00:00:00.133-->00:00:06.340 >>So who here is for the RFID talk? Eh Every- everyone. Uh so it's gonna be uh, uh it's 00:00:06.340-->00:00:11.278 gonna be a quick 20-minute talk, uh it's something I've been working on for a while, uh it's 00:00:11.278-->00:00:16.383 i- i- it's not 100 percent complete yet so there, you'll. you'll see a lot of like uh, uh 00:00:16.383-->00:00:19.419 kind of missing things or something where I'll say hey this is not perfect but I'm 00:00:19.419-->00:00:25.425 working on it, uh but yeah so real time RFID cloning in the field. This is not something new 00:00:25.425-->00:00:31.531 but it's just, I it's, it's a different way of doing things uh and you'll see me fiddling with 00:00:31.531-->00:00:34.735 this thing the whole time because I'm trying to get it to work before the demo slide comes 00:00:34.735-->00:00:40.741 on so one second, let me turn this one on. They sound really cool when they start up. 00:00:40.741-->00:00:45.746 [inaudible] [laughter] I always get weird looks from people like I'm, I'm about to die. 00:00:48.415-->00:00:53.287 [laughter] Alright, so that may not be me stealing someone's badge. Uh, so who am I? I'm not 00:00:53.287-->00:00:57.124 going to spend too much time. I'm Dennis a lot of you know me, uh who here's been to one of my 00:00:57.124-->00:01:03.530 other talks before? I spoke twice, everyone? Uh, I'm an adversarial engineer at LARES 00:01:03.530-->00:01:08.535 Consulting. Uh, uh and for I- I am a Houstonian a current Houstonian uh and I found, woo, 00:01:10.704-->00:01:15.042 I founded Houston Lock Sport a lock picking club. We just hand out, drink beers and pick locks 00:01:15.042-->00:01:19.813 uh and ha ha, Houston Area Hackers Anonymous or association or whatever you want to call it 00:01:19.813-->00:01:23.717 uh, for those who are, wh- who, if you're in Houston, you find yourself in Houston around the 00:01:23.717-->00:01:28.922 same time we do any of those meet ups totally stop by, it's awesome. Uh, I spoke previously 00:01:28.922-->00:01:33.927 at Def Con 23 and Def Con 24. Uh okay. So, yeah demos totally not gonna work but. RFID, radio 00:01:37.731-->00:01:43.737 frequency identification so, wh- you all know what RFID is right? Why her has an RFID card on 00:01:43.737-->00:01:49.343 them? Don't lie. All of you guys. I mean who here is staying at this hotel? Alright, RFID 00:01:49.343-->00:01:55.682 cards. So just a little bit background what radio frequency identification is. Uh, it's 00:01:55.682-->00:01:59.586 electronic access control for many companies, and organizations, hotels and what 00:01:59.586-->00:02:03.357 have you. Even some homes, personal homes have it if you have like uh one of those 00:02:03.357-->00:02:07.828 Samsung smart locks that supports RFID technology. It's a contact list form of 00:02:07.828-->00:02:14.067 authentication. So, you have a wireless badge, uh kind of like what I have in my hand here. Uh 00:02:14.067-->00:02:19.272 it's either a tag or a badge th- they come in many different form factors uh and you present it to 00:02:19.272-->00:02:24.277 a reader on the wall or on a door and if it's the correct, correct card it lets you in. Uh 00:02:27.114-->00:02:31.051 as far as hard technology wise there's 2 different types of technology that's going to 00:02:31.051-->00:02:34.788 require 2 different types of readers. You have the low frequency technology that runs 00:02:34.788-->00:02:41.428 on 125 kilohertz uh and that's typically your HID Prox, Indala, flex, ioProx and some other uh, 00:02:41.428-->00:02:46.166 uh manufactured inventors that make that type of technology. It's older technology, it's 00:02:46.166-->00:02:50.737 commonly referred to as less secure because it doesn't support uh, cool things like 00:02:50.737-->00:02:55.942 cryptography and stuff. Uh but then you have high frequency which operates on a 13.56 00:02:55.942-->00:03:01.681 megahertz and that's where y- HID iCLASS comes in, MIFARE, LEGIC and others that you've 00:03:01.681-->00:03:06.620 heard of. Uh, this is the technology that actually supports cryptography and uh, 00:03:06.620-->00:03:10.957 mathematics and a lot of other things between the card and reader to make it harder to 00:03:10.957-->00:03:16.897 clone a card and attack the reader. Um, you b-, you'll hear commonly referred to as 00:03:16.897-->00:03:22.836 credentials, uh card stickers, tags, you guys have all different sorts of, of media 00:03:22.836-->00:03:27.707 that have this technology imbedded in them. And, and a lot of devices may have an RFID tag 00:03:27.707-->00:03:32.212 in it and you may not even know it. Uh if you've ever gotten like uh, a garage remote or 00:03:32.212-->00:03:38.318 smart key from an apartment, there might be an a- uh, uh an RFID tag in there for the key 00:03:38.318-->00:03:43.023 management computer or something. Um, so here's just some examples, you see e- e- 00:03:43.023-->00:03:49.663 employee badges uh, ISIS back when it was called ISIS now what is it called?? The uh, uh 00:03:49.663-->00:03:55.469 Figgis, the Cyril Figgis detective thing, something like that, whatever. Uh but you have 00:03:55.469-->00:03:59.439 these badges that people will wear on their person at all times even when they're not at 00:03:59.439-->00:04:04.277 work. You have people wearing it on their uh uh lanyard on over the neck and it's swinging 00:04:04.277-->00:04:09.116 around or they have it on their either left side or right side just pinned to their belt. And, 00:04:09.116-->00:04:14.821 and what that allows us to do as, as pen testers, I'm gonna assume everyone here is legit, 00:04:14.821-->00:04:19.626 they're pen testers, they're not like Black Hat hackers. But as pen testers if we're targeting a 00:04:19.626-->00:04:25.065 specific company we want to get in physically then we can see how they're' wearing their 00:04:25.065-->00:04:30.103 badges and target that. So, if we have a device like a, one of these long-range readers I'm 00:04:30.103-->00:04:35.742 going to talk about and we see they're wearing their badge on their left side hip then we can 00:04:35.742-->00:04:40.413 put our RFID reader in a backpack and walk by someone passing by their left side and 00:04:40.413-->00:04:46.153 try to get a good badge read from that. So, here's kind of ooo, there ya go, here's kind of 00:04:46.153-->00:04:51.625 th- sneaky little, random person I don't know, uh who's sitting, who knows this guy has a badge 00:04:51.625-->00:04:56.696 so I sit next to it and in my backpack is one of the RFID readers and I'm just close 00:04:56.696-->00:05:01.968 enough to get a quick read and I'm acting nonchalant, I'm trying not to be suspicious 00:05:01.968-->00:05:06.873 other than the fact that I look like me. Uh and just walk away. And now I have that person's 00:05:06.873-->00:05:13.280 badge. So, what did I sue?? I used one of these long-range readers. So, there's a few 00:05:13.280-->00:05:17.450 different types of long range readers that you've, that you guys have probably seen. Uh like 00:05:17.450-->00:05:22.522 I said this is nothing new. Bishop Fox the, c- came like did, did a talk like this what 00:05:22.522-->00:05:26.726 2, 3 years ago? Where they talked about weaponized one of these long-range readers. So, 00:05:26.726-->00:05:31.731 you have the MaxiProx 5375 and that's the low frequency long range reader that HID uh 00:05:35.168-->00:05:39.906 manufactured and sold at some point. Uh and it can read HID Prox card and it can actually 00:05:39.906-->00:05:46.112 read it from a range of 18 to 24 inches. That's, that's somewhere between like, 2 to 3 feet. Uh 00:05:46.112-->00:05:49.916 it's actually pretty good. Uh it's a good read range. So, you don't actually have to like get 00:05:49.916-->00:05:56.356 up to someone and touch their butt to get a card read. [laughter] Damn, who said that? 00:05:56.356-->00:06:01.294 Uh y- but you'd you just have to be close enough, like that bench. I was a few feet away 00:06:01.294-->00:06:06.299 from that person at the bench uh or maybe in an elevator. So, here's, here's, here's what it 00:06:08.401-->00:06:13.406 looks like. Like, except I took it apart. Um, it's got a big antenna coil that's energized 00:06:17.110-->00:06:22.115 and will constantly send out up power, eh- like, just w- I- I'm not a physics major but radio 00:06:24.851-->00:06:31.091 frequencies. I'm not even going to try and fake it. Th a- a- and a card is present within the 00:06:31.091-->00:06:34.728 field close enough it'll power the card and that card will respond back with i- it's 00:06:34.728-->00:06:39.566 information and we get a read. Uh same thing with the R90 those are for the high frequency 00:06:39.566-->00:06:45.672 cards, I class cards. Uh, an- and those uh th- because of the, the, the, the technology and the 00:06:45.672-->00:06:52.078 physics and the science uh it doesn't read as long of a r- of a range as the low frequency so 00:06:52.078-->00:06:57.050 it's kind of 12 to 16 inches but it's still good enough for what we want to do. And that's this 00:06:57.050-->00:07:01.988 one here. That's the cover and that's what it looks like. Um, this thing. And these are 00:07:06.493-->00:07:10.797 devices, these aren't like hacker devices these are devices, uh oh by the way 00:07:10.797-->00:07:13.967 they're small enough to fit in a backpack and you can find them on eBay, be it they're probably 00:07:13.967-->00:07:19.205 expensive but you can find them on eBay. Uh these devices aren't hacker devices they are devices 00:07:19.205-->00:07:26.179 that manufacture or like building owners uh, e- anyone who has a facility can buy or 00:07:26.179-->00:07:31.785 vendor can buy to allow legitimate users to scan their badge from a distance for 00:07:31.785-->00:07:36.389 example if they're in a car you don't' want the user to have to get out and go to the reader and 00:07:36.389-->00:07:40.093 scan their badge but if they can do it from their car, the long range readers going to provide 00:07:40.093-->00:07:44.964 enough of a read range to do that. Um, and so you see them all over the place if you pay 00:07:44.964-->00:07:50.470 attention. Go to like garages or some apartments that have those. Or, or or like parking lots for 00:07:50.470-->00:07:54.174 companies, they'll have those long-range readers. No don't go stealing those because they're 00:07:54.174-->00:08:00.880 connected somewhere so you'll create a lot of damage. Uh but often like maybe a building gets 00:08:00.880-->00:08:05.452 decommissioned or demolished and they take these and they sell them or they donate them to some 00:08:05.452-->00:08:10.457 uh, warehouse, electronics part warehouse so you can go look for them. So, what uh one of these 00:08:12.592-->00:08:17.097 look like? So, this is what one kind of looks like normally. Uh you see it's got that big 00:08:17.097-->00:08:21.434 antenna coil and all that circuitry hidden behind that white piece of paper that's the 00:08:21.434-->00:08:26.773 normal circuitry that it comes with uh to kind of paper that coil and do all of its magic 00:08:26.773-->00:08:32.579 mumbo jumbo to make RFID reading work and then there's just, often there's 4 wires, sometimes 00:08:32.579-->00:08:36.750 there's more but the minimum is 4. You've got 2 wires for power and ground and you've got 2 00:08:36.750-->00:08:41.554 wires for the Wiegand data 1 and the Wiegand data zero. Uh and those will often feed all the 00:08:41.554-->00:08:45.859 way back to some wall through, through some wall to some controller that interprets that 00:08:45.859-->00:08:51.664 information. So, what we can do is if we were to grab one of these, we can modify it so you 00:08:51.664-->00:08:57.036 can see here on this picture I put extra circuitry in here. Uh the first one on the bottom 00:08:57.036-->00:09:01.908 being a battery source. Uh, in this case I'm using uh 18 650 batteries. I'll kind of go into 00:09:01.908-->00:09:06.713 detail a little later. Uh but that battery source is going to allow me to power this reader uh 00:09:06.713-->00:09:12.218 on its' own and not be connected to an external source. Uh and then there's a series of DC 00:09:12.218-->00:09:17.090 boost converters and 09:13 converters. Sounds advanced but it really isn't. Uh, but just to 00:09:17.090-->00:09:21.728 kind of do power management like uh boost the, the voltage up to 12 volts to power the reader 00:09:21.728-->00:09:25.532 then back down to 5 volts to power Raspberry Pi. And then we have the Raspberry Pi which is 00:09:25.532-->00:09:31.371 the brains of this operation here. Um, wh- what the Raspberry Pi does is, is it allows for 00:09:31.371-->00:09:36.543 wireless connectivity so I, I can spin up a Wi-Fi access point. By the way that's the new 00:09:36.543-->00:09:41.681 Raspberry Pi Zero W it's awesome. It's 10 bucks and it has wireless built in. Um, and I 00:09:41.681-->00:09:45.885 can I can host servers. It's a Linux operating system so I can host web pages and servers and 00:09:45.885-->00:09:50.924 stuff. Uh and, what, what this Raspberry Pi will do is, it'll it's connected to the Wiegand 00:09:50.924-->00:09:55.528 data wires of this reader and it'll interpret and automatically decode with python 00:09:55.528-->00:10:00.934 code that is- has been released to, like 10 minutes ago, um, uh you- I'll, I'll talk about it. 00:10:00.934-->00:10:07.407 Uh, it's terrible code, don't pl- [applause] While you're clapping I'm gonna see if my 00:10:07.407-->00:10:13.146 demo's gonna work. Uh probably not. Turn off your Wi-Fi devices please. And whoever's trying to 00:10:13.146-->00:10:17.517 crack that network, stop. Um [laughter] so it's gonna automatically decode, uh 00:10:17.517-->00:10:24.123 interrupt and decode the Wiegand uh the, the, eh data and it's going to uh get present, ooo it 00:10:24.123-->00:10:28.495 worked, present all the infor- information for, well hol- don't clap yet because I haven't 00:10:28.495-->00:10:33.166 started the demo yet. So, I'm going to speed through it to get to the demo. Um, so it's, so the 00:10:33.166-->00:10:36.936 Raspberry Pi is the brains of the operation it does everything. So, m- let's, let's 00:10:36.936-->00:10:41.941 see if this is gonna work for me. So, I am connected to something. Oh, yes. Boop. Let's 00:10:46.513-->00:10:51.518 see, let's see. Open. Okay, so what, what I have here now is I had to use my backup reader uh 00:10:54.687-->00:10:59.292 but this is the high frequency reader and what it's, wh- wh- it, it's currently powered on 00:10:59.292-->00:11:03.296 powered by these batteries and there's a Raspberry Pi, th- i- it's connected to. The Raspberry 00:11:03.296-->00:11:08.134 Pi has Wi-fi enabled. So, it has an access point and I'm connected to that access point. 00:11:08.134-->00:11:13.506 Um, I'm just going to go ahead and get a read now, just in case. That work? Ah! E- 00:11:13.506-->00:11:18.511 something broke. Uh, so what happen- what's happening is every time it gets a read it's 00:11:20.680-->00:11:24.651 gonna automa- eh there's a webpage that you connect to, so you connect to this over Wi-Fi 00:11:24.651-->00:11:29.656 via your phone or your uh, uh, uh laptop and you go to this webpage and it's just 00:11:32.225-->00:11:37.797 websockets, what it has is it has a table with all the Wiegand information in it and uh that's 00:11:37.797-->00:11:42.702 gonna be your Wiegand binary, your Wiegand hex data and your card number facility code. Right 00:11:42.702-->00:11:47.707 now, this is a unknown card so let me get a quick legitimate card and see what happens. And 00:11:53.246-->00:11:56.549 what's cool about this is for those who remember or who remember even made the Bishop 00:11:56.549-->00:12:01.654 Fox one u the Bishop Fox one is great and i- it gave me the kind of incentive to, to make it 00:12:01.654-->00:12:06.292 better because with, with the Bishop Fox one when you get a card read you have to go back to 00:12:06.292-->00:12:11.197 your base wherever, take the take the SD card out, decode the Wiegand binary data as you see 00:12:11.197-->00:12:16.202 there and uh, uh just, ya know figure out how to decode that an uh and go from there. Uh but 00:12:19.038-->00:12:24.978 what mine does is if you see in the, boom, reads here, I'm actually not going to read this 00:12:24.978-->00:12:30.550 because it's probably not a number I should be displaying uh but [laughter] if you see this 00:12:30.550-->00:12:33.886 over here you see this is the Wiegand data string, this is the, the Wiegand binary you'll 00:12:33.886-->00:12:37.757 typically get with the Bishop Fox uh from the SD card. Uh what it'll do is it'll give you the 00:12:37.757-->00:12:40.660 hex data and this is cool because you don't have to do anything. You don't' have to 00:12:40.660-->00:12:45.865 automatically decode that, uh by hand. It'll actually give you this and this is what you need 00:12:45.865-->00:12:49.736 for the Proxmark. All you do is you pass this code to the Proxmark and boom, you've cloned 00:12:49.736-->00:12:55.174 a card. Uh and then it'll even, uh decode this num- these numbers for you 18 2 2 1 that's 00:12:55.174-->00:12:59.379 the facility vote, that's the card number. Uh and incase it's a specific format it's a card, 00:12:59.379-->00:13:03.816 eh this is the card number without the facility code. So, this will automatically decode 00:13:03.816-->00:13:07.253 based on the specific format. For those who are familiar with HID there's a specific format 00:13:07.253-->00:13:12.525 like 26 bit, 35 bit, 37 bit. This'll do all that magic for you all you gotta do is get a 00:13:12.525-->00:13:19.165 card read and then copy and paste this into uh, Proxmark. Super easy. Uh what I also have 00:13:19.165-->00:13:24.170 if this didn't die on me, aha. Uh, boom. Let's see. There we go. Oops. Oh. Aw. That's not my 00:13:35.782-->00:13:40.787 dog, that's [laughter] that's Doug's dog. He's Doug, from Austin. Her name is River, she's 00:13:43.656-->00:13:50.163 cute. Um, so let's say I have this thing in my backpack there's a bag here, and I- I'm 00:13:50.163-->00:13:54.434 in the elevator and I wanna get someone's read. I don't but I don't know if I'm positioned 00:13:54.434-->00:13:59.305 right. So, what you do is, this is an android app, it's on my phone, uh and what I'll do is, I 00:13:59.305-->00:14:04.944 will get close enough to the person to get a read. You can still see it. And let's, where's 00:14:04.944-->00:14:09.949 my card? Is this the good card or the bad card? So, you get a read and what happens is it 00:14:15.021-->00:14:20.426 automatically pops up on that screen and as you heard you get a notification. So even when 00:14:20.426-->00:14:27.366 you're not focused on it, I get a notification. Of course, don't let it sound, let it vibrate. Uh 00:14:27.366-->00:14:32.371 but, but now, but now you have, you have in your pocket, it's vibrating and yes, I got a good 00:14:34.474-->00:14:38.111 read. And by the way, I've got a Pebble watch and I got it on my Pebble watch too so I can see 00:14:38.111-->00:14:43.616 facility code and card number on there. So, I know exactly who I just got uh, and, and that's, 00:14:43.616-->00:14:47.687 that's pretty much th- there's an android app, the android app we're still kind of working on. 00:14:47.687-->00:14:51.858 I haven't had time to finish it but that'll be released really soon once I get that finished. 00:14:51.858-->00:14:56.129 Now that's pretty much the meat of it. Now there is another cool thing unfortunately, let me try 00:14:56.129-->00:15:01.067 and get it. Um, turn that off. Turn this on. One cool thing I really want to show you guys but 00:15:03.703-->00:15:07.740 I don't think I'll be able to because WI-FI is not working is with the low frequency reader 00:15:07.740-->00:15:12.779 and I'm slowly working on the high frequency reader, I have this. This is currently very 00:15:12.779-->00:15:18.351 big, there's a Raspberry Pi in there, uh, uh, uh p- Proxmark in there and a battery. What this 00:15:18.351-->00:15:23.089 will do is, it's the satellite system. It's wh- when you turn this on which I'm gonna turn it 00:15:23.089-->00:15:28.528 on right now, it's a, it's a battery-powered. Ooo, I have 5 minutes, thank you. It's a 00:15:28.528-->00:15:33.566 battery powered Raspberry Pi, this wirelessly connects to this access point from that reader. 00:15:33.566-->00:15:38.871 So, let's say Tim and I are in an assessment and Tim has the RFID reader and I have this 00:15:38.871-->00:15:43.776 satellite kind of at least, what 30 feet a- away from him. When he gets a read it's going to 00:15:43.776-->00:15:48.748 automatically send that information to this satellite system, satellite Pi and it's 00:15:48.748-->00:15:53.653 going to automatically write a card. So, all you do is just take it out and you have a copy. 00:15:53.653-->00:15:58.324 So I'm gonna, I'm gonna, I'm gonna try for like 1 second to see if this is gonna work. Let's 00:15:58.324-->00:16:03.262 find out. Did it get a read? Yeah, there's too much wireless here so unfortunately I can't 00:16:12.138-->00:16:17.376 demo it, but what I can do is I will m- if someo- if someone wants to offer a village I can 00:16:17.376-->00:16:21.080 hang out with tomorrow I can have all this stuff up and you guys can all play with it. Uh 00:16:21.080-->00:16:24.851 but, hit me up on Twitter tomorrow, I'll have all the stuff and I'll bring it 00:16:24.851-->00:16:29.856 somewhere. Probably to Lock Pick Village and I'll just let you guys see how all this works. But 00:16:29.856-->00:16:33.392 yeah. What this will automatically do is it will automatically clone that card 00:16:33.392-->00:16:38.397 and, so in seconds you s-, you steal someone's badge and you have a complete copy and you 00:16:44.003-->00:16:49.008 just walk into the building. That's pretty much it for that. [applause] So, I'm gonna, I'm 00:16:53.412-->00:16:57.617 gonna rush through making your own. I don't have a lot of detail here is because the 00:16:57.617-->00:17:02.188 reason of that I'm posting most of the detail on GitHub. I written quite a bit of detail on 00:17:02.188-->00:17:07.360 there. Once Tim, Tim right there Tim McGuffin, once he helps me figure out how to draw schematic 00:17:07.360-->00:17:11.230 diagram I'll draw a schematic diagram on how you can make one of these your own. But it's 00:17:11.230-->00:17:15.768 fairly simple. So, making your own, all you need it, you need of course you need one of these 00:17:15.768-->00:17:19.305 readers. Buy it on eBay or whatever. If you pay me enough money I can give you that one. 00:17:19.305-->00:17:24.877 Uh but it's, a lot of money. You need a battery source, battery can be anything, uh it has to 00:17:24.877-->00:17:28.848 support 3 amps so if you just use like a few double A's probably not going to work but a 00:17:28.848-->00:17:32.685 bunch of double A's will work, just like Bishop Foxes. But I like to use the 18 650 00:17:32.685-->00:17:35.888 batteries. My batteries support 10 amps each. They're awesome and they have a protection 00:17:35.888-->00:17:40.526 circuit so when you screw something up and I've screwed something up, uh the protection 00:17:40.526-->00:17:44.497 circuit will hopefully prevent your reader from dying. And that's another story for later. 00:17:44.497-->00:17:49.502 Uh, then all you need i- I got a read. Who, who read my card? Um, then you need a DC boost 00:17:52.805-->00:17:55.808 converter, so if you have a battery service like, these 2 batteries here only support 7 00:17:55.808-->00:18:00.046 volts. The boost converter will boost it up to 12 volts. So it can actually power the reader. 00:18:00.046-->00:18:03.249 But then you need a buck converter so you don't burn your Raspberry Pi. That's gonna, 00:18:03.249-->00:18:07.620 that's gonna bring the 12 volts down to 5 volts to power the Pi. And of course you get the Pi 00:18:07.620-->00:18:13.626 Zero with all the magic and of course wire. So, to, with the Pi Zero, just install Raspbian 00:18:13.626-->00:18:17.797 Jessie Lite. I see everyone taking pictures so I'm going to upload this the GitHub after 00:18:17.797-->00:18:22.435 this. Uh, but there's a, there's a GitHub, yeah take a picture of that fine. Uh there's the GitHub 00:18:22.435-->00:18:26.138 link. Uh, download Raspbian Jessi- Jessie Lite and install it on an SD card, put it on the 00:18:26.138-->00:18:31.677 Raspberry Pi and there's Python code and uh, and a setup script. All you do is you run the setup 00:18:31.677-->00:18:35.581 script after you install Raspbian Jessie Lite and that should install everything for 00:18:35.581-->00:18:40.987 you. It should install and setup a WIFI access point and install the python code necessary to a, 00:18:40.987-->00:18:46.525 to get all this to work. And then on the Github I'll f- I'll t- I'll show you how to wire the 00:18:46.525-->00:18:53.032 geo pins to get that to go. It's 5 simple pins, power, ground, d- data 1, data zero, 4 pins not 5. 00:18:53.032-->00:18:57.737 Um, and then for the automatic cloning, none of that's gonna be on GitHub yet, because I'm still 00:18:57.737-->00:19:02.642 working on it. But it's simple. It's just a, a Proxmark, any version with the Raspberry Pi 00:19:02.642-->00:19:07.646 and a battery. That's all it is. So, if you go to my GitHub which I've just made this public. How 00:19:09.815-->00:19:14.820 do I switch tabs? I can't see my mouse. There it is. Here you'll see there is a set of scripts 00:19:17.890-->00:19:21.694 down here so once you get Raspbian Jessie Lite on a Raspberry Pi just run that set 00:19:21.694-->00:19:25.364 of scripts. It should do everything automatically. Uh I'l-, I'm gonna be working on 00:19:25.364-->00:19:30.569 getting a, eh, a Raspberry Pi, a Raspbian image that has all this stuff. I already have that image 00:19:30.569-->00:19:35.641 but it's a 16 gig uh DD of a SD card. I have to figure out how to make it a 2 giga SD card 00:19:35.641-->00:19:39.812 without actually having, unless somebody has a 2 gig SD card they can lend me? No? Okay, uh 00:19:39.812-->00:19:46.585 but down here there's a bunch of information on how to set it up. And as the day, as the weeks, as 00:19:46.585-->00:19:51.390 time goes by I'm gonna be updating it, making it more clear and adding more diagrams 00:19:51.390-->00:19:55.828 to get it to, to work. Uh it's, it's been pretty busy last few months so I haven't had a lot of 00:19:55.828-->00:20:00.833 time but I'm going to focus on that, so. Um, that's pretty much it, I'm out of time so, 00:20:10.676-->00:20:15.681 questions. Questions. [applause] Uh, I guess I'm out of time so I'm gonna have to like step down 00:20:19.251-->00:20:23.189 here while I, and, and I can ask- answer questions or outside in the hall, so is there 00:20:23.189-->00:20:26.892 anything else that I need a? Alright thank you so much, sorry for the demo fail but uh, I'll, 00:20:26.892-->00:20:30.463 I'll have it tomorrow. Thank you. [applause]