00:00:00.133-->00:00:05.138
>>So the talk today, Craft, uh
Controlling IoT Devices with
Crafted Radio Signals. Um so my

00:00:07.608-->00:00:12.613
name is Caleb Madrigal. Um by
day I work for FireEye slash
Mandiant doing some awesome IR

00:00:15.549-->00:00:20.554
software. Um, my public handle
is Metem you can't know my
private handle. Um, website

00:00:23.156-->00:00:29.930
there. I'm a Ham radio operator,
w0hak. Um, bit about me. I've
been programming for around 18

00:00:29.930-->00:00:35.302
years. Um, mostly for fun
originally and then ya know for
pay later. Um I really enjoy

00:00:35.302-->00:00:42.075
like math-y and hacky kind of
stuff. Um so like signal
processing, machine learning,

00:00:42.075-->00:00:48.649
AI, ya know, that kind of stuff.
Um, I, I find it really
interesting being able to like

00:00:48.649-->00:00:55.389
hear the unhearable. Or see the
unseeable. So you can, do stuff
like that with math and I'm not

00:00:55.389-->00:00:59.960
like of a big math background.
But I like it when it helps me
do awesome stuff. Um,

00:00:59.960-->00:01:06.199
ontologically I guess the best
way to describe myself is as
like a Christian Mystic. Um, and

00:01:06.199-->00:01:12.239
then I like ya know, art and
music and that kind of stuff.
Um, this talk was kind of hard

00:01:12.239-->00:01:17.611
to come up with a title for. Um,
so you know I played around with
a few titles like intercepting,

00:01:17.611-->00:01:23.083
modifying and generating
wireless signals with SDR. How
digital data is transmitted

00:01:23.083-->00:01:27.888
wirelessly. Um, controlling
wireless IoT devices with
crafted radio signals. Which is

00:01:27.888-->00:01:34.227
what I went with. But another
way of maybe a good way to
describe it is um, how the OS

00:01:34.227-->00:01:40.600
side physical layer works. And
how to attack it. So, today
we're gonna be exploring a few

00:01:40.600-->00:01:46.673
different attacks on wireless
systems. Wireless digital
systems. Which uh we're gonna

00:01:46.673-->00:01:53.613
look at a few concrete examples
but these attacks should apply
to many, many different areas,

00:01:53.613-->00:01:59.052
as you'll see. Um, bit of
background on kind of what led
me to doing this talk. So I kind

00:01:59.052-->00:02:05.058
of came in from like 3 different
directions. Um, so the first
one, well so IoT, music theory

00:02:05.058-->00:02:11.231
and wireless hacking. So with
IoT um, I, I kind of got into
IoT before I knew it was called

00:02:11.231-->00:02:15.936
IoT stuff. Um obviously buzzword
bingo, but uh so I ended up
making like the little home

00:02:15.936-->00:02:20.941
security system out of like a
Raspberry Pi, um and uh, uh like
this little wireless control

00:02:25.145-->00:02:29.182
system. So like I bought this
little 20 dollar pack of
wirelessly controlled outlets at

00:02:29.182-->00:02:35.188
home depot. Ya know 20 bucks, uh
you have this remote which you
can turn uh the switches on and

00:02:35.188-->00:02:40.360
off with. Um so ya know I was
like hardware hacker time, break
it open ya know take out the

00:02:40.360-->00:02:46.733
little uh control unit. Uh
basically I snipped off these
little tactile switches and

00:02:46.733-->00:02:53.173
soldered in some transistors and
voila, ya know you have a IoT
device. Um, little more

00:02:53.173-->00:02:57.744
programming but. The other, the
second thing that brought me to
this kind of stuff is music

00:02:57.744-->00:03:03.150
theory. Which would sound
probably ironic or not fitting.
But like a few years ago I was

00:03:03.150-->00:03:08.155
just like lo0king at a keyboard
and I was like why are the black
keys not evenly spaced Ya know

00:03:10.157-->00:03:14.795
there's, you could have 6 white
keys and 6 black keys but
there's 5, there's 5 black keys

00:03:14.795-->00:03:21.201
and 7 white keys, eh, so like it
led me into this whole like
rabbit hole of exploring like

00:03:21.201-->00:03:26.206
sounds analysis, wave theory, um
and so ya know but I kind of
learned some of the math of like

00:03:28.742-->00:03:33.547
fourier transform stuff and all
that kind of stuff. Which really
interestingly applies very, very

00:03:33.547-->00:03:38.552
well for radio hacking. Um, this
is like a spectrogram of me
singing like do, re, me, fa, so,

00:03:41.955-->00:03:46.960
la, ti, do. Something like that.
Um, the last, the last
[applause] here all day folks.

00:03:49.729-->00:03:54.468
Um, the last and the last angle
was just wireless hacking. So
for a while I've been into

00:03:54.468-->00:03:58.805
wireless hacking. I think it's
really fun. One thing I like
about it is that often when you

00:03:58.805-->00:04:04.611
find like a WI, like a wireless
protocol attack it's not
something that you can just f-

00:04:04.611-->00:04:10.784
fix with a binary patch. It's
often, often you're dealing with
systemic problems. When you're

00:04:10.784-->00:04:14.754
doing wireless hacking. Which is
really cool because ya know,
when you find them they don't

00:04:14.754-->00:04:19.759
really get patched which, it's
kind of cool. I did a talk
earlier this year at Cypher Con

00:04:22.095-->00:04:27.100
in Milwaukee. Um, on uh
basically like um, using 8, oh,
2, 11 monitor mode to figure out

00:04:29.770-->00:04:34.775
like if a wireless security
camera um has detected motion
even without being connected. So

00:04:34.775-->00:04:40.480
ya know put out software for
that. So anyway wireless
hacking. Um, music theory. Um,

00:04:40.480-->00:04:43.783
and then all the other stuff
that's kind of what brought me
to doing this kind of stuff. Ya

00:04:43.783-->00:04:47.487
know if you see me in a coffee
shop you might find me looking
like this. [laughter] A friend

00:04:47.487-->00:04:53.293
took this photo um, a few months
ago. Uh people like don't like
it when you have huge antennas

00:04:53.293-->00:04:59.065
for some reason at coffee shops.
I, I don't know why but, um and
anyway so ya know doing the

00:04:59.065-->00:05:02.936
wireless hacking of other types
ya know are poisoning and all
that kind of stuff. I always had

00:05:02.936-->00:05:06.740
ya know I looked at the OS side
layer and like way down here,
the physical layer, it's always

00:05:06.740-->00:05:12.579
been kind of this like black
box. And so this talk, the goal
is really to demystify that

00:05:12.579-->00:05:17.584
black box for you. Um, and show
the kinds of attacks that you
can do at the physical layer.

00:05:20.821-->00:05:25.992
Um, so this talk eh I mean this,
this type of stuff is super
exciting to me. Um I feel like

00:05:25.992-->00:05:30.297
kind of like it's like magic or
something. So ya know I feel
like saying it sounds like some

00:05:30.297-->00:05:35.135
kind of like ya know new age
religion or something, like
harness the invisible energy all

00:05:35.135-->00:05:39.472
around us ya know. I- it feels
like the, the Star Wars or
something. It's ya know there's

00:05:39.472-->00:05:45.612
this electromagnetic radiation
all around us right. It's here
in this room, it penetrates us.

00:05:45.612-->00:05:51.384
If you know how to make secret,
these secret codes you can like
manipulate it to make things

00:05:51.384-->00:05:57.257
happen in the physical world. I
mean it's like the closest thing
to like a magician or something

00:05:57.257-->00:06:01.595
like that, that I've see. You
know I use to play like uh
Diablo 2 Lord of Destruction a

00:06:01.595-->00:06:08.134
lot, be a sorceress. And so this
kind of stuff it kind of feels
like that. And um, ya know this

00:06:08.134-->00:06:14.608
wireless stuff it's kind of like
adding a new skill tree to your
ya know you're hacking tree. So

00:06:14.608-->00:06:18.812
uh, and it's pretty cool one.
Also, another big thing
obviously, you guys know the

00:06:18.812-->00:06:25.619
whole IoT stuff uh happening. Um
and it's like it's almost like I
got a like a charm or something

00:06:25.619-->00:06:31.291
and it's like all IoT or all
wireless attacks now have like
way more damage power potential

00:06:31.291-->00:06:36.796
cause of the IoT stuff right. I
mean it's just gonna be crazy
with all the devices attached.

00:06:36.796-->00:06:40.233
Um uh it's also something where
it's' really valuable to know
even if you're not wanting to

00:06:40.233-->00:06:46.039
attack people right. So you know
what to look out for. You can
analyze various wireless devices

00:06:46.039-->00:06:52.445
if you really know how the
physical layer works. Um, and so
we know ya know like almost

00:06:52.445-->00:06:58.852
everything operates through
radio. Um, you know obviously,
we know standard FM, AM radio.

00:06:58.852-->00:07:05.625
We call that radio. But really
TV is radio, cell phones are
radio, WIFI, Bluetooth, GPS,

00:07:05.625-->00:07:10.630
wireless security systems, I
mean almost any kind of wireless
stuff is radio. Um and li- you

00:07:14.668-->00:07:18.705
know like looking around in
Milwaukee like you can find
stuff like large SCADA sewer

00:07:18.705-->00:07:24.277
systems that have their channels
published. Um I have not look at
those for like vulnerabilities

00:07:24.277-->00:07:28.581
but there's a lot of stuff.
There's a lot of stuff that you
can control if you have radio.

00:07:28.581-->00:07:33.586
So, so, um the, the main tool
like if we're doing magic and
that kind of stuff. Um, the

00:07:40.727-->00:07:46.533
software to find radio. It's
kind of like ya know, it'd kind
of be like if your wand or

00:07:46.533-->00:07:50.837
whatever. So I have HackRF
that's what I'm using for, for
the presentation, uh this

00:07:50.837-->00:07:55.842
presentation. Um, there's also
things like the LimeSDR and all
that. But uh RTL-SDR for a

00:07:58.478-->00:08:04.184
cheaper version. Um but it's
really cool cause like you know
you've got this antenna and like

00:08:04.184-->00:08:08.855
you're actually transmitting
power through it. You know feels
just like it's just crazy, uh I

00:08:08.855-->00:08:14.661
love the metaphor. Anyway, um so
let's go ahead and do some demos
and stop just talking about

00:08:14.661-->00:08:19.666
stuff right. Um, so the first 1
um I actually ca- I've got a
video for it, I can't it's

00:08:21.735-->00:08:26.740
actually attacking my Jeep
Patriot and um this is like the
first thing I did um, when I got

00:08:29.309-->00:08:34.314
my HackRF. And um, so let me
play a brief s- video briefly.
This is me unlocking my Jeep

00:08:36.316-->00:08:41.321
with uh the HackRF. And let me
try to just, see if the sound
works here. And if it doesn't

00:08:48.528-->00:08:53.533
work it's not a big deal. Um,
but basically, I have like a new
radio uh notebook and I'm using

00:08:55.935-->00:09:01.474
it to turn on my Jeep and you
should see the lights blink in
the video, I don't know if

00:09:01.474-->00:09:06.479
that's showing up. So I'm about
to execute the script to turn on
the lights of the Jeep. Kay, and

00:09:24.931-->00:09:28.635
talking more in the video more
than I thought. Come on Caleb
what's up, why are you taking so

00:09:28.635-->00:09:34.374
long? Okay there we go. Alright
so um, so it's kind of uh
[applause] and then I lock it

00:09:34.374-->00:09:38.978
back or whatever. [applause]
Thank you. Um, it's uh, it's
really like, I mean and ya know

00:09:38.978-->00:09:42.749
for me getting a software to
find radio I was like first
thing I do and I'm like able to

00:09:42.749-->00:09:47.620
unlock my car, I'm like wow this
is awesome and it's of course if
you're familiar to SDR it's a

00:09:47.620-->00:09:54.394
simple replay attack. Um this
won't work on every car. Um,
because uh a lot of them have

00:09:54.394-->00:10:00.033
rolling codes. There are other
ways to g- uh defeat that uh in
my case the Jeep Pat does not

00:10:00.033-->00:10:05.038
have a rolling code so it was
very simple. Um, the next uh one
sec. The next uh kind of

00:10:12.011-->00:10:17.417
vulnerability I just want to
demo and this is just kind of to
give you guys a bit of the um,

00:10:17.417-->00:10:22.355
ya know a bit of an idea of what
kind of attacks you can do with
software defined radios. So uh I

00:10:22.355-->00:10:28.695
want to demo, basically a
jamming attack, but I mean
jamming is heavily illegal. So

00:10:28.695-->00:10:33.833
like I'm not actually going to
be jamming, well depends on your
definition okay. So, um,

00:10:33.833-->00:10:38.438
[laughter] so I've got, I, I am
a Ham radio operator so I can
operate uh these little radios.

00:10:38.438-->00:10:44.744
So I'm gonna just um, what I'm
gonna try to do is I'm gonna try
to play some music from this uh

00:10:44.744-->00:10:49.749
this radio to this one. And then
out of curiosity I wanna see
what a just a really loud sign

00:10:52.352-->00:10:56.823
way, signal sounds like
transmitted coincidentally at
the same frequency as uh this

00:10:56.823-->00:11:00.960
other one. [laughter] So like
it's not jamming because we're
actually wanting to see what

00:11:00.960-->00:11:05.965
this sounds like right? So let's
see if this works. [audio-demo]
Let me actually set that again.

00:11:16.609-->00:11:21.614
[demo-inaudible] Alright and now
we'll jam it. [demo-inaudible]
Oh wrong one. Sorry. [laughter]

00:11:38.197-->00:11:43.202
[demo-inaudible] That's another
demo, one second. Uh.
[inaudible] Okay so, let's go

00:11:56.482-->00:12:01.421
ahead and execute that again.
Ready. [audio-demo] And there
you have it so the music just

00:12:09.028-->00:12:14.033
cuts out and I'll stop it.
[applause] [audio-demo] Alright,
so um, y- I wanted to do a

00:12:20.773-->00:12:24.978
Nickelback song, ya know like,
ya know like if you're at a bar
and y- or a r- restaurant and

00:12:24.978-->00:12:31.017
you hear Nickelback like haven't
you ever wanted to. Anyway,
copyrighted so they told me not

00:12:31.017-->00:12:37.690
to. So um, anyway jamming,
obviously be very careful doing
that it's highly illegal. Um to

00:12:37.690-->00:12:42.161
actually jam something. Anyway,
but it's a good example. I mean
physical layer it's one of those

00:12:42.161-->00:12:47.000
things where it's like you think
about all these other layers up
here. And then sometimes we

00:12:47.000-->00:12:51.904
might forget about the very
lowest layer and how vulnerable
it can b- it can be. The last

00:12:51.904-->00:12:56.909
one, um the last big demo is um,
so ya know I was doing all this
stuff and I was like yeah this

00:12:58.911-->00:13:03.716
is cool but like ya know a, a
software defined radio is almost
like a swiss army knife for

00:13:03.716-->00:13:09.455
radio hacking. So, I don't'
wanna have to like record the
signal or just jam it. I, what

00:13:09.455-->00:13:14.827
if I wanna, generate it from
scratch basically? Like how
could you generate a signal to

00:13:14.827-->00:13:19.932
control something? Like in
theory it's just doing these
waveforms. So, I thought well if

00:13:19.932-->00:13:24.637
I can mathematically if I can
just look at what it looks like
and then just use math to like

00:13:24.637-->00:13:29.308
kind of simulate the signal uh
base- basically do like the
modulation side of a modem

00:13:29.308-->00:13:34.313
right. Mo- modem, modulate
demodulator, um so that was what
I was going for with doing this.

00:13:36.949-->00:13:43.122
So um, so I have a script and
we're gonna go into in a bit
how, how this actually works.

00:13:43.122-->00:13:48.127
But I wanna do the demo first
just so you can see it. Um, now
this is really small but

00:13:50.329-->00:13:55.501
basically, it's just this 1 line
script. Or 1 line to call the
script and I have a

00:13:55.501-->00:14:02.408
configuration file um, to turn
the outlet on. I'll just show
you what, you guys what that

00:14:02.408-->00:14:07.680
looks like. Uh it's just ya know
you have the bit string, you
have the frequency the baud

00:14:07.680-->00:14:12.685
rate, sample rate, etcetera. So
I generate that signal and the
outlet comes on. Um, and then I

00:14:18.291-->00:14:23.296
can generate the off signal
using the off config file. And
we'll see if that works. Someone

00:14:39.412-->00:14:44.417
jamming me? [laughter] I'll see
if I can get little bit closer
and. Yeah it's not gonna work.

00:14:46.786-->00:14:51.791
But um, kudos by the way this is
a hacker conference obviously
expect it. Hah. But so anyway

00:14:54.393-->00:14:59.966
you can do this by doing a
replay attack but this signal
that I used to turn that on, I

00:14:59.966-->00:15:04.604
never recorded. I looked at
another outlet and found the key
pattern and I was able to

00:15:04.604-->00:15:09.609
generate the signal from scratch
just using math. So, I wanna go
into kind of how that, how that

00:15:12.345-->00:15:17.683
looks, how to do that. Uh real
quick before we do that though
uh, I wanna show you what it,

00:15:17.683-->00:15:23.556
what this looks like. So, I
wanna show you what the signal
actually looks like. So this one

00:15:23.556-->00:15:28.561
right here on the bottom. This
is the actual signal. This is
one of the signals I captured by

00:15:31.731-->00:15:36.736
listening on the SDR. So I'll
let you see what it sounds like,
okay. [audio-demo] And you get

00:15:44.811-->00:15:50.983
the idea right, it just keeps
repeating. But if you uh if you
zoom in, and this is just in

00:15:50.983-->00:15:56.289
Audacity. Which by the way like
I mentioned ya know I do some
audio analysis stuff uh a lot of

00:15:56.289-->00:16:02.295
the tools actually for audio can
be reused for radio hacking. So
these are radio waves and we're

00:16:02.295-->00:16:07.300
suing a sound uh, editing
program to actually see these.
You can even edit them in here.

00:16:09.335-->00:16:15.041
Um, and you know if you zoom in
far enough uh you can see the
pattern just repeats and you

00:16:15.041-->00:16:20.947
have uh it's called ASK ya know
on off keying. Um so you have
the short ones which represent

00:16:20.947-->00:16:26.619
zeros the long bursts represent
1s. Ya know so the way to read
this would be zero, 1, 1, zero,

00:16:26.619-->00:16:31.624
1, zero, etcetera. Um and that's
the signal. Um, up here is
actually my generated signal so

00:16:34.227-->00:16:41.033
you can actually hear them a
little different. Uh this is the
original. [audio-demo] And this

00:16:41.033-->00:16:46.038
is I think the generated one
here. [audio-demo] So, it's cool
cause it's actually a little

00:16:48.574-->00:16:54.013
different so you don't have to
exactly replicate for it to
actually be accepted by the uh,

00:16:54.013-->00:16:59.018
outlet. Anyway. Um, you can I
have a few notes on how to open
up wave files in Audacity. I'm

00:17:01.387-->00:17:05.291
gonna skip over that but those
are gonna be in the notes inc-
incase you guys wanna be able to

00:17:05.291-->00:17:10.296
do that. So, alright so an-
understanding waves. Um, so I
wanna look at a little bit of

00:17:12.565-->00:17:17.970
the details of how radio waves
work, mathematically why some of
this stuff works. But I wanna

00:17:17.970-->00:17:24.410
emphasize something. You guys do
not need to know or do this math
to actually do radio hacking.

00:17:24.410-->00:17:29.115
There's programs like a new
radio that you can use. Uh and
you don't have to actually go

00:17:29.115-->00:17:34.120
and like write all this math
out. But I personally found it
very insightful to see how these

00:17:36.389-->00:17:41.360
radio waves work and how waves
work. To help me understand how
to do this stuff. So I wanna

00:17:41.360-->00:17:46.933
like look at some of that stuff.
Should give you guys a really
good foundation an understanding

00:17:46.933-->00:17:51.837
of what's actually happening and
then you have a better idea when
you use other tools what they're

00:17:51.837-->00:17:57.577
actually doing. Um, and its' and
a lot of time I know hackers
aren't really into math a ton

00:17:57.577-->00:18:02.081
and I'm not really traditionally
either, but you know like I
don't want to be a script kit- I

00:18:02.081-->00:18:06.919
don't want to be a script kitty
I want to understand what's
really happening. And so that's

00:18:06.919-->00:18:12.158
kind of the purpose of this. So
understanding waves um, what do
we mean when we talk about

00:18:12.158-->00:18:17.163
waves? Um I mean usually just
sine waves right, sinusoidal
wave. In computers we represent

00:18:19.899-->00:18:24.904
them as simple arrays. Right so
if you look at this graph this
is simply um, ya know an array.

00:18:27.106-->00:18:30.543
Where the values are going
greater than zero and then there
are less than zero. Ya know it

00:18:30.543-->00:18:35.881
might be like zero point 1 point
2 point 3 all the way up to 1.
Back down to like negative 1 and

00:18:35.881-->00:18:40.519
it oscillates. Right? That's w-
that's what a wave is. Um, uh
sin wave, ya know it's related

00:18:40.519-->00:18:45.491
to sin on the circle. Um so
waves going up and down like
this. If you just follow one

00:18:45.491-->00:18:51.797
dimension and a circle it's
going to make that shape. Um,
there are some really, really

00:18:51.797-->00:18:57.236
interesting things about sin
waves. Uh about waves in
general. Um, eh let's look at

00:18:57.236-->00:19:02.041
these really quick. So, first
they're everywhere. They are the
epitome of change. Uh there's

00:19:02.041-->00:19:05.945
this thing called a
superposition principle which is
really nec- really important to

00:19:05.945-->00:19:11.851
understand. Um, we're gonna look
at convolution, deconvolution,
um the relation to e which

00:19:11.851-->00:19:17.556
believe it or not is actually
useful for programming this. Uh
so first waves are everywhere,

00:19:17.556-->00:19:23.663
alright. Like any time you have
circular motions or vibrations
that's sine waves. Somewhere in

00:19:23.663-->00:19:28.134
there. Ya know all wireless
communication which we already
mentioned, motion of pendulums

00:19:28.134-->00:19:33.939
or springs, um, etcetera. Um you
see it in the temperature of
earth. You have a natural sin

00:19:33.939-->00:19:39.478
wave created. Patterns of
breathing You know in and out,
kind of yin yang stuff. Um it's

00:19:39.478-->00:19:43.783
all over modern physics. So it's
really interesting to understand
waves. Ya know quantum field

00:19:43.783-->00:19:49.221
theory says that like even
particles are just comply
excitations in fields, or waves

00:19:49.221-->00:19:55.461
in various types of physical
fields. Um, which pretty cool.
Uh string theory would say that

00:19:55.461-->00:20:01.300
maybe vibrating strings are the
basis of all matter. Um which is
cool. Um I'm sure you guys have

00:20:01.300-->00:20:04.136
heard of the uncertainty
principle like, uh the
Heisenberg uncertainty

00:20:04.136-->00:20:08.774
principle. Um it was kind of
cool like what I was doing audio
analysis I stumbled upon it,

00:20:08.774-->00:20:13.913
like accidentally. Like
basically if you look at a
spectrogram like this you have

00:20:13.913-->00:20:19.518
basically the time d- dimension
in the X axis and then the Y
axis is the frequencies and the

00:20:19.518-->00:20:24.390
intensity of the caller is um,
the intensity of the, the
amplitude basically. But

00:20:24.390-->00:20:30.029
basically if like you, if you
have sin wave um if you only
listen for like a millisecond,

00:20:30.029-->00:20:35.134
like how do you know exactly
what the frequency is? I- It
could be uh i- i- it's gonna be

00:20:35.134-->00:20:38.938
hard to tell. The more data
points you have the more sure
you can be, the higher

00:20:38.938-->00:20:44.677
probability you have of knowing
exactly what that frequency is.
But the more samples you have to

00:20:44.677-->00:20:50.449
gather to get that, the less
sure you are in time. Right? If
you're chunking by 1 second

00:20:50.449-->00:20:56.355
chunks, you're only gonna know
within 1 second where this spot
was. So what happen when we up

00:20:56.355-->00:20:59.592
the uh winnows size from the
spectrogram uh you don't' have
to understand all of this but

00:20:59.592-->00:21:05.164
just look at, watch what it
does. Um, you're gonna see in
the time domain we're gonna be

00:21:05.164-->00:21:09.902
less and less sure. It's going
stretch out horizontally. But in
the frequency domain which is

00:21:09.902-->00:21:15.207
the Y axis it's gonna get more
and more tight. Right? So it's
kind of cool, you can visually

00:21:15.207-->00:21:21.113
see the uh, the uncertainty
principle. Um, so it's cool
waves help us understand the

00:21:21.113-->00:21:26.719
universe. Uh another cool thing
I found uh waves are kinda the
epitome of change, uh of any

00:21:26.719-->00:21:33.159
shape ya know like because the
derivative of a sine wave is
itself another sine wave. Um, so

00:21:33.159-->00:21:38.731
it's kind of cool it's like the
epitome of change. Not important
for radio stuff necessarily. But

00:21:38.731-->00:21:44.537
kind of cool. Um, there's also
this really, really cool
concept. Now this is true of

00:21:44.537-->00:21:49.542
both sound and radio waves. It's
called the superposition
principle. Um so let's t- let's

00:21:51.911-->00:21:56.916
try this um so I'm gonna knock.
Can you hear me, can you hear me
and the uh knocking at the same

00:21:59.351-->00:22:04.123
time? And can you differentiate
them? Well you can. But what's
actually happening is in the

00:22:04.123-->00:22:10.462
sound waves by, the pressure
from my vocal cords is getting
added to the sound of me, like

00:22:10.462-->00:22:15.467
knocking on the desk and they're
being added together um, into 1,
into basically pressure that's

00:22:17.670-->00:22:22.675
reaching your ears. Your ears
only can determine pressure. Oh,
there we go. Um, so the idea is

00:22:29.114-->00:22:34.787
there can be multiple simple
waves all added together and
stacked together uh to form a

00:22:34.787-->00:22:40.526
more complex one. So what this
looks like visually you can see
these 4 sin waves uh 1 is flat,

00:22:40.526-->00:22:45.531
you add those together they look
like this, right? This is like
and this is what radio waves

00:22:45.531-->00:22:50.336
look like as well, uh look at
all, think about all the radio
devices all around us that are

00:22:50.336-->00:22:54.540
transmitting. It's making,
they're all getting added
together and it's making this

00:22:54.540-->00:22:59.545
really big complex wave. But
we're able to tune in to 1
frequency with radios. That is

00:23:02.781-->00:23:08.254
only possible because it's able
to deconvolute this really
complicated wave of

00:23:08.254-->00:23:13.259
electromagnetic uh radiation.
Um, and so this is important
because we have to do that. We

00:23:15.527-->00:23:19.898
have to be able to tune in. We
don't wanna have the noise from
the radio station near by

00:23:19.898-->00:23:26.372
effecting our cell signal,
right? Um this kind of thing is
done with a Fourier Transform.

00:23:26.372-->00:23:30.609
Not gonna get into it a lot ya
know. It goes from ya know the
time domain to the frequency

00:23:30.609-->00:23:35.614
domain. But um, so yeah,
deconvolution is necessary to
actually tune into a signal. Um

00:23:38.217-->00:23:43.222
one other little side note
that's kind of interesting, um
this, this kind of blew my mind

00:23:43.222-->00:23:47.826
okay. It's really ki- kind of
cool if you get it. Um, so if
you have 2 different sine waves

00:23:47.826-->00:23:53.899
let's say you have a 8 hertz
sine wave, uh so it's uh cycling
ev- 8 times a second. And you

00:23:53.899-->00:24:00.272
have a 12 hertz sine wave and
you multiply or take the dot
product of those together they

00:24:00.272-->00:24:05.544
will always basically any 2 fr-
uh frequencies, any 2 different
frequencies are gonna cancel

00:24:05.544-->00:24:11.884
each other out when multiplied.
But to a wave that has the same
frequency in it, if you multiply

00:24:11.884-->00:24:16.755
it, take the dot product you'll
actually have a big value.
That's actually how you can tune

00:24:16.755-->00:24:21.994
in. That's actually how you can
deconvolute a signal. So for
example ya know here I have an 8

00:24:21.994-->00:24:28.200
hertz wave and a 12 hertz wave.
Multiply those and you get
something close to zero. You do

00:24:28.200-->00:24:34.773
an 8 hertz wave and an 8.1 hertz
wave and you get a large value.
Um if you're curious like does

00:24:34.773-->00:24:39.778
it drop off right away? Um the
graph looks kind of like this,
it's kind of crazy. Um, a- and

00:24:41.847-->00:24:47.486
this is kind of esoteric but you
could imagine every single
simple sin wave as 1 dimension

00:24:47.486-->00:24:51.757
in this really complex covert
space. Um I mean you can
actually like add vectors

00:24:51.757-->00:24:56.228
together. But anyway. It's kind
of uh, uh, it's kind of
interesting stuff but I'm gonna

00:24:56.228-->00:25:00.532
skip over that for time sake.
Uh, the last thing and this is
actually gonna be, this was

00:25:00.532-->00:25:07.473
actually useful to me for
generating the script. Um, if
you have a si- a single

00:25:07.473-->00:25:14.079
dimensional sine wave just going
up and down what in- what radios
actually take is a complex sine

00:25:14.079-->00:25:18.817
wave. So it actually is
oscillating not just up and down
but left and right. So it

00:25:18.817-->00:25:25.424
actually looks like a circle
like this going forward. Um, and
raising e to the I times some

00:25:25.424-->00:25:31.964
power, actually generates a
2-dimensional sine wave. Which
is pretty cool. So um, let me

00:25:31.964-->00:25:36.402
show what that looks like. So
basically like this so instead
of having just 1 up and down sin

00:25:36.402-->00:25:42.141
wave you actually have this
circle the spiral shape. And
that's actually what radios use.

00:25:42.141-->00:25:46.979
So, then how does actual digital
communication happen? Well, we
know modems of course. We're

00:25:46.979-->00:25:51.450
doing the m- mod side of a
modem. You know uh just to go
through it quickly. There's a

00:25:51.450-->00:25:57.055
couple types of um modulation.
Um so there's amplitude
shift-keying frequency,

00:25:57.055-->00:26:01.493
phase-shift keying, etcetera.
Amplitude-shift keying you're
just making the amplitude of the

00:26:01.493-->00:26:08.000
wave go up to be louder or down.
So this would be like zero 1.
That's what it would actually

00:26:08.000-->00:26:11.570
look like. Um, the sample uh the
demo that I did with the outlet,
that's an example of ASK. Right

00:26:11.570-->00:26:16.575
you can see where it's really
small and then it gets really
loud, etcetera. Um, frequency

00:26:19.645-->00:26:24.983
shift keying you're actually
changing the frequency. Um
there's lot of stuff that uses

00:26:24.983-->00:26:30.722
that as well. Um actually FM
radio would be frequency shift
keying. Um, this is what that

00:26:30.722-->00:26:35.727
would look like. Uh so this
would be like, zero, 1, zero, 1,
1, zero in FSK. Um there's also

00:26:38.464-->00:26:43.569
phase-shift keying and other
crazy stuff like quadrature
amplitude modulation. That's

00:26:43.569-->00:26:48.574
actually what WIFI uses, it's
kind of a combination of ASK and
PSK. Um, anyway uh just to show

00:26:51.710-->00:26:58.450
you kind of what my process was
like for actually getting um,
this script developed. So first

00:26:58.450-->00:27:03.388
this script um it's all online.
But it's about 120 lines of
python right here. Um, so not

00:27:06.892-->00:27:13.398
really, not bad. Um, but I wanna
go through kind of what it was
like. So basically you know I

00:27:13.398-->00:27:18.303
started off with this ASK
sample. I j- I kind of just eyed
it to try to figure out, well is

00:27:18.303-->00:27:23.308
this uh what is the baud rate?
All that kind of stuff. Um, and
you know I, I said okay well I

00:27:25.377-->00:27:30.716
need to do b- do basic amplitude
modulation. Um, you don't you
could ignore all this code, um

00:27:30.716-->00:27:36.922
this is a Jupiter notebook by
the way. Um, which uh it
basically it's an executable

00:27:36.922-->00:27:42.227
visual thing. So like all the
code necessary to do this is in
this single document and its' at

00:27:42.227-->00:27:48.934
the end of the uh sl- it's on
the last slide. Anyway, um so I
have this wave and I need to

00:27:48.934-->00:27:54.406
amplitude modulate it. So I
wrote some code to do that. Um,
and then I basically wrote some

00:27:54.406-->00:27:59.978
code to say, well I need to make
it, I kn- I wanna trans- I wanna
make zeros and 1's transmit into

00:27:59.978-->00:28:05.717
low and high. Uh I'm not gonna
go into all the details there.
There's also bit spacing. Um you

00:28:05.717-->00:28:10.422
know you notice that if you look
at the signal um, there's some
bit of space in between each

00:28:10.422-->00:28:16.128
bit. Um, so basically you know,
find all those variables and
then I have an algorithm to

00:28:16.128-->00:28:22.434
generate a signal from that. Um,
I tried this and I was like hey
sweet that's like really close

00:28:22.434-->00:28:27.439
to the original. Um and I tried
it and it failed. Um, and
actually the reason it failed

00:28:30.676-->00:28:35.881
was I learned the hard way, well
yeah it's actually gotta be a
complex sine wave signal. Um so

00:28:35.881-->00:28:41.153
I was basically able to
substitute out s- raising sin to
the X, raising E to the IX and

00:28:41.153-->00:28:47.893
it just worked. Um or actually
well there was 1 other, 1 other
step that I had to do. Um, and

00:28:47.893-->00:28:53.198
it was interesting but there's
uh, there's basically when I
looked at the waves up close um,

00:28:53.198-->00:28:59.304
doing a simple wave uh, it was
almost you almost couldn't' hear
it. Actually I had to do another

00:28:59.304-->00:29:04.910
sine wave inside of. Um, so I
was transmitting at 315
megahertz. I had to do another

00:29:04.910-->00:29:08.780
like 1-->000 hertz wave or
something like that and that's
the 1 I was actually making go

00:29:08.780-->00:29:14.252
loud and quiet. Um, so a few
little details if you actually
wanna do it. Otherwise you can

00:29:14.252-->00:29:19.257
just use the script it's on
GitHub. Um, and um there was
definitely some interesting

00:29:21.927-->00:29:26.932
obstacles. Uh, that I had to
pass to get it to work. Um, this
script uh this whole

00:29:29.067-->00:29:34.072
presentation including these
links I'm gonna have at the end.
So anyways, conclusion, um, it's

00:29:36.274-->00:29:40.345
really cool because like all
wireless communication. Like
virtually every wireless

00:29:40.345-->00:29:46.852
communication that I could think
of happens over electromagnetic
radiation. Um, all digital

00:29:46.852-->00:29:50.522
communication rather. The only
exception I can think of is
sound waves. That's a form of

00:29:50.522-->00:29:55.527
wireless communication that is
not radio wave based, right it's
sound waves. Um, having looked

00:29:57.963-->00:30:03.735
at ya know the various waves you
can attack the physical layer.
Um I mean hopefully you can be

00:30:03.735-->00:30:08.807
aware of various attacks that
are possible, ya know we went
through jamming attacks replay.

00:30:08.807-->00:30:14.179
The stuff I'm doing. Generating
these signals from scratch, you
could use that potentially to

00:30:14.179-->00:30:20.085
bruteforce, right? Um or you may
see a sample, like In my case I
actually saw a sample of another

00:30:20.085-->00:30:24.589
outlet. Not this one but another
one. From that I was able to
derive the binary code for this

00:30:24.589-->00:30:30.762
one. Just you know a few bits
difference. Um, there's a lot
potential for doing things like

00:30:30.762-->00:30:35.033
mixed attacks. So you might do
like, there might be a 1 time
rolling code and you want to

00:30:35.033-->00:30:39.805
bruteforce that but you replay
the other part, right? You see
what the key space looks like

00:30:39.805-->00:30:46.244
and then you generate all the
possibilities. Uh that's another
possibility. Um, and y- ya know

00:30:46.244-->00:30:50.615
thinking about this kind of
stuff, um uh so like I have a
home security system. I have a

00:30:50.615-->00:30:56.888
wireless home security system.
Um, so like the jamming attack,
ya know you could theoretically

00:30:56.888-->00:31:03.195
uh, jam betw- okay so like I
have a door sensor and then it
has the hub right? Well so you

00:31:03.195-->00:31:07.799
could jam at the frequency that
those communicate with. Even if
it's armed it will open the

00:31:07.799-->00:31:14.206
door, right? Um, and so wh- well
how could he fix that right?
Could, I mean could just do a

00:31:14.206-->00:31:19.811
non-wireless system. That would
be 1 way. Um, you could also if
you're looking at wireless

00:31:19.811-->00:31:24.549
systems, wireless security
systems you might say well I'm
gonna look for 1 that has maybe

00:31:24.549-->00:31:31.022
active low. So if it, if the
power gets cuts um, we know
something's up right? Um or

00:31:31.022-->00:31:34.626
there could be ones that keep
track of their state. They
actually look for an ack coming

00:31:34.626-->00:31:41.166
back from the hub. Um that kind
of stuff would be harder to
attack in this way. Um, so

00:31:41.166-->00:31:47.372
hopefully this will give you
guys a good basis for how radio
works right? How all the stuff

00:31:47.372-->00:31:51.810
works. You can use various
tools. I recommend getting a new
radio, getting a new radio

00:31:51.810-->00:31:56.982
companion, uh HackRF. Um and
there's a lot of new cool tools
coming out right now. Just

00:31:56.982-->00:32:01.553
recently ya know, there's this
whole like software defined
radio ya know, movement

00:32:01.553-->00:32:06.558
happening. Um, so uh yeah and
then that's, that's all I have
for today. Um I think we may

00:32:08.760-->00:32:13.698
have a few minutes for questions
in case any one has any. Uh the
link right here is to this

00:32:13.698-->00:32:19.738
presentation. Um, and the link
below is to my GitHub which has
the Jupiter notebook, all the

00:32:19.738-->00:32:24.743
scripts all that kind of stuff.
Um so let's see, uh do we have
any questions? Yes. >>[off mic

00:32:35.287-->00:32:40.292
question] >>I can't hear you.
Can you come a little closer?
>>[off mic question] [applause]

00:32:47.766-->00:32:52.103
>>Thank you