00:00:00.000-->00:00:05.000
>>Um [laughs] So yeah Def Con
has a long standing tradition
and uh ya know if uh- it’s a

00:00:07.458-->00:00:12.458
speaker’s first time on stage,
then um they do a shot. So it’s
not about uh alcohol although

00:00:15.958-->00:00:20.958
you know [applause] yeah, it’s
a- it’s a tradition that’s
intended just to honor our

00:00:23.167-->00:00:28.167
speakers and uh Def Con you know
from from times of yore so
anyway this is Matt Wixy and uh

00:00:38.917-->00:00:43.917
he’s gonna do a shot with us
>>Cheers! [applause] [laughter]
>>Alright so please welcome Matt

00:01:03.208-->00:01:08.208
Wixey. [applause] [computer
start up noise] >>Hello Def Con.
Uh. So this is, um, “See no

00:01:13.750-->00:01:17.583
evil, hear no evil- Hacking
invisibly and silently with
light and sound.” Um. My name is

00:01:17.583-->00:01:22.167
Matt Wixey. I lead the
vulnerability research function
on, uh, the pentesting team at

00:01:22.167-->00:01:27.708
PwC’s UK. I also run something
called The Dark Art Lab which is
a research blog looking at the

00:01:27.708-->00:01:33.208
more esoteric aspects of
security research. Uh. I’ve been
a PwC for about a year. Uh.

00:01:33.208-->00:01:38.833
Prior to that I worked in, uh,
law enforcement in the UK for
about eight years, uh, leading a

00:01:38.833-->00:01:42.625
technical and research
development team. So today’s
talk is split into four parts.

00:01:42.625-->00:01:46.375
Um. First I’m going to show you
three custom tools I’ve
developed to, uh, use light and

00:01:46.375-->00:01:51.667
sound to jump air-gaps. I’m then
going to talk about, uh, laser
microphones, two different kinds

00:01:51.667-->00:01:56.500
of, uh, infrared motion
detectors, and different ways
you can disrupt and disarm them.

00:01:56.500-->00:02:01.667
Part three Bantz. Um. I’m not
sure if that term’s made out of
the UK. Um. But it roughly

00:02:01.667-->00:02:06.333
translates to lulz so it’s kind
of stuff I’ve found during the
course of research- the term,

00:02:06.333-->00:02:10.875
um, has made me, um, laugh more
than anything else. Um. Rather
than being kind of practical

00:02:10.875-->00:02:15.292
use. Um. And as you’ll see
throughout this talk, that’s
quite a l-low bar. Um. But

00:02:15.292-->00:02:19.000
hopefully you guys will enjoy as
well. And then I’m just going to
sum up and give some ideas for-

00:02:19.000-->00:02:24.333
for future research. So a couple
of disclaimers. The views and
opinions in this talk aren’t

00:02:24.333-->00:02:28.292
necessarily those of PwC. Um.
All the content is for
educational purposes only. So

00:02:28.292-->00:02:34.083
please check legislation. Get
permission. So on. Uh. This
presentation isn’t about, uh,

00:02:34.083-->00:02:39.500
exploiting vulnerabilities per
say. It’s about manipulating,
uh, the inputs and outputs of a

00:02:39.500-->00:02:44.833
system in order to have a
desired effect. Uh. And lastly,
I am definitely not an

00:02:44.833-->00:02:49.375
electronics expert or a physics
expert at all. Uh. In fact I’ve
only been in security for about

00:02:49.375-->00:02:53.542
six or seven years. Uh. My
bachelor’s degree was in, uh,
English Language and Literature,

00:02:53.542-->00:02:59.667
uh, which has been really
helpful. Um. [laughter] So, um.
Yeah. So just to give you an

00:02:59.667-->00:03:06.542
idea, um, I kind of regularly
still poke myself over resisters
and drill myself with soldering

00:03:06.542-->00:03:11.125
irons and, uh, I see magic smoke
so much it’s not even magical to
me anymore. [laughter] It’s

00:03:11.125-->00:03:17.833
just, uh- it’s just I call it
routine smoke. Um. [laughter] So
this is where I am on the- on

00:03:17.833-->00:03:21.167
the Dunning-Kruger Curve. If
you’ve guys are familiar with
this. [laughter] Um. So I don’t

00:03:21.167-->00:03:26.250
want you guys to think that I’m
kind of presenting myself as an
expert on this stuff. Um. But

00:03:26.250-->00:03:31.542
what I’m going to do at the end
of the talk is, uh, put my
Twitter handle up and email

00:03:31.542-->00:03:36.333
address. And please do get in
touch if you- if you think I’ve
got something wrong or there’s

00:03:36.333-->00:03:40.333
something that could be improved
or you’ve got any ideas or
suggestions. That’d be great

00:03:40.333-->00:03:45.417
‘cause, um, that’s what Def Con
is about at the end of the day.
Right? Um. So let’s jump

00:03:45.417-->00:03:50.375
straight into it. So the first
thing I want to show you is
this. This is an example of

00:03:50.375-->00:03:56.000
Li-fy. Data transmission through
lights. Uh. In this case, the
data is music. And this is, uh,

00:03:56.000-->00:04:02.667
adapted off of, uh, Schematic on
GitHub. And the, uh, the link to
that will be in the, uh,

00:04:02.667-->00:04:08.917
references part at the end of
the deck. Um. But it’s
basically, uh, what we’ve got

00:04:08.917-->00:04:13.583
here is, uh, a phone that’s
playing music. The headphone
output goes through a breadboard

00:04:13.583-->00:04:18.000
of LED’s which are going to
modulate the music data that is
going through. And then you have

00:04:18.000-->00:04:23.000
a photo vinod hooked up to a
speaker, uh, that’s going to
play the music. [music plays]

00:04:36.542-->00:04:39.667
[laughter] Um. Yeah. So that was
my impression with that actually
worked for the first time. Uh.

00:04:39.667-->00:04:44.667
And then I did the same thing,
uh, with infrared LEDs as well.
So exactly the same setup. Even

00:04:48.500-->00:04:53.667
the same song. It’s just
infrared LEDs instead of white
LEDs are modulating. [music] So

00:04:53.667-->00:04:58.667
that got me kind of thinking
about air-gaps and different
ways you can jump air-gaps. And,

00:05:05.500-->00:05:10.958
uh, I’m going to assume that
everyone here is kind of
familiar with the concept of an

00:05:10.958-->00:05:16.625
air-gap. Um. There’s been a lot
of research on how to jump them.
And they all come with caveats.

00:05:16.625-->00:05:20.708
So, um, the first caveat is we
assume the attackers have
managed to infect at least one

00:05:20.708-->00:05:27.125
host, uh, with a bit- a bit of
malware. Um. That the attack has
physical or near-physical access

00:05:27.125-->00:05:30.875
to that affected host because
we’re talking about quite
primitive inputs and outputs to

00:05:30.875-->00:05:35.708
a system. So we’re talking about
like heat, sound, light, um, uh,
EM radiation, that kind of

00:05:35.708-->00:05:40.917
thing. And then linked to that,
um, the exfiltration of air-gap
systems is going to be really

00:05:40.917-->00:05:46.125
slow. Uh. And it’s going to deal
with quite small pieces of data
because typically we’re talking

00:05:46.125-->00:05:50.625
about two bit channels, um, so
high or low states. So this is
some of the research that has

00:05:50.625-->00:05:54.125
been done in this area. You guys
would be familiar with a lot of
this already probably. Um. All

00:05:54.125-->00:05:58.750
the way from Van Eck phreaking
back in the 70’s which is EM
radiation from, uh, CLT

00:05:58.750-->00:06:03.667
monitors. Um. There’s been some
great work done by guys at
Bangor University in Israel, uh,

00:06:03.667-->00:06:07.958
on jumping air-gaps. Um.
Particularly, uh, using heat.
Um. VisiSploit which, um,

00:06:07.958-->00:06:14.042
encoded data as a kind of QR
code. Flashed it up on the
screen. Um. The attacker would

00:06:14.042-->00:06:20.125
then film the screen, um, and be
able to decode it. And Hasan and
others in 2013 gave a really

00:06:20.125-->00:06:24.500
good overview of some of these
techniques. Um. And one I think
that they proposed was using

00:06:24.500-->00:06:29.417
ambient light sensors from
mobile devices to be able to
control smart phones, um, by

00:06:29.417-->00:06:35.083
flickering overhead lighting.
That kind of thing. So the first
technique I want to show you is

00:06:35.083-->00:06:40.542
using ambient light sensors. Um.
So ambient light sensors are,
um, essentially hardware

00:06:40.542-->00:06:43.958
components. They’re found in the
frames of laptops, smartphones,
monitors, that kind of thing.

00:06:43.958-->00:06:49.000
And they’re normally, um, uh,
photoresistors, photodiodes,
something like that, that

00:06:49.000-->00:06:52.292
increases or decreases
resistance according to the
amount of light that hits it.

00:06:52.292-->00:06:56.917
Uh. And the idea there is you
just screen write this according
to the amount of ambient light.

00:06:56.917-->00:07:01.500
So it’s quite, uh, um, um,
benign, uh, thing to have. Um.
And you can interact with it

00:07:01.500-->00:07:06.500
programmatically, um, through
the Windows API. So, um, my plan
was to create a malware that

00:07:09.792-->00:07:14.000
could read in light intensity
values from, uh, an ambient
light sensor on a Windows

00:07:14.000-->00:07:19.000
workstation, um, and then
execute different commands
according to the amount of light

00:07:20.417-->00:07:26.167
that was hitting the ALS and the
kind of changes in, uh,
frequency- oh, sorry- in changes

00:07:26.167-->00:07:28.917
in intensity. So a couple of
problems is that, um, you have
to try to make this like a

00:07:28.917-->00:07:33.042
covert activity because you
can’t just shine a massive
flashlight, um, uh, a laptop.

00:07:33.042-->00:07:37.375
And you need some kind of
exfiltration capability as well.
Right? Because, um, being able

00:07:37.375-->00:07:41.083
to control malware is fine, but
for an air-gap system ideally
you want to concentrate on, uh,

00:07:41.083-->00:07:59.958
exfiltration. So, uh, I’m going
to be brave and try to show you
a live demo of this. Ok. So I’ve

00:07:59.958-->00:08:03.458
got a laptop here, um, that’s
got an ambient light sensor. The
ambient light sensor is just

00:08:03.458-->00:08:09.042
here. And what I’ve got here is
an infrared torch. So if I just
turn this on, you shouldn’t be

00:08:09.042-->00:08:13.042
able to see anything besides
like a red glow. But for
unfiltered cameras, um, they’ll

00:08:13.042-->00:08:22.000
be able to see them. So I’m
going to run the malware on this
laptop and then introduce high

00:08:22.000-->00:08:30.333
values through the ambient light
sensor. And that then, uh, pops
up a calc on the screen.

00:08:30.333-->00:08:51.167
[laughter] [applause] Ok. So,
yeah, in terms of exfiltration,
um, optical channels, um, for

00:08:51.167-->00:08:55.625
air-gaps are quite difficult,
um, optically. Um. There have
been some things suggested so

00:08:55.625-->00:09:00.875
VisiSploit like I mentioned
earlier, that relies on the, uh,
attacker having a camera, uh,

00:09:00.875-->00:09:05.000
inside what is probably a secure
area. So I came up with this
instead. Um. So the idea here is

00:09:05.000-->00:09:11.000
that the malware when it wants
to exfiltrate data, it will read
in a file, uh, convert it to

00:09:11.000-->00:09:15.542
bits, uh, and it will then make
very subtle changes in the
screen brightness, um, to

00:09:15.542-->00:09:20.375
represent that which then can be
picked up by an external sensor.
Um. So the easiest way to, um,

00:09:20.375-->00:09:25.250
make screen brightness changes
is with WMI. Um. Unfortunately
that requires, uh, admin

00:09:25.250-->00:09:30.833
privileges. However changing
gamma values and displays
doesn’t. So you can use a set

00:09:30.833-->00:09:37.500
device gamma ramp with a Windows
API, um, and you can make very,
very small changes, uh, in the

00:09:37.500-->00:09:42.875
gamma value of a display. So
the- the device I’ve got here,
um, is a light to frequency

00:09:42.875-->00:09:48.042
converter. And this is much more
sensitive than a typical
photodiode or photo sensor. Um.

00:09:48.042-->00:09:51.917
It can actually pick up changes
in the bioluminescence of
bacteria. Um. It can read light

00:09:51.917-->00:09:56.542
intensity changes through-
through your hand. Um. And it’s
connected to an Arduino nano

00:09:56.542-->00:10:06.417
here. So what I’ve got here is
a, um, the circuit connected
with a microsoft SD reader

00:10:06.417-->00:10:10.958
writer module. And I’m just
going to do a test of this
exfiltration function. So the

00:10:10.958-->00:10:15.083
malware is going to read in a
file. And it’s going to make
very small changes to the- the

00:10:15.083-->00:10:19.833
gamma value with the display.
Uh. What the malware actually
does- it takes likes a baseline

00:10:19.833-->00:10:24.792
before exfiltration. Then it
makes changes, um, uh, increases
or decreases according to

00:10:24.792-->00:10:28.125
whatever. So one over zero. And
then after exfiltration’s
finished, it will return it

00:10:28.125-->00:10:32.292
back. So you might be able to
see that, um, the very kind of
slight changes there. Um. But

00:10:32.292-->00:10:36.542
from the attacker’s point of
view, it’s actually quite
obvious whether it’s, uh, a one

00:10:36.542-->00:10:52.625
or a zero being transmitted. And
then what you can then do is
demodulate the data and retrieve

00:10:52.625-->00:10:56.708
the original bits. And, uh,
that’s not particularly covert.
Kind of just plunking a

00:10:56.708-->00:11:01.250
breadboard down to a screen so
this is a more, uh, covert
application. Um. So what we have

00:11:01.250-->00:11:06.417
here is the same, uh, light
sensor, light to frequency
converter, an Ada Fruit Flora

00:11:06.417-->00:11:11.083
board, so an air conductor with
a conductive thread. And then
you have, uh, the same SD writer

00:11:11.083-->00:11:14.875
as well. Um. So the idea is you
can exfiltrate data or an
attacker can exfiltrate data

00:11:14.875-->00:11:22.208
just sitting in front of a
screen and wearing that tie. So
the second thing I want to show

00:11:22.208-->00:11:25.875
you is Dreadphone. Uh. So
Dreadphone is commander control
using near-ultrasonic sounds. So

00:11:25.875-->00:11:33.250
by near-ultrasonic, uh, what I
mean is sounds that are, uh,
typically not able to be heard

00:11:33.250-->00:11:39.000
by most adults. Um. So the
theoretical range of human
hearing is 20 hertz to 20

00:11:39.000-->00:11:44.625
kilohertz. In practice, most
adult humans can only hear, um,
up to about 16 kilohertz. So 16

00:11:44.625-->00:11:50.042
kilohertz to 20 kilohertz is
like near-ultrasonic. At most,
adults can’t hear that. It’s

00:11:50.042-->00:11:54.500
perfectly within the
capabilities of a normal, uh,
laptop soundcard, uh, speaker or

00:11:54.500-->00:11:58.875
microphone to transmit and
receive audio, uh, in that
range. So there’s been previous

00:11:58.875-->00:12:03.417
research on this. Uh. Toftsed
and others and Hanspach and
Goetz did something similar. Uh.

00:12:03.417-->00:12:08.708
One problem they’ve come across,
uh, is this. So this is, uh, a
recording of near-ultrasonic

00:12:08.708-->00:12:20.500
sounds being played. [computer
audio] So while you can’t hear
the tones there, what’s actually

00:12:20.500-->00:12:25.375
happening is that there’s
electrical discharge on the
soundcard, uh, which makes those

00:12:25.375-->00:12:33.250
kinds of clicks and pops. So,
um, what I did with Dreadphone
was I pre-prepared 16 wav files.

00:12:33.250-->00:12:39.125
Uh. Each one represents a
different ultrasonic tone, uh,
in increments from 18.5

00:12:39.125-->00:12:43.500
kilohertz up to 20 kilohertz. So
16 in total. Each one
representing a hex, uh,

00:12:43.500-->00:12:49.750
character. Um. I applied
multiple fade-ins and fade-outs
to those. Um. So it kind of

00:12:49.750-->00:12:53.625
smooths the, uh, the input into
the sound card. And then
amplified it. You end up with

00:12:53.625-->00:13:04.958
this. So this is Dreadphone
running on two laptops. Um. This
is the victim. And the attacker

00:13:04.958-->00:13:11.792
is here on the left. So, uh,
this is monitoring the- the
microphone input. So what the

00:13:11.792-->00:13:15.958
attacker is going to do here is
just tell the victim to pop
calc, um, which means it’s going

00:13:15.958-->00:13:21.542
to send a sequence of those
pre-prepared wav files and the
victim then, um, executes that.

00:13:21.542-->00:13:33.667
[laughter] [applause] Ok. So
the- the next thing, um, is
exfiltration. So this is, uh, a

00:13:33.667-->00:13:42.042
txt file. [laughter] It, uh So
Batman would be a really good
movie if Bruce Wayne was

00:13:42.042-->00:13:46.625
actually true to the type and
communicated with people at 45
kilohertz. Um. [laughter] The

00:13:46.625-->00:13:50.708
attacker’s going to exfiltrate
this, uh, this txt file. So it’s
just going to send the

00:13:50.708-->00:13:57.917
exfiltration message. And I’ll
stay with the attacker here. And
what you’ll see is a different

00:13:57.917-->00:14:02.417
tone start to come back. Now
there is a case study of this
technique being used in the mode

00:14:02.417-->00:14:06.333
Um. I haven’t gotten a copy of
the malware so I haven’t been
able to verify it. But BadBIOS.

00:14:06.333-->00:14:11.625
You guys heard of that? Um. So
that, um, whilst infected the
BIOS, um, of machines it also

00:14:11.625-->00:14:21.708
communicated with other infected
hosts uh, there you go um using
near-ultrasonic tones.

00:14:21.708-->00:14:32.042
[applause] So, um, Dreadphone is
fine for like small bits of data
and small strings and stuff like

00:14:32.042-->00:14:36.708
that. But if you want to
exfiltrate, um, uh, more
content, say images for

00:14:36.708-->00:14:40.875
instance, you’re a bit more
limited. But you can actually
use a technique that’s been used

00:14:40.875-->00:14:45.083
in popular music before. Um. And
it involves spectrograms. Uh. So
a spectrogram is a visual

00:14:45.083-->00:14:50.292
representation of the
frequencies in a piece of audio.
Um. And, what the, uh, what

00:14:50.292-->00:14:54.167
these musicians have done is
they’ve read-in an image file.
They’ve iterated through the

00:14:54.167-->00:14:58.208
pixels, got the pixel values,
and then they’ve written out,
uh, frequencies, uh, to a wav

00:14:58.208-->00:15:02.583
file that corresponds with those
pixel values. And when you view
the audio as a spectrogram, uh,

00:15:02.583-->00:15:06.958
you end up with, uh, an
approximation of that original
image. Uh. So in this case you

00:15:06.958-->00:15:11.250
have a face on the left and a
cat on the right. So these are
both, um, uh, examples from

00:15:11.250-->00:15:25.625
popular music. Uh. So Let me
try another demo. So let’s say I
have an image like this that I

00:15:25.625-->00:15:39.917
want to exfiltrate. This is a
spectrogram tool that does that.
So it reads in the image and

00:15:39.917-->00:15:43.417
then you can specify a minimum
and a maximum frequency. So I’m
staying with, um,

00:15:43.417-->00:15:49.958
near-ultrasonic again. If I
generate that, it writes out a
wav file. If I try and play that

00:15:49.958-->00:15:59.250
wav file, you shouldn’t really
be able to hear anything unless
you’ve got really good hearing

00:15:59.250-->00:16:02.958
or are younger than I am. So
some of you might be able to
hear it. Um. But if I view that

00:16:02.958-->00:16:23.958
in a spectrogram, you can
recover, uh, the original image.
[laughter] [applause] Now the-

00:16:23.958-->00:16:27.833
the, um There are tools out
there already that will let you
do this. So Coagula,

00:16:27.833-->00:16:31.042
Spectrology, that kind of thing.
Uh. What spectrogram also does
is it let’s you merge your

00:16:31.042-->00:16:35.333
secret file with a legitimate
audio file. So, um, in case you
have got your kind of younger

00:16:35.333-->00:16:39.958
people working environment that
are able to hear that. Um. So
I’ve got a normal, uh, wav file

00:16:39.958-->00:16:47.292
here. [music plays] So it just
plays kind of ordinary music.
And I can merge my secret file

00:16:47.292-->00:17:01.708
with that. And that writes me
out a new wav file. So if I play
that, um, you just hear the

00:17:01.708-->00:17:15.833
ordinary music. You can open
that merge file and still
recover, uh, the original image.

00:17:15.833-->00:17:28.833
[applause] Ok. So in terms of
mitigation for this kind of
stuff and jumping air-gaps in

00:17:28.833-->00:17:31.833
general. You’re looking at
things like TEMPEST standards,
um, removing and disabling

00:17:31.833-->00:17:34.792
ambient light sensors if they’re
not required or covering them
up. Um. Privacy filters for

00:17:34.792-->00:17:40.333
laptops do a really good job of
muting, uh, screen brightness
changes. Um. And in terms of the

00:17:40.333-->00:17:44.583
ultrasonic stuff, um, you can
look at things like white noise
or ultrasonic detectors. Um. But

00:17:44.583-->00:17:48.875
ultimately, uh, if you’ve got
any kind of input and output to
a system that’s not necessary or

00:17:48.875-->00:17:52.833
not integral to the operation of
that particular piece of
equipment, um, you’re probably

00:17:52.833-->00:17:58.208
better off just disabling it. So
part two. Uh. Surveillance and
counter-surveillance. Um. So

00:17:58.208-->00:18:02.750
first thing is a laser
microphone. Um. Just a quick
hands up, who’s heard of a laser

00:18:02.750-->00:18:08.500
microphone before? Ok. Quite a
few people. Um. So, uh, for
those of you who haven’t, I’ll

00:18:08.500-->00:18:13.750
just quickly explain what it
does. So imagine that you’re
doing, uh, surveillance on a

00:18:13.750-->00:18:18.417
group of people across the
street from you. And those
people are behind a window. Um.

00:18:18.417-->00:18:22.583
Let’s say the- the glass is
soundproof so you can’t hear
anything. Um. Let’s say they’ve

00:18:22.583-->00:18:27.000
drawn the curtains so you can’t
video them and do lipreading.
And assume you don’t have any

00:18:27.000-->00:18:30.333
bugs or anything in the room.
What you can do is use a laser
microphone. So you shine a laser

00:18:30.333-->00:18:35.917
at the window and you capture
the reflective beam with a
photodiode or a photosensor. So

00:18:35.917-->00:18:40.208
what’s happening is as those
people in that room are talking,
the air is vibrating. It makes

00:18:40.208-->00:18:44.417
the glass in the window vibrate.
Which makes your reflected laser
beam shift slightly. And as that

00:18:44.417-->00:18:49.542
moves across the surface of your
photodiode, it of course shifts
in voltage which can then be

00:18:49.542-->00:18:54.417
converted back into sound. Uh.
So on the right here I’ve got a
really cheap laser module, um,

00:18:54.417-->00:18:59.583
that’s hooked up to an 8 volt
battery. And on the left I have
a photodiode. Um. This is

00:18:59.583-->00:19:03.125
actually adapted from a circuit
that did something else. Um. The
output goes through a 3.5

00:19:03.125-->00:19:14.000
millimeter audio jack. So, uh,
to demonstrate this So I have
the laser. I’ve got the listener

00:19:14.000-->00:19:20.875
hooked up to a speaker. Uh. The
laser is firing at a, uh, phone
that’s playing music very, very

00:19:20.875-->00:19:24.958
quietly. Taped to the back of
the speaker is a bit of
reflective material. And at the

00:19:24.958-->00:19:27.917
moment, there’s a bit of
obstruction between the
reflected laser beam and the

00:19:27.917-->00:19:51.833
listener. If I remove that
[music begins to play] So um
[laughter] [applause] So that

00:19:51.833-->00:19:55.500
obviously like a really cheap, a
really simple sort of model.
And, uh, that only cost like 25

00:19:55.500-->00:20:00.000
pounds, the whole kind of setup.
Um. If you obviously had a bit
more of a budget, you could use

00:20:00.000-->00:20:04.708
like interferometry. Um. You
could experiment with using
infrared lasers to make it more

00:20:04.708-->00:20:08.542
covert. Um. ‘Cause nothing says
“I’m using a laser microphone”
like shining a really highly

00:20:08.542-->00:20:13.708
visible laser. Um. [laughter]
You can kind of filter
interference use [mic crackles]

00:20:13.708-->00:20:19.417
kind of stuff as well. Ok. Um.
So moving onto sniffing,
analysing, cloning infrared. So,

00:20:19.417-->00:20:26.000
um, I imagine a lot of people
here will have done, um, or will
have experimented with, like,

00:20:26.000-->00:20:30.917
cloner replay attacks using a,
uh, SDR with RF signals. And
infrared’s very similar. Um. So

00:20:30.917-->00:20:35.667
with infrared signals, assuming
that like fixed codes- they, uh,
will use things like byface

00:20:35.667-->00:20:39.625
market coding, manchestering
coding, that kind of thing as
well. Uh. They use a carrier

00:20:39.625-->00:20:44.208
wav. Um. Normally 38 kilohertz
but it can be other frequencies
as well. So we need a way to

00:20:44.208-->00:20:49.917
listen to the signal. Uh. Then a
way to analyze it and then a way
to replay it. Uh. And if you

00:20:49.917-->00:20:54.542
guys are interested in infrared,
there’s a really great talk, um,
from Def Con in 2005 by Major

00:20:54.542-->00:21:00.833
Malfunction. He found a way to
compromise hotel payment systems
by messing around with infrared,

00:21:00.833-->00:21:06.000
uh, TV remotes, uh, in hotel
rooms. So the first thing you
could do is just use an RTL-SDR.

00:21:06.000-->00:21:09.250
So these things still have an
infrared sensor in them, um,
that you can actually use to

00:21:09.250-->00:21:15.000
sniff infrared signals. Um. It
just returns you like the raw
post data so it’s completely

00:21:15.000-->00:21:20.250
undecoded. Uh. But you could do
that. You could use a dedicated
infrared receiver component like

00:21:20.250-->00:21:26.000
Arduino and then you can use the
IRLib library. And the nice
thing about this library is if

00:21:26.000-->00:21:31.042
it’s one of, um, kind eight or
nine popular consumer protocols,
it will actually tell you what

00:21:31.042-->00:21:36.667
protocol it is and decode it for
you. So then this is the standby
signal for my, uh, TV remote. So

00:21:36.667-->00:21:42.000
it tells me it’s using the NEC
protocol and then tells me what
the value, um, of that code is.

00:21:42.000-->00:21:49.583
And then you can also use the
listener, um, for that laser
microphone. So that will do it

00:21:49.583-->00:22:01.625
as well. [computer noises] And
then you can expect the- the-
the- inspect the signal visually

00:22:01.625-->00:22:07.875
which is quite nice. In terms of
replaying it, if it’s a known
protocol like NEC or something

00:22:07.875-->00:22:12.125
like that, you can just play it
back. Um. So in this case I’ve
used the IRremote library. Uh.

00:22:12.125-->00:22:18.000
You can just play it back with a
normal consumer protocol. Uh.
Like RF, however, if it’s

00:22:18.000-->00:22:22.375
unknown, um, then you have to
replay the raw array, um, that
you’ve managed to sniff. So

00:22:22.375-->00:22:29.667
applying this practically, um,
to, um, motion detectors. So the
testing I’m going to talk about

00:22:29.667-->00:22:33.875
is a passive infrared motion
detector. So these have a
passive infrared sensor in them

00:22:33.875-->00:22:40.333
that respond to changes in
infrared radiation, ie. uh, body
heat. So there was a talk, um,

00:22:40.333-->00:22:45.417
at BlackHat 2013 USA by Porter
and Smith where they talked
about different methods to

00:22:45.417-->00:22:49.250
defeat physical security and
they mentioned passive infrared
sensors. Uh. And you can do

00:22:49.250-->00:22:53.083
things like move really slowly
so the changes in body heat
aren’t registered by the sensor.

00:22:53.083-->00:22:57.875
You can, um, coat yourself in a
reflective material. Not the
most practical approach but, uh,

00:22:57.875-->00:23:02.875
it works. Um. Or you could
overwhelm the sensor with heat
so like a flame. Um. So I think

00:23:02.875-->00:23:09.167
in their talk, they used a
lighter to do it. So here’s an
example of a passive infrared

00:23:09.167-->00:23:13.958
motion detector. Um. So the gray
sphere on it, that’s the actual
sensor itself. Uh. The red

00:23:13.958-->00:23:18.000
window to the top, that’s
actually the receiver for that
remote control. So the remote

00:23:18.000-->00:23:23.583
control is used to arm or disarm
the main unit. Um. Quiet-wide
I’ve used infrared to do that. I

00:23:23.583-->00:23:28.083
don’t know, um, as opposed to
RF. Um. And then on the right is
a circuit board I can use to do

00:23:28.083-->00:23:33.208
a simple clone to replay attack.
Uh. I just clone the disarm
signal, uh, from that remote.

00:23:33.208-->00:23:53.000
[alarm noises] So it’s now on.
They’re just tested works. And
then I can use my evil device to

00:23:53.000-->00:24:05.417
just clone the disarm signal.
And that’s now disarmed. So
there’s nothing kind of

00:24:05.417-->00:24:09.083
particularly innovative or
interesting about that. It’s
just the normal clone and replay

00:24:09.083-->00:24:13.167
attack. I suppose the one thing
that is interesting it’s
infrared. Um. But there’s two

00:24:13.167-->00:24:17.458
big flaws in this approach. And
the first is how do you get the
disarmed signal in the first

00:24:17.458-->00:24:20.917
place? Assuming it’s- because,
you know, it’s infrared. You
have to be quite close to it.

00:24:20.917-->00:24:26.417
Um. So you’re stuck with having
to like, um, have a device in
the vicinity or steal a remote

00:24:26.417-->00:24:31.458
somehow and capture the signal.
And the second problem is how do
you get close enough to disarm

00:24:31.458-->00:24:37.333
it once you’ve got the disarm
signal, um, without setting off
the main unit. So I bought nine

00:24:37.333-->00:24:44.208
of these. Um. They’re
manufactured by the same
manufacturer but sold under the,

00:24:44.208-->00:24:47.042
um, different brand names. And I
captured the signals from the
remotes. And here are the

00:24:47.042-->00:24:56.917
signals from the first six.
[laughter] Ok. So straight out
of the box, um, regardless of

00:24:56.917-->00:25:02.167
what main unit the remote was
first used with, it will arm and
disarm any main unit. So here’s

00:25:02.167-->00:25:21.292
all nine. [laughter] So I just
picked the remote up. [video
playing] [laughter] And then

00:25:21.292-->00:25:34.833
pick another one up and I can
disarm all of them. [laughter]
[applause] So I’m almost like

00:25:34.833-->00:25:41.125
embarrassed to present that at
Def Con. [laughter] Now, so
that’s the first problem taken

00:25:41.125-->00:25:44.000
care of. How do we get the
disarm the signal. Second
problem: how do we get close

00:25:44.000-->00:25:48.167
enough to the main unit to
disarm it without setting it
off. Here’s the first solution.

00:25:48.167-->00:25:56.958
[laughter] Um. So this is a
Drone to clone to pwn. This is,
um, the disarming circuit

00:25:56.958-->00:26:03.042
powered by the drone’s internal
USB port. The reason you can use
a drone is ‘cause the lithium

00:26:03.042-->00:26:07.375
battery in it doesn’t get hot
enough to set off, um, a motion
detector until it’s been in the

00:26:07.375-->00:26:16.375
air for about 45 seconds.
[laughter] So here’s the alarm
in the foreground. You can see

00:26:16.375-->00:26:22.917
I’ve dressed up for this video.
So if I arm this and then try to
walk up to it, it detects me. So

00:26:22.917-->00:26:32.750
you’ll shortly see that my drone
piloting skills are about on a
par with my fashion sense.

00:26:32.750-->00:26:40.750
[laughter] Ok. So we’re going to
fly the drone over and it won’t
set it off, but it will disarm

00:26:40.750-->00:27:18.250
it. [laughter] [applause] Ok.
Second solution: Phone to clone
to pwn. So. Um. This is using an

00:27:18.250-->00:27:23.417
AdaFruit GSM break up board. Um.
This is heavily based on, uh,
Samy Kamkar’s ding dong ditch or

00:27:23.417-->00:27:28.000
digital ding dong ditch if
you’ve seen that. Um. Some
slight modifications. So

00:27:28.000-->00:27:32.833
obviously it uses infrared
rather than RF. Um. It also
doesn’t use Interrupt. It just

00:27:32.833-->00:27:37.208
uses a time loop and it deletes
text messages off the SIM card,
uh, once they’ve been read. So

00:27:37.208-->00:27:41.292
the idea here is you would hide
this or pay someone to hide this
near an alarm, um, during the

00:27:41.292-->00:27:45.833
day when it’s deactivated. Then
after hours when the system is
on, you can just send a text to

00:27:45.833-->00:27:56.833
a number containing a certain
string, and it will then disarm
it. Ok. So as usual the first

00:27:56.833-->00:28:07.250
thing I’ll do is arm the, uh,
main unit and then just test it.
[alarm beeps] Ok. And I’ll just

00:28:07.250-->00:28:12.458
look quickly at the Arduino
sketch, um, which is just
checking for new messages every

00:28:12.458-->00:28:16.625
five seconds on that SIM card.
So I’m now going to send a text
to the number that’s on that SIM

00:28:16.625-->00:28:20.417
card. And in this case, the
string, uh, sketch you’re
looking for is “new phone who

00:28:20.417-->00:28:47.833
dis.” [laughter] [alarm beeps]
[applause] And then just looking
at the sketch to just to make

00:28:47.833-->00:28:51.917
sure it reads the, uh, text
message and sends a signal and
then deletes the message from

00:28:51.917-->00:28:56.875
the SIM card. Now you could
combine both of those together
and do Phone to Drone to Clone

00:28:56.875-->00:29:04.458
to PWN. Um. [laughter] But that
would just be absurd so I
haven’t done that. Ok. Um. The

00:29:04.458-->00:29:09.417
next kind of motion detector is
this. So this is active infrared
motion detector. So the idea

00:29:09.417-->00:29:13.375
here is you have two components:
a transmitter and receiver. And
the transmitter is constantly

00:29:13.375-->00:29:20.667
sending a pulse of infrared
signals, uh, to the receiver.
And if the beam’s broken [alarm

00:29:20.667-->00:29:25.125
beeps] then the alarm sounds.
And if you continually move the
transmitter, away [alarm beeps]

00:29:25.125-->00:29:33.250
then the alarm would just
continually sound until you
clone the signal from the

00:29:33.250-->00:29:43.625
transmitter and just put it
right next to the receiver.
[laughter] Ok. Uh. So in terms

00:29:43.625-->00:29:47.167
of mitigation for these kinds of
attacks. So for laser
microphones, um, you can get

00:29:47.167-->00:29:51.917
devices that vibrate the glass
on windows, um, to try and
disrupt laser mics. I’m not sure

00:29:51.917-->00:29:56.750
how effective they are. But
things like wire screens and
coverings on windows. Um. As

00:29:56.750-->00:30:02.333
you’ve seen with the, um,
infrared torchlight is you can
detect the infrared light if

00:30:02.333-->00:30:06.000
you’re using an unfiltered
camera. So you can use that to
detect infrared lasers. Um.

00:30:06.000-->00:30:09.583
Double-glazing or curved glass
can cause issues with laser
mics. Um. As can other

00:30:09.583-->00:30:13.500
environmental conditions like,
uh, rain and snow and that kind
of a thing. Um. In terms of

00:30:13.500-->00:30:18.000
alarms, ideally you want to try
and disarm the physical keypads.
Um. Not that that’s perfect, but

00:30:18.000-->00:30:21.583
it’s better than remotes because
the signals could be sniffed.
Um. And if you do have to use

00:30:21.583-->00:30:25.458
remotes, you want to go for ones
that use, like, tried and
tested, encrypted rolling code

00:30:25.458-->00:30:30.792
algorithm. Um. And that are
paired uniquely to a device. You
wouldn’t think you’d have to say

00:30:30.792-->00:30:38.208
that explicitly, um, but yeah.
Ok. So, uh, last part is bantz.
Um. So the first thing I want to

00:30:38.208-->00:30:42.250
show you is speech jamming or
delayed auditory feedback. Um.
So this is a technique that’s

00:30:42.250-->00:30:47.125
been around since the 50’s. It’s
actually, um, originally used to
help people who stutter. Um. The

00:30:47.125-->00:30:52.917
idea is you introduce a latency
between someone, um, speaking
and them hearing themselves

00:30:52.917-->00:30:57.583
speak. And when, uh, used with
people who stutter, it, um,
enables them to speak more

00:30:57.583-->00:31:01.208
clearly. If you use it on people
who don’t have a stutter, it
dramatically inhibits their

00:31:01.208-->00:31:06.333
capability to speak. Um. And it
causes, like, mental stress.
Safe to assume. Um. Researches

00:31:06.333-->00:31:11.208
in 2012 who came up with, like,
a hardware version. Um. I built
a software version called

00:31:11.208-->00:31:15.792
doubleSpeak. And I tested it out
some- on some colleagues because
I didn’t want to look stupid

00:31:15.792-->00:31:21.625
myself. So. [laughter] So what
these guys are doing is they’re
reading a paragraph, uh, from a

00:31:21.625-->00:31:26.125
website about delayed auditory
feedback, uh, while my tool is
running on the laptop and

00:31:26.125-->00:31:31.000
they’re wearing a pair of
headphones. >>Delayed auditory
feed-feedback, also called

00:31:31.000-->00:31:38.625
delayed side tone, is a type of
audi- auditory feedback -back
that consists of extending the

00:31:38.625-->00:31:48.875
time between speech and auditory
s- perception. >>Delayed
auditory feedback, also called

00:31:48.875-->00:31:53.583
delayed sidetone, is a type of
audi- aud- auditory fee-
feedback -back that consists of

00:31:53.583-->00:32:02.292
extending the time between the
speech and the auditory per-
perception. [laughter] >>Delayed

00:32:02.292-->00:32:09.083
aud itory feed. back, also
called delayed sidetone, is a
type of alted- alteuditory

00:32:09.083-->00:32:15.875
feedback that consists of
extending the time between
speech and auditory percep

00:32:15.875-->00:32:24.292
tion. [laughter] >>when hear
his.. voice in headphones a
fract- come of a sec ond later.

00:32:24.292-->00:32:28.750
Some DAF devices are hardware.
DAF computer software is also
available. Most delays produce a

00:32:28.750-->00:32:34.792
noticeable effect are between 50
to 200 milliseconds. DAF usage
with a 175 millisecond delay has

00:32:34.792-->00:32:42.000
been shown to induce mental
stress. Surely this is
stressful. [laughter] So, um, on

00:32:42.000-->00:32:46.167
the face of it, that doesn’t
seem to have much practical
application to security. Um. One

00:32:46.167-->00:32:50.125
way that we came up with that
you might be able to use it is,
um, say you’re on a network and

00:32:50.125-->00:32:54.875
your goal is to kind of sow
disruption and discord but in a
very subtle way. You could find

00:32:54.875-->00:32:58.792
out when a very important
conference call is taking place
and use this. And kind of affect

00:32:58.792-->00:33:03.458
the decision outcome of that
conference call, um, without
kind of having to do anything,

00:33:03.458-->00:33:08.833
um, too blatant. Ok. Uh. Next
thing: demotivating malware
analysts. So, um, this is

00:33:08.833-->00:33:14.708
inspired by Christopher Domas
who’s speaking, uh, tomorrow I
think. Um. And he came up with

00:33:14.708-->00:33:21.042
this awesome thing in, uh, 2015,
um, which was he created fully
functioning malware which when

00:33:21.042-->00:33:25.958
looked at in a disassembler in
the flow graph, represents an
image, um, under his control. So

00:33:25.958-->00:33:30.042
he can basically choose the
image that a malware analyst has
to stare at all day long. Um.

00:33:30.042-->00:33:35.833
Which is awesome. So I used my,
um, spectrogram tool to come up
with something, uh, similar,

00:33:35.833-->00:33:39.917
albeit a lot cruder. So let’s
say you’ve got malware and when
you run it, it plays really

00:33:39.917-->00:33:48.292
weird music like this.
[screeching computer noise] So
the first thing you do is

00:33:48.292-->00:33:51.083
disassemble it. In this case
it’s dot net so it’s very easy.
And you look at what’s causing

00:33:51.083-->00:33:55.375
that sound. So in this case,
it’s a wav file, um, that you
can then extract from the, um,

00:33:55.375-->00:34:06.125
main binary. And you’re playing
that wav file and trying to
think what is this? Is this some

00:34:06.125-->00:34:11.542
kind of encrypted communication?
Is it trying to exploit
something? What is it? And you

00:34:11.542-->00:34:14.458
spend ages and ages looking at
it. Until eventually it occurs
to you to look at it as a

00:34:14.458-->00:34:34.417
spectrogram. And then you see
something like that. [laughter]
[applause] Ok. Uh. Do we have

00:34:34.417-->00:34:41.625
any Gilmore Girls fans in the
room? [Cheers] Ok. So, um, to
give you a bit of background on

00:34:41.625-->00:34:45.167
this, my wife is a huge Gilmore
Girls fan. Uh. She watched it
all when it first came out. Um.

00:34:45.167-->00:34:49.708
They streamed it like two years
ago and she’s watched- since
then, she’s watched season one

00:34:49.708-->00:34:53.750
to season eight I- I’ve lost
count. In that time, I’ve gone
from passive indifference

00:34:53.750-->00:34:58.708
thinking, you know, “this is ok
but I can’t really see the
appeal” to kind of active

00:34:58.708-->00:35:03.375
loathing of this program.
[laughter] So I came up with,
um, Kill More Gilmore which I

00:35:03.375-->00:35:08.083
think on reflection is probably
the best thing I’ve ever done.
Um. So Kill More Gilmore is, uh

00:35:08.083-->00:35:13.833
It comes- it’s two parts. It’s a
Python script and an Arduino
device. Now the Python script

00:35:13.833-->00:35:18.750
uses, uh, an open source music
recognition library called Deja
Vu, um, which is on GitHub.

00:35:18.750-->00:35:22.833
Again, the- the link will be,
uh, at the end of the talk. Um.
And what Deja Vu does is it lets

00:35:22.833-->00:35:27.333
you write mp3 files to a
database and it fingerprints
them, um, I believe using a fost

00:35:27.333-->00:35:32.708
furat. And it then compares
audio coming into the microphone
to what’s in the database. So my

00:35:32.708-->00:35:37.667
Python script here is comparing
audio coming into the
microphone, uh, to the database.

00:35:37.667-->00:35:44.375
And if it gets a match for the
Gilmore Girls theme tune, it
sends a serial byte, um, it

00:35:44.375-->00:35:48.667
sends a byt, sorry, over the
serial port to the connected
Arduino device, which clones the

00:35:48.667-->00:36:08.208
power off signal for my TV.
[laughter] [applause] So, um, I
have a video of this.

00:36:08.208-->00:36:11.833
Unfortunately because of
possible copyright issues, I’ve
had to mute it. Um. But after

00:36:11.833-->00:36:16.292
the talk if you, um, look at my
Twitter feed, I’ll upload it
somewhere, um, with the full

00:36:16.292-->00:36:25.542
audio so you can see it. Ok. So
this is like the pre-credit
sequence so there’s no music

00:36:25.542-->00:36:29.792
yet. Um. So what the script’s
going to do, it just listens to
ten seconds and it will conclude

00:36:29.792-->00:36:41.958
that the-the Gilmore Girls isn’t
playing at the moment.
[laughter] Ok. And then the

00:36:41.958-->00:37:04.333
theme tune starts. [laughter]
[applause] Ok. And, uh, the last
thing I want to show you is

00:37:04.333-->00:37:08.708
this. So this is AstroDrone. So
this is using, uh, echolocation
jamming against ultrasonic

00:37:08.708-->00:37:13.333
altimeters in drones. Um. So
I’ve demonstrated it with a
Parrot, um, just ‘cause I had

00:37:13.333-->00:37:17.708
one handy. Um. It’s not picking
on Parrots specifically. Other
drones with ultrasonic

00:37:17.708-->00:37:21.708
altimeters will be vulnerable to
this as well. So the idea with
an ultrasonic sensor is it uses

00:37:21.708-->00:37:25.875
echolocation. Alright? So you
have a transmitter that sends
out ultrasonic pulses at a

00:37:25.875-->00:37:30.083
particular frequency, they hit
an obstacle, get reflected back
to the receiver. And based on

00:37:30.083-->00:37:34.667
the width of the pulse that
comes back, um, the navigation
board can infer how far away it

00:37:34.667-->00:37:40.042
is from the obstacle. So when
you do this with drones with
ultrasonic altimeters, ‘cause

00:37:40.042-->00:37:44.500
it’s used on the bottom of the
drone to figure out how close it
is to the ground. Eight times

00:37:44.500-->00:37:50.583
out of ten it launches it
upwards at quite a frightening
pace. Um. Two times out of ten

00:37:50.583-->00:37:54.000
it tries to sink through the
floor because you’re making the
drone think it’s either at

00:37:54.000-->00:37:58.792
maximum or minimum altitude. So,
um, there’s a talk last year at
Def Con by Liu and others

00:37:58.792-->00:38:04.500
against, uh, about ultrasonic
attacks against autonomous cars,
against TESLRs. Um. So this is a

00:38:04.500-->00:38:10.750
similar technique albeit, um, a
lot cruder. Um. So first thing I
used was this. So this is an

00:38:10.750-->00:38:16.333
animal repellent alarm. So, um,
you put this in your garden. Um.
The idea is that you have a

00:38:16.333-->00:38:19.417
passive infrared sensor. When it
goes high, it sends out an
ultrasonic tone to scare away

00:38:19.417-->00:38:51.958
dogs and cats, that kind of
stuff. When you fly a drone over
it [drone noises] So you

00:38:51.958-->00:38:54.875
noticed that the drone became
like completely unresponsive to
commands. It just refused to

00:38:54.875-->00:39:02.167
land. And in that case, uh, with
a broken drone. [laughter] So,
um, that was kind of the first

00:39:02.167-->00:39:05.458
part of this. And then I
thought, well, let’s try to
expand that. So rather than

00:39:05.458-->00:39:09.375
having the drone fly directly
overhead, can we come up with
something that detects, um,

00:39:09.375-->00:39:20.625
drones in multiple directions
and sends out a more powerful
signal. [laughter] So, um,

00:39:20.625-->00:39:28.208
that’s a colander, um, ‘cause I-
I ran out of money. Um. And you
have, uh, four, passive infrared

00:39:28.208-->00:39:34.250
sensors. There’s two Arduino
unos, um, underneath. Uh. And
eighteen ultrasonic transducers

00:39:34.250-->00:39:40.292
connected to it. So, um,
infrared’s one option and then I
also used acoustic signatures

00:39:40.292-->00:39:45.167
with the Deja Vu library again.
So I recorded the sound of a
drone flying, um, and then

00:39:45.167-->00:39:49.958
compared the microphone to it.
Um. And that works just as well.
I just don’t have time to show

00:39:49.958-->00:40:20.167
it. But, uh. Let me show you
this one. So. [drone noises] Ok.
Um. So. We are not doing further

00:40:20.167-->00:40:24.708
research on that in the moment
and trying to, um, test it
against different drones,

00:40:24.708-->00:40:28.583
different, um, kinds of, um,
environmental conditions,
different kinds of echolocation,

00:40:28.583-->00:40:33.958
that kind of a thing. Um. So.
Um. You could use this as
essentially like as a drone

00:40:33.958-->00:40:38.542
repellent. If you wanted to, uh,
you could use it as a personal
drone repellent as well.

00:40:38.542-->00:40:50.542
[laughter] [applause] Ok. So I
think I have about five minutes
left so I’m just going to do a

00:40:50.542-->00:40:54.792
really quick summary. Um. If I
don’t have time for questions,
um, then I’ll take them in the

00:40:54.792-->00:40:59.833
hall afterwards. And you can
email me or whatever. So this is
an overview of the research I’ve

00:40:59.833-->00:41:04.542
done on light and sound. Um. And
you can, um, interpret this in
two ways. You can either look at

00:41:04.542-->00:41:09.292
it and think, uh, “Yes. He had a
really careful and comprehensive
research plan.” Uh. Or “it’s

00:41:09.292-->00:41:13.375
something he coupled together
this morning to give his talk
the illusion of structure.” Um.

00:41:13.375-->00:41:18.000
Either one of those is good with
me. Um. But they all kind of do
fit into each other. So as an

00:41:18.000-->00:41:23.125
attacker, um, using light and
sound for attacks, um Pros are
they’re great for any, uh,

00:41:23.125-->00:41:27.500
environment that uses physical
security devices. Particularly
infrared stuff. Uh. Any

00:41:27.500-->00:41:32.500
environment where there’s
air-gap systems. They’re really
difficult to detect and to

00:41:32.500-->00:41:37.375
defend against. Um. And they
leave very little trace. And you
can, uh, as you’ve seen, uh, do

00:41:37.375-->00:41:42.125
this stuff on the cheap, um, a
lot of the time kind of at home.
And test it out. Cons are you

00:41:42.125-->00:41:46.125
need proximity, um, to the
systems you’re attacking
obviously. Um. Subject to

00:41:46.125-->00:41:50.125
environmental interference
particularly things like laser,
microphones. Um. And the range

00:41:50.125-->00:41:54.375
and power of your solutions are
very much going to depend on the
resources that are available to

00:41:54.375-->00:42:00.083
you. So in terms of mitigation,
um, definitely the first step is
knowing these techniques exist

00:42:00.083-->00:42:03.792
and knowing they’re out there.
Um. And the inputs and outputs
can be manipulated. Um. So

00:42:03.792-->00:42:08.917
ideally if it’s possible or
feasible, you looked up block
those inputs/outputs completely.

00:42:08.917-->00:42:14.417
Um. If you can’t, you’d have
like a reliable failover. Um.
And lastly, yeah,

00:42:14.417-->00:42:19.208
clone-and-replay attacks and,
you know, jamming, that kind of
thing are as much applicable to

00:42:19.208-->00:42:23.625
light and sound as they are to,
um, any other kind of
technology. So ideas for future

00:42:23.625-->00:42:28.500
research, um, exfiltration via
infrared, uh, is something I’ve
wanted to explore. Acoustic

00:42:28.500-->00:42:32.208
keylogging which has been
empirically proven to work. Um.
But I’ve yet to see like an

00:42:32.208-->00:42:36.833
automated practical solution for
it. Um. More work on LiFi and
some more work on drone

00:42:36.833-->00:42:40.917
repellents as well. So
hopefully, in terms of how you
feel about this talk, uh, you’re

00:42:40.917-->00:42:55.250
more on the left, uh, than on
the right. [laughter] Um. So,
um. Um. So just to wrap up. Um.

00:42:55.250-->00:42:59.417
The music credits that were used
in this presentation were
Royalty free or creative commons

00:42:59.417-->00:43:03.292
so thanks very much to those
people for putting that music
out there. Uh. References. Um.

00:43:03.292-->00:43:08.292
I’ll let you guys go through
that on your own time. Uh. So
yeah. So that’s my email address

00:43:08.292-->00:43:13.917
and my Sorry. That’s my email
address, my twitter handle. Um.
So please do get in touch if you

00:43:13.917-->00:43:19.667
have any suggestions, comments,
um, feedback, generally
criticisms, anything like that.

00:43:19.667-->00:43:23.833
If I’ve got anything wrong
during the talk or presentation,
you can just keep that to

00:43:23.833-->00:00:00.000
yourself. Um. Um. [laughter]
Yup. So that’s it from me. Thank
you very much. [applause]