1
00:00:00,000 --> 00:00:01,459
PHILIP POLSTRA: All right, guys.

2
00:00:01,459 --> 00:00:05,626
Just want to talk a little bit about how

3
00:00:05,626 --> 00:00:09,167
with your own little pentest army.

4
00:00:11,292 --> 00:00:17,459
So as you can see, by the way,

5
00:00:17,626 --> 00:00:19,542
I social engineered myself.

6
00:00:19,542 --> 00:00:20,834
I'm very proud of that.

7
00:00:20,999 --> 00:00:23,999
I social engineered myself a title

8
00:00:23,999 --> 00:00:26,626
at the University of Redacted.

9
00:00:29,501 --> 00:00:32,334
So what is this talk about anyway?

10
00:00:32,334 --> 00:00:36,250
I am going to talk a little bit

11
00:00:36,250 --> 00:00:39,751
with some small low power devices.

12
00:00:39,876 --> 00:00:43,999
It turns out that

13
00:00:43,999 --> 00:00:48,209
devices in the BeagleBoard family

14
00:00:48,209 --> 00:00:54,876
is pretty much made my own custom

15
00:00:54,959 --> 00:00:58,501
And The Deck is essentially

16
00:00:58,501 --> 00:01:04,083
out of backtrack and none

17
00:01:04,083 --> 00:01:06,501
The stuff that people haven't used

18
00:01:07,083 --> 00:01:09,083
I didn't port that stuff.

19
00:01:09,083 --> 00:01:10,417
I ported everything else.

20
00:01:10,999 --> 00:01:15,667
I'll talk very briefly about porting stuff

21
00:01:15,667 --> 00:01:17,792
I don't want to focus on that too much.

22
00:01:17,792 --> 00:01:21,709
A lot of the stuff I want to talk

23
00:01:21,709 --> 00:01:24,999
Mostly just so it's in the slides, it's

24
00:01:24,999 --> 00:01:26,542
up later.

25
00:01:26,542 --> 00:01:27,999
Ask me questions, whatever.

26
00:01:28,417 --> 00:01:31,667
I also want to talk

27
00:01:31,667 --> 00:01:34,209
coordinated attacks

28
00:01:34,209 --> 00:01:36,709
of pentesting minions.

29
00:01:38,125 --> 00:01:40,751
So who am I anyway?

30
00:01:41,375 --> 00:01:45,918
I am a Prof at the University

31
00:01:45,918 --> 00:01:49,999
in residence somewhere in the Midwest.

32
00:01:49,999 --> 00:01:52,834
I have been programming

33
00:01:52,834 --> 00:01:55,334
Been hacking hardware since I was 12.

34
00:01:55,334 --> 00:01:59,999
Also been known to fly some planes,

35
00:02:01,918 --> 00:02:05,375
What I'm going to talk

36
00:02:05,375 --> 00:02:11,459
a platform that was appropriate,

37
00:02:11,459 --> 00:02:16,542
a base OS, building a base system

38
00:02:16,542 --> 00:02:20,792
getting some tools

39
00:02:20,792 --> 00:02:25,209
and also talk

40
00:02:25,209 --> 00:02:31,083
get things out of a repository;

41
00:02:31,083 --> 00:02:34,918
for a little arm-based device?

42
00:02:34,999 --> 00:02:41,334
I'll move into networking

43
00:02:41,999 --> 00:02:47,999
Talk to you guys a little bit, talk

44
00:02:47,999 --> 00:02:51,999
and I'll have some demonstrations.

45
00:02:51,999 --> 00:02:54,999
I apologize, via screen shot.

46
00:02:55,167 --> 00:02:59,125
As we all know live demos are never

47
00:02:59,125 --> 00:03:01,626
in a crowd this size.

48
00:03:01,999 --> 00:03:04,667
But I will be available later

49
00:03:04,667 --> 00:03:08,999
to get touchy-feely with some

50
00:03:09,542 --> 00:03:13,209
Talk about attack networks

51
00:03:14,417 --> 00:03:17,083
So picking a platform.

52
00:03:17,209 --> 00:03:19,334
This is my criteria.

53
00:03:19,334 --> 00:03:22,959
I wanted something that was small,

54
00:03:22,959 --> 00:03:24,667
Something I could afford.

55
00:03:24,918 --> 00:03:28,250
You know, I don't make much

56
00:03:28,709 --> 00:03:32,584
Something that was mature,

57
00:03:32,584 --> 00:03:35,125
good community support.

58
00:03:35,167 --> 00:03:37,999
Had some nice input

59
00:03:38,709 --> 00:03:43,501
And the winning platform, I kind

60
00:03:43,501 --> 00:03:47,999
is the BeagleBoard family of devices.

61
00:03:47,999 --> 00:03:52,083
In particular I started out doing this

62
00:03:52,083 --> 00:03:55,375
a desktop replacement device

63
00:03:55,375 --> 00:03:59,999
to having something that runs

64
00:03:59,999 --> 00:04:05,209
the new BeagleBone Black,

65
00:04:05,584 --> 00:04:08,999
Pretty cheap stuff, BeagleBoard XM,

66
00:04:11,501 --> 00:04:15,501
The BeagleBone Black lists

67
00:04:15,501 --> 00:04:21,459
for less than list price

68
00:04:21,501 --> 00:04:23,584
Half a gig of RAM.

69
00:04:23,751 --> 00:04:29,083
Networking, USB, DVID output,

70
00:04:31,999 --> 00:04:36,999
Here is a little picture

71
00:04:36,999 --> 00:04:39,083
This is stolen

72
00:04:39,417 --> 00:04:41,125
It gives you some of the specs.

73
00:04:41,209 --> 00:04:44,834
You can see it's three and

74
00:04:44,834 --> 00:04:45,999
It's pretty small.

75
00:04:46,999 --> 00:04:50,999
And here is the other device that you

76
00:04:50,999 --> 00:04:53,709
if you were starting today.

77
00:04:53,709 --> 00:04:58,167
This is the BeagleBone Black,

78
00:04:58,167 --> 00:04:59,417
All right?

79
00:04:59,417 --> 00:05:01,375
This came out in late April.

80
00:05:01,584 --> 00:05:03,918
It lists for 45 bucks.

81
00:05:03,918 --> 00:05:07,125
I've spent an average of $42

82
00:05:07,542 --> 00:05:09,209
It's a nice piece of hardware.

83
00:05:11,999 --> 00:05:16,667
I know at least somebody is going

84
00:05:17,375 --> 00:05:19,918
Well, here is why I didn't use the Pi.

85
00:05:20,250 --> 00:05:22,292
The Pi is not near as powerful.

86
00:05:22,459 --> 00:05:24,751
Doesn't run to Ubuntu.

87
00:05:24,751 --> 00:05:29,626
It has ancient ARM are architecture that

88
00:05:29,834 --> 00:05:34,417
It is not as mature, the platform.

89
00:05:34,999 --> 00:05:38,751
The original BeagleBone has been

90
00:05:38,999 --> 00:05:41,918
There is no cost savings, if any.

91
00:05:42,626 --> 00:05:45,626
I think if you try

92
00:05:45,626 --> 00:05:48,999
you would spend more money,

93
00:05:48,999 --> 00:05:57,209
Even now it's not easy to go buy 50 Pis,

94
00:05:57,209 --> 00:05:58,292
A lot

95
00:05:58,292 --> 00:06:00,375
with flakey boards.

96
00:06:00,501 --> 00:06:03,876
Also even though they are not

97
00:06:03,876 --> 00:06:06,959
they consume

98
00:06:07,999 --> 00:06:12,292
So you know, I've talked to a lot

99
00:06:12,292 --> 00:06:16,709
with the Pi and I hear a couple

100
00:06:16,709 --> 00:06:21,125
I hear the: I never got it

101
00:06:21,125 --> 00:06:25,999
you know, Raspion and that stuff never

102
00:06:27,792 --> 00:06:30,834
I also hear it worked great two weeks

103
00:06:30,834 --> 00:06:33,999
the Flakey power circuits failed.

104
00:06:34,626 --> 00:06:37,999
And then the other,

105
00:06:37,999 --> 00:06:41,584
story I hear is yeah, I wanted

106
00:06:41,584 --> 00:06:44,792
and then it wasn't powerful enough.

107
00:06:45,083 --> 00:06:47,459
But it can flash LEDs!

108
00:06:47,459 --> 00:06:48,999
It's really cool.

109
00:06:48,999 --> 00:06:51,584
(Cheering.)    PHILIP POLSTRA: Blink

110
00:06:52,501 --> 00:06:55,999
I think I'm doing something

111
00:06:55,999 --> 00:06:59,999
You can judge for yourselves here,

112
00:07:00,417 --> 00:07:04,999
Now that I've selected a device,

113
00:07:04,999 --> 00:07:06,999
to start with.

114
00:07:06,999 --> 00:07:10,751
Well, again unlike the Pi,

115
00:07:10,751 --> 00:07:16,125
it actually comes with an OS

116
00:07:16,459 --> 00:07:19,083
They even give you a power cable

117
00:07:19,083 --> 00:07:21,083
Amazing, don't have to buy extra stuff.

118
00:07:21,292 --> 00:07:25,209
So it comes

119
00:07:25,209 --> 00:07:28,209
most people never heard

120
00:07:28,209 --> 00:07:31,918
like to do embedded Linux stuff.

121
00:07:32,209 --> 00:07:37,375
It is not a bad distro, it's optimized

122
00:07:37,375 --> 00:07:39,626
it's not the best.

123
00:07:39,999 --> 00:07:43,584
The guys who made it initially aren't

124
00:07:43,584 --> 00:07:45,834
They didn't say hey, I want

125
00:07:45,834 --> 00:07:47,918
on my little board.

126
00:07:47,999 --> 00:07:50,375
Until recently, nobody was doing that.

127
00:07:50,999 --> 00:07:54,999
So I chose the Ubuntu.

128
00:07:54,999 --> 00:07:59,999
It's available, as you all probably know,

129
00:08:01,542 --> 00:08:07,125
Lot a support in the community

130
00:08:08,792 --> 00:08:13,334
So now that I have

131
00:08:13,334 --> 00:08:16,709
to go about installing it.

132
00:08:16,834 --> 00:08:19,626
So on the Beagles,

133
00:08:19,626 --> 00:08:22,709
it has two gig

134
00:08:22,709 --> 00:08:24,459
enough for me.

135
00:08:24,959 --> 00:08:28,375
The image for The Deck

136
00:08:28,834 --> 00:08:31,918
I have just a few tools in there.

137
00:08:32,334 --> 00:08:35,501
I forgot, though,

138
00:08:35,501 --> 00:08:39,083
in there to blink LEDs, but I didn't do it.

139
00:08:39,083 --> 00:08:40,083
I apologize.

140
00:08:40,083 --> 00:08:43,626
(Chuckles.)    PHILIP POLSTRA: You're

141
00:08:43,626 --> 00:08:44,626
Maybe I'll add it.

142
00:08:44,959 --> 00:08:48,125
So what you want to do,

143
00:08:48,125 --> 00:08:52,999
an image and if you're going

144
00:08:53,292 --> 00:08:55,459
Get their images or there's

145
00:08:55,459 --> 00:08:56,959
Nelson.

146
00:08:56,999 --> 00:09:00,999
He writes stuff for images all day.

147
00:09:01,918 --> 00:09:07,667
I chose to use his branch for it

148
00:09:09,918 --> 00:09:13,083
You can find good instructions

149
00:09:13,083 --> 00:09:16,792
at the link provided if you want

150
00:09:18,250 --> 00:09:21,584
So now I have a device.

151
00:09:21,918 --> 00:09:23,125
Got a starting point.

152
00:09:23,209 --> 00:09:26,459
I've ported some of the tools

153
00:09:26,459 --> 00:09:28,125
of the tools.

154
00:09:29,209 --> 00:09:31,626
So what is the easiest thing?

155
00:09:32,459 --> 00:09:34,999
Well, I want this tool.

156
00:09:35,209 --> 00:09:40,999
App, get, install, pray, right?

157
00:09:41,167 --> 00:09:43,709
And a lot of times you get lucky.

158
00:09:44,334 --> 00:09:49,999
Now, sometimes you don't get quite

159
00:09:49,999 --> 00:09:51,626
A lot of people like Ubuntu.

160
00:09:51,876 --> 00:09:57,334
A lot of times if you can't get that

161
00:09:57,334 --> 00:10:01,999
a dev final and use D-package

162
00:10:01,999 --> 00:10:06,584
In case of a dev file, what I found is,

163
00:10:06,584 --> 00:10:11,834
on an interpreted language like PERL,

164
00:10:11,834 --> 00:10:15,999
to work pretty well kind

165
00:10:15,999 --> 00:10:19,918
If it's a C-based program,

166
00:10:19,918 --> 00:10:22,626
you are probably okay as well.

167
00:10:25,626 --> 00:10:30,501
Now, sometimes you actually have

168
00:10:30,501 --> 00:10:34,167
Now, in my experience this was roughly

169
00:10:34,167 --> 00:10:37,209
So 90 percent

170
00:10:37,209 --> 00:10:41,375
and it worked or I got some dev files

171
00:10:41,375 --> 00:10:43,125
and it worked.

172
00:10:43,501 --> 00:10:46,999
A couple times you actually have

173
00:10:47,000 --> 00:10:50,042
So you have to build this stuff,

174
00:10:50,042 --> 00:10:54,042
You have to say: Do I want to build it

175
00:10:54,042 --> 00:10:56,709
Or do I want to build it

176
00:10:56,709 --> 00:10:58,626
and gobs of RAM?

177
00:10:59,999 --> 00:11:02,250
If you build it on the Beagle, it has

178
00:11:02,250 --> 00:11:04,834
of being pretty straightforward.

179
00:11:04,876 --> 00:11:07,834
It has the disadvantage

180
00:11:07,834 --> 00:11:09,999
if it's a big program.

181
00:11:10,999 --> 00:11:15,083
Of course, you can cross compile,

182
00:11:15,083 --> 00:11:19,751
but you can take advantage

183
00:11:19,834 --> 00:11:21,375
All right.

184
00:11:21,459 --> 00:11:24,999
So if you're going to go

185
00:11:25,334 --> 00:11:28,876
Do a pseudo-app get,

186
00:11:28,876 --> 00:11:30,959
and not plural.

187
00:11:30,959 --> 00:11:32,999
I don't know why, but that's

188
00:11:33,417 --> 00:11:34,999
You are pretty much on your way.

189
00:11:34,999 --> 00:11:39,626
Download the code, do

190
00:11:39,626 --> 00:11:42,125
Something to keep in mind

191
00:11:42,125 --> 00:11:45,125
the BeagleBoard XM, be aware

192
00:11:45,125 --> 00:11:48,959
in there and use DHCP,

193
00:11:48,959 --> 00:11:53,999
you get a new Mac address

194
00:11:53,999 --> 00:11:58,542
If you wonder,

195
00:11:58,542 --> 00:12:00,751
Just don't ever turn it off; you'll be fine.

196
00:12:02,334 --> 00:12:03,542
All right.

197
00:12:03,542 --> 00:12:05,375
I'm not going to cover this in detail.

198
00:12:05,375 --> 00:12:09,083
I just want to include this in the slides,

199
00:12:10,083 --> 00:12:12,999
The most simple way

200
00:12:12,999 --> 00:12:15,751
you download

201
00:12:15,751 --> 00:12:17,959
the standard thing.

202
00:12:17,959 --> 00:12:21,250
You go get your source code

203
00:12:21,250 --> 00:12:25,834
make install, and

204
00:12:26,667 --> 00:12:30,667
The only difference is if you look

205
00:12:30,667 --> 00:12:35,792
says configure and then there's a dash,

206
00:12:36,501 --> 00:12:40,999
All that is telling the compiler is: Hey,

207
00:12:40,999 --> 00:12:42,959
I'm not building

208
00:12:42,959 --> 00:12:46,876
whatever machine I'm running

209
00:12:46,876 --> 00:12:49,083
I want to compile

210
00:12:51,292 --> 00:12:55,083
And other than that, it's pretty much

211
00:12:55,083 --> 00:12:57,167
for your own machine.

212
00:12:58,125 --> 00:13:00,999
You can be a little bit more fancy.

213
00:13:01,167 --> 00:13:03,083
You can start using Eclipse.

214
00:13:03,626 --> 00:13:09,250
And there's some good instructions

215
00:13:09,250 --> 00:13:14,375
And if you get really, really fancy

216
00:13:15,083 --> 00:13:18,083
I prefer you

217
00:13:18,083 --> 00:13:22,083
a link to that at the bottom of the page,

218
00:13:22,083 --> 00:13:25,083
If you have questions about this stuff,

219
00:13:25,417 --> 00:13:26,876
Okay.

220
00:13:27,083 --> 00:13:29,292
So now we have a device.

221
00:13:29,584 --> 00:13:30,999
We select a device.

222
00:13:30,999 --> 00:13:31,999
We have an OS.

223
00:13:31,999 --> 00:13:34,667
We ported all of our tools over.

224
00:13:34,667 --> 00:13:37,250
Now let's talk about networking.

225
00:13:37,334 --> 00:13:41,584
How many of you are familiar

226
00:13:42,417 --> 00:13:45,667
All right, like maybe ten of you.

227
00:13:45,999 --> 00:13:47,292
Not a lot.

228
00:13:47,292 --> 00:13:48,292
All right.

229
00:13:48,292 --> 00:13:50,584
Also sometimes called XB networking.

230
00:13:50,584 --> 00:13:52,999
Sometimes you might hear

231
00:13:52,999 --> 00:13:55,584
is built on top of Zigbee.

232
00:13:55,959 --> 00:14:00,999
I'm going to give you a brief overview

233
00:14:01,250 --> 00:14:06,083
Talk about some of the hardware,

234
00:14:06,083 --> 00:14:09,834
2XB radios and some slightly harder

235
00:14:09,834 --> 00:14:15,209
up to the hard stuff where you're doing

236
00:14:17,083 --> 00:14:20,876
So typically you'll find these XB

237
00:14:20,876 --> 00:14:25,125
in industrial settings when people are

238
00:14:25,125 --> 00:14:28,999
with low power embedded devices.

239
00:14:29,083 --> 00:14:34,375
They like to use XBs and

240
00:14:34,501 --> 00:14:36,751
They usually come in two flavors.

241
00:14:36,751 --> 00:14:40,999
They have the basic ones,

242
00:14:40,999 --> 00:14:46,709
you know, of one,

243
00:14:46,999 --> 00:14:49,334
And then we have

244
00:14:49,334 --> 00:14:51,250
of up to a mile.

245
00:14:52,334 --> 00:14:55,334
They have two different modes

246
00:14:55,334 --> 00:14:57,501
They have what we call AT mode which

247
00:14:57,501 --> 00:15:02,167
of the olders among us you might

248
00:15:02,334 --> 00:15:04,792
It's from these things called modems.

249
00:15:04,959 --> 00:15:08,125
Some of you are like, I heard

250
00:15:08,125 --> 00:15:12,375
(Chuckles.)    PHILIP POLSTRA: It's

251
00:15:13,626 --> 00:15:16,459
And it supports a lot

252
00:15:16,459 --> 00:15:20,876
as peer-to-peer networks,

253
00:15:21,584 --> 00:15:26,209
It's by a company called Midgy

254
00:15:26,417 --> 00:15:30,417
They have pro formats.

255
00:15:30,417 --> 00:15:32,999
They are interchangeable

256
00:15:33,999 --> 00:15:37,209
I can have a network where part

257
00:15:37,209 --> 00:15:40,125
the regular adapters and part

258
00:15:40,125 --> 00:15:43,083
the pro adapters and that works.

259
00:15:43,083 --> 00:15:45,083
They interoperate just fine.

260
00:15:45,417 --> 00:15:49,999
One thing that is a pain

261
00:15:49,999 --> 00:15:53,125
they use a 2-millimeter spacing.

262
00:15:53,584 --> 00:15:58,083
Not the standard 2.54-millimeter

263
00:15:58,417 --> 00:16:00,709
You have to get some sort of adapter.

264
00:16:00,999 --> 00:16:03,999
A lot of different antenna options.

265
00:16:04,375 --> 00:16:08,334
When you're buying these things,

266
00:16:08,751 --> 00:16:13,834
You'll see series one and series two

267
00:16:13,834 --> 00:16:16,250
to as ZB adapters.

268
00:16:16,626 --> 00:16:20,083
You can interoperate's and pro,

269
00:16:20,083 --> 00:16:23,083
and series two together.

270
00:16:23,876 --> 00:16:28,083
So buy all the same kind, okay?

271
00:16:30,918 --> 00:16:36,918
So if you get these little XB modules

272
00:16:36,918 --> 00:16:41,876
pretty much what you can do

273
00:16:41,876 --> 00:16:48,083
those are the easiest way of doing this,

274
00:16:48,083 --> 00:16:51,501
plug it into your computer.

275
00:16:51,501 --> 00:16:53,584
They provide some software you can

276
00:16:53,584 --> 00:16:55,083
You set up different things.

277
00:16:55,083 --> 00:16:56,959
You configure each of these modems.

278
00:16:56,959 --> 00:16:58,709
You give it a baud rate.

279
00:16:59,083 --> 00:17:03,584
Tell it what kind of device it should be,

280
00:17:03,999 --> 00:17:09,918
You set the channel and you also set

281
00:17:10,250 --> 00:17:14,083
You can choose something great

282
00:17:14,083 --> 00:17:16,999
You know or you can -- probably

283
00:17:16,999 --> 00:17:19,250
but you can change it.

284
00:17:19,999 --> 00:17:25,083
You pick a destination low address

285
00:17:25,083 --> 00:17:27,876
And it is pretty simple.

286
00:17:27,876 --> 00:17:31,083
I'll talk about the different modes that it

287
00:17:31,083 --> 00:17:36,083
And you just write this information

288
00:17:36,542 --> 00:17:38,834
Then you label it with a piece of tape

289
00:17:38,834 --> 00:17:41,375
all confused because they all look

290
00:17:41,626 --> 00:17:49,999
And go forth and do some XB

291
00:17:49,999 --> 00:17:50,999
All right.

292
00:17:50,999 --> 00:17:53,667
So what is the absolute simplest thing

293
00:17:53,999 --> 00:17:58,792
You have one drone and you just want

294
00:17:58,959 --> 00:18:05,792
So I might have one little drone device

295
00:18:05,792 --> 00:18:12,167
to sit maybe

296
00:18:12,167 --> 00:18:16,959
My lunch box, of course, has

297
00:18:17,083 --> 00:18:19,083
Why is it Buzz Lightyear?

298
00:18:20,876 --> 00:18:24,667
I'm going to hack you to infinity

299
00:18:27,834 --> 00:18:33,292
By default these XB adapters are meant

300
00:18:33,334 --> 00:18:37,501
Basically what it does, if you set

301
00:18:37,501 --> 00:18:42,999
of these are pointing at each other,

302
00:18:43,501 --> 00:18:48,167
So stuff just goes back and forth using

303
00:18:48,999 --> 00:18:52,709
And you can do this and then set

304
00:18:52,709 --> 00:18:56,959
which again some

305
00:18:57,125 --> 00:19:01,999
Something that people used

306
00:19:02,209 --> 00:19:04,501
So it is pretty simple.

307
00:19:04,501 --> 00:19:06,167
There's a lot of information

308
00:19:06,167 --> 00:19:08,125
up and you can do it.

309
00:19:08,459 --> 00:19:09,999
That's one way you can go.

310
00:19:11,999 --> 00:19:15,083
Now, you can go and do

311
00:19:15,083 --> 00:19:19,083
of thing and have multiple drones.

312
00:19:19,083 --> 00:19:21,334
All you need to do

313
00:19:21,334 --> 00:19:24,667
of those drones is having

314
00:19:24,667 --> 00:19:30,209
of your command center and

315
00:19:30,250 --> 00:19:32,999
For them, they think that it's exclusive.

316
00:19:32,999 --> 00:19:34,584
It's like they are

317
00:19:34,584 --> 00:19:36,083
or something.

318
00:19:36,501 --> 00:19:38,999
They all think it's just them.

319
00:19:38,999 --> 00:19:40,667
They don't know about the rest.

320
00:19:41,999 --> 00:19:43,959
And it's pretty simple.

321
00:19:43,959 --> 00:19:45,792
You don't have to do any programming.

322
00:19:45,792 --> 00:19:47,709
You can just use the AT commands.

323
00:19:47,959 --> 00:19:49,250
How does that work?

324
00:19:49,250 --> 00:19:51,751
You open

325
00:19:51,751 --> 00:19:54,999
If you want to change something,

326
00:19:54,999 --> 00:19:57,834
is hit plus three times.

327
00:19:57,834 --> 00:20:00,542
Wait a little bit and it will say okay.

328
00:20:00,542 --> 00:20:01,999
Then you can give it

329
00:20:01,999 --> 00:20:05,999
as this command that says hey,

330
00:20:05,999 --> 00:20:08,667
I can talk to this drone now.

331
00:20:08,999 --> 00:20:13,876
And then I can go and write those

332
00:20:15,792 --> 00:20:21,999
I can also use an API mode which

333
00:20:23,209 --> 00:20:28,876
The nice thing about API mode

334
00:20:28,876 --> 00:20:31,292
It's a lot better performance.

335
00:20:31,292 --> 00:20:33,501
And error correction, all that good stuff.

336
00:20:34,083 --> 00:20:35,999
By the way, a little tip.

337
00:20:36,334 --> 00:20:39,125
If you didn't configure

338
00:20:39,125 --> 00:20:42,334
and you're standing there

339
00:20:42,334 --> 00:20:44,709
why isn't it do anything?

340
00:20:45,083 --> 00:20:47,375
You think it's my Python scripting.

341
00:20:47,918 --> 00:20:52,125
It's probably just that you

342
00:20:52,709 --> 00:20:55,999
There are different ways that you can

343
00:20:55,999 --> 00:20:56,999
You can use Java.

344
00:20:56,999 --> 00:21:00,999
There's a Java protocol and a library

345
00:21:01,334 --> 00:21:05,167
There's a Python library, which I use.

346
00:21:05,709 --> 00:21:09,709
Or if you want to kick it old school,

347
00:21:09,959 --> 00:21:10,959
You can do that.

348
00:21:11,999 --> 00:21:18,501
I recommend that you use API mode

349
00:21:19,834 --> 00:21:23,999
So you can also go to multiple drones.

350
00:21:23,999 --> 00:21:25,459
Again, this

351
00:21:25,459 --> 00:21:27,792
networking at this point.

352
00:21:27,792 --> 00:21:29,501
It's really point to multi-point.

353
00:21:29,709 --> 00:21:33,375
And you set up this peer

354
00:21:33,375 --> 00:21:36,083
performance and all that.

355
00:21:36,083 --> 00:21:42,459
So it's a good thing.

356
00:21:42,459 --> 00:21:43,459
All right.

357
00:21:43,459 --> 00:21:46,667
One possibility you can do is what I did.

358
00:21:46,667 --> 00:21:50,125
You can write some simple Python

359
00:21:50,125 --> 00:21:54,751
a command center and then have

360
00:21:54,751 --> 00:21:56,834
and just wait.

361
00:21:56,834 --> 00:21:59,792
Wait for commands on the XB.

362
00:21:59,959 --> 00:22:02,999
You know, wait for commands

363
00:22:03,417 --> 00:22:06,626
It's not a line or wire, I guess,

364
00:22:08,209 --> 00:22:11,375
One down side

365
00:22:11,375 --> 00:22:14,626
you can't run an interactive program,

366
00:22:14,626 --> 00:22:17,417
the way I've done my scripting.

367
00:22:17,417 --> 00:22:20,999
But it does work pretty well.

368
00:22:21,083 --> 00:22:22,918
You can send commands.

369
00:22:22,918 --> 00:22:24,083
You can get responses.

370
00:22:24,083 --> 00:22:28,292
There's also a facility in there

371
00:22:28,292 --> 00:22:32,999
I might say: Hey, you drone over here,

372
00:22:33,083 --> 00:22:36,999
When it's done, it send me

373
00:22:36,999 --> 00:22:38,083
Hey, Phil, guess what?

374
00:22:38,459 --> 00:22:41,083
The password was: Password 1.

375
00:22:41,876 --> 00:22:44,876
So all the code

376
00:22:44,876 --> 00:22:47,584
about today is available

377
00:22:47,584 --> 00:22:51,167
but I'll give you some of the highlights.

378
00:22:54,083 --> 00:22:57,083
If you need to do

379
00:22:57,083 --> 00:22:58,999
you can do it.

380
00:22:59,250 --> 00:23:01,459
One thing that is cool

381
00:23:01,459 --> 00:23:03,334
to change anything.

382
00:23:03,334 --> 00:23:05,999
There's no changes in your scripts.

383
00:23:06,292 --> 00:23:07,792
It all just works.

384
00:23:07,792 --> 00:23:08,834
All right?

385
00:23:08,834 --> 00:23:11,542
You can take

386
00:23:11,542 --> 00:23:14,083
in series 2 modules.

387
00:23:14,125 --> 00:23:16,667
Really, it's a matter

388
00:23:16,667 --> 00:23:19,417
before you plug them into your drones.

389
00:23:20,250 --> 00:23:25,459
Something to keep in mind, though, if,

390
00:23:25,459 --> 00:23:29,083
as a router, routers are not allowed

391
00:23:29,083 --> 00:23:33,876
because routers that don't respond are

392
00:23:33,876 --> 00:23:37,209
End devices are allowed to sleep

393
00:23:39,292 --> 00:23:42,083
What is the simplest case?

394
00:23:42,334 --> 00:23:44,876
Again, let's back up a little bit.

395
00:23:44,876 --> 00:23:49,334
We selected a device, got our OS,

396
00:23:49,501 --> 00:23:52,999
And figured out how to do

397
00:23:52,999 --> 00:23:55,999
Well, the simplest case,

398
00:23:56,375 --> 00:23:57,501
You set it up.

399
00:23:57,918 --> 00:23:59,626
And you can hack from a distance.

400
00:24:00,083 --> 00:24:02,667
What is the advantage of this?

401
00:24:02,667 --> 00:24:04,999
It is running 24/7.

402
00:24:04,999 --> 00:24:09,292
You are not suspiciously sitting

403
00:24:09,292 --> 00:24:11,083
on your van.

404
00:24:11,083 --> 00:24:14,876
(Laughter.)    PHILIP POLSTRA: It's

405
00:24:14,959 --> 00:24:18,918
That's the famous FBI van number 6,

406
00:24:19,792 --> 00:24:21,542
Little story on that.

407
00:24:21,542 --> 00:24:24,083
Last weekend I was at maker fair

408
00:24:24,542 --> 00:24:26,250
I was running some of this stuff.

409
00:24:26,250 --> 00:24:28,125
Someone came up to my booth

410
00:24:28,125 --> 00:24:31,501
there's FBI van number 6 right there.

411
00:24:31,584 --> 00:24:33,626
I was like dude, I know it's you.

412
00:24:33,876 --> 00:24:37,792
I mean, dude, you're 6 inches

413
00:24:37,792 --> 00:24:40,334
the strongest signal.

414
00:24:40,334 --> 00:24:45,083
So I'm pretty sure you're FBI van

415
00:24:45,167 --> 00:24:49,501
So okay, you can lounge by the pool

416
00:24:49,999 --> 00:24:52,999
Especially if you go someplace

417
00:24:52,999 --> 00:24:56,209
You want to sit by the pool or whatever,

418
00:25:00,417 --> 00:25:02,334
Other things you can do.

419
00:25:02,334 --> 00:25:04,709
You can have multiple drones.

420
00:25:05,209 --> 00:25:08,918
And you can interopt with each

421
00:25:09,709 --> 00:25:12,876
Use your imagination, okay?

422
00:25:12,876 --> 00:25:15,999
Again, I want to reiterate, one

423
00:25:15,999 --> 00:25:20,250
can you get things

424
00:25:20,250 --> 00:25:21,250
Of course you can.

425
00:25:22,417 --> 00:25:26,876
Of course, the nice thing

426
00:25:26,876 --> 00:25:31,584
and every one of them has a full copy

427
00:25:31,584 --> 00:25:35,542
So they each have six gig worth

428
00:25:37,125 --> 00:25:41,542
So you don't have to go oh,

429
00:25:41,542 --> 00:25:43,083
You know, it's on there.

430
00:25:43,083 --> 00:25:44,501
It's pretty much all there.

431
00:25:46,334 --> 00:25:51,626
And again you can retest drones

432
00:25:51,626 --> 00:25:53,250
and such.

433
00:25:53,250 --> 00:25:54,250
All right.

434
00:25:54,250 --> 00:25:57,083
So let's talk a little bit

435
00:25:57,083 --> 00:25:58,918
So you want to build accessories.

436
00:25:58,918 --> 00:26:02,584
This picture here

437
00:26:02,667 --> 00:26:03,792
Right?

438
00:26:03,876 --> 00:26:06,709
So first thing you want to do

439
00:26:06,709 --> 00:26:07,792
You can see the scale.

440
00:26:08,167 --> 00:26:09,375
It's pretty small.

441
00:26:09,375 --> 00:26:10,709
It's next to an SD card.

442
00:26:12,999 --> 00:26:15,083
So you want to power your drones.

443
00:26:15,334 --> 00:26:18,083
I'm not doing anything real fancy here.

444
00:26:18,083 --> 00:26:22,834
I'm using a 7805 linear power regulator

445
00:26:22,834 --> 00:26:25,999
in order to smooth stuff out.

446
00:26:27,375 --> 00:26:29,959
And battery or two, right?

447
00:26:30,667 --> 00:26:32,834
A word on batteries.

448
00:26:32,834 --> 00:26:36,250
Now, I just showed you a picture

449
00:26:36,918 --> 00:26:40,083
That works great and 9-volts are nice

450
00:26:40,083 --> 00:26:42,667
but it's not really figures.

451
00:26:42,999 --> 00:26:45,959
For one thing, I'm dropping 9 volts to 5.

452
00:26:45,959 --> 00:26:47,459
I'm wasting a lot of energy.

453
00:26:47,459 --> 00:26:48,834
It all goes to heat.

454
00:26:49,334 --> 00:26:53,167
Also 9-volt batteries don't have

455
00:26:53,167 --> 00:26:57,751
compare them to things like D-cells

456
00:26:57,834 --> 00:27:00,834
Something to keep in mind.

457
00:27:00,834 --> 00:27:03,459
Other things to keep

458
00:27:03,834 --> 00:27:07,999
You can have a BeagleBoard

459
00:27:07,999 --> 00:27:09,959
blast, right?

460
00:27:10,083 --> 00:27:16,959
Running 100 percent CPU

461
00:27:17,250 --> 00:27:20,375
Like 1.1-watts or so of power.

462
00:27:20,375 --> 00:27:21,375
Not a lot.

463
00:27:21,375 --> 00:27:23,999
How much do you think

464
00:27:25,167 --> 00:27:26,876
It's over 2.

465
00:27:27,167 --> 00:27:28,999
And it does less.

466
00:27:29,709 --> 00:27:31,459
But witness doesn't matter.

467
00:27:31,459 --> 00:27:33,999
All you can do is blink LEDs

468
00:27:33,999 --> 00:27:34,999
That's all good.

469
00:27:36,542 --> 00:27:39,999
One thing to keep

470
00:27:39,999 --> 00:27:43,999
networks, they do use power,

471
00:27:43,999 --> 00:27:46,292
Don't sit there and transmit constantly.

472
00:27:46,292 --> 00:27:50,083
Make use of things

473
00:27:50,459 --> 00:27:52,083
So some power options.

474
00:27:52,083 --> 00:27:54,209
Here we have a couple of options.

475
00:27:54,459 --> 00:27:59,584
USB capable, different power adapters,

476
00:27:59,584 --> 00:28:03,292
see some

477
00:28:03,292 --> 00:28:07,792
We've got one with two 9-volt clips

478
00:28:07,792 --> 00:28:13,584
on you and another one

479
00:28:17,375 --> 00:28:20,999
80215 hardware looks like this.

480
00:28:21,417 --> 00:28:25,999
Here I just made some simple adapters

481
00:28:25,999 --> 00:28:28,167
Four wires that you have to solder.

482
00:28:29,250 --> 00:28:32,083
Here is the same thing in a little case.

483
00:28:32,083 --> 00:28:34,918
By the way,

484
00:28:34,918 --> 00:28:36,250
It doesn't look like an XB.

485
00:28:36,834 --> 00:28:41,709
In order to get it in my little case,

486
00:28:41,709 --> 00:28:45,334
That's why you don't see an antenna

487
00:28:45,334 --> 00:28:48,209
You probably need an adapter

488
00:28:48,501 --> 00:28:52,375
Again you can get two kinds

489
00:28:52,375 --> 00:28:54,501
You can get a UART or serial adapter.

490
00:28:54,999 --> 00:28:58,083
It's basic and you have four wires

491
00:28:58,999 --> 00:29:01,792
You can also get a USB adapter.

492
00:29:01,792 --> 00:29:04,417
You're probably going to want

493
00:29:04,417 --> 00:29:07,792
to hook it up to your PC and

494
00:29:08,834 --> 00:29:12,083
You don't have to solder or anything.

495
00:29:12,876 --> 00:29:15,959
So if you're connecting it

496
00:29:15,959 --> 00:29:18,999
the USB adapter there's nothing to do.

497
00:29:18,999 --> 00:29:19,999
Just plug it in.

498
00:29:19,999 --> 00:29:24,459
If you have the UART adapter,

499
00:29:24,626 --> 00:29:28,626
You can find more details about that

500
00:29:28,999 --> 00:29:32,834
You have to tell the Beagle: Hey, this

501
00:29:32,834 --> 00:29:34,334
all right?

502
00:29:34,459 --> 00:29:35,999
A little note on that.

503
00:29:35,999 --> 00:29:37,999
The older BeagleBone,

504
00:29:37,999 --> 00:29:40,375
an older kernel version.

505
00:29:40,876 --> 00:29:43,250
There was a way of doing this stuff.

506
00:29:43,250 --> 00:29:45,999
You just have

507
00:29:46,083 --> 00:29:49,918
The new BeagleBone Black uses

508
00:29:50,083 --> 00:29:53,334
They changed how stuff works.

509
00:29:53,334 --> 00:29:55,834
I don't have time to go

510
00:29:56,667 --> 00:29:59,375
Have a look

511
00:29:59,375 --> 00:30:02,999
home to have a nice detailed article

512
00:30:05,250 --> 00:30:06,999
All right.

513
00:30:09,250 --> 00:30:10,999
Other hardware.

514
00:30:10,999 --> 00:30:13,417
Capes or if you're familiar with Arduino,

515
00:30:13,417 --> 00:30:15,876
in the BeagleBone world.

516
00:30:16,042 --> 00:30:18,959
Something I'm working on now,

517
00:30:18,959 --> 00:30:20,999
by some folks

518
00:30:20,999 --> 00:30:23,501
like to solder, which is cool.

519
00:30:24,250 --> 00:30:27,999
I like to solder.

520
00:30:27,999 --> 00:30:32,083
We are working on developing

521
00:30:32,083 --> 00:30:36,334
a network switch so you can inline it

522
00:30:36,334 --> 00:30:41,000
in case you need some more USB

523
00:30:41,000 --> 00:30:46,125
80211 buy fine and maybe

524
00:30:46,125 --> 00:30:48,417
That's something that might be coming

525
00:30:48,918 --> 00:30:51,876
Other things are in terms of hardware,

526
00:30:51,876 --> 00:30:53,542
for your stuff.

527
00:30:53,542 --> 00:30:57,459
I have my GI Joe backpack,

528
00:30:57,792 --> 00:31:00,876
If you look inside, it looks like this.

529
00:31:01,501 --> 00:31:05,250
The touch screen, Beagle

530
00:31:05,250 --> 00:31:10,250
USB hub, keyboard, mouse,

531
00:31:13,751 --> 00:31:15,209
All right.

532
00:31:15,209 --> 00:31:18,459
This is just an example of minus

533
00:31:18,459 --> 00:31:21,334
how could you make it plannable?

534
00:31:21,918 --> 00:31:24,083
Get a USB power cable, get

535
00:31:24,083 --> 00:31:27,792
plugs someone's network

536
00:31:28,083 --> 00:31:31,334
Plug your power into their USB port

537
00:31:31,334 --> 00:31:33,999
until they clean under their desk.

538
00:31:34,292 --> 00:31:36,999
Which happens a lot, right?

539
00:31:37,459 --> 00:31:38,834
You go to the offices,

540
00:31:38,834 --> 00:31:40,999
under their desk every day.

541
00:31:40,999 --> 00:31:43,334
Or every five years, seems like.

542
00:31:43,999 --> 00:31:45,999
Pretty cool.

543
00:31:46,125 --> 00:31:48,250
All right.

544
00:31:48,626 --> 00:31:51,083
There we go.

545
00:31:51,083 --> 00:31:52,250
Other things you can do.

546
00:31:52,250 --> 00:31:55,417
This is just showing you

547
00:31:55,626 --> 00:31:57,417
Okay, so for the rest

548
00:31:57,417 --> 00:32:01,709
to real quick show you what kinds

549
00:32:01,709 --> 00:32:04,999
starting with what can you do,

550
00:32:04,999 --> 00:32:07,999
and what could you do

551
00:32:07,999 --> 00:32:10,834
and put it together, all right?

552
00:32:11,292 --> 00:32:12,999
Here is the first demo.

553
00:32:12,999 --> 00:32:15,125
Some of you might recognize

554
00:32:15,125 --> 00:32:17,876
as last year's DEF CON CD.

555
00:32:18,083 --> 00:32:24,125
Run it on my lunch box, in an NMap

556
00:32:24,125 --> 00:32:28,334
I see -- I don't know how visible.

557
00:32:28,459 --> 00:32:29,709
It's kind of visible.

558
00:32:29,918 --> 00:32:31,834
I tried to highlight some stuff.

559
00:32:31,918 --> 00:32:34,751
Oh, there's something running

560
00:32:34,834 --> 00:32:37,459
That tells me it's probably what kind

561
00:32:37,459 --> 00:32:38,626
AUDIENCE: Windows.

562
00:32:38,626 --> 00:32:40,167
PHILIP POLSTRA: Windows!

563
00:32:40,751 --> 00:32:41,999
Our favorite target.

564
00:32:41,999 --> 00:32:47,125
So port 445 means let's try our favorite

565
00:32:47,125 --> 00:32:49,083
What is our favorite in the whole world?

566
00:32:49,083 --> 00:32:50,999
AUDIENCE: 067.

567
00:32:50,999 --> 00:32:52,584
PHILIP POLSTRA: 067, right?

568
00:32:52,584 --> 00:32:53,918
It's at every Con.

569
00:32:56,542 --> 00:32:59,542
So sure enough,

570
00:32:59,542 --> 00:33:04,542
and successfully getting the shell

571
00:33:05,083 --> 00:33:08,542
You Raspberry Pi people,

572
00:33:08,542 --> 00:33:09,626
I'm running exploit.

573
00:33:10,334 --> 00:33:12,375
But your LEDs are cool.

574
00:33:12,375 --> 00:33:15,667
What about something else?

575
00:33:18,999 --> 00:33:21,083
Crack a LIM WiFi.

576
00:33:21,375 --> 00:33:23,417
Run Airmon.

577
00:33:23,417 --> 00:33:27,999
Do some scanning.

578
00:33:29,626 --> 00:33:31,584
Find someone to attack.

579
00:33:31,999 --> 00:33:34,167
This guy has a great password.

580
00:33:34,459 --> 00:33:35,999
Password 1.

581
00:33:35,999 --> 00:33:36,999
It is!

582
00:33:36,999 --> 00:33:41,834
So you know, crack, crack

583
00:33:41,918 --> 00:33:45,167
Of course, we

584
00:33:45,584 --> 00:33:47,292
Run up Hydra.

585
00:33:47,292 --> 00:33:50,083
This is Hydra running against a router.

586
00:33:50,999 --> 00:33:55,667
You can see that this guy

587
00:33:55,667 --> 00:33:57,834
He went with straight up "password."

588
00:33:58,083 --> 00:33:59,751
couldn't do the 1.

589
00:34:01,626 --> 00:34:02,999
All right.

590
00:34:02,999 --> 00:34:06,876
Maybe people have stuff that's

591
00:34:06,876 --> 00:34:11,167
But how many of you

592
00:34:11,709 --> 00:34:13,918
What is your favorite tool for that?

593
00:34:13,999 --> 00:34:15,334
(Speaker away

594
00:34:15,334 --> 00:34:17,250
POLSTRA: Reaver, right?

595
00:34:17,250 --> 00:34:18,250
Little tip.

596
00:34:18,250 --> 00:34:21,959
Some of those cheap routers,

597
00:34:21,959 --> 00:34:23,999
it's still on.

598
00:34:23,999 --> 00:34:25,375
You might want to call out Reaver

599
00:34:25,375 --> 00:34:28,459
to make sure it's actually turned off.

600
00:34:29,375 --> 00:34:34,959
Here is just a little run with Reaver

601
00:34:34,959 --> 00:34:40,083
boom, I got the password, which was,

602
00:34:43,167 --> 00:34:49,209
Again I call this pwning Windows 7

603
00:34:49,999 --> 00:34:54,792
Some of you might say it should be

604
00:34:56,584 --> 00:35:00,999
But yeah, kind of, but about a year

605
00:35:00,999 --> 00:35:03,876
big vulnerability that came out.

606
00:35:03,876 --> 00:35:08,417
Some of you were like 400,000 Macs

607
00:35:08,417 --> 00:35:11,709
and all the PCs went: Uh-huh?

608
00:35:13,209 --> 00:35:14,999
All of us did.

609
00:35:16,125 --> 00:35:21,167
But so the Macs had a problem, right,

610
00:35:21,459 --> 00:35:26,626
And then you got these smug Mac

611
00:35:26,999 --> 00:35:28,083
Well, you did.

612
00:35:28,584 --> 00:35:31,999
You get

613
00:35:31,999 --> 00:35:33,999
Well, see, I told you!

614
00:35:35,083 --> 00:35:36,417
Guess what?

615
00:35:36,417 --> 00:35:38,083
They had the same vulnerability.

616
00:35:38,501 --> 00:35:40,459
Again, I load up melt exploit.

617
00:35:40,999 --> 00:35:43,709
This is all running on little Beagle,

618
00:35:44,792 --> 00:35:47,375
I might even flash some LEDs

619
00:35:47,709 --> 00:35:53,709
So sure enough, bam, here you go.

620
00:35:54,083 --> 00:35:57,834
I've got a shell

621
00:35:57,834 --> 00:36:01,584
from University of redacted.

622
00:36:01,792 --> 00:36:03,999
Pretend you can't read what it says

623
00:36:05,751 --> 00:36:07,417
All right.

624
00:36:09,626 --> 00:36:16,417
The final so low demo

625
00:36:16,709 --> 00:36:19,876
Some of you probably are familiar

626
00:36:20,876 --> 00:36:26,834
Aaron Finex and myself came

627
00:36:26,834 --> 00:36:29,125
That's someone who

628
00:36:29,501 --> 00:36:31,918
They can only use GUIs.

629
00:36:32,209 --> 00:36:35,876
They can only use things

630
00:36:35,876 --> 00:36:38,250
which came out last year.

631
00:36:38,834 --> 00:36:43,083
It's a nice little tool

632
00:36:43,125 --> 00:36:46,209
It's basically point and click pwnage

633
00:36:46,501 --> 00:36:49,459
You pull it

634
00:36:49,459 --> 00:36:51,999
which one shall I attack?

635
00:36:51,999 --> 00:36:54,083
It tells you when it's done.

636
00:36:54,083 --> 00:36:55,083
Basic, pretty neat.

637
00:36:57,667 --> 00:36:58,999
Enough of that.

638
00:36:58,999 --> 00:37:02,999
Let's talk a little bit about bringing

639
00:37:02,999 --> 00:37:06,083
So again if you take

640
00:37:06,083 --> 00:37:11,918
mode and a couple of drones,

641
00:37:11,999 --> 00:37:14,125
You can connect to one.

642
00:37:14,292 --> 00:37:17,083
If you want to switch again, you do

643
00:37:17,083 --> 00:37:21,751
give it some commands and then start

644
00:37:21,999 --> 00:37:24,918
It sort of is legible, I guess.

645
00:37:24,999 --> 00:37:29,918
I'm actually running two drones here

646
00:37:30,083 --> 00:37:31,999
And I'm sending commands to both.

647
00:37:34,834 --> 00:37:39,709
If you want to use the Python scripting,

648
00:37:39,709 --> 00:37:41,626
fancy, right?

649
00:37:41,792 --> 00:37:45,667
I've got a little command console

650
00:37:45,876 --> 00:37:48,584
You can send it commands

651
00:37:48,584 --> 00:37:50,250
commands

652
00:37:50,250 --> 00:37:52,501
in that window as well.

653
00:37:52,999 --> 00:37:59,083
I have all of the responses I captured

654
00:37:59,083 --> 00:38:02,918
sophisticated tool

655
00:38:02,918 --> 00:38:04,959
is called tail dash F.

656
00:38:04,959 --> 00:38:10,999
Basically here you can see, this

657
00:38:10,999 --> 00:38:13,250
I have a really simple API, right?

658
00:38:13,250 --> 00:38:15,083
It will say: Hey,

659
00:38:15,083 --> 00:38:16,876
to this drone?

660
00:38:16,999 --> 00:38:19,584
If you say colon and a number

661
00:38:19,584 --> 00:38:22,083
it switches to another drone.

662
00:38:23,999 --> 00:38:26,417
Here is some basic output.

663
00:38:26,417 --> 00:38:29,542
They'll tell you, hey, this

664
00:38:29,542 --> 00:38:32,417
and this is what I got back.

665
00:38:35,250 --> 00:38:37,167
Pretty basic stuff.

666
00:38:37,459 --> 00:38:39,584
This is giving you an idea.

667
00:38:39,584 --> 00:38:43,167
There's nothing like really awesome

668
00:38:43,167 --> 00:38:45,501
anything like that.

669
00:38:45,501 --> 00:38:46,501
Okay.

670
00:38:46,501 --> 00:38:48,709
So some future directions.

671
00:38:48,709 --> 00:38:52,083
I'm going to continue to try

672
00:38:52,083 --> 00:38:54,999
You know, I started in this work

673
00:38:54,999 --> 00:38:57,167
after DEF CON last year.

674
00:38:57,167 --> 00:39:00,083
I actually added some packages.

675
00:39:00,501 --> 00:39:04,751
The basic, very first version

676
00:39:04,751 --> 00:39:06,709
of last year.

677
00:39:06,709 --> 00:39:11,083
Between DEF CON and that time

678
00:39:11,459 --> 00:39:15,999
And optimizing some packages.

679
00:39:16,209 --> 00:39:18,751
Looking at some other output options.

680
00:39:18,792 --> 00:39:23,250
Possibly exploiting some USB

681
00:39:23,417 --> 00:39:27,334
Some of you may have done some work

682
00:39:27,334 --> 00:39:29,083
Any of you use the teensy?

683
00:39:30,125 --> 00:39:31,876
A couple of you?

684
00:39:31,999 --> 00:39:35,999
Done a little bit of hid hacking?

685
00:39:35,999 --> 00:39:37,709
You know, you set

686
00:39:37,709 --> 00:39:40,083
and enter some commands.

687
00:39:40,209 --> 00:39:41,999
Well, that's

688
00:39:41,999 --> 00:39:44,250
eight-bit processor.

689
00:39:44,250 --> 00:39:46,959
I have a 32 gig git-ARM processor.

690
00:39:46,999 --> 00:39:51,250
I can push some commands

691
00:39:51,667 --> 00:39:55,167
The other thing I'm working

692
00:39:55,167 --> 00:39:58,459
is literally making this platform fly.

693
00:39:59,999 --> 00:40:03,501
Hoping to have this done for GrrCON

694
00:40:03,501 --> 00:40:07,000
but basically I am going

695
00:40:07,000 --> 00:40:11,834
inside of an aerial drone that

696
00:40:11,834 --> 00:40:17,959
and landings, so you can drive

697
00:40:18,999 --> 00:40:24,709
Land it on the roof, hack them

698
00:40:24,709 --> 00:40:29,000
(Laughter.)    PHILIP POLSTRA: There

699
00:40:29,000 --> 00:40:33,334
You can potentially use

700
00:40:33,334 --> 00:40:37,209
in the drone as a router

701
00:40:37,209 --> 00:40:43,292
the lower powered drones

702
00:40:43,292 --> 00:40:45,999
wherever you can.

703
00:40:46,584 --> 00:40:48,876
So that's something I'm working on.

704
00:40:48,999 --> 00:40:51,000
The other thing is, you know,

705
00:40:51,000 --> 00:40:52,999
from down the street.

706
00:40:53,000 --> 00:40:56,083
So why don't you hack

707
00:40:56,334 --> 00:41:00,125
There's this beautiful thing called

708
00:41:00,125 --> 00:41:02,999
I have a couple of these at my office.

709
00:41:03,209 --> 00:41:07,250
And so what you do

710
00:41:07,250 --> 00:41:12,999
is in the range of your drones

711
00:41:12,999 --> 00:41:16,709
possibly hook

712
00:41:16,709 --> 00:41:19,459
at their cafe, right?

713
00:41:19,459 --> 00:41:21,209
Plug it

714
00:41:21,209 --> 00:41:24,792
over in Australia doing this pentest.

715
00:41:24,792 --> 00:41:25,792
It doesn't matter.

716
00:41:26,584 --> 00:41:32,501
And as I said before, I'm working

717
00:41:32,501 --> 00:41:37,834
and also right now I'm currently

718
00:41:37,834 --> 00:41:39,334
I didn't quite have it finished.

719
00:41:39,501 --> 00:41:41,167
Probably in the next couple weeks.

720
00:41:41,334 --> 00:41:44,709
If you look at my website again it

721
00:41:44,709 --> 00:41:49,083
I want to be able

722
00:41:49,083 --> 00:41:52,417
For example if I want to send

723
00:41:52,417 --> 00:41:56,834
to be able to send that over the XB

724
00:41:56,834 --> 00:41:58,999
all that good stuff.

725
00:41:59,999 --> 00:42:04,083
Here's some references that you can

726
00:42:04,083 --> 00:42:07,876
And if there's any questions,

727
00:42:07,876 --> 00:42:09,918
which went away.

728
00:42:09,918 --> 00:42:13,083
So I'm going to recommend that

729
00:42:13,083 --> 00:42:15,999
at the Chill-out Lounge later.

730
00:42:15,999 --> 00:42:17,999
I'll bring my little toys.

731
00:42:18,125 --> 00:42:20,999
And you can have

732
00:42:20,999 --> 00:42:23,334
about out of time.

733
00:42:23,334 --> 00:42:24,999
Do you have like three minutes?

734
00:42:24,999 --> 00:42:25,999
One question?

735
00:42:25,999 --> 00:42:28,292
(Applause.)    PHILIP POLSTRA: One

736
00:42:34,709 --> 00:42:36,292
Okay, thank you.

737
00:42:36,292 --> 00:42:38,584
I think we have time

738
00:42:38,584 --> 00:42:41,709
If not, I'll head that way.

739
00:42:42,375 --> 00:42:46,542
AUDIENCE: How do you secure your

740
00:42:46,542 --> 00:42:49,250
PHILIP POLSTRA: I do not currently.

741
00:42:50,125 --> 00:42:55,999
There is support for that in encryption,

742
00:42:55,999 --> 00:43:00,626
is essentially it's out of band

743
00:43:00,999 --> 00:43:03,417
If you use 80211 networks, people

744
00:43:03,417 --> 00:43:06,542
what thee's this rogue network?

745
00:43:06,999 --> 00:43:11,083
If you use 80234, it's

746
00:43:11,083 --> 00:43:13,918
no idea that's going on.

747
00:43:14,125 --> 00:43:16,959
You can easily do that,

748
00:43:16,959 --> 00:43:19,792
and it takes a performance hit.

749
00:43:19,792 --> 00:43:19,792
AUDIENCE: (Speaker away

750
00:43:19,792 --> 00:43:19,792
POLSTRA: Basically I'm writing my own

751
00:43:19,792 --> 00:43:22,417
on Ubuntu with all of the good tools

752
00:43:22,417 --> 00:43:22,417
AUDIENCE: (Speaker away

753
00:43:22,417 --> 00:43:23,417
POLSTRA: I do.