00:00:00.000-->00:00:05.672 >>OK, um. Thank you. Um. I'm Dave Karit I'm a security consultant pentester from 00:00:05.672-->00:00:12.179 Wellington, in New Zealand. Uh, for those of you who don't know where Wellington is [laughter] 00:00:12.179-->00:00:17.184 we're at the top of the map there. [clapping] Um, I enjoy sort of the radio hacking also 00:00:19.486-->00:00:26.126 the physical stuff of flox sport and stuff like that. So, today we're going to be looking at 00:00:26.126-->00:00:31.131 GPS, um, GPS spoofing, sort of how we can change time and what we can do with it. And taking 00:00:33.734-->00:00:40.007 some NTP servers and whether we can actually detect some of the spoofing. So just going back to 00:00:40.007-->00:00:46.146 the start, GPS can tell us where the timers tells us and tells us where we are and it uses the 00:00:46.146-->00:00:50.117 time to actually do the calculations to figure out where you are and it's called slashes 00:00:50.117-->00:00:55.122 in satellites orbiting about 20-->000 kilometers above us. Um, so we have to trust GPS, right? 00:00:57.891-->00:01:02.829 So, does anyone currently not trust GPS locations? Anyone not trust GPS time currently? Does 00:01:05.832-->00:01:10.837 it ever feel they may change their opinion by the end of this talk? [inaudible audience 00:01:13.073-->00:01:18.679 sounds] Um. So we have to trust GPS, right? It's too important to life. It's got to be robust, 00:01:18.679-->00:01:23.684 the military uses it. Important services like Uber and Tinder and stuff require it. [laughing] 00:01:27.587-->00:01:32.259 Uh, and also some other least important things like NTP time, planes and ships navigating 00:01:32.259-->00:01:38.832 keeping an eye on Armid fans and their taxi, we just changed our taxi seat law in New Zealand and 00:01:38.832-->00:01:42.502 they removed the knowledge requirement for the drivers because minister of transport 00:01:42.502-->00:01:48.241 came out and basically said "Uh, what was the last time you ever saw a taxi driver without a GPS 00:01:48.241-->00:01:53.380 in their car?" and from my experience, actually, since taxi drivers have got GPS they've 00:01:53.380-->00:01:56.717 actually become worse at actually getting to where the.. you need to go. [laughter] 00:01:56.717-->00:02:01.655 [clapping] Um, so move forward and look at some of the techs. There sort of been GPS jamming 00:02:04.691-->00:02:10.797 for a while now in this particular instance, you know, a truck driver, the manager at Pot 00:02:10.797-->00:02:15.902 GPS trackers and all their trucks. So he didn't like being tracked, he also liked him in 00:02:15.902-->00:02:21.975 the afternoon a nap. Um happened one of his particular nap spot was next to a Newark airport and 00:02:21.975-->00:02:27.581 when you mess with planes people do sort of notice and they will come out and actually track you 00:02:27.581-->00:02:34.254 down. And also on the GPS jamming front apparently some of the black cabs in um London they 00:02:34.254-->00:02:39.659 don't like Uber in lifts so they're running GPS jammers to mess with Uber and Lifts so they 00:02:39.659-->00:02:46.099 will come so people will use the black cabs rather than actually Uber and Lyft. But you know 00:02:46.099-->00:02:51.204 jammers are rather boring you can just buy them off the.. your favorite Chinese online store. 00:02:51.204-->00:02:56.810 They're not particularly graceful, they just sort of jam GPS you realize that Hey I don't 00:02:56.810-->00:03:01.748 have a GPS location, something is amiss. Um, moving forward to sort of a 2011. Um, supposedly 00:03:05.752-->00:03:10.757 the Iranian s..um stall crash the US drone by doing some GPS spoofing to try to get it to 00:03:13.293-->00:03:18.298 land or crash land in Iran. Though this was nation state level of cash and research. Um, 00:03:20.901-->00:03:27.374 moving forward to 2013. A professor with some students and two thousand dollars worth of 00:03:27.374-->00:03:33.613 server equipment managed to steer a sh.. a ship off course. Um, this wasn't GPS spoofing per 00:03:33.613-->00:03:40.087 say, it was the fact that they delayed the GPS time signals ever so slightly that the boat 00:03:40.087-->00:03:45.325 thought it was somewhere where it wasn't so it altered course trying to correct itself. In May 00:03:45.325-->00:03:50.330 last year, um, Unicorn team talked about, um, using wallace time signals to um, in uh 00:03:54.935-->00:03:59.539 attacking in Taipei with us. Um, they looked at GPS though so they look at some of the other 00:03:59.539-->00:04:05.979 terrestrial time sig., uh, time sources that are sending out over radio. Um, though from what 00:04:05.979-->00:04:10.984 I could see in they didn't actually release any code. Then I found this on GitHub um 00:04:13.887-->00:04:18.892 someone had written a software to find GPS signal simulator. So I took that, um edit in sort of 00:04:21.962-->00:04:27.901 in addition to that you need a computer to run it on, you need a software to find radio with 00:04:27.901-->00:04:33.039 transmit, I pe personally used a BliteRF because that's what we had sitting around the office at 00:04:33.039-->00:04:38.678 the time, Um, also a HackRF for the USOP will also work. So for less than five hundred dollars 00:04:38.678-->00:04:43.683 in hardware you can start your GPS spoofing and as far as software to find radio things go 00:04:46.186-->00:04:51.091 this is one this code you just downloaded it you, you ran it and it just worked straight out 00:04:51.091-->00:04:56.496 of the box. Sort of one of the best experiences I've had with software to find radio code, 00:04:56.496-->00:05:01.434 which is really nice. Um, yea. Um, so yea, I also had it running off of Rsupply 3. In 00:05:03.904-->00:05:08.909 that case with a battery that case that should have BliteRF about the biggest thing involved 00:05:11.178-->00:05:17.984 in the set up. Um, people the regulators generally don't like you trying to broadcast GPS 00:05:17.984-->00:05:24.958 signals so best a wrap it up in a terabay cage with some aluminum foil. Um, you know, 00:05:24.958-->00:05:29.963 yea. Yea, I'm not a lawyer. Um, yea, it's not open spectrum. You got to keep your GPS good list 00:05:33.200-->00:05:39.773 to yourself unfortunately. Um and when you are doing this your software to find radio 00:05:39.773-->00:05:43.343 transmitter it's going to be a lot closer than the satellites. Satellites are about 20-->000 00:05:43.343-->00:05:48.348 kilometers away, your, you going to be a lot less than that. Um, though from what I have seen of 00:05:50.383-->00:05:55.055 other people using this tool Uh the ra.. the range is still only whole wave length it doesn't go 00:05:55.055-->00:06:01.094 particularly well through walls and GPS signals on the whole are actually quite weak so on the 00:06:01.094-->00:06:06.600 left there we've got a normal radio signal we have in the red there we've got the noise floor 00:06:06.600-->00:06:11.538 such as the background static and then in the green we've got the signals so grossly 00:06:11.538-->00:06:17.244 simplifying radio stuff in this case we can basically figure out what the noise floor is delete 00:06:17.244-->00:06:21.781 it and you're left with just signal. Um, but on the right hand side there we've got the 00:06:21.781-->00:06:26.086 GPS and it's the other way around. In red we've got the noise floor and below the noise 00:06:26.086-->00:06:32.058 floor we've actually got the GPS signal. So that's why GPS processing is so much battery 00:06:32.058-->00:06:36.963 power because it's actually even process all the noise hoping to actually find the GPS signal. 00:06:36.963-->00:06:42.602 That's basically going to mask, and it goes instead of GPS signal or it's better GPS signal 00:06:42.602-->00:06:46.439 and when it doesn't take too long it goes oh yea they do have it and it actually start 00:06:46.439-->00:06:51.444 processing it. Um, so we got the simulator software, I got a blind RAF, what could we do? Um, 00:06:55.382-->00:07:01.288 you know, first simple thing, we can just change your location. Um, my phone was under my desk 00:07:01.288-->00:07:05.725 in the office in Wellington. Here I've got my phone think it's actually in Bitterly Park. 00:07:08.828-->00:07:13.633 Um, so how how does this the tool work? Um, it had two methods of working. The first 00:07:13.633-->00:07:18.705 one was a toast it process where it would generate the data and then it would broadcast it. That 00:07:18.705-->00:07:23.944 works at about a gigabyte of data per minute. Um and it can be a steady location or it can 00:07:23.944-->00:07:29.983 be a path so you can actually have the GPS location moving around . Um it also takes an 00:07:29.983-->00:07:33.753 element of where all the satellites are going to be at a given time so it's not 00:07:33.753-->00:07:38.091 generating just one GPS satellite, it's not generating an entire constellation, it will 00:07:38.091-->00:07:43.063 go at this place on earth it should be seeing this set of satellites at this particular 00:07:43.063-->00:07:48.068 time. Um, yet in the other method it has it does both the generate and the broadcast in 00:07:50.270-->00:07:55.675 one step in real time. Um, though this does have a down side it needs much more CPU to 00:07:55.675-->00:08:00.613 actually do this. Um, so more limitations of the two by default it will only generate 00:08:02.949-->00:08:07.954 five minutes of data at a time. Um, with that um, you can just go into the [inaudible] file, 00:08:09.989-->00:08:16.429 change it and you can do longer I suspect. The reason for this was didn't want microquest in 00:08:16.429-->00:08:20.600 compliance and this thing filled up my desk screen when I was trying generate two days worth 00:08:20.600-->00:08:24.971 of data. That means that hopefully the person who knows how to change the C file also 00:08:24.971-->00:08:31.578 realizes about s.. files sizes and stuff. The Raspberry Pi 3 can't do the generation in real 00:08:31.578-->00:08:36.583 time, oop, um, heh. It tae..it takes, um, if I was trying to generate five minutes of data on 00:08:40.787-->00:08:45.792 Raspberry Pi 3 it would take about fifteen minutes of actual CPU time to generate that five 00:08:48.061-->00:08:54.067 minutes of data. Um, and also generating a path is quite simple you get sort of point at 00:08:54.067-->00:08:59.072 one second intervals you give it a set of locations. Unfortunately, you can't just 00:08:59.072-->00:09:03.843 use latitude, longitude and altitude. Um, you have to use earth's internet effects or nima 00:09:03.843-->00:09:08.415 data rows thus but there are tools to do the conversion online for you. So it becomes 00:09:08.415-->00:09:13.119 quite simple and you can start drawing little paths in the middle of Wilmington Harbor 00:09:13.119-->00:09:18.124 using the tool. Uh, so what can we do with the locations spoofing? Um, you know, other 00:09:20.160-->00:09:24.697 than you want to take it back to your underground lair, broadcast the path that it should be 00:09:24.697-->00:09:28.334 traveling around all the banks, but you're actually driving it off to your underground lair. 00:09:28.334-->00:09:33.339 Um, Uber, um has a time and a distance component. If [laughing] [clapping] If you 00:09:44.451-->00:09:49.222 need a lift, your actual destination is going to have time component and given an 00:09:49.222-->00:09:55.261 experiment..experience with dri..uber drivers and stuff, then never going to, they always 00:09:55.261-->00:09:59.065 blame on saying oh the map's really bad or it's giving me bad routes data just to assume the 00:09:59.065-->00:10:04.304 apps having a bad day than even going to assume someone is actually attacking them to scare 00:10:04.304-->00:10:09.709 money out of them. Um, planes can also use GPS for landing, particularly when it's not a 00:10:09.709-->00:10:13.680 straight landing and you can't use the normal terrestrial base radio stuff. There's this 00:10:13.680-->00:10:18.551 Queenstown airport in New Zealand it's got this nice hair pin a little she came unto 00:10:18.551-->00:10:23.790 landing through some tight valleys and stuff, so you want the planes navigating fairly 00:10:23.790-->00:10:28.795 accurately through that or they'll make a big mess on the side of a hill. Um, also we can 00:10:31.097-->00:10:35.768 change time seeing the core one of the core things that GPS is actually spitting out throughout 00:10:35.768-->00:10:40.773 all the calculation for locations as its ists time so we have NTPD. Um, which is the 00:10:42.942-->00:10:47.947 common NTP damen on limits and unit servers. Um, if you just, if you have the GPS receiver 00:10:51.818-->00:10:56.856 just putting material into the computer, NTPD will knows how to do the rest and actually uses 00:10:56.856-->00:11:01.427 the time source so with no really additional confect required of an [inaudible] any 00:11:01.427-->00:11:07.767 used server and the confect file. Um, also looking at some of the commercial NTP servers 00:11:07.767-->00:11:12.772 available on the market that do have NTP in. Uh, sorry, GPS in. Um they will appear to run NTPD 00:11:15.041-->00:11:20.046 under the hood and because NTPD has its own custom license so they have admitted in the 00:11:22.115-->00:11:27.787 documentation they've mentioned they've got stuff licensed under the NTPD license. Um, there's a 00:11:27.787-->00:11:32.792 wave of NTP days running under the hood. Um, so a little bit of taking NTP, um. If you through, 00:11:36.963-->00:11:43.570 if you try to move time in big amounts, particularly over five minutes, NTPD will shut down 00:11:43.570-->00:11:49.142 though there's actually no log messages saying why it's shut shut down and if you, when you 00:11:49.142-->00:11:53.880 start it back when you're restarting NTPD it's just the time has been changed. Which is 00:11:53.880-->00:11:58.885 really common because the local motherboard clock and NTP, uh very rarely actually correspond 00:12:00.920-->00:12:07.126 with ea.. each other cause um motherboard clocks is notoriously inaccurate and 00:12:07.126-->00:12:12.131 all...always trust the GPS time or the netw..NTP network time over the motherboard, um, clock. 00:12:14.367-->00:12:19.372 Um, if you do tune the NTPD logging uh, to sort of debug level, but no one actually runs 00:12:22.108-->00:12:28.348 the in production like this, um, there is some logging which I could kind of interpret what was 00:12:28.348-->00:12:32.018 going on because I was actually attacking it at the time and knew what I was doing, but if 00:12:32.018-->00:12:37.023 someone saw this actually in real life they wouldn't think much of it. Um, anything to big 00:12:39.659-->00:12:44.464 crashes and um and restarts through through a watchdog or- or- the sys admin has to get up 00:12:44.464-->00:12:49.535 at two A.M. in the morning and at rate it just restarts normally and continues on the 00:12:49.535-->00:12:53.673 right they aren't actually going to look any deeper or actually check the time that's correct a 00:12:53.673-->00:13:00.313 lot of the time. They just want to go back to sleep. Um, but we want to start having move this 00:13:00.313-->00:13:06.386 time um with without actually crashing into BD because if we are actually attacking it and so 00:13:06.386-->00:13:11.858 we have to instead of doing the big steps we have to do lots of little steps back in time. Sort 00:13:11.858-->00:13:17.363 of wind the clock back. Um, so I wrote a talk called Tanjumps it's a python script wrapped 00:13:17.363-->00:13:23.236 around that sort of myth of toe of the GPS signal simulator. Um the code's up on GitHub 00:13:23.236-->00:13:28.241 currently and this is sort of designed mostly for error gap network. So a network where 00:13:31.577-->00:13:37.817 you've got the NTP time servers got that's getting the time from GPS as no other network 00:13:37.817-->00:13:41.921 connection out there to the rest of the world to get in a time source from anywhere else or 00:13:41.921-->00:13:47.293 people who have sort of configured badly with maybe only GPS and one other server and the 00:13:47.293-->00:13:52.298 internet case at will almost only trust GP..the GPS time more than the other one because uh 00:13:54.767-->00:14:01.374 all have a lot of stratum coming from the GPS satellite. So I sort of my little tist set up I 00:14:01.374-->00:14:07.313 had was a little hacker on his laptop broke out the other GPS signal and then down at the 00:14:07.313-->00:14:12.385 bottom there I've got a NTP receiver receiving the GPS signal. So I've got a little 00:14:12.385-->00:14:18.091 sort of video of all of this, um. So the local machine up on the top left, that's their 00:14:18.091-->00:14:23.096 attacker the tiger machine that was on the NTP server on the top right and the bottom there I'm 00:14:23.096-->00:14:28.534 actually going to have the script running. Um, when, yet, so the scripts are on their way. 00:14:28.534-->00:14:33.740 Um, so it takes a little while and there's the scripts running and it also moves time backwards 00:14:33.740-->00:14:40.313 let it sort of give it time for the GPS receiver to sync backup let it run forward a little bit 00:14:40.313-->00:14:46.519 and then it will move the time back again. You know wait for the GPS receiver to sync up 00:14:46.519-->00:14:50.823 again and then play for a little bit and then move the time backwards again. So that it 00:14:50.823-->00:14:57.764 stayed rather stable. You can move the time back a lot through this method and it's just 00:14:57.764-->00:15:02.702 running like this. Um, so moving on. So what can we sort of do with these so that if we can 00:15:05.772-->00:15:11.010 change time what sort of attacks can we do? Um, most of you have mostly run across time one time 00:15:11.010-->00:15:15.581 passwords. Like you'll see on Google Earth. Every thirty seconds you'll get a new token 00:15:15.581-->00:15:20.586 to use with your login. Um, so in this case if we can if the if we if we move time backwards, 00:15:25.091-->00:15:31.297 what can happen here? So I've got a little video here. Um, its supply..yep. Doot, doot, doot, 00:15:31.297-->00:15:37.870 ta doot. So just getting to know the the current date there. Um, it's essentially known and then 00:15:37.870-->00:15:42.842 here I've set up it's actually require the veri..the verification code in addition 00:15:42.842-->00:15:47.847 to, um the password. So, there we've logged in. So now we're sort of going to fast forward, 00:15:53.286-->00:15:58.124 awe just captur..cap...bleh. Copying the time just so we can reference back to it later and 00:15:58.124-->00:16:02.161 now the video is going to fast forward a little bit so we gots the time is moved forward a 00:16:02.161-->00:16:07.166 little bit. Um, so we'll just wait for that to happen. [Silence] Do, do, do, dooooooo. 00:16:11.871-->00:16:16.876 Going forward, going forward. [Silence] Da, da, dooo, come on. Pht. Ta, ha, ha. There so I'm 00:16:30.656-->00:16:37.563 checking the data again now and we see that the time has moved forward, so we'll log in again 00:16:37.563-->00:16:44.237 and at the first, at the first time I log in I'm going to use the code we used before and 00:16:44.237-->00:16:49.242 we'll see that we get prompted again for the password because it's the incorrect one time 00:16:51.410-->00:16:56.415 password for this particular time. Yep, so it's prompting for the password, but if I type in 00:16:58.484-->00:17:04.724 the password and then use the current verification code[silence] I can log in. So, 00:17:04.724-->00:17:09.729 I'll logout, out again and I'll fast forward it again but this time during the, while it's 00:17:12.365-->00:17:17.904 fastforwarding I'm actually going to be moving time backwards again. So, the video 00:17:17.904-->00:17:22.909 is fastforwarding, time's going to be start winding itself backwards. After a little bit. 00:17:30.049-->00:17:33.986 [heavy breath] Do,do,do,do,doot. So, it, there so we see time is move back a little bit and just 00:17:33.986-->00:17:38.991 waiting for it to now, rock, take forward to where we logged in last time or the very first 00:17:38.991-->00:17:43.996 time, sorry. Yep, so the time's in sync so we can, hit the section again. Type in the 00:17:47.900-->00:17:52.905 pa...using the password and use the same code as before and we've logged in. [applause] So 00:18:07.720-->00:18:12.725 this was this the default lid pan um, [mouth sounds] Google Earth sort of time based one 00:18:15.561-->00:18:21.968 time passwords um library, Um. Thing was when you are setting it up it didn't heather to fault 00:18:21.968-->00:18:28.240 for years. So this is the question we've had for years if you just hit enter it would just 00:18:28.240-->00:18:33.179 prompt you again with these or no. It doesn't actually say "yes you do want reuse protection on 00:18:33.179-->00:18:39.251 because it stops, you know they may be assuming that time only moves forward you won't get to 00:18:39.251-->00:18:44.624 reuse it if time moves backwards. Um so that's the case. I've also looked at some 00:18:44.624-->00:18:51.597 other implementations. I've got some add ons to web sites and things and then some of them do 00:18:51.597-->00:18:56.902 have it by default some def..have no default and then on the right, I've got common 00:18:56.902-->00:19:01.841 libraries available and in this case se..only one of them actually had the the reuse 00:19:04.477-->00:19:10.149 verification in it. The others didn't even have that function available they jus..just 00:19:10.149-->00:19:16.956 obviously assumed that time moved forward. Um, yea. So when you are looking at implementing 00:19:16.956-->00:19:22.128 time based one time passwords, um, make sure there is a setting for disabling reuse and make 00:19:22.128-->00:19:28.634 sure it's set not to allow reuse or you can look at other to factor off alternatives. Um, 00:19:28.634-->00:19:35.241 there's actually R2P which is takes the counter plus the C to give you the number. There's 00:19:35.241-->00:19:40.680 usually, which is currently what I prefer if that's available and also friends don't let friends 00:19:40.680-->00:19:45.684 use this unless it is 2FA. Um, so I was also looking at what some of the other things in 00:19:48.687-->00:19:53.692 limits that uses um time. Um, so so because because pseudo which allows you to escalade and run 00:19:55.828-->00:20:00.599 something as root and that will prompt you for a password and then if you try again in the 00:20:00.599-->00:20:05.204 next five or fifteen minutes it won't prompt you again for the password, so I thought, hey, can 00:20:05.204-->00:20:10.142 I pseudo let time run forward roll time backwards and then can I stroll right in? In this case 00:20:10.142-->00:20:17.049 pseudo didn't uh realize what had happened and stopped it and this is because instead of using 00:20:17.049-->00:20:21.754 wall clock time like the le pen was using, pseudos looked at the number of all these techs coming 00:20:21.754-->00:20:27.259 from the CPUs, so it's actually know how much techs have passed, therefore um I need to 00:20:27.259-->00:20:33.666 re..reauthenticate the user. Um, Uptime works in a similar way so I've considered using Uptime as 00:20:33.666-->00:20:39.572 an example here. So I've got a a date initially on the seventh of November. The service has been 00:20:39.572-->00:20:46.145 up for about four minutes. I roll the server forward in time awake and it realizes, hey, it's 00:20:46.145-->00:20:52.017 only now still been up for seven minutes so it will mean three minutes have passed between me 00:20:52.017-->00:20:57.490 doing those two snippets. Um, forensics could get rather interesting if you had a log 00:20:57.490-->00:21:02.428 consolidator that allowed you to sort all your logs by time, um, the logs might have the earliest 00:21:04.763-->00:21:09.201 log entries on the hacker logging out then the hacker doing a late hack and the most 00:21:09.201-->00:21:15.341 recent entries is the hacker logging in and um, I know a person may initially start from 00:21:15.341-->00:21:19.612 when they logged in instead of looking forward to see what happened they might literally 00:21:19.612-->00:21:24.617 actually look backwards to see what happened in the past before their initial log in. Um, also 00:21:27.219-->00:21:33.893 if there's not centralized logging you could just with a cron job move just a date moving 00:21:33.893-->00:21:39.732 backwards and forwards at random and this might actually cause the log rolling, log purging to 00:21:39.732-->00:21:44.637 happen on the server that, oh, a weeks passed I better go on purge and delete all the logs. 00:21:44.637-->00:21:49.642 Um, and a couple of weekends ago, someone saw on twitter, someone had mentioned that that 00:21:52.144-->00:21:57.149 sing uh stingray release one of the stingray device release notes that, um, that sometimes 00:21:59.218-->00:22:04.156 when an external GPS device gives erroneous GPS text the license for the stingray may 00:22:07.159-->00:22:12.164 fail, so, this, you know maybe if you n.. [clapping] So maybe if you're in a jurisdiction that 00:22:16.402-->00:22:21.407 allows GPS broadcasts and you want to disable uh, stingray device, maybe that's a method to 00:22:23.642-->00:22:28.647 try. Um, so what's of the NTP servers and actually how how do they work? Um, [inaudible] may 00:22:34.420-->00:22:39.425 often say a GPS aerial that often looks like that. Um, and so the these work in two ways. 00:22:42.795-->00:22:48.567 At the top you ought to have the GPS antenna and a sw.. radio down the cable down to your data 00:22:48.567-->00:22:54.540 down ,bleh. Sorry. Down to your data rec and into the computer and then actually inside the 00:22:54.540-->00:23:01.413 server you got you've got the GPS receiver and that's directly soldered onto the motherboard 00:23:01.413-->00:23:06.752 and the other option is you have the GPS antenna and that's also got the GPS receiver up on the 00:23:06.752-->00:23:13.626 roof and then it all sends serial down through the building down to the rec and into the GPS 00:23:13.626-->00:23:18.631 server and to use that you just tell NTPD that you got a new server 127 dot O dot 20 dot O 00:23:21.300-->00:23:26.305 and then they know NTPD goes, oh, that's a GPS source, I'll look at DFGPSO and DFPP it's 00:23:29.208-->00:23:34.213 zero and start doing the import for time. Um, so the serial data is the nima data rows. Um, the 00:23:38.117-->00:23:44.456 GPS funds start with dollar gp. Uh, those are the two sort of most common ones used sort of by 00:23:44.456-->00:23:50.195 NTPD for time and you'll see there I've got a time component and one of them also has a date 00:23:50.195-->00:23:55.334 component. And and and the other, there's an additional wire quite invol.. involved 00:23:55.334-->00:24:00.673 that's a pulse for second um signal and what that means for for the that point one of a 00:24:00.673-->00:24:05.744 second at the ver.. At the very start of a second you'll go high for point one of a second 00:24:05.744-->00:24:10.849 there'll be low for point nine of a second and the pulse for a second doesn't contain a time 00:24:10.849-->00:24:15.721 variant it only gives a very accurate indicator where the second starts. And the way the 00:24:15.721-->00:24:22.428 s..GPS receivers are built and designed, um, the pulse per second takes a much shorter path 00:24:22.428-->00:24:27.733 through the processing and has little processing on it so it's a much more accurate time sort 00:24:27.733-->00:24:33.105 of indicator and gives you sort of micro and nano seeking accuracy oppose to the nima data 00:24:33.105-->00:24:38.110 C which is maybe only a millisecond accuracy. Um, so in the setup I had here I initially 00:24:40.813-->00:24:46.952 just had NTPD running on Raspberry Pi the GPS receiver coming in through serial onto 00:24:46.952-->00:24:52.958 the GPR pens along with the pulse per second along with pulse per second. Um, so 00:24:52.958-->00:24:57.196 initially I start looking at can I just spoof per pulse per second it's nice and simple it 00:24:57.196-->00:25:01.767 just ties in highs and lows you don't have to think too much so I connected the pulse per second 00:25:01.767-->00:25:06.338 wire to another GPR pen on the Raspberry Pi and I just had a little scrap bit set the pen on 00:25:06.338-->00:25:11.343 the high and lows applicable. Um, what I found out ha..what's happening was, um, if you run 00:25:13.379-->00:25:19.017 the pen pulse per second sort of faster or slower than any of the nima data it would sort of keep 00:25:19.017-->00:25:25.224 correcting itself as it would get the actual second number from the nima data rows but just 00:25:25.224-->00:25:29.561 the start of that second might be a little messed up. So neither deviated more than a 00:25:29.561-->00:25:36.268 second and if you're in finance or telecoms or energy where fr..fractions of a seconds count 00:25:36.268-->00:25:41.273 it would be an important thing and other industries where seconds aren't that actual 00:25:41.273-->00:25:46.278 fractions of a second aren't that important it's probably much more least of an issue. Um, 00:25:46.278-->00:25:52.518 software....oh! Can I just remove the serial data and will it just rely solely on pulse per 00:25:52.518-->00:25:58.390 second? Pulling the wire, um, it didn't it just stopped and it even started to freak out in the 00:25:58.390-->00:26:03.896 pulse per second of that case and so I did have to actually start working on getting a full 00:26:03.896-->00:26:10.636 solution that did the nima data and the pulse per second so I've got another python script that 00:26:10.636-->00:26:15.641 will do that. Um, just like tardgps it will move time backwa.., um, slowly and in 00:26:18.077-->00:26:23.081 steps, so you can adjust the time. Um, I found this, um, simpler to use than tardgps 00:26:25.484-->00:26:30.055 because I wasn't having to deal with GPS signals. I was only worrying about serial data and 00:26:30.055-->00:26:35.227 it's a lot simpler to write serial that it is trying to integrate with other tools and 00:26:35.227-->00:26:40.232 involve radio and the timing involved and that. Um, so the script basically worked by 00:26:44.102-->00:26:49.575 writing some nima serial to standard out, have a pulse per second pen and going on high and 00:26:49.575-->00:26:55.781 low loop through that at whatever rate you wanted a second to be you socat to move 00:26:55.781-->00:27:01.487 the standard out to the relevant, uh, virtual..virtual console then sublink the virtual 00:27:01.487-->00:27:06.492 console to dev GPS zero NTPD top the time from there. Um, it's uh behaved just like tardgps 00:27:11.964-->00:27:17.769 simpler because I don't have to involve the radio, though does require physical access to the 00:27:17.769-->00:27:22.908 data sync to the roof to actually splice into the wires rather than attacking it 00:27:22.908-->00:27:27.913 remotely. So I went and got an NTP server, um, this is a cheap one um but the boss paid for. 00:27:30.782-->00:27:35.787 Um, on the website it says that this company delivers NTP solutions for things like 00:27:38.357-->00:27:44.496 airports and nuclear power plants and yea, so this should be good, right? Nuclear power 00:27:44.496-->00:27:49.501 plants. You got to keep those safe. Um, so with tardgps and Nima desync, um you know if I 00:27:53.505-->00:27:59.211 moved home forward in just one big jump it just continued on merrily. Um, if I moved time 00:27:59.211-->00:28:04.550 backwards in a big jump it crashed like we saw in NTPD before but tardgps and Nima 00:28:04.550-->00:28:09.421 desynced worked finer and I could work backwards on it and so it had no protections, um, in 00:28:09.421-->00:28:14.426 that regard. Um, yea, and then I also had a look at the web u i, found some bugs that's so simple 00:28:17.629-->00:28:22.634 and dumb I'm almost afraid to actually mention them here. But, um, found that, hey, there's, 00:28:28.106-->00:28:32.978 it's using gate for everything, so even when you log in with a password and then just puts the 00:28:32.978-->00:28:37.983 password up in the URL bar, um.. [laughter] Yea, and basically because it's not using cookies 00:28:40.752-->00:28:45.757 at all so I I could just, later navigate directly to the relevant pages. Um, yea and you 00:28:48.727-->00:28:52.764 notice when you went to change the pa..the first one was changed in the network settings 00:28:52.764-->00:28:57.102 when you go to change the password you actually at a different password form. Um,this 00:28:57.102-->00:29:02.040 case, yea, password form and when you reset the password, again, the new passwords just in 00:29:04.910-->00:29:10.215 the gate. I don't I don't find any posts in it. Um, having this roll is really handy when you do 00:29:10.215-->00:29:14.753 go to change the password and you come to the thing a month or two later you don't forgot the 00:29:14.753-->00:29:21.460 password you just pull out the URL and reset the password with no, wi..without actually needing 00:29:21.460-->00:29:26.465 to know the password, so. Yea, off by pass by not having any off I suppose. [heavy breath] 00:29:33.472-->00:29:38.477 Um, so sort of, we've been looking at someone attacking, um how about we can look at maybe 00:29:38.477-->00:29:43.482 some detecting of uh GPS spoofing. Um, have a little talk of GPS Snitch and how that works 00:29:50.155-->00:29:55.160 is it looks at the time offsets from.. And in this case if you do have external time sources 00:29:57.195-->00:30:02.434 other than just GPS you could look at whether the time you are being getting from GPS defers 00:30:02.434-->00:30:06.171 from the time you are getting from the NTP network. You can also look at say the signal 00:30:06.171-->00:30:10.442 strengths because when a satellite's directly over here it's going to be stronger than 00:30:10.442-->00:30:15.747 when it's down at the horizon because the distance is greater and also the range of the signal 00:30:15.747-->00:30:18.817 strengths because you know different strengths of the satellites you should see a 00:30:18.817-->00:30:23.822 different range and the signal and the signal strengths. Um, and also if it's an NTP server 00:30:26.758-->00:30:32.264 the location should be stationary. M...most people don't have data centers that 00:30:32.264-->00:30:37.269 move much. And also one that I haven't actually looked at is um maybe looking actually at the 00:30:41.073-->00:30:45.844 direction of the signal because if you're doing GPS spoofing, chances are the signals are all 00:30:45.844-->00:30:51.316 going to be one direction when when you are using GPS in the real world the satellites are 00:30:51.316-->00:30:56.321 all around you. Um, so I got uh, uh a little video of it all running. Um, so what you see, 00:30:59.424-->00:31:03.161 let's take you through and initially it's something that you're going to do mornings. Um, 00:31:03.161-->00:31:07.699 this is because you want to remove any false positives because sometimes if a cloud 00:31:07.699-->00:31:13.205 goes past or other little things like that the GPS signal will change slightly and we don't 00:31:13.205-->00:31:19.111 want to alert every time a cloud goes pass pass so we'll wait for a particular number of failures 00:31:19.111-->00:31:23.381 and also more than just one type of failure so by the end of it that it's actually saying 00:31:23.381-->00:31:28.954 critical error there we go it's actually saying it's critical and it's detecting the error 00:31:28.954-->00:31:34.426 now. Although it's spoofing, now. Um, yea, so that's particularly helpful maybe if 00:31:34.426-->00:31:40.165 you're running GPS server if you just stop looking at the GPS location but you could also use 00:31:40.165-->00:31:45.170 another GPS receiver. Um, so, how could we detect the Nima Serial spoofing? So, this is uh 00:31:51.843-->00:31:56.848 and you two are just for defcon, hopefully it's on GitHub. Um, if my colleagues have woken up at 00:31:59.117-->00:32:05.023 nine A.M. on a Saturday morning they should have made the suppository public [laughs] so 00:32:05.023-->00:32:10.028 if not it should be public soon, but it is there waiting to go. Um, what this tool does it 00:32:12.030-->00:32:16.701 records as all the Nima sentences is coming in it looks at the time and it times stamps 00:32:16.701-->00:32:23.675 them all and it looks at the ratios between the different Nima sentence types and also how 00:32:23.675-->00:32:29.514 many sentences per seconds it gets. So, just a little tie in then, most of the sentences are 00:32:29.514-->00:32:34.519 coming in once per second. This one there, that sort comes in every point six of a second so 00:32:36.955-->00:32:42.694 if you start to see this the uh the the sentence rate deviating from one and sort of the ratio 00:32:42.694-->00:32:47.699 changing uh you know that something's amiss in this case. Um, and you know, when when it 00:32:50.969-->00:32:55.974 sees those different it will alert for you. Um so you got this tools to protect and detect 00:32:59.311-->00:33:04.249 this GPS spoofing. Some other methods are is making sure you have more than three upstream 00:33:06.318-->00:33:11.323 DTP servers a number of servers I have reviewed and my day job that only have one NTP server 00:33:13.792-->00:33:20.065 um, even better when they have one NTP server configured and that server is no longer 00:33:20.065-->00:33:25.070 actually working. Um, yea if you got three uh you can detect the bad tecker and you know which 00:33:27.339-->00:33:31.476 one is actually taking bad, because you still have two corresponding and also make sure 00:33:31.476-->00:33:38.116 you've got moldable types of up strength. Um, don't rely just on GPS. These all sort of atomic 00:33:38.116-->00:33:43.121 clocks, the NTP poll [crinkling sound] and also don't pick one upstream provider for you time 00:33:46.992-->00:33:53.231 outside your unit work because you might have the rogue edmond problem at the upstream who they 00:33:53.231-->00:34:00.105 can change all the times on the air internet facing NT P service and then all your time goes ary. 00:34:00.105-->00:34:06.678 Um, yea prot..they protect that's a particularly common case if you use a managed if 00:34:06.678-->00:34:12.083 you're if you're a customer of a managed service provider and they just provide their own time 00:34:12.083-->00:34:17.289 servers into your own network you may be like to say hey could we see sometime from outside 00:34:17.289-->00:34:22.294 we're not reliant solely on you for time. Um, if you're on an air gap network um and you saw a 00:34:26.498-->00:34:32.070 line on GPS well you're still receiving some signals over the air so are you still really in 00:34:32.070-->00:34:38.143 an air gap network? Um, have been that case splash out get some atomic clocks or some 00:34:38.143-->00:34:43.148 caesium or rubidium and yea do it like the the national labs that run the some of the central 00:34:46.084-->00:34:51.089 time servers around. Um, yea if you're actually delving into some NTPD or something uh, maybe 00:34:53.992-->00:35:00.665 look at implementing something like GPS Snitch and Nima dsync. Um make the logging a little bit 00:35:00.665-->00:35:05.670 more explicit when it is shutting down because the time's so different. Um, yea, so that's 00:35:07.872-->00:35:12.877 my talk. Um, thank you very much. Um, thank you for coming. [applause]