00:00:00.042-->00:00:05.333 >>Hey how's everybody doin'? So just a quick survey, uh, who here likes hacking? Who thinks 00:00:05.333-->00:00:09.125 hacking's interesting? Yeah. Few people? Alright. How bout who thinks guns are kinda 00:00:09.125-->00:00:11.167 interesting? H**l yeah. A handful. [cheering] Alright. How about hacking guns? Any uh any 00:00:11.167-->00:00:16.167 interest in that [cheering]? Can I hack some guns. Good. Cause that's what we're gonna talk 00:00:21.708-->00:00:26.708 about today. Uh, we're gonna talk about popping a smart gun. So, we're going to... what is- 00:00:28.750-->00:00:34.208 what is a smart gun? Um so a smart gun would be a gun that can be fired only by an 00:00:34.208-->00:00:40.375 authorized user. Uh I think that a lot of the um mentality around gun-uh smart guns has been 00:00:40.375-->00:00:44.083 shaped by Hollywood in particular the movie Skyfall. This is a Bond film a couple 00:00:44.083-->00:00:50.958 years ago. Uh in the film Q gives Bond a modified Walther and it's somehow uh associated 00:00:50.958-->00:00:57.208 with Bond's grip uh some sort of biometrics and in the movie uh Bond can shoot the weapon but 00:00:57.208-->00:01:00.458 when the assailant gets the weapon and tries to shoot Bond, doesn't work. And then the 00:01:00.458-->00:01:06.458 assailant gets like killed by a Komodo dragon or something. But uh anyhow uh we're a little ways 00:01:06.458-->00:01:12.458 away from that for now but we do have several smart gun uh models in development in the- that are 00:01:12.458-->00:01:17.292 biometric based so this would be things like fingerprints or palm prints. We also see ones that 00:01:17.292-->00:01:23.750 use things like magnetic rings and then things like RFID and RFID wristbands. That sort of 00:01:23.750-->00:01:29.083 thing. Um now there's a lot of controversy around smart guns and this is largely due to a New 00:01:29.083-->00:01:34.083 Jersey law that was passed in the early otts and this law said that after three years - three 00:01:36.250-->00:01:41.375 years after the first smart gun becomes available at retail, only smart guns could be sold in 00:01:41.375-->00:01:46.458 New Jersey and so gun people were a little upset about this thinking that they would no 00:01:46.458-->00:01:51.458 longer be able to buy non smart firearms and as a result they uh started to kind of protest when 00:01:54.750-->00:02:00.667 gun stores dis-discussed even carrying smart guns um up to the point people were getting death 00:02:00.667-->00:02:05.208 threats and that sort of thing. Now I'm-I'm not quite. I'm not really that extreme. I think 00:02:05.208-->00:02:10.167 that if you want a smart gun, you should be able to have a smart gun. Um I like guns. I 00:02:10.167-->00:02:15.667 like shooting guns rifles, pistols, shotguns, I think if you've never shot clays with a 00:02:15.667-->00:02:22.333 shotgun you-you should give it a try. It's fun. Um I do think that if you are going to buy a 00:02:22.333-->00:02:26.208 smart gun you should be able to get what you're paying for. Should be- It should match 00:02:26.208-->00:02:31.875 what's on the label. And also yeah if-if you should be able to buy a smart gun but not limited 00:02:31.875-->00:02:36.875 to only smart guns. Alright so if you do care to buy a smart gun, the only one you can buy in 00:02:39.250-->00:02:44.250 the states right now is the Armatix iP1 and this is a uh fully uh from the ground up 00:02:46.333-->00:02:50.750 smart gun design it's not like a modification of some other model. And it's made by a German 00:02:50.750-->00:02:56.000 company called Armatix. It's a twenty-two caliber, uh semi automatic, straight blowback 00:02:56.000-->00:03:02.708 action, hammer-hammer fired um, holds ten rounds, um takes two AAA batteries. So you know. 00:03:02.708-->00:03:07.875 Have-have batteries for your gun. Don't wanna have that run out. [laughter] Um it has two 00:03:07.875-->00:03:12.625 components. The pistol and the watch and the way that it authenticates its users to see 00:03:12.625-->00:03:19.417 if they're authorized is by communicating with the watch. So, give you kind of an idea of 00:03:19.417-->00:03:25.750 how that's supposed to work. Uh what you would do, the user would put the watch on the wrist 00:03:25.750-->00:03:30.292 and then enter a-a pin on the watch and then select a period of time between about one and 00:03:30.292-->00:03:35.292 eight hours and during that period of time the watch will allow the gun to be fired. And 00:03:35.292-->00:03:40.542 so during that period of time you might draw the weapon and go shoot something and you would 00:03:40.542-->00:03:46.083 squeeze the grip. You'd squeeze the back strap on the pistol. And when that happens the pistol 00:03:46.083-->00:03:51.333 will signal the watch and the watch will check to see if it's authorized and if it is it will 00:03:51.333-->00:03:57.625 send a token to the pistol. The pistol will say "yep I'm here" and the pistol will uh allow 00:03:57.625-->00:04:01.708 itself to be fired with that-that token from the watch. That only works if it's within 00:04:01.708-->00:04:06.625 about a foot so it needs to be within about twenty-five centimeters or a foot um to work 00:04:06.625-->00:04:11.625 like-like that. So um let's see how this works. With the uh the caveat that this is not my 00:04:16.583-->00:04:21.583 computer so we'll see-we'll see, doo doo doo. So the first thing. I'm gonna show two videos. The 00:04:32.375-->00:04:37.375 first one is if you don't have a watch on and oop hold on a second. [clicking] Oop oop Hold 00:04:40.583-->00:04:45.583 on. Hold on. There we go. In case you were unaware they were having AV difficulties in this 00:04:48.042-->00:04:53.000 room all day so um. Alright so here's what happens if you try to fire the wea-Armatix iP1 00:04:53.000-->00:04:58.000 without a watch on. Uh, What you'll see is that when you pull the trigger the hammer will fall 00:05:01.375-->00:05:07.125 and the gun will just go click. Nothing will happen. Alright. So that's without the watch. Now 00:05:07.125-->00:05:12.125 the normal operation with a watch is you pull the trigger and it goes- [gunfire] it goes 00:05:14.708-->00:05:19.708 bang. Alright. So pretty standard. That's uh-that's how it's supposed to work. Hmm hmm 00:05:24.417-->00:05:29.417 hmm. Alright so last year I spoke at Defcon about side channel attacks on high security 00:05:35.250-->00:05:39.917 in the electronic safe locks and so y'know that happened and it went well and I cracked some 00:05:39.917-->00:05:44.833 safe locks and that was great and so then I was looking for what to do next. And I-I kind of 00:05:44.833-->00:05:50.583 thought back to this thread. This was a thread on a uh a very pro gun forum um about a review 00:05:50.583-->00:05:56.917 of the Armatix rP1 back when it was released around 2015 and the-the people on there were 00:05:56.917-->00:06:02.458 kind of uh- y'know maybe mocking it like one person in particular this guy named Sky Hawk said 00:06:02.458-->00:06:08.458 "yeah could you imagine what the guys at Defcon could do to the uh iP1." So I thought well uh 00:06:08.458-->00:06:13.458 I'm a guy at Defcon I guess. And so y'know. Le-let's see what happens here so um I got one and 00:06:16.958-->00:06:21.125 I thought "oh y'know um I wonder how hard it will be to hack it-it'll be a really good 00:06:21.125-->00:06:26.125 challenge" and then I-I hacked it three ways. So, um we are going to show th-all three of 00:06:28.583-->00:06:32.750 these today. So the three hacks to defeat the proximity restrictions so instead of being 00:06:32.750-->00:06:39.542 within a foot you're able to uh extend that range significantly. Secondly to be able to prevent 00:06:39.542-->00:06:45.333 the weapon from being fired even when it is otherwise authorized. And third to fire the weapon 00:06:45.333-->00:06:52.125 without authorization. So the first of these, the proximity restriction is uh normally 00:06:52.125-->00:06:57.125 twenty-five centimeters. Uh again about a foot and to understand what this is you have 00:06:57.125-->00:07:02.667 to look at how the weapon, how the pistol communicates with the watch. And it does this on two 00:07:02.667-->00:07:08.250 different bands. One is in the nine hundred megahertz ISM band and then the other is down in 00:07:08.250-->00:07:12.875 the five point three five kilohertz using inductively coupled communications. You have 00:07:12.875-->00:07:19.583 two coils essentially. One is in the pistol and one is in the watch and uh when the pistol 00:07:19.583-->00:07:24.875 wants to signal the watch it will generate a signal, a carrier at five point three five 00:07:24.875-->00:07:31.542 kilohertz. That will be coupled through from it's coil to the watch's coil and that looks like 00:07:31.542-->00:07:37.042 this. If you hook up a coil, another coil to an oscilloscope and place it near the pistol 00:07:37.042-->00:07:40.750 while it's attempting to signal the watch, you'll see something like this. It's a five point 00:07:40.750-->00:07:45.250 three five kilohertz burst for about one and a half milliseconds. Uh carries no 00:07:45.250-->00:07:51.125 information on its own. It's just a pure carrier. And so all this does is signal the watch 00:07:51.125-->00:07:55.125 that it wants to communicate on the higher nine hundred megahertz band. Now critically 00:07:55.125-->00:08:00.625 this is how it knows that it's close to the watch because of physics the coupling only 00:08:00.625-->00:08:06.042 happens within about a foot um it falls off much quicker. Its not-its not a propagating wave 00:08:06.042-->00:08:12.208 or anything. So I thought well y'know that sounds like we could just make a classic relay 00:08:12.208-->00:08:19.000 attack. Mmm so I whipped that up um. This is a block diagram of the device I made for that. So 00:08:19.000-->00:08:23.708 to kind of walk you through it. On the one-there are two half parts to this device, or two 00:08:23.708-->00:08:27.667 devices rather. One goes near the pistol and the other goes near the watch. On the pistol 00:08:27.667-->00:08:34.083 side you have a tuned coil, tuned to five point three five kilohertz and the coil there 00:08:34.083-->00:08:40.750 listens for the signal from the pistol. When the pistol has its backstroke squeezed it'll 00:08:40.750-->00:08:45.750 generate a five point three five kilohertz tone which will be coupled into the coil which will 00:08:45.750-->00:08:50.083 go into a band fast filter or amplifier, go to the micro controller and eventually be 00:08:50.083-->00:08:55.917 make its way into our nRF24 which is a uh a nice little two point four gigahertz 00:08:55.917-->00:09:00.917 transceiver. Really easy to use, cheap, all that. That signal, that trigger is in uh 00:09:03.750-->00:09:08.333 transmitter of a two point four gigahertz backhaul to another two point four gigahertz device 00:09:08.333-->00:09:13.583 another nRF24 which goes to another microcontroller and-and this time goes to a coil driver 00:09:13.583-->00:09:18.083 so essentially it's going to transmit at five point three five kilohertz. Into another 00:09:18.083-->00:09:24.833 tuned coil. Tuned LC circuit. LC tank. And from there. That couples into the coil in the 00:09:24.833-->00:09:29.500 watch. The watch receives that signal. Thinks "hey I'm talking right to the pistol" and 00:09:29.500-->00:09:35.792 generates the token meant for the pistol to authorize it for firing and um that gets 00:09:35.792-->00:09:40.708 transmitted back in the nine hundred megahertz band. Now the nine hundred megahertz band is a 00:09:40.708-->00:09:46.708 true propagating-um has a true propagating wave so it gets uh much further than the five point 00:09:46.708-->00:09:52.542 three five kilohertz would so it can go directly from the watch to the pistol um at least about 00:09:52.542-->00:09:57.625 three meters. So you've extended the range from about twenty-five centimeters to about three 00:09:57.625-->00:10:02.625 meters. Alright so, um the hardware itself, pretty simple. It kind of uh s-I built the red 00:10:06.042-->00:10:10.583 boards on there um, whipped them up in an afternoon. Uh not-not too hard. The uh the way I 00:10:10.583-->00:10:15.542 designed it is to have the hardware be reusable for both the pistol side and the watch 00:10:15.542-->00:10:21.208 side and just populate different components to uh to and act of the different functionality. Um 00:10:21.208-->00:10:26.458 those nRF24 little receiver boards. Those are-are great and they're super cheap. They're 00:10:26.458-->00:10:30.833 like five bucks a piece off of Amazon. So if you're looking for something like that th-that's 00:10:30.833-->00:10:37.125 great. Um here's a little pic. Sixteen F, Eighteen three twenty-four microcontroller. 00:10:37.125-->00:10:42.708 Y'know. It's like less than a dollar. Super capable. Love that too. And uh circuit boards also. 00:10:42.708-->00:10:46.750 Man circuit boards are cheap these days. Like you can get those from China for nothing 00:10:46.750-->00:10:52.792 like uh I des-I ripped up the design, some of the Gerber and a week later they're in my hands 00:10:52.792-->00:10:58.083 and it's super cheap. So twenty bucks for the relay, for the custom hardware and load from 00:10:58.083-->00:11:03.083 firmware for it and all that. Alright so, um let's take a look then at what the relay attack 00:11:10.167-->00:11:15.167 looks like. Doo doo doo. Yeah. Okay so the-a little bit of context here. Um what I'm doing 00:11:24.917-->00:11:28.542 right now is I'm picking up uh the pistol and I don't have the watch on. You'll notice the 00:11:28.542-->00:11:33.542 watch is down at the bottom on the table. As you can see-yeah on the table. And uh it's well 00:11:36.125-->00:11:40.583 out of range-normal range. It's about three feet away when I go to shoot it and as a result when 00:11:40.583-->00:11:46.625 I pull the trigger it's just gonna go click so you'll see that happen. [click] Alright so 00:11:46.625-->00:11:51.375 just click. Now what I'm doing is I'm taking the one half of the relay the part that goes 00:11:51.375-->00:11:56.375 near the pistol and y'know hold it up to the pistol and you'll see right next to the watch on 00:11:56.375-->00:12:01.042 the table there already is the other half of the relay and that's going to communicate 00:12:01.042-->00:12:07.208 that-that trigger signal to the watch then so when we hold it up to the pistol and pull the 00:12:07.208-->00:12:12.208 trigger this time [gunfire] it goes bang. So there we go. Defeated the uh range uh 00:12:14.708-->00:12:19.708 restriction with uh with the relay attack. Classic. Um, yeah. So let's see here. [applause] 00:12:31.458-->00:12:36.458 Thanks. Now part of the reason why this works is because it has a-a very lax timing requirements 00:12:38.875-->00:12:43.167 um with the- just this one built it actually tolerates at least six hundred and thirty 00:12:43.167-->00:12:48.667 microseconds of delay and um that's kind of surprising. And I was expecting a much more- a 00:12:48.667-->00:12:53.792 much tighter uh timing requirement. But like here are the still or uh screenshot. You 00:12:53.792-->00:13:00.417 can see the blue trace which is when the pistol is transmitting its y'know normal five point 00:13:00.417-->00:13:05.583 three five kilohertz tone. And then you have the uh the relay generated tone down below and 00:13:05.583-->00:13:09.875 that is separated by about six hundred and thirty microseconds and it seems to handle that no 00:13:09.875-->00:13:15.000 problem. So one of the things they could do to- to kind of improve on this is really 00:13:15.000-->00:13:21.917 enforce tighter timing requirements um you might not the-the distances involved here 00:13:21.917-->00:13:26.333 like a foot is so short that you're talking about like sub nanosecond times for the speed 00:13:26.333-->00:13:32.708 of light but you could at least tighten things up for in terms of tolerance um if we -if it-say 00:13:32.708-->00:13:38.042 if it had tolerated uh a microsecond of delay that would have been much harder to-to 00:13:38.042-->00:13:44.375 mount and attack on so uh it would be even better approach would be to not rely on nRF at 00:13:44.375-->00:13:50.417 all if you needed proximity - if you needed defense proximity you might want to use something that 00:13:50.417-->00:13:55.125 has physical contact. It actually ends up being a tricky problem actually applicable to a 00:13:55.125-->00:14:00.125 lot of industries. You'll find this a lot with cars for example and you'll see other talks 00:14:00.125-->00:14:05.917 including here at Defcon this year where they talk about relay attack and in other context. So 00:14:05.917-->00:14:10.667 classic relay attacks it's kind of a hard problem to defend against but y'know it still 00:14:10.667-->00:14:14.292 requires that you have access to the watch and that could be kind of tricky and you have to kind 00:14:14.292-->00:14:18.458 of like have contrive scenarios where that would be relevant. But I got to y'know build some 00:14:18.458-->00:14:23.458 hardware and write some firmware so I was like y'know Yeah. Pretty happy about that. Um so 00:14:27.292-->00:14:32.292 the next attack is denial of service. So we've- this is when you want to fire the gun and you 00:14:34.333-->00:14:40.583 are authorized to fire the gun but you can't fire the gun uh because of some external 00:14:40.583-->00:14:44.792 influence. So you can kind of imagine a couple different scenarios here where this might 00:14:44.792-->00:14:51.750 happen. Perhaps an adversary wants to prevent you from firing your gun or perhaps there's 00:14:51.750-->00:14:58.375 somebody who say doesn't want any guns fired within a-an area. Or perhaps there's not 00:14:58.375-->00:15:02.958 intentional at all. Maybe it's just somebody's grandmother blabbing on the cordless phone 00:15:02.958-->00:15:08.083 and nobody knows why she still has a landline but y'know it's there. Or maybe a baby monitor. 00:15:08.083-->00:15:13.625 There's actually a lot of devices that operate on this nine hundred megahertz ISM band 00:15:13.625-->00:15:18.625 um and tho-a lot of them have uh modulation schemes that will allow, potentially interfere 00:15:20.917-->00:15:25.917 with what the iP1 uses and so to uh-to test against this what they should be doing during 00:15:29.750-->00:15:32.875 development or prior to releasing this product is they should be doing what's called 00:15:32.875-->00:15:36.917 EMC test. This is electromagnetic compatibility and this tests for two things. 00:15:36.917-->00:15:43.375 Uh especially for part fifteen devices like this. One, you want to make sure that this device 00:15:43.375-->00:15:49.250 doesn't interfere with another device. And two you want to make sure that other devices don't 00:15:49.250-->00:15:54.250 interfere with your device to -to the extent possible anyway. And so uh one of the great 00:15:56.250-->00:16:00.458 things about this testing and the FCC certification is that you can go look up all this 00:16:00.458-->00:16:05.250 information online. It's all- it's all public record. And so on all these devices that have 00:16:05.250-->00:16:10.250 uh FCC IDs you can go to the web and enter in that FCC ID and pull up all sorts of useful 00:16:12.583-->00:16:18.208 information about the bands that the devices operate on and things like internal photos 00:16:18.208-->00:16:23.208 sometimes schematics and uh fortunately for this one it was- they had a just a wealth of data 00:16:25.333-->00:16:31.583 in the FCCs certification database. Including, uh, some great photos and from the um the 00:16:31.583-->00:16:36.125 inside the pistol and the watch which is useful because it's otherwise uh podded in epoxy and 00:16:36.125-->00:16:41.792 I would have had to kind of destroy the- the gun to extract it. That showed the transceiver 00:16:41.792-->00:16:46.417 that they use. They use a transceiver from a company called Marada now uh part of our 00:16:46.417-->00:16:53.042 FM. And it's the TR1000 and so this transceiver operates at nine hundred and sixteen point 00:16:53.042-->00:16:58.625 five megahertz. Uh, it's a fully, uh kind of integrated transceiver but um and it-its 00:16:58.625-->00:17:03.625 not too advanced for its on off keying and amplitude modulage and amplitude shift keying. Um, 00:17:05.792-->00:17:10.458 when you want to transmit data you would feed it a-a bit stream. Kind of a base band 00:17:10.458-->00:17:15.625 signal and when you're trying to have received data from it you receive essentially a-a-a simple 00:17:15.625-->00:17:20.667 bit stream. Um but it isn't like decoding it down into it like-like the packet layer or 00:17:20.667-->00:17:25.667 anything like that. So, uh to kind of understand this- what it gives you back on the receiver 00:17:28.333-->00:17:33.333 side which is then to understand why we can attack it. Let's learn a little bit about why the 00:17:35.542-->00:17:41.458 IP1 encodes data and um this is about- this is Manchester coding. Manchester coding is all 00:17:41.458-->00:17:46.417 about the edges. About the transitions like from low to high. That would be a one. And 00:17:46.417-->00:17:53.250 from high to low would be a zero. Has some great aspects. One is that it is- it has a zero 00:17:53.250-->00:17:58.250 DC value so that simplifies a lot of design. Um, one thing though is that you have to have 00:18:00.458-->00:18:05.083 a good slicer level to decide what is high and what is low and if you have the slicer level set 00:18:05.083-->00:18:08.750 incorrectly you might miss a transition and then you'd lose a bit and then of course your 00:18:08.750-->00:18:13.750 data's corrupted. So here's kind of an example of that. In the top we have a slicer level 00:18:13.750-->00:18:18.333 that's set sufficiently even though our second little rise there is a bit of a runt pulse. 00:18:18.333-->00:18:22.583 It still gets high enough above the slicer level that we can see that edge and decode the bit 00:18:22.583-->00:18:29.000 stream into one zero one one. In contrast on the bottom, the slicer level is too high and we 00:18:29.000-->00:18:35.333 miss that- that transition on that runt pulse. It goes high but not high enough and we-we 00:18:35.333-->00:18:40.333 totally miss that bit. So, we're not able to decode that bit stream successfully in that 00:18:43.750-->00:18:48.750 case. So, with that background in mind here is what a- an actual authentication tooken 00:18:52.083-->00:18:57.917 from the watch to the pistol looks like. Its nineteen bytes long and you can see each of the 00:18:57.917-->00:19:02.917 individual bytes grouped in these little bursts-these little jagged bursts and most of this 00:19:04.917-->00:19:10.625 data is a combination of constant and static data. About half of it is constant. Half of 00:19:10.625-->00:19:17.625 it is dynamic. The dynamic data contains a uh a time dependent token and that will allow the- 00:19:17.625-->00:19:21.833 the weapon to be fired. They have to have synchronized clocks. And also importantly it 00:19:21.833-->00:19:28.250 has a checksum. And-and there's a checksum not a CRC and it notably is not a error 00:19:28.250-->00:19:33.292 correcting code. All it can do is detect errors it can't correct them. And if it detects 00:19:33.292-->00:19:38.292 an error it will retry about four hundred milliseconds later. Or rather the pistol doesn't act 00:19:40.792-->00:19:47.250 the watch, the watch will retry four hundred milliseconds later. Um, but if you have both of 00:19:47.250-->00:19:52.250 those are corrupted you-you're kind of up a creek. So, I looked at that for a while and uh- I 00:19:55.792-->00:20:02.250 came up with a- what signal it would be most susceptible to and this is a uh pulse data and it 00:20:02.250-->00:20:04.250 is- this is a view of it on a spectrum analyzer set to a zero hertz span. This is kind of a 00:20:04.250-->00:20:06.250 way to make a spectrum analyzer behave in the time domain instead of how it normally 00:20:06.250-->00:20:08.250 operates which is in the frequency domain. It can be pretty useful and so the uh 00:20:08.250-->00:20:13.250 the-the signal the base pan signal I found to be useful wa-has a thirty-three 00:20:22.542-->00:20:28.667 microsecond period of carrier followed by a three hundred microsecond period of no 00:20:28.667-->00:20:34.167 carrier. And so the full period then would be three hundred and thirty-three microseconds. And 00:20:34.167-->00:20:38.083 if you're saying "well y'know where did those numbers come from it seems oddly specific." 00:20:38.083-->00:20:44.583 The answer is the thirty three microseconds is about one bit width in the uh in the-the token 00:20:44.583-->00:20:50.458 being sent from the watch to the pistol and three hundred and thirty three microseconds is a 00:20:50.458-->00:20:55.458 little bit shorter than one byte width. And so- or one byte period. So if you overlay those 00:20:57.958-->00:21:04.583 two you can see that the-they're-the very steady repeating pattern is the-the 00:21:04.583-->00:21:11.000 test signal and the kinda smaller pattern is the-the token from the watch and if you 00:21:11.000-->00:21:17.333 overlay those you can see that the-the test signal happens to hit at least once in every byte, 00:21:17.333-->00:21:23.125 um, and so that's important because of the different ways that the test signal can 00:21:23.125-->00:21:28.125 interfere with the signal from the watch. The-the the desire signal. Uh a couple different 00:21:31.250-->00:21:36.167 scenarios. So we have three different scenarios and uh regarding relative signal 00:21:36.167-->00:21:41.667 strengths. So uh first scenario. Interference is much greater than the signal. Much-much uh 00:21:41.667-->00:21:46.667 stronger. What will happen in this case is the TR1000 will set the slicer level to a point six 00:21:51.583-->00:21:56.583 DB down from the peak of a recent signal. It sets it automatically um and one of the 00:21:59.583-->00:22:05.625 things that even the TR1000 data sheet notes is that it will do that incorrectly in the face of 00:22:05.625-->00:22:10.875 pulse interference. So we're making some pulse interference in setting that slicer level 00:22:10.875-->00:22:15.792 incorrectly. Uh and what will happen then is we have our slicer level way too high and 00:22:15.792-->00:22:17.792 it's well above all of the desired signal and so we totally miss all the transitions and the 00:22:17.792-->00:22:19.792 desired signal so we totally miss all of the bits in that signal and so we don't get the 00:22:19.792-->00:22:21.792 token. The second scenario is when the interference is roughly the same as your desired signal. 00:22:21.792-->00:22:23.792 In that case the interference would fill the gaps in the signal because again we have 00:22:23.792-->00:22:25.792 this pulse happening about once per byte and what will happen then is you're filling in gaps 00:22:25.792-->00:22:27.792 so you are causing again missed transitions. You're still seeing some of the transitions because 00:22:27.792-->00:22:29.792 the slicer level is set correctly this time but whereas since Manchester encoding relies 00:22:29.792-->00:22:31.792 on those transitions, you're filling in the gaps, it sees no transitions, and so you lose 00:22:31.792-->00:22:33.792 those bits again. As before you lose even one bit you lose the entire byte. You lose the byte, 00:22:33.792-->00:22:35.792 you lose the packet and the token is no good and the gun does not fire. So, third 00:22:35.792-->00:22:37.792 scenario is when the interference is somewhat less than the signal. When one of the 00:22:37.792-->00:22:42.125 strange aspect of the-of the byte stream that you could see in the uh some of the period 00:22:42.125-->00:22:47.250 slides is there were kind of gaps between each of the bytes it's like bursts and it kinda 00:22:47.250-->00:22:51.500 looked uh, oddly separated. And what will happen if this interfering signal is low and 00:22:51.500-->00:22:55.792 happens in between those bytes is you'll interfere with the synchronization of the bytes and 00:22:55.792-->00:23:00.875 so the TR1000 will be tricked into setting the slicer level a little bit too low and think 00:23:00.875-->00:23:05.750 that the byte is starting and you'll get this uh corruption again in the bits because your 00:23:05.750-->00:23:09.917 timing and synchronization is off. As before you lose the bits, you lose the bytes and you 00:23:09.917-->00:23:12.833 lose the token. So, so I built, had experimented with all of this and with using some-some 00:23:12.833-->00:23:14.833 lab equipment. Using a signal generator and an arbitrary waveform generator to hone in on 00:23:14.833-->00:23:16.833 what was kind of the right waveform. And from that built a test transmitter. It's very 00:23:16.833-->00:23:18.833 simple. I didn't bother with a circuit board this time. Just built it on some strip board. So 00:23:18.833-->00:23:21.625 what I used here was actually the same module that they use in the pistol and the watch. It's a 00:23:21.625-->00:23:27.625 Murata TR1000 again and driving that with another PIC16F for the base fan signal so that drives 00:23:27.625-->00:23:32.583 the transmitter and the transmitter drives the antenna and we get a portable little 00:23:32.583-->00:23:37.583 test transmitter to kind of simulate what would happen if you had uh some other adversary 00:24:04.208-->00:24:09.208 or just an unintentional interference again like a baby monitor or a cordless phone 00:24:51.917-->00:24:56.917 potentially. So, that works actually really well. Up to at least-up to from at least three 00:25:05.333-->00:25:11.875 meters onto about ten meters. At three meters rock solid. And this is just at uh par fifteen 00:25:11.875-->00:25:16.917 sort of output levels. Its works kind of reliably up til about ten meters. It depends on the 00:25:16.917-->00:25:22.083 relative orientation of the-the watch and the pistol and the transmitter and so forth. But 00:25:22.083-->00:25:27.833 the bottom line at three meters of rock solid um interference. So this is, it's kind of 00:25:27.833-->00:25:29.833 surprising that it worked. Cause it could have caught this sort of thing during, again, y'know 00:25:29.833-->00:25:31.833 EMC testing when they were testing for uh susceptibility to external devices. External 00:25:31.833-->00:25:33.833 fields and so forth. So let's look at the denial of service attack. So, okay so what's gonna 00:25:33.833-->00:25:36.708 happen here. I'm gonna fire it normally. [gunshot] Alright. So the gun fires normally. And now 00:25:36.708-->00:25:41.708 what I'm gonna do is I'm going to go over and take off the transmitter and turn it on. So 00:25:45.292-->00:25:50.292 this is the same transmitter that I was just showing. And I'm gonna try firing it again. 00:26:14.542-->00:26:19.542 [click] [click] [click] and it doesn't fire. So, yeah [applause]. So, um, so that, 00:26:28.958-->00:26:33.583 y'know that was kind of interesting. Y'know. What could they have done to defend against 00:26:33.583-->00:26:39.625 that? Well one thing would have been to use more transmitter power from the EMC report about 00:26:39.625-->00:26:45.583 the pistol and my own direct measurements found that they were transmitting at about minus 00:26:45.583-->00:26:51.083 twenty BBM which is about in round numbers about twenty BB below the PAR 15 limit. So 00:26:51.083-->00:26:55.042 holding all else equal they could have used a lot more power but they chose not to for some 00:26:55.042-->00:27:01.208 reason. Um, the- an easy software fix. Well maybe not easy, but a possible software 00:27:01.208-->00:27:06.500 fix would be to use error correcting codes. So right now you have a single bit error and 00:27:06.500-->00:27:13.125 you lose the entire token. You lose the-the whole off. So if you had error correcting codes 00:27:13.125-->00:27:19.917 you might be able to tolerate more bit errors and as a result be able to get the token that uh 00:27:19.917-->00:27:26.875 authorizes firing through without uh without failing. Then of course uh using more robust 00:27:26.875-->00:27:31.542 modulation might be another approach. Instead of on-off keying and amplitude modulation 00:27:31.542-->00:27:35.625 maybe consider something like spread spectrum. Something that is inherently more immune to-to 00:27:35.625-->00:27:40.958 uh to interference. Plus a spread spectrum you can use more power than megahert- nine 00:27:40.958-->00:27:45.958 hundred megahertz span. Alright So, I so I-I had to thought about the third attack. So this 00:27:55.958-->00:28:02.250 would be how to make the gun fire without authorization. And so I was considering all sort of 00:28:02.250-->00:28:07.042 interesting angles on it and I was thinking like oh how can I decode the tokens from the 00:28:07.042-->00:28:11.542 watch. And how can I maybe like a replay attack or maybe you can just sort of generate my own 00:28:11.542-->00:28:15.500 tokens or maybe there's some sort of side channel attack. Or something really sexy. I mean I 00:28:15.500-->00:28:20.292 was going for something really technical and sexy and I was really-really gung ho about that 00:28:20.292-->00:28:25.542 and eh making a little bit of progress but not-not as much as I was hoping for. So I took a 00:28:25.542-->00:28:32.500 step back and I pulled up um some patents that our Armatix had filed and it turns out that 00:28:32.500-->00:28:38.208 they had done a pretty good job of explaining how the gun works in their patents. And you know 00:28:38.208-->00:28:44.792 kudos to them for filing a patent that they actually use but um in any case it provided 00:28:44.792-->00:28:50.375 some insight into how the mechanism would be weak and how it could be compromised so I'm 00:28:50.375-->00:28:56.417 just gonna go into how-how the gun works internally to give me an idea of where we were gonna 00:28:56.417-->00:29:01.875 be going with this. So internally if you imagine that you're looking down the slide of 00:29:01.875-->00:29:06.292 the gun. So this is the top part of the gun that slides back and forth. It's the part that has 00:29:06.292-->00:29:09.917 the barrel on it so imagine you're kind of looking in line with the barrel from behind the 00:29:09.917-->00:29:13.917 hammer. So from the back of the gun. You're kind of looking longitudinally down that and 00:29:13.917-->00:29:20.500 you're looking at the firing pin. Now, ordinarily the firing pin is blocked. It has some-you 00:29:20.500-->00:29:27.000 can imagine having some lugs in the side and those not matching up with sort of a-a uh a holes 00:29:27.000-->00:29:33.500 in the s- in the slide. So you might have this mis fashioned uh the lugs to the wards and if you 00:29:33.500-->00:29:38.417 were to strike the firing pin with the hammer it wouldn't move and the gun wouldn't fire so 00:29:38.417-->00:29:43.667 that's kind of what you want ordinarily when you're not pulling the trigger for example. 00:29:43.667-->00:29:48.667 What happens is when you partially pull the trigger you move that uh mechanism a little 00:29:51.125-->00:29:58.042 bit particularly you rotate the firing pin slightly and those wards or those lugs become 00:29:58.042-->00:30:04.625 closer to lining up with the wards. Closer to uh matching and allowing it to slide but not 00:30:04.625-->00:30:10.667 quite far enough. So you pull the trigger and pull the trigger halfway and you would get a 00:30:10.667-->00:30:15.667 little bit of movement on the- the firing pin but not enough to fully unlock the device. And 00:30:18.667-->00:30:22.792 that's kind of just the-the scenario you have if you're if you're not authorized to fire. 00:30:22.792-->00:30:26.167 Like lets say you pull the trigger the full way. Nothing happens because its you have 00:30:26.167-->00:30:33.125 that mismatch. However if you do have - if you are authorized to fire then an electromagnet is 00:30:33.125-->00:30:38.750 turned on by the microcontroller in the pistol and that electromagnet will pull on 00:30:38.750-->00:30:42.792 another piece that's connected to the firing pin. This is a little bit of a ferrous metal 00:30:42.792-->00:30:49.250 which means it can be attracted by a magnet. And when the electromagnet pulls on that 00:30:49.250-->00:30:54.250 ferrous material it will align the lugs with the wards in the-in the slide and at that 00:30:57.708-->00:31:03.875 point then the firing pin can slide longitudinally so when the hammer strikes the firing pin 00:31:03.875-->00:31:08.875 the firing pin will move, strike the primer in the cartridge and the gun will fire. So um this is 00:31:13.125-->00:31:19.917 actually a-a shot of the patent which was great. See patent y'know eighty-nine, sixty-six, 00:31:19.917-->00:31:24.750 eight o three. Good tip if you're looking for patents that companies have filed. They don't 00:31:24.750-->00:31:29.417 always file them in a way that there as easily searchable so you what you wanna look for I 00:31:29.417-->00:31:33.333 found is to search in the company name and then pull the patents they have filed in their 00:31:33.333-->00:31:38.333 name and then pull up other patents that are associated with the inventors on those patents 00:31:40.458-->00:31:44.458 and sometimes you can get a much uh greater breadth of information than you otherwise 00:31:44.458-->00:31:50.833 would, even if it doesn't mention the company by name those are their patents. In real 00:31:50.833-->00:31:57.500 life this is what it looks like. This is a view into the gun from the top. This is, imagine you've 00:31:57.500-->00:32:02.792 taken the slide off of the pistol and you're looking from the top down into the gun. So 00:32:02.792-->00:32:07.750 this is uh you have the barrel on the left and you have the hammer on the right and kind of 00:32:07.750-->00:32:11.875 in between them where the arrow is pointing you have this little circle and in that circle there 00:32:11.875-->00:32:18.708 is an electromagnet. It's the electromagnet from the diagram. Now that lines up with the 00:32:18.708-->00:32:23.333 components in the slide. So this is the slide and you have two views of it here. The profile 00:32:23.333-->00:32:28.333 view and the bottom view. Or-or from the bottom up. You can see there is uh a little piece that 00:32:31.917-->00:32:36.417 the cam would press on when you pull the trigger partway. When you pull that trigger partway it 00:32:36.417-->00:32:40.708 will lift up on a linkage and move that piece of ferrous material down a little bit 00:32:40.708-->00:32:46.750 further into range of the electromagnet. And uh then y'know operate as before. If the 00:32:46.750-->00:32:51.917 electromagnet is on it will be pulled-be pulled further. Unlock the firing pin. And if not it 00:32:51.917-->00:32:56.917 will just uh not fire. So one thing you can see easily on this paired view of the profile view 00:32:59.917-->00:33:05.167 and the bottom view of the slide is where the ferrous material is relative to kind of markings on 00:33:05.167-->00:33:10.167 the side of the slide. You can see it's kind of uh near this detent on the right side. So 00:33:12.833-->00:33:19.667 keep that in mid for a little bit later. Um, y'know I thought I thought gosh an electromagnet 00:33:19.667-->00:33:25.167 I-I could just put a big a** magnet next to it right and like, uh they make those. And 00:33:25.167-->00:33:30.625 y'know pull the same way and so I went on Amazon and I'm like y'know "Big A** Magnet" and its 00:33:30.625-->00:33:36.500 like this huge hockey puck sized nudenium magnet. Uh so I was like y'know y'know overnight 00:33:36.500-->00:33:42.917 that or uh two day it and um I got it and I-I uh I slapped that on the side of the-the gun and 00:33:42.917-->00:33:48.333 it did not work at all. I mean it was dead. That was way too much magnet. Like it was. That 00:33:48.333-->00:33:53.542 was just. [laughter] And I could kind of just imagine kind of a sucking sound. Kind of a [makes 00:33:53.542-->00:33:57.500 sucking sound] of all the components in the- in the pistol being kind of pulled to that 00:33:57.500-->00:34:02.625 side. It was uh, yeah nothing that you couldn't pull the trigger at all. [laughter] You 00:34:02.625-->00:34:07.625 couldn't like, it was just like way too much magnet. Um so never thought I'd say that, yeah. Too 00:34:10.958-->00:34:15.958 much magnet. Yeah. Uh so I- I went back to Amazon and found some smaller magnets. These are 00:34:20.333-->00:34:26.417 some again nudenium magnets about an inch and a quarter by about a quarter inch and you 00:34:26.417-->00:34:30.125 need about three of 'em. They come in four packs but you need about three of them so you need 00:34:30.125-->00:34:34.625 about fifteen dollars worth of magnets. And I got those together and I picked up some- 00:34:34.625-->00:34:39.750 some scrap wood dowel and uh stainless steel screw. Stainless steel so it wouldn't uh be 00:34:39.750-->00:34:45.333 attracted by the magnet depending on the alloy. And this is the magnet tool. This is the 00:34:45.333-->00:34:51.458 fifteen dollar tool to defeat the fifteen hundred dollar smart gun. Um you can see a piece of 00:34:51.458-->00:34:56.292 wood with a screw in it and some magnets stuck on the end. Uh it's kind of good that I needed 00:34:56.292-->00:34:59.917 exactly three magnets because there's no way I'm ever getting those apart again. Like they 00:34:59.917-->00:35:04.917 are-they are really stuck together. So the way you use this tool. Pretty simple. You 00:35:08.375-->00:35:14.000 just align the magnet right there. Remember from the earlier slide you have the ferrous 00:35:14.000-->00:35:18.500 material that was aligned basically where that arrow is and so again what you're doing 00:35:18.500-->00:35:23.500 you're just pulling from the-the outside standing in for the electromagnet and uh that is 00:35:27.708-->00:35:32.125 most easily done actually at a slight angle. I found that if you-you had kind of uh the 00:35:32.125-->00:35:37.125 magnet just right on the edge it would uh kind of pull too hard but in a little bit of an angle 00:35:39.583-->00:35:45.042 works a lot better. Let's see, so you slide the magnets up there. Oh one other thing to 00:35:45.042-->00:35:50.042 notice about this. You'll see this in the video too. There's a red light kind of near my-my um 00:35:52.292-->00:35:57.375 uh wrist sort of on this picture near the back of the gun. When the gun is authorized for firing 00:35:57.375-->00:36:02.750 it'd be green but in this photo and ththe video that we're gonna see in a moment it will always 00:36:02.750-->00:36:08.375 be red. It's always be unauthorized to fire. Not authorized to fire. Alright, so 00:36:08.375-->00:36:13.375 let's look at the demo of the magnet attack. Firing without authorization. [click] Okay 00:36:21.875-->00:36:26.667 again with a little bit of context. I'm gonna do- pull the trigger a few times to show that 00:36:26.667-->00:36:30.625 the gun won't fire ordinarily. So right now I don't have kind of the watch nearby or anything 00:36:30.625-->00:36:35.542 like that. No relay attack. Nothing like that in place and so you'll know it. If you-It's 00:36:35.542-->00:36:39.583 kind of hard to see the red light is on on the back indicating it's not authorized 00:36:39.583-->00:36:44.792 to fire. So pulling the trigger a couple times. [click] [click] Not working. So then we'll take 00:36:44.792-->00:36:49.792 the magnets. Put them next to the gun on the right spot. [gunfire] And it fires. 00:36:55.000-->00:37:00.000 [applause] Thanks. So then y'know a couple other instances of this. I fired it again uh or 00:37:05.708-->00:37:11.292 I clicked it again showing it wouldn't work [click] put the magnets up and [gunfire] fires 00:37:11.292-->00:37:15.500 again. And you know for- how bout a, how bout a first person view? Alright so we're gonna go 00:37:15.500-->00:37:21.333 and- and take that and [click] oop nope doesn't fire. Oh no. Oh no. [click] Actually this time 00:37:21.333-->00:37:26.292 it didn't work the first time but that's okay we'll just put the magnets back on again and oh 00:37:26.292-->00:37:31.375 there we go [gunfire]. No problem. No problem. So you take the magnets off. Put em on. 00:37:31.375-->00:37:36.375 [gunfire] No problem. Pretty easy. I actually showed, uh. [applause] I-I so I showed uh a 00:37:45.542-->00:37:50.375 couple people how to do this and they they caught on pretty fast. Um in fact for the wired video 00:37:50.375-->00:37:54.792 piece the-the videographer I had him I had him shoot it too to show him I wasn't full of s**t 00:37:54.792-->00:37:59.792 or something so um the, yeah so y'know it. I know what you're thinking. Y'know. F**king 00:38:02.542-->00:38:07.542 magnets how do they work? Um it's a miracle. It's a miracle, yeah. I-I honestly didn't know 00:38:11.500-->00:38:14.500 it. I had no idea what anyone was talking about and everyone kept being like "F**king 00:38:14.500-->00:38:19.167 magnets." And then I'm like "what are you talking about." I had to Google that one I'm 00:38:19.167-->00:38:23.875 sorry. I'm getting old. Um the magnet defense however. How do you defend against this sort of 00:38:23.875-->00:38:28.875 thing? So basically uh don't do this. Don't rely on solenoids. Don't rely on DC magnetic fields 00:38:33.000-->00:38:36.458 and we see this thing, this sort of problem repeated again and again. Like there was this 00:38:36.458-->00:38:41.958 classic case a couple years ago about Sentry safes. So this particular model of Sentry Fire 00:38:41.958-->00:38:47.083 Safe was susceptible to a magnet attack uh you basically would just put a magnet a magnet up on 00:38:47.083-->00:38:53.625 the- the door and it would move a solenoid inside the safe and the safe would open so, um, 00:38:53.625-->00:38:58.583 pretty pathetic and the-they kind of made the same mistake here and so I would guess they 00:38:58.583-->00:39:02.708 aren't the last to make that mistake either. But basically don't use anything that relies 00:39:02.708-->00:39:08.000 on DC magnetic fields. Instead consider something like a motor drive. So in better safe locks 00:39:08.000-->00:39:14.583 like the ones I talked about last year. You'll find a motor and it'll move like a bolt on an 00:39:14.583-->00:39:19.625 acting screw for example. And this is much harder to-to in-induce from outside of the 00:39:19.625-->00:39:26.542 safe or outside of the gun or externally anyway. And um that- that sort of uh that's one 00:39:26.542-->00:39:31.875 approach. Another option would be to design a system that would detect an attack. So that would 00:39:31.875-->00:39:36.292 have some sort of relocker. So like it would say oop there's some sort of external magnetic 00:39:36.292-->00:39:39.167 field so as a result we're going to activate a secondary lock and there are a variety of clever 00:39:39.167-->00:39:44.167 implementations for this sort of thing but um again the the idea is that any sort of external 00:39:49.542-->00:39:54.417 magnetic field would in-induce some sort of secondary relocking ideally without any sort of 00:39:54.417-->00:39:59.417 electronic interventions so that it would still work with the power off. So uh y'know y'know a 00:40:01.750-->00:40:06.750 few- a few thoughts finally um. A-again I'm not against smart guns. I think that if you want a 00:40:09.625-->00:40:15.917 smart gun you should be able to have a smart gun but you should get what's on the label. You 00:40:15.917-->00:40:21.792 should have one that actually provides meaningful extra security. And I think this fell 00:40:21.792-->00:40:28.583 short. I think the the iP1 um fell short and uh it was kind of a dis-kind of a little bit of a 00:40:28.583-->00:40:32.167 disappointment. I was expecting a greater challenge. Actually when the magnet thing happened I 00:40:32.167-->00:40:37.167 was really hoping for a y'know a Defcon talk. I was like "oh no magnets." Like that's not gonna 00:40:39.375-->00:40:44.375 fly. Like that's too simple. So I'm like "Oh no magnets" but then uh, it turned out to be 00:40:46.500-->00:40:51.833 interesting anyways I thought. Um there was also kind of an ethical dilemma and I went back 00:40:51.833-->00:40:56.542 and forth with the media actually about this because they were worried about teaching kids 00:40:56.542-->00:41:02.667 how to do something dangerous. In this case how to fire maybe their parents gun. And y'know 00:41:02.667-->00:41:06.750 it's always kind of tricky and you- you see this a lot with with hacking and so forth in 00:41:06.750-->00:41:11.250 many contexts. Is it better to kind of sit on the information or is it better to share it with 00:41:11.250-->00:41:15.417 the world. And I took the opinion that yeah, you might be sharing this information, 00:41:15.417-->00:41:20.333 teaching a kid how to fire their parent's gun but on the other hand you're telling their 00:41:20.333-->00:41:24.542 parents that this exists. You're getting the word out that these things exist and that we can fix 00:41:24.542-->00:41:30.292 them and then we can make future products better. Y'know. I-i-it's probably. Y'know I was 00:41:30.292-->00:41:35.167 talking to somebody else about this and he pointed out that it's good that this sort of 00:41:35.167-->00:41:42.042 problem was found now before anybody's died because of it than in the future when somebody 00:41:42.042-->00:41:48.625 might discover it because of some unfortunate accident with a kid or... So anyhow if you have 00:41:48.625-->00:41:53.625 any questions I'll be out in the hallway and uh thanks for your attention and have a good 00:41:58.458-->00:41:59.667 evening. [applause]