00:00:00.000-->00:00:06.917
>>Ok, so let's talk a bit about
the micro:bit and uh the way you
know we can hack this uh tele

00:00:06.917-->00:00:13.667
device. So, just to introduce
myself, I’m Damien Cauquil head
of R & D, at Econocom digital

00:00:13.667-->00:00:19.375
security, sorry, it’s a French
company, I’m also the senior
security researcher, and uh and

00:00:19.375-->00:00:28.208
uh I’m also a software, hardware
reverse engineer. So I’m French,
expect er- errors and so on. I

00:00:28.208-->00:00:34.750
think you’re-you’re quite
familiar with it. So, we will
talk about the micro:bit,

00:00:34.750-->00:00:41.417
micro:bit uh, uh, this is a tiny
device with uh many amazing
features, uh many, well many

00:00:41.417-->00:00:47.958
interesting things, from a
hacker point of view. And I will
introduce you to the where to

00:00:47.958-->00:00:56.542
turn the micro:bit into a
sniffer, into um some nice tools
in order to accurate into radio

00:00:56.542-->00:01:02.125
frequency protocols. And, uh I’m
going to show some demos too.
So, first of all, the BBC

00:01:02.125-->00:01:09.458
micro:bit, so this is uh, uhhhhh
BBC sponsored device, that was
given to a lot of students in

00:01:09.458-->00:01:18.875
the, the United Kingdom, uh in
order to to facilitate the the
learning of coding in the UK

00:01:18.875-->00:01:28.625
schools. So as they create uh
five by five LED screens, uh LED
matrix, two buttons, uh, uh

00:01:28.625-->00:01:36.250
custom expansion connector and
also, wireless capabilities. So,
it's about to be noted because

00:01:36.250-->00:01:43.750
uh this is the interesting part
in the micro:bit. And, uh it's
running MicroPython so you, if

00:01:43.750-->00:01:52.292
you want to coding Python on the
micro:bit, this is possible. It
costs only fifteen bucks, uh I

00:01:52.292-->00:01:59.042
checked on smartphone so if you
want to buy one it's very cheap.
From, uh, another perspective,

00:01:59.042-->00:02:07.083
this is a-a device, based on the
Nordic Semiconductor's nRF51822
it's a bitware uh it's a bit 19,

00:02:07.083-->00:02:16.458
but its a 2 point 4 gigahertz
GFSK transceiver uh along that
comes along with a cpu, sorry

00:02:16.458-->00:02:24.125
it's uh pretty cool, it has uh
256 kilobytes of flash, 16
Kilobytes of ram. Uh you can use

00:02:24.125-->00:02:32.000
some things like AD uh ADCs so
if you want to rate digital or
some uh trade some for digits or

00:02:32.000-->00:02:40.125
so on, you can do it. Uh it's
also as an SPI bus, uh I2C bus,
and you can use 20 GPIOs to do

00:02:40.125-->00:02:45.125
whatever you want with the
expiration plot. Powered on 3
volts so it's uh kinda cool,

00:02:45.125-->00:02:53.250
powered with two uh triple A
batteries, it's uh very portable
and very affordable. It’s also

00:02:53.250-->00:02:59.750
easy to program, this device has
been designed to uh feed the
children needs so uh everything

00:02:59.750-->00:03:04.750
is online, we can use uh
javascript blocks editor for
instance uh they wrote by

00:03:04.750-->00:03:09.833
microsoft it's kind of scratch
uh can use to program you know
micro:bit, you just put blocks

00:03:09.833-->00:03:17.750
and uh develop on the micro:bit
uh by using this uh editor or
you can do it the Python way but

00:03:17.750-->00:03:23.417
by online using uh online editor
if you put put some co-Python
code in it. It combines online

00:03:23.417-->00:03:30.958
and you get the next file your
of just to put uh put this file
on the in your micro:bit uh you

00:03:30.958-->00:03:36.792
know this is uh an interesting
device because if you plug it-
this- through- the uh-uh through

00:03:36.792-->00:03:42.125
the- through the USB cable to
your computer, it pops up as a
mass storage device so you just

00:03:42.125-->00:03:47.375
have to drag and drop your file
and flashes automatically your
micro:bit. So, this is uh this

00:03:47.375-->00:03:54.083
is very cool. It’s also at the
REPL, the read evaluate print
loop so if you want to debug

00:03:54.083-->00:03:59.625
your code you can just use a-a
cyber mini code and you can dip
again through url. So, this is

00:03:59.625-->00:04:07.375
uh, this is nice to- to when you
are developing some uh, some uh,
some code on the micro:bit. It

00:04:07.375-->00:04:14.375
also has wireless capabilities
and this is the interest- uh
most interesting part uh this uh

00:04:14.375-->00:04:20.667
transceiver the nr51822 is about
to communicate through Legacy
ShockBurst Protocol, so this is

00:04:20.667-->00:04:25.958
a protocol designed by nordic uh
and the also the Enhanced
ShockBurst Protocol, this is a

00:04:25.958-->00:04:32.958
new version of this protocol and
last but not least the Bluetooth
Low Energy Protocol. So, eh this

00:04:32.958-->00:04:39.375
chip can uh emulate devices, can
uh it can put some Bluetooth Low
Energy services on it get you

00:04:39.375-->00:04:46.250
bluetooth enabled device, this
is uh this is great. So, when I
discovered this uh this uh

00:04:46.250-->00:04:54.958
capabilities I was like uh you
know [laughter]. So, it's
interesting because it erea pth

00:04:54.958-->00:05:01.000
uh French I say it's uh
interesting because the Enhanced
ShockBurst protocol is well

00:05:01.000-->00:05:06.667
known as it was presented last
year by Marc Newlin uh from
Bastille and uh it was equally,

00:05:06.667-->00:05:13.708
it was attacked by Marc Newlin
during this uh last DefCon and
uh it had lots of what you call

00:05:13.708-->00:05:18.875
the-the mousejack framework, so
the mousejack framework create a
set of tools able to hijack

00:05:18.875-->00:05:25.542
wireless keyboards and mice, so
it's uh a great tool written in
Python too uh it’s also, it’s

00:05:25.542-->00:05:32.792
also open source so this is a
good way so uh it’s good to know
the bad things of this hack uh

00:05:32.792-->00:05:40.000
because it’s not Marc Newlin who
found out how to turn this uh
device which is a crazy way to a

00:05:40.000-->00:05:49.542
PA into a sniffer. All the
credits go to Travis Goodspeed,
with uh his uh NRF24L01 plus

00:05:49.542-->00:05:54.708
hack. Uh in this hack he managed
to turn uh another chip for
nothing micro nordic

00:05:54.708-->00:06:03.583
semiconductor which is the
NRF24L01 plus into a sniffer by
using a, a trick I’m uh talk

00:06:03.583-->00:06:11.292
about the uh in the in another
section of this presentation but
uh it’s good to know. Uh, also

00:06:11.292-->00:06:18.667
Samy Kamkar made the this uh
keysweeper which is a tiny
device, um it's uh just uh very

00:06:18.667-->00:06:25.500
small uh it looks like a
portable adapter, but inside,
you’ll find uh another node

00:06:25.500-->00:06:33.875
connected to a NRF24L01 so it's
able to sniff wireless keyboards
and it’s also uh using uh a GSM

00:06:33.875-->00:06:39.083
gateway to send texts and
receive texts so you can get uh
the intercepted stuff and tested

00:06:39.083-->00:06:48.375
keystrokes over uh wirelessly
with your phone. Uh, another
interesting tool for 24L01

00:06:48.375-->00:06:54.500
protocols is a DSMX hijacking
tool called ic-icarus, so this
one is a bit real here but in

00:06:54.500-->00:07:02.750
fact this is a tool that uh uses
some kind of sniffing to hack
into uh the DSMX protocol, and

00:07:02.750-->00:07:10.083
what is DSMX protocol? It’s a
protocol used um, in uh-uh with
remoted airplanes, so when you

00:07:10.083-->00:07:16.583
are just flying in remoted
airplanes, you may use uh
controller and receiver that

00:07:16.583-->00:07:22.833
uses this this protocol. And the
action to this protocol and we
are going to, to take complete

00:07:22.833-->00:07:33.208
control of uh say a plane or
quite copter in this case. So,
after uh, after I been reading

00:07:33.208-->00:07:38.000
all of this, I’ve been thinking
about um doing some kind of
offensive Python on the

00:07:38.000-->00:07:42.750
micro:bit. You know if I’m maybe
it’s possible to turn this
micro:bit into a sniffer and

00:07:42.750-->00:07:50.542
hopefully it is, well uh maybe
we can do a lot more with it.
So, just have a look at it. So

00:07:50.542-->00:07:58.042
let’s start digging into the
micro:bit, and uh, I’m, I’m
going to start with the NRF51822

00:07:58.042-->00:08:03.125
and it’s specific uh
specifications. And, especially
the way you can turn this

00:08:03.125-->00:08:12.167
transceiver into a sniffer. So,
I-I talked about the uh Travis
Goodspeed hack so this is uh the

00:08:12.167-->00:08:17.958
Travis Goodspeed hack box. So
basically you have uh-uh a
datagram sent over the air and

00:08:17.958-->00:08:26.667
the transceiver tries to match
some fields just to identify
very packet. Your uh packet

00:08:26.667-->00:08:33.583
starts with a preamble which is
uh in this uh in this example 55
x and then followed by your 3

00:08:33.583-->00:08:40.583
byte address, the address can be
3, 4, or 5 bytes uh when you are
dealing with the MX shortbox

00:08:40.583-->00:08:46.000
protocol and this address is
followed by your packet control
field, which is 9 bit, then the

00:08:46.000-->00:08:53.333
payload and the at the end a
CRC. So, this is uh, this, thi,
this is a basic set up for the

00:08:53.333-->00:09:01.833
uh ESP protocol but what Travis
Goodspeed discovered is that the
matching uh when the transceiver

00:09:01.833-->00:09:08.250
tries to identify the start of a
packet, it does not relies on
the, the preamble byte. It, it’s

00:09:08.250-->00:09:18.500
preference the matching of the,
on the address. So If you
configure your NRF24L01 uh in a

00:09:18.500-->00:09:25.042
real way, the, the possibility
to sniff, I mean, uh since the
matching is here from the

00:09:25.042-->00:09:32.167
address we set up uh the
transceiver to match a 2 bytes
long address rather than the 3,

00:09:32.167-->00:09:39.542
4, or 5 bytes. And if you put uh
uh double o 55 in X as an
address, it will match the

00:09:39.542-->00:09:47.125
preamble of the packet. So, uh
we also configure this
transceiver to forget about the

00:09:47.125-->00:09:54.250
PCI fib. So we go back to the
legacy shockburst protocol and
we tell the transceiver that we

00:09:54.250-->00:10:02.583
need a 32 bytes of payload. So,
in the payload, we will find the
so the ESB address which is uh 3

00:10:02.583-->00:10:11.000
bytes, the 9 bits of PCI fail,
the original payload, and also a
CRC. In order for this packet to

00:10:11.000-->00:10:17.958
be notified, uh to the to our
code, we need to disable the
CRC. Um why? Because, if the CRC

00:10:17.958-->00:10:24.333
is enabled uh, the matching
algorithm we che we check the
CRC and in this conversation the

00:10:24.333-->00:10:31.458
CRC doesn’t match. So, once you
configure your transceiver this
way, you are able to sniff. So

00:10:31.458-->00:10:39.458
this is for the 24L01 plus, not
for the 51822. But vertically
they did the same mistake, on

00:10:39.458-->00:10:45.833
the 51822 so if you just trick a
bit the conversation of the
51822 you can get the exact same

00:10:45.833-->00:10:55.667
effect. There are some
differences between the 24L01
plus and the 51822, so basically

00:10:55.667-->00:11:01.708
the fifty one is allowed to do
both uh, big engine and little
engine converters where the

00:11:01.708-->00:11:12.000
NRF24L01 just sticks with the
big engine and also the NRF51822
that’s uh very difficult to say

00:11:12.000-->00:11:23.125
uh sorry uh uh the payload with
a max 254 bytes instead of the
32 bytes we got with uh 24L01

00:11:23.125-->00:11:29.417
plus.So, It’s very cool because
we were limited with the 24L01
but the limitation is no longer

00:11:29.417-->00:11:36.375
here with the fifty one. But the
configuration is a bit uh uh a
bit more complex. So here we uh

00:11:36.375-->00:11:45.000
how it is done, uh I put all
this on the code so you have a
base zero and prefix zero uh

00:11:45.000-->00:11:50.792
registers you have to put some
zero in it and 55, just to be
sure to match the preamble. Uh

00:11:50.792-->00:11:58.917
we configure the PCF field to be
zero to, to adjust uh to use
this field here here and uh also

00:11:58.917-->00:12:05.500
we set up the engine to big with
uh some kind of vital and set up
the maximum payload lens to 40,

00:12:05.500-->00:12:13.167
why 40? Just to be able to get,
to catch the 32 bytes payload uh
we would have missed if we were

00:12:13.167-->00:12:23.000
using the, the NRF24L01. Once
you set up your 51822 like this
you will get some packets in it

00:12:23.000-->00:12:29.250
because uh it matches the
preamble. But, we have to check
the CRC ourself because uh this

00:12:29.250-->00:12:34.833
is not verified by the receiver.
So, by doing this and um by
using some code from NRF

00:12:34.833-->00:12:39.500
research firmware which is a
firmware used for the mouse jack
proto, uh mouse jack uh tool, we

00:12:39.500-->00:12:44.583
can uh check the CRC and uh um
just uh avoid um all false
positives from this. So, I put

00:12:44.583-->00:12:54.458
all of this into a modified
micro python firmware. I’ve
brought that would be uh i mean

00:12:54.458-->00:13:04.292
what is this at the end of this
talk, uh so I, I modified the
micro python uh motor just to uh

00:13:04.292-->00:13:11.708
to implement some new fixed, new
features such as this uh
sniffing this uh sniffing trick,

00:13:11.708-->00:13:18.042
by using some lines of spice on
them I was able to develop a
quick ESB sniffer, so I got a

00:13:18.042-->00:13:23.083
little demo to show you right
here, so, uh first of all, I,
well I am programing my

00:13:23.083-->00:13:28.375
micro:bit with my specific
firmware, and the uh, I tell the
micro:bit to use a specific

00:13:28.375-->00:13:35.958
python file I wrote , so the the
file I was showing you just
before, and by connecting to

00:13:35.958-->00:13:43.250
UART With a specific baud rate,
uh I am getting all the stuff
printed by the micro:bit so,

00:13:43.250-->00:13:50.292
here we can see many devices
talking with uh, uh over some
kind of ESB protocol, so this is

00:13:50.292-->00:13:57.083
uh logitech wireless mouse and
it's uh sniffed without any
problem by this uh this little

00:13:57.083-->00:14:06.417
hack. So, there it is. But we
are not limited to uh ESB port,
uh ESB protocol or SB protocol

00:14:06.417-->00:14:12.208
uh either it's uh 2.4 GHZ uh
transceiver, we can do a lot of
stuff. We can do uh sniffing,

00:14:12.208-->00:14:18.750
also can inject information into
this protocol. And, this
technique is not limited to ESB,

00:14:18.750-->00:14:26.208
so we can uh hack into any 2.4
GHZ uh protocol that relies on
the GFSK modulation uh with a

00:14:26.208-->00:14:29.833
specific data rate. So, there is
a whole new world of
possibilities. And um, uh the

00:14:29.833-->00:14:39.958
[inaudible] actor uh just be on
some kind of quad copter uh and
uh I did something to put some

00:14:39.958-->00:14:47.750
uh support for the XN297
transceiver which is uh found in
the Cheerson CX-10, I don’t know

00:14:47.750-->00:14:53.958
if you’re familiar with this uh
quad copter but uh it's uh it’s
quite uh- common, so uh but the

00:14:53.958-->00:14:59.708
transceiver is not common. This
is compatible with NRF51822, uh
but there is a, a slight

00:14:59.708-->00:15:07.583
difference uh that is this
transceiver use, uses a data
whitening algorithm. So, anyway,

00:15:07.583-->00:15:15.292
it’s not uh a big deal. So, uh I
developed a lot of uh some f,
some myth art for the Module to

00:15:15.292-->00:15:23.875
uh, to keep it uh to be able to
communicate with the XN297. So
if you use um, the gsm preamble

00:15:23.875-->00:15:30.792
used by this transceiver uh
which is 71 0F 55 uh as a
receiver and transmitter

00:15:30.792-->00:15:35.667
address, you can communicate
with this device without no
problem at all so it is uh

00:15:35.667-->00:15:43.583
pretty uh, pretty easy to, to,
to implement in the, in the
micro:bit. Although, the uh

00:15:43.583-->00:15:50.792
fift, uh NR51822 is uh, is
bluetooth smart capable. So, I,
I was wondering uh there were uh

00:15:50.792-->00:15:57.333
some kind of possibilities to
sniff some kind of bluetooth
smart traffic, uh and this is

00:15:57.333-->00:16:05.042
possible just as a reminder uh,
uh for those of you that don, do
not know where the bluetooth low

00:16:05.042-->00:16:12.750
energy protocol uh the b80
protocol using three channels to
advertise uh devices this is the

00:16:12.750-->00:16:20.750
37, 38 and 39 channels uh the
these channels are spread over
along the, the old band 2.4 GHZ

00:16:20.750-->00:16:28.958
band uh so this is uh just a
reminder and the every device
uh, uh that uh perform this

00:16:28.958-->00:16:36.667
advertising stuff uh has to send
specific packets to a specific
access address, this is a 4 byte

00:16:36.667-->00:16:43.500
address used as a preamble just
to match uh, uh to identify
unique links and in this, uh in

00:16:43.500-->00:16:49.958
this packets where we’d find
some kind of PDU, this is a PDU
that tells uh BB stack what it's

00:16:49.958-->00:16:58.417
all about. So here uh, we are
looking for advertisement and I
also put all this all of this in

00:16:58.417-->00:17:06.250
my modified micro:bit firmware
ma-micropython so, uh I wrote
uh, uh a quick ble advertisement

00:17:06.250-->00:17:14.500
sniffer uh using the using
python and I ran it yesterday,
or last night at the hotel so

00:17:14.500-->00:17:20.792
it's uh, there were a lot, a lot
of devices advertising
themselves on sniffer, this is

00:17:20.792-->00:17:30.833
this is uh quite normal. But, we
can also spoof advertise uh
advertisement packets so if we

00:17:30.833-->00:17:37.000
build from scratch a packet, we
can create a DEFCON 25 device,
and advertise this device, but

00:17:37.000-->00:17:46.417
um, furthermore, we can do some
fuzzing on the PDU parsers used
in mini BLE stacks. So, I decided

00:17:46.417-->00:17:54.958
to modify just a byte of
the first one of the DEFCON 25
uh string which normally is 09

00:17:54.958-->00:18:04.667
but I put an 0a so just if I do
plus 1 instead of a 9, and I uh
advertise this uh, this device

00:18:04.667-->00:18:11.917
and I use my laptop with uh my
integrated BAD adaptor just to,
to detect the devices that’s a

00:18:11.917-->00:18:21.458
way around um if you, if you
look carefully you can see that
the, even um the accent of

00:18:21.458-->00:18:28.417
malform PDU but my stack got it
and I get one more character at
the end of DEFCON 25 because it

00:18:28.417-->00:18:36.458
uh, it uh, it uh, it was uh a 10
bytes long string rather than 9
bytes can be also useful to test

00:18:36.458-->00:18:43.500
some kind of this stuff on the
on the bluetooth. Furthermore,
we can sniff uh we can try to

00:18:43.500-->00:18:51.083
sniff BLE connections, so if you
want to make a, a, 15 bucks BLE
sniffer well maybe the way. So,

00:18:51.083-->00:18:57.125
I tested this uh, I tried to
sniff a BLE connection request
uh that's uh, BLE connection

00:18:57.125-->00:19:02.958
request is a, a specific packet,
by device uh,uh that wants to
connect to a specific other

00:19:02.958-->00:19:09.250
device, BLE device uh to tell
the uh to provide this, this
device with all the requested

00:19:09.250-->00:19:16.292
parameters. And uh, we can sniff
this uh this connection request,
so I did this again with a, a

00:19:16.292-->00:19:26.542
BLE device I own, so everything
is on a micro:bit uh still. So,
I take some time to get the uh

00:19:26.542-->00:19:31.750
the connection request because,
because since the device
advertise itself on 3 channels

00:19:31.750-->00:19:40.083
you get to, to be on one channel
when the connection request
arrives. Just waiting, ok we got

00:19:40.083-->00:19:45.125
the first one so, uh here we get
the access address which is a 4
byte address identifying the

00:19:45.125-->00:19:50.833
link and the initial toll uh the
initial toll address, the
advertiser address, the CRC init

00:19:50.833-->00:19:55.667
which is important here because
if you don’t have this vital
then you can’t carry compute the

00:19:55.667-->00:20:05.083
CRC for agent of your packet in
the open server which is uh, uh
a vital that is yours to

00:20:05.083-->00:20:09.708
literally open your frequency.
So, uh obviously I was on the on
the good start to sniff BLE

00:20:09.708-->00:20:16.208
connections but uh in fact
Python cannot do sniffing well
uh with a micro:bit because uh

00:20:16.208-->00:20:22.542
micropython introduce
incompatible delays uh, it's
it's a slow just to say it's

00:20:22.542-->00:20:29.583
simply it’s slow, uh we have a
few RAM available so to gather
to create a BLE sniffer using

00:20:29.583-->00:20:37.833
this uh micropython stuff. So,
but uh this is not really a
problem uh, as we are going to

00:20:37.833-->00:20:43.542
see later. So ,uh this is a tool
implement some tools, so the
first one is a mousejack like

00:20:43.542-->00:20:50.292
ESB sniffer obviously, uh since
uh everything the wireless
keyboard and mice hijacking so

00:20:50.292-->00:20:55.958
this uh sniffer is able to dump
32 byte payloads where the
mousejack original bit again

00:20:55.958-->00:21:01.958
original code cannot uh it
supports ESB and legacy SB and
also the BLE link layer uh

00:21:01.958-->00:21:06.917
implemented some kind of
bluetooth sort of sniffing at
the link layer just to be able

00:21:06.917-->00:21:12.708
to capture packets uh this is
quite new uh its also in so this
is follow mode for ESB but uh

00:21:12.708-->00:21:19.250
this mode is also present in
mousejacks for mousejack 2 and
uh it can do a raw sniffing, uh

00:21:19.250-->00:21:25.958
this is very useful when you are
trying to debugging some uh 2.4
GHZ protocols. So this is uh,

00:21:25.958-->00:21:34.042
the system, um I tested my tool
against my uh wireless keyboard
and uh mouse, so, uh again I

00:21:34.042-->00:21:40.375
programmed my micro:bit to use
uh some kind of middleware I’ve
developed and I installed my

00:21:40.375-->00:21:45.208
sniffer, telling my sniffer to
follow a specific device, uh
which is my uh wireless

00:21:45.208-->00:21:52.667
keyboard, so I discover these
devices by using the same tool
and uh here we, here we go, so

00:21:52.667-->00:21:57.958
we get uh many packets, many
active engagements, and uh if I
type in with my keyboard as you

00:21:57.958-->00:22:03.417
can see it’s uh all the packets
this, this keyboard sent
encrypted frames so this is not

00:22:03.417-->00:22:13.333
something in pure text, so this
is good. But uh if I take uh a,a
notepad, and if I type with a my

00:22:13.333-->00:22:19.000
wireless keyboard so you can see
there are a lot of, a lot of
packets and exchange between the

00:22:19.000-->00:22:24.708
wireless keyboard and donger.
So, by doing this, we can uh spy
on wireless devices with using

00:22:24.708-->00:22:33.417
the ESB protocol. Obviously, it
was uh sounded like a good idea
to create a wireless keylogger

00:22:33.417-->00:22:40.208
using this uh micro:bit, so I
used the, the micro:bit with two
triple A batteries uh I created

00:22:40.208-->00:22:45.208
the software so it changes the
UART interface to send the
recorded keystrokes, the

00:22:45.208-->00:22:50.875
micro:bit uh provides a tiny
file system you can use to store
uh in memory and pass it to

00:22:50.875-->00:22:58.417
memory the data, so if you want
to, to get track of uh every
keystroke uh, uh sniffed by this

00:22:58.417-->00:23:05.875
device, this is uh a good way to
go. So, I decided to plant my
keylogger, in the limiting room,

00:23:05.875-->00:23:12.708
we have a digital security, so,
just put it on, you can see the
lid uh doing some kind of

00:23:12.708-->00:23:20.167
searching for wireless keyboard.
And I asked a colleague of mine
to look into uh an account using

00:23:20.167-->00:23:28.917
this wireless keyboard. Uh, here
he’s currently looking in in uh
outlook, uh using my vulnerable

00:23:28.917-->00:23:39.167
keyboard, so he’s entering his
password, here it goes so,
everything was uh sniffed by uh,

00:23:39.167-->00:23:46.042
by this keylogger and when I get
my keylogger back, I connect
this keylogger to my computer.

00:23:46.042-->00:24:01.042
So this is the rough stuff to
get the, the keystrokes, ok so
uh, just a little bit faster, so

00:24:01.042-->00:24:06.750
I press a button and with this I
get all the keystrokes so this
is uh the password is uh

00:24:06.750-->00:24:19.583
illumine in French, and I
reloaded speak so this is uh
[applause]. So, it, it was done

00:24:19.583-->00:24:27.000
with a less than 200 lines of
space and the hard part was the
HID uh HID uh conversion for the

00:24:27.000-->00:24:36.667
from the keystroke to, to the uh
collectors. Uh, sort of nice too
to try to hack into some kind of

00:24:36.667-->00:24:46.083
wireless quadcopters 2.4 GHZ uh,
uh based quadcopters. So uh I
saw uh in the in November 2016

00:24:46.083-->00:24:54.167
that uh Marc Newlin and uh
challenged Michael Ossmann and
Dominic Spill and uh yeah during

00:24:54.167-->00:25:00.958
toorcamp uh so the idea for came
from Marc Newlin it, it wanted
to makes some kind of duel,

00:25:00.958-->00:25:10.125
drone duel, uh with uh against
uh Michael Ossmann, uh so they
inboxed two Cheerson CX-10, and

00:25:10.125-->00:25:19.292
they tried to uh hack the, the,
the other Cheerson, uh, uh it
was done with the micro, the

00:25:19.292-->00:25:25.250
mousejack firmware from Marc,
Marc Newlin, and uh I don’t know
what tools used Michael Ossmann

00:25:25.250-->00:25:32.500
uh but I guess it's uh geo
based. And uh the result was the
following, so um apparently they

00:25:32.500-->00:25:38.917
ended up with a draw and uh no
phishing nets or hijacking
whatsoever, so that was a good

00:25:38.917-->00:25:46.792
start. Dominic Spill and Michael
Ossmann uh presented the CX-10
wireless protocol during the

00:25:46.792-->00:25:51.417
talk so we got, I got all the
stuff uh already done. So this
is a binding request sent by the

00:25:51.417-->00:25:56.583
remote control to the
quadcopter, so basically it's
uh,uh,the controller sends a

00:25:56.583-->00:26:03.833
binding request containing its
transmitter ID and the the uh
quadcopter answers back with a

00:26:03.833-->00:26:09.792
binding reply with a transmitter
ID and a vehicle ID or aircraft
ID, uh, uh followed by your

00:26:09.792-->00:26:17.083
confirmation and then this
starts hopping from channel to
channel ummm sending uh, from

00:26:17.083-->00:26:20.875
the controller all the
information about the stick
positions uh from the controller

00:26:20.875-->00:26:27.250
so, uh basically, throttle, yaw,
pitch, roll and button states.
And when it does this, uh by

00:26:27.250-->00:26:34.208
looping on the, on the different
channels. So, my idea was to
create one controller uh that

00:26:34.208-->00:26:38.667
would be able to take over
connec, uh logistic connection
uh and to take control of the

00:26:38.667-->00:26:45.583
drone so. Uh, this can be done
by sending your work packet uh
just before the uh original,

00:26:45.583-->00:26:53.375
original controller the uh does
and uh by doing this, we can
take uh control of this. So, the

00:26:53.375-->00:26:59.875
channel hopping mechanism is uh,
is just using 4 channels that
are derived from the transmitter

00:26:59.875-->00:27:04.458
ID, so once you get the
transmitter ID, you get the
channels. So there this hijack

00:27:04.458-->00:27:09.750
is quite common, we sniff a
valid packet from channel 3 to
18, which is the first branch of

00:27:09.750-->00:27:16.500
the first channel used by this
uh drone. Once a valid pack,
once a valid packet is found, we

00:27:16.500-->00:27:21.875
get the transmitter and vehicle
ID. We check this transmitter ID
against the channels we derive

00:27:21.875-->00:27:27.542
again the channel list and check
if we, if uh, uh the channel we
are currently listing on uh is

00:27:27.542-->00:27:34.500
in this list and if it's okay we
just synchronize with the, the
drone and send quicker uh, with

00:27:34.500-->00:27:40.625
uh, with uh, we send qui,
packets quicker than the
original remote and get control

00:27:40.625-->00:27:46.833
of this. So, this radio is set
by using my micro python modeled
firmware, so this is the same,

00:27:46.833-->00:27:53.042
we wait for a valid packet, we
stop with 55 index preamble, we
get the transmitter ID, we

00:27:53.042-->00:27:57.833
divide the channels and we check
if the channel we are listening
on is in the channel list, if

00:27:57.833-->00:28:03.292
it's okay, if it’s found in the
channel list then, we start
synchro, synchronizing with the

00:28:03.292-->00:28:06.792
drone and then send packet with
the correct values to take
control of the drone. But the

00:28:06.792-->00:28:14.750
fact is, I need uh a way to fly
the spite of the drone, so I
need a remote controller. I

00:28:14.750-->00:28:21.792
thought about using your classic
RC, but, nope, this is uh way
too, way too complex, this is uh

00:28:21.792-->00:28:27.208
using some kind of protocol. I
also thought about uh using a
USB compatible game pad, uh we

00:28:27.208-->00:28:33.250
use normally in the model RC but
again this was very complex. So
I decided to go with uh a

00:28:33.250-->00:28:39.167
existing remote controller for
from the CX-10. And so, I
modified uh my remote

00:28:39.167-->00:28:44.333
controller, put some wires in
it, unsoldered the original
transmitter, used in this uh

00:28:44.333-->00:28:58.708
controller, and made my own work
controller. So, that’s it
[applause]. With this

00:28:58.708-->00:29:07.250
controller, uh, I am able to
read existing files by using the
ADC’s from the 51822, and um I

00:29:07.250-->00:29:15.333
won’t perform any live demos uh,
I’m sorry, we had some insurance
issues, they told me if I can

00:29:15.333-->00:29:21.167
put uh some thread to tie my
quadcopter to a table, I did
this at home and smash it to the

00:29:21.167-->00:29:27.375
ground, so no, just see I won't
be able to do this but I, I got
videos. So this is uh the first

00:29:27.375-->00:29:33.750
one, uh demonstrating um the
hijacking process, so, uh I got
uh 6-610 so it's waiting for

00:29:33.750-->00:29:42.458
binding, uh I uh perform this
binding with a remote controller
and can control the drone with

00:29:42.458-->00:29:50.333
this remote, uh this is quite
okay, and then I’m using my
working transmitter, well

00:29:50.333-->00:29:57.208
basically this is not powered on
so it doesn’t work, so I put
power on it, check if the

00:29:57.208-->00:30:02.292
original transmitter is
disconnected so here it is, I
got the controller of the, of

00:30:02.292-->00:30:08.250
the drone and I’m going to use
my uh my remote controller to
pilot the drone so this is uh

00:30:08.250-->00:30:22.333
quite interesting [applause].
So, this was a testbed I made on
my desk, uh and I made another

00:30:22.333-->00:30:30.125
video showing uh, the real
flight, uh this is quite the
same, I just stop the

00:30:30.125-->00:30:36.417
quadcopter, put it on the floor,
binding the quadcopter with the
remote controller. So, here it

00:30:36.417-->00:30:45.167
is, so I can fly the drone with
uh, with this uh, uh legit
remote controller, so I’m not a

00:30:45.167-->00:30:56.333
good uh drone pilot, you know,
so, as I said, so there it is
and then I take my remote

00:30:56.333-->00:31:03.542
controller, provide, provide, uh
provide tones sorry, just uh oh
here it is, so just taking a

00:31:03.542-->00:31:10.333
normal day when you do it uh
when you do it uh live, get some
trouble with the quadcopter but

00:31:10.333-->00:31:17.458
it's uh flying high this is not
really a problem you can get the
controller uh quickly. So, here

00:31:17.458-->00:31:25.958
it is and using my remote
controller I was able to fly it
uh smoothly, well, almost. Uh so

00:31:25.958-->00:31:37.917
it's working and uh I can fly
it, it’s not just a proof of
concept [applause]. So, uh

00:31:37.917-->00:31:43.417
sometimes I get the remote
controller disconnected but uh I
also experience some issues with

00:31:43.417-->00:31:49.583
the green version of this
copter, I ordered some on Amazon
and got it, received them and

00:31:49.583-->00:31:54.625
then when I tried this attack,
uh doesn’t work, and didn’t go
very well because uh, uh the uh

00:31:54.625-->00:32:01.375
sticks do not return the same
values so, this is uh a problem,
we are trying to take control of

00:32:01.375-->00:32:08.000
this. So, hopefully, uh
everything is online now, uh as
I’m speaking, so I put

00:32:08.000-->00:32:12.167
everything, the tools and
firmware and so on, it’s
available on github it’s open

00:32:12.167-->00:32:16.917
source, uh if you have a
micro:bit, feel free to use it
and uh test this, this firmware,

00:32:16.917-->00:32:26.792
if you find issues or bugs or so
on, file a request and you’re
you, if you test it you will see

00:32:26.792-->00:32:36.875
that it’s a child’s play to, to
hack into something [laughter].
So, as a conclusion because I, I

00:32:36.875-->00:32:41.250
got to,to be very quick, uh this
is a cheap, tiny and battery
powered radio frequency hacking

00:32:41.250-->00:32:46.500
tool, so, this is quite
interesting, it also allows
rapid prototyping if you are

00:32:46.500-->00:32:52.417
going to experiment in ESB
protocol, SB protocol or BLE,
you can do uh nice stuff with

00:32:52.417-->00:32:59.083
it, It's uh, it maybe better
than Bastille’s mousejack, I
don’t want to uh to, to get Marc

00:32:59.083-->00:33:05.250
Newlin angry you know uh and you
can do even better with the
micro:bits DAL which is a device

00:33:05.250-->00:33:09.417
that’s actually later developed
by the University of Lancaster.
So, this is the simplest version

00:33:09.417-->00:33:16.042
not by them so just to get uh
deeper in the source code, but
uh, I’m currently working on uh

00:33:16.042-->00:33:23.458
the start of implementation of
Mike Ryan’s hacking tool for
BLE, so Mike Ryan developed us a

00:33:23.458-->00:33:31.333
BLE sniffer based on the
ubertooth uh using some HDR and
guess what? We can, I’m quite

00:33:31.333-->00:33:39.167
sure we can do the same with uh
the micro:bit. I implemented the
access address recovery, uh the

00:33:39.167-->00:33:45.292
CRC recovery from this tool,
it’s still in development, I’ve
got no proof of concept to show

00:33:45.292-->00:33:51.792
you, but uh, if I connect my uh
my smartphone to a device, I’m
able to get all these values

00:33:51.792-->00:33:57.667
back, um, uh and the opentable
too. So this uh it’s, it’s just
a matter of time to get it

00:33:57.667-->00:34:06.667
working with a, a real BLE
device. So this is uh, just uh
some future work with all of

00:34:06.667-->00:34:13.083
this. If you have any questions,
uh I will be available right out
there, uh wondering through

00:34:13.083-->00:00:00.000
holes and worms and thank you.
[applause]