RF Counter-Surveillance
Four listen-only detectors, jamming, captured-remote, silenced-sensor and RollJam, with no offensive transmit.
Auf dieser Seite
Counter-surveillance is Echo's defining role. It runs four detectors, all listen-only, in a monitoring session you turn on from the app. When something fires, Echo pushes an alert to your phone.
The four detectors
What it detects: the band being flooded with a strong, sustained signal, the classic sign someone is jamming a remote or sensor to stop it reaching its receiver.
How it works: Echo learns the normal background noise level as it listens, then watches for the signal strength to sit well above that baseline for a sustained stretch, not just a brief spike from an ordinary remote press.
What the alert looks like: a jamming alert on your phone, with the signal strength at the moment it fired. The alert clears itself automatically as soon as the noise drops back down, or a valid signal gets through.
What it detects: "your fob or remote was captured", a remote Echo has already seen appears again in a way that looks like a recording being replayed rather than a fresh press.
How it works: Echo tracks recently-seen signals. A burst of identical repeats right after the original press is normal (that's how a fob confirms its own signal), but the same signal reappearing well after that burst has ended is treated as suspicious.
What the alert looks like: a captured-remote alert naming the event, useful on its own, and it's also one half of the RollJam detector below.
What it detects: the "sensor silenced" case, a door, PIR or other sensor that normally checks in on a regular cadence suddenly goes quiet.
How it works: Echo learns how often each sensor it's watching normally checks in, then alerts if a sensor is overdue, especially when that silence coincides with noise on the band, a pattern consistent with the sensor being jammed rather than just idle.
What the alert looks like: one alert per outage, it won't repeat every few seconds while the sensor stays silent, and it clears once the sensor checks in again or catches back up to its normal cadence.
What it detects: the signature of a jam-and-replay (RollJam-style) attack, a jamming burst followed closely by a repeat of a rolling-code remote.
How it works: it correlates the other two detectors, if a jamming excursion and a captured-remote hit on a rolling-code signal both occur within a short window of each other, it raises a single combined alert rather than two separate ones.
What the alert looks like: one RollJam alert, fired once per episode rather than repeating for as long as the pattern holds.
How they work together
The monitoring session runs the detectors you choose over the same live listening stream. The RollJam detector is the clearest example of them working together: a jam-and-replay attack shows up as a noise burst (jamming detector) closely followed by a repeat of a rolling-code remote (captured-remote detector on a signal the rolling-code classifier recognised). When both line up within a short window, Echo raises a single RollJam alert.
You start and stop monitoring in the app, and alerts arrive as notifications on your phone.