system. While it is possible to get it working on Linux and the BSDs with WINE and winetricks, it is not trivial to do so.

VARA is also less robust then the ARDOP mode at the cost of being just a bit slower. The ARDOP mode is an actual open standard with a open source C implementation for all major operating systems. In my testing, ARDOP is able to establish connections in ARQ mode when VARA HF is not even able to establish one. I have also had to operate in an emergency situation with a mobile station under active jamming conditions. ARDOP was the only mode able to punch through a jammer and hold a ARQ connection open long enough to send a complete email. It is able to do this because it is able to operate in as little as 200Hz of bandwidth and change it's payload lengths adaptively.

Here is the Open ARDOP specification: https://www.winlink.org/sites/default/files/downloads/_ardop_specification.pdf
And here is the C implementation: https://www.cantab.net/users/john.wiseman/Documents/ARDOPC.html

ARDOP is also fully unlocked without a license unlike VARA.

There have been many situations during Ghostnet when VARAHF was failing to connect where I felt ARDOP could.

[shithubsucks]

WARNING

VARAHF is spyware. Every time you make a call with it, it connects to the internet and sends data including the callsigns used. The newest version includes code designed so the software can brick itself when used with certain callsigns. If you've ever seen VARA freeze before making a call on an airgapped machine that is why, it's because it can't contact it's C2C server. If you must use VARA do not upgrade past v4.7.7 and keep it airgapped.

[busysteve]

Do you have details? What port? What destination address? I've been monitoring the process and its connections but not seeing this activity.... yet. Stephen

…

On Tue, Apr 23, 2024 at 5:05 PM shithubsucks ***@***.***> wrote: WARNING VARAHF is spyware. Every time you make a call with it, it connects to the internet and sends data including the callsigns used. The newest version includes code designed so the software can brick itself when used with certain callsigns. If you've ever seen VARA freeze before making a call on an airgapped machine that is why, it's because it can't contact it's C2C server. If you must use VARA do not upgrade past v4.7.7 and keep it airgapped. — Reply to this email directly, view it on GitHub <#14 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGE6A7SA6FBAJFDRTZRMR3Y63EH7AVCNFSM6AAAAABF23ZGAWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANZTGQ2DCOBSGE> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[shithubsucks]

79.151.84.70, 79.150.116.117 the ip changes a lot. port range in the 8000s-9000s.

[busysteve]

Thanks Stephen

…

On Thu, Apr 25, 2024 at 7:55 PM shithubsucks ***@***.***> wrote: 79.151.84.70, 79.150.116.117 the ip changes a lot. port range in the 8000s-9000s. — Reply to this email directly, view it on GitHub <#14 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGE6AYEKKLMGOJS3BS6CWLY7GJYXAVCNFSM6AAAAABF23ZGAWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANZYGM2TINBRGM> . You are receiving this because you commented.Message ID: ***@***.***>

[RD-Neck]

Not true about VARA being spyware. What is your affiliation with ARDOP? 😀 I have used ARDOP and VARAHF more than most. I have a BPQ32 running both right now. VARA blows ARDOP away. The key is VARAHF Narrow. 500hz connections. Too much QRM out there.

[shithubsucks]

If you don't believe me your more than welcome to use any off the shelf packet capture program and see for yourself. ARDOP is an open standard with an open source reference implementation; not a commercial product. How can I be affiliated with it? What is your affiliation with VARA? Also what does 'blows away' even mean?

[RD-Neck]

That was a joke about being involved with ARDOP. Especially with QRM, VARA outperforms ARDOP. There is no situation where I would use ARDOP over VARA. You you like ARDOP keep using it. It just an inferior product.
I assume that’s RMS servers doing what you are describing. I don’t use Winlink. Reach out to Jose who developed VARA. What you are describing sounds like how he keeps people from pirating the software.

[RD-Neck]

The real issue to me is Winlink itself. All messages are published on a their server and are viewable by anyone with a Winlink account. Doesn’t matter what modem you use.
https://www.winlink.org/content/us_amateur_radio_message_viewer

[busysteve]

Winlink is not used for Peer to Peer message transfers. However, I just installed wireshark on windows and ran a VaraHF P2P attempt. I see nothing useful. I don't like the Ghostnet "dependency" on VaraHF either, I prefer ardop due to it's openness and accessibility. But I am not seeing any threats with VaraHF yet on my end. I'll keep looking though. Stephen

…

On Mon, Apr 29, 2024 at 9:29 AM RD-Neck ***@***.***> wrote: The real issue to me is Winlink itself. All messages are stored on a their server and are viewable by anyone with a Winlink account. Doesn’t matter what modem you use. — Reply to this email directly, view it on GitHub <#14 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGE6A5D6OWXHG56A7PS3UTY7ZDMZAVCNFSM6AAAAABF23ZGAWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOBSG42TONZRG4> . You are receiving this because you commented.Message ID: ***@***.***>

[RD-Neck]

Initially, there would have to be some kind of connection to the VARA servers to authenticate your registration code. @shithubsucks are you saying it does this every time you use VARA?

[busysteve]

Can someone share proof of the sniffed Vara network chatter?

…

On Mon, Apr 29, 2024, 10:47 RD-Neck ***@***.***> wrote: Initially, there would have to be some kind of connection to the VARA servers to authenticate your registration code. @shithubsucks <https://github.com/shithubsucks> are you saying it does this every time you use VARA? — Reply to this email directly, view it on GitHub <#14 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGE6A5QJID3RQKLAN567PLY7ZMO3AVCNFSM6AAAAABF23ZGAWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOBSHE2DGMJRGY> . You are receiving this because you commented.Message ID: ***@***.***>

[JFRHorton]

Just ran a wireshark capture of the following:
Starting VARA HF session from Winlink
Make Connection
Close VARA

All on Windows 10.

I saw what appears to be VARA-related traffic only upon startup, containing the following:
DNS Lookup and response for EA5HVK.ddns.net
TCP Packet to EA5HVK current IP, source port 10154 dest port 8002
0000 f8 32 e4 ad f1 10 2c db 07 98 fb 98 08 00 45 00
0010 00 34 6b c6 40 00 80 06 08 63 c0 a8 01 e7 4f 96
0020 74 75 27 aa 1f 42 6d 7e 03 a1 00 00 00 00 80 02
0030 fa f0 35 79 00 00 02 04 05 b4 01 03 03 08 01 01
0040 04 02

Response packet (same ports, and IPs)

0000 2c db 07 98 fb 98 f8 32 e4 ad f1 10 08 00 45 00
0010 00 34 86 9a 40 00 70 06 fd 8e 4f 96 74 75 c0 a8
0020 01 e7 1f 42 27 aa 13 55 be 09 6d 7e 03 a2 80 12
0030 ff ff 5f 0a 00 00 02 04 05 ac 01 03 03 00 01 01
0040 04 02

I'm guessing this is a check for license activation.

Next up I send two packets:
0000 f8 32 e4 ad f1 10 2c db 07 98 fb 98 08 00 45 00
0010 00 28 6b c7 40 00 80 06 08 6e c0 a8 01 e7 4f 96
0020 74 75 27 aa 1f 42 6d 7e 03 a2 13 55 be 0a 50 10
0030 02 04 9d c9 00 00

0000 f8 32 e4 ad f1 10 2c db 07 98 fb 98 08 00 45 00
0010 00 38 6b c8 40 00 80 06 08 5d c0 a8 01 e7 4f 96
0020 74 75 27 aa 1f 42 6d 7e 03 a2 13 55 be 0a 50 18
0030 02 04 89 cc 00 00 01 0d 0d 0d 0d 0d 34 2e 38 2e
0040 37 0d 48 46 0d 0e

When looking at an ASCII Dump of the second packet, it contains:
"4.8.7 HF" on 0030 and 0040, which is the version of VARA HF I am using.

This is followed by a single response packet:
0000 2c db 07 98 fb 98 f8 32 e4 ad f1 10 08 00 45 00
0010 00 28 86 9f 40 00 71 06 fc 95 4f 96 74 75 c0 a8
0020 01 e7 1f 42 27 aa 13 55 be 0a 6d 7e 03 b2 50 10
0030 ff ef 9f cd 00 00 00 00 00 00 00 00

Presumably, this is the interaction that supports the "A new version of VARA is available for download" message.

The last packet I saw was UDP from me out to 8003 on that same EA5HVK domain, transmitted as I started a connection.

0000 f8 32 e4 ad f1 10 2c db 07 98 fb 98 08 00 45 00
0010 00 2b 6b e3 00 00 80 11 48 44 c0 a8 01 e7 4f 96
0020 74 75 f8 d9 1f 43 00 17 9d 4e 48 46 20 34 2e 38
0030 redacted

I redacted the last line, since it has my callsign (even though that's easy to find publicly), but it contained only the .7 from "NHF 4.8.7" from line 0020 (version number again) and my callsign. This might be some sort of usage collection. Nowhere did I see the destination callsign I was reaching out to.

I don't see any evidence to support that VARA is "spying". Shy of decompiling the binaries, we probably won't know more, but this all seems to be fairly benign "phoning home" for licensing and updates.

The only other traffic I saw during this interaction was fairly normal Netbios to my router, and a surprising amount of HTTPS telemetry to Winlink.org itself, send with each message I recieved. Presumably, this is to 'sync' the state of all internet-connected inboxes on Winlink.

Regardless, if you're worried about the security of your comms, why would you EVER run them from an internet-connected machine? It's pretty hard to defeat an Airgap.

UPDATE:
I've decompiled the VARA HF binary, and so far it looks to match the behavior I see above, just checking for license validation. I'll try to see what the origin of that UDP packet at the end is.
Interestingly, there is a hardcoded "ExceptionList" of ham callsigns that skip the license check, presumably friends of the developer who can use it for free.

Can someone share proof of the sniffed Vara network chatter?
…
On Mon, Apr 29, 2024, 10:47 RD-Neck @.> wrote: Initially, there would have to be some kind of connection to the VARA servers to authenticate your registration code. @shithubsucks https://github.com/shithubsucks are you saying it does this every time you use VARA? — Reply to this email directly, view it on GitHub <#14 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABGE6A5QJID3RQKLAN567PLY7ZMO3AVCNFSM6AAAAABF23ZGAWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOBSHE2DGMJRGY . You are receiving this because you commented.Message ID: @.>

[shithubsucks]

"presumably"?

[shithubsucks]

are you saying it does this every time you use VARA?
Yes. It phones home every time you make a VARA call.

[RD-Neck]

are you saying it does this every time you use VARA?
Yes. It phones home every time you make a VARA call.

Gotcha, My machine is airgapped and Im not having any issues. Need to see what version I am running.