1 00:00:00,000 --> 00:00:00,760 All right, cool. 2 00:00:00,760 --> 00:00:02,540 We're going to start going now. 3 00:00:02,540 --> 00:00:03,980 So my name is Justin. 4 00:00:03,980 --> 00:00:08,400 I work for Delphi Automotive, who is sponsoring the Car Hacking Village. 5 00:00:08,420 --> 00:00:10,840 I run the red team testing lab there. 6 00:00:10,880 --> 00:00:15,480 So my team, who you'll see around here, is the ones that are going to be doing demos and doing a lot of this stuff for us. 7 00:00:15,480 --> 00:00:20,000 But we hack our own modules to help our engineers secure them better. 8 00:00:20,820 --> 00:00:26,420 So to get into this a little bit, starting off at the Car Hacking Village, we do have a CTF there this year. 9 00:00:26,540 --> 00:00:27,920 It's really, really cool. 10 00:00:27,920 --> 00:00:32,080 They've got lots of different interfaces, lots of different systems to hack into. 11 00:00:32,280 --> 00:00:34,800 The first place prize is this truck over here. 12 00:00:35,500 --> 00:00:38,180 So if you guys want to play around, you can win a truck. 13 00:00:38,440 --> 00:00:42,500 Another prize that we're going to be giving away is this antenna that we're going to be demoing for you guys. 14 00:00:42,560 --> 00:00:47,260 So you can see right here, this is a GPS helical directional antenna. 15 00:00:47,460 --> 00:00:50,120 We'll go into the making of that as well in a little bit. 16 00:00:51,280 --> 00:00:53,460 So to, yeah, going back to our day job. 17 00:00:53,460 --> 00:00:57,480 So we're a Delphi cybersecurity testing team. 18 00:00:57,620 --> 00:01:01,880 We do pen testing for the company, process and tool development as well as research and development. 19 00:01:02,040 --> 00:01:03,500 This is what our facility looks like. 20 00:01:03,500 --> 00:01:08,680 We've got a bunch of garage bays we can pull cars into and a pretty big facility to do testing on modules. 21 00:01:09,860 --> 00:01:16,140 So now moving into the outline, we're going to talk about different test interfaces on the wireless side as well as tool kits for it. 22 00:01:16,140 --> 00:01:19,680 Just to help you guys out in case you may not have tested or done this stuff before. 23 00:01:19,800 --> 00:01:23,300 So we'll just kind of give you the rundown of what we're using and what works for us. 24 00:01:23,520 --> 00:01:26,020 Then we're going to do a demo on key fob analysis. 25 00:01:26,020 --> 00:01:33,440 So we're going to use GNU radio and a hack RF to do some analysis on key fob to show you how to pull those out of the air and do a deep dive into those. 26 00:01:33,640 --> 00:01:40,400 And then we're going to go into building directional antenna, which is this guy over here in the front, Brian, who's the mastermind behind that. 27 00:01:40,440 --> 00:01:46,420 And then we're going to get into the demo of actually directionally pointing GPS over here and showing you how that antenna works. 28 00:01:47,580 --> 00:01:51,020 All right, so now this stuff I'll run through quick because you guys probably know a lot of this. 29 00:01:51,180 --> 00:01:53,620 This is just a typical Wi-Fi standards. 30 00:01:53,620 --> 00:01:55,640 So I just wanted to throw this in here so you had it all. 31 00:01:55,880 --> 00:01:58,640 Here's some tools that you guys can use for Wi-Fi. 32 00:01:59,080 --> 00:02:01,580 We don't do too much Wi-Fi stuff in cars. 33 00:02:01,700 --> 00:02:03,860 I mean pretty much most of them have WPA2. 34 00:02:03,900 --> 00:02:08,020 So unless you can bypass the password, which they're getting a little bit better. 35 00:02:08,020 --> 00:02:12,820 The car companies are slowly getting better at making good passwords on WPA2 . 36 00:02:12,820 --> 00:02:15,600 But that's really the only weakness that we're seeing. 37 00:02:15,860 --> 00:02:18,740 So yeah, we'll go to the next one, which is going to be Bluetooth. 38 00:02:19,060 --> 00:02:22,080 Bluetooth was a lot more vulnerable in the older versions. 39 00:02:22,080 --> 00:02:27,980 So any older cars that have older versions of Bluetooth in it are extremely vulnerable to those types of attacks. 40 00:02:28,160 --> 00:02:29,760 Here's some more specs on that. 41 00:02:29,760 --> 00:02:35,040 It's another RF spectrum that sits in the 2.4 gigahertz range. 42 00:02:36,320 --> 00:02:40,600 The Bluetooth version 5 is really nice because it's bumping up the speed like crazy. 43 00:02:40,600 --> 00:02:43,820 And mainly the, whoops, mainly the distance which is nice. 44 00:02:43,860 --> 00:02:49,160 Just because all these different devices people are making in their houses, you can go a lot more farther in your house. 45 00:02:49,160 --> 00:02:52,460 But then for us, if we want to do drive-bys, we can also get into their stuff. 46 00:02:53,580 --> 00:02:55,980 So here's some tools that we use for Bluetooth testing. 47 00:02:55,980 --> 00:02:57,520 The UberTooth one is really helpful. 48 00:02:57,520 --> 00:02:59,120 And then we just use this adapter. 49 00:02:59,140 --> 00:02:59,900 It's really easy. 50 00:02:59,900 --> 00:03:00,840 We can transmit on this. 51 00:03:00,840 --> 00:03:02,300 We can do whatever we want with this device. 52 00:03:02,300 --> 00:03:04,180 Some Bluetooth devices won't allow you to. 53 00:03:05,280 --> 00:03:09,380 So now moving into cellular, there's three different areas that we focus on in cellular. 54 00:03:09,380 --> 00:03:11,580 This is just giving you a rundown of spectrums. 55 00:03:11,580 --> 00:03:19,120 So whenever we're trying to dig into a new technology or understand it more, this is the type of data we compile to start digging and understanding what tools we want to buy. 56 00:03:19,220 --> 00:03:23,440 And then we start reaching out to vendors or coming to events like this and buying all the hacker tools. 57 00:03:24,280 --> 00:03:34,560 So when you're getting into cellular related stuff or any wireless stuff on cars, it's recommended to look for this type of content on any of the modules. 58 00:03:34,560 --> 00:03:38,220 Mainly something with the FCC ID or even an IMEI number. 59 00:03:38,280 --> 00:03:42,480 It's going to let you know there's a cell network in here and there's transmitting some kind of RF somewhere. 60 00:03:42,740 --> 00:03:46,920 So this is how we quickly can move on to understanding what's coming out of this module. 61 00:03:48,040 --> 00:03:52,700 So now looking into the tools that we use, we're, um, trying to find what works best for us. 62 00:03:52,700 --> 00:03:55,600 So we buy a lot of industry based tools like this guy up here. 63 00:03:55,600 --> 00:03:56,600 This is from Roden Schwartz. 64 00:03:56,600 --> 00:03:58,000 It's a cell site simulator. 65 00:03:58,180 --> 00:04:00,400 So this will actually put up a cell tower for you. 66 00:04:00,400 --> 00:04:06,880 You put a SIM card in your phone or whatever you need to and now you can see all the data streams and everything that's going back and forth from that phone. 67 00:04:07,020 --> 00:04:14,960 So it's really helpful for us when we're trying to test apps in cars that people are building to understand if they're actually communicating to the server securely and what type of data they're sending back and forth. 68 00:04:15,340 --> 00:04:24,580 Um, and then for putting up base stations, um, on a cheaper way, you can use a blade RF with the HBTS or this USRP device with the HBTS as well. 69 00:04:24,580 --> 00:04:30,340 Those are a little bit cheaper routes to go and you get a lot more custom, uh, customizability with those. 70 00:04:30,840 --> 00:04:34,580 Um, next is moving on to key fob, which we're going to show you the demo on. 71 00:04:34,660 --> 00:04:37,520 This is something that was introduced in 1980 by Ford. 72 00:04:37,520 --> 00:04:43,360 Um, there's two main frequencies, which is 3.5 megahertz and 433.92 megahertz. 73 00:04:43,540 --> 00:04:49,960 Um, the distance is 5 to 20 meters and the security on this is mainly rolling codes and challenge response. 74 00:04:49,960 --> 00:05:00,600 A couple years ago you guys may have seen a guy named Sammy Kamkar create a device that was able to bypass or, you know, leverage rolling codes to be able to get into people's cars. 75 00:05:00,760 --> 00:05:05,460 Um, there's also passive key entry systems, which are running stuff in the, uh, kilohertz range. 76 00:05:05,460 --> 00:05:13,000 So when you walk up to your car and you want to unlock it with just your button, uh, or the handle on the car, that's usually using something in the kilohertz range. 77 00:05:13,080 --> 00:05:14,940 And that's called passive key entry. 78 00:05:15,840 --> 00:05:19,140 So here's some tools that we use for, uh, the key fob stuff. 79 00:05:19,220 --> 00:05:25,000 We mainly are using the hacker refs, but the spectrum analyzer is really helpful to see those packets coming across. 80 00:05:25,440 --> 00:05:29,860 Um, and then we also use the yardstick one because that goes down to the lower kilohertz. 81 00:05:31,100 --> 00:05:34,980 So now moving on to GPS, which we'll show you a demo on that as well. 82 00:05:34,980 --> 00:05:38,040 This is something that was created by the United States in the 70s. 83 00:05:38,040 --> 00:05:39,820 Um, there's a few different bands. 84 00:05:39,820 --> 00:05:42,400 The ones that are mainly public are L1 and L2. 85 00:05:42,580 --> 00:05:47,580 Uh, if you want to lock down GPS properly, use both radios in your devices. 86 00:05:47,740 --> 00:05:48,780 Most people don't. 87 00:05:48,780 --> 00:05:52,700 I know Apple doesn't and we can show you what happens with that because they don't. 88 00:05:52,700 --> 00:06:03,240 Um, we'll pretty much can put anybody's phone wherever we want if you're only using one band because your phone's only relying on that band so it's not getting another source to say, hey, you're not actually here, you should be here. 89 00:06:03,860 --> 00:06:06,900 Um, so we'll show you what, how that can be messed with. 90 00:06:07,560 --> 00:06:09,600 Um, some different tools we're using for this. 91 00:06:09,600 --> 00:06:10,960 You can use a hacker ref. 92 00:06:11,240 --> 00:06:15,280 Uh, they're kind of hard because you got to stack a bunch because you have to do transmitting and receiving. 93 00:06:15,560 --> 00:06:20,820 Um, and then we mainly use a blader ref, um, which we have set up here connected to this antenna. 94 00:06:20,980 --> 00:06:22,360 So we'll show you that in a moment. 95 00:06:23,220 --> 00:06:26,760 And then the next one, the last one, which is a fun one, which you guys may not have heard of yet. 96 00:06:26,760 --> 00:06:28,300 This is something that's coming in cars. 97 00:06:28,300 --> 00:06:31,160 It's kind of scary from my perspective because of what they're trying to do with it. 98 00:06:31,160 --> 00:06:33,140 But it is something that's needed. 99 00:06:33,140 --> 00:06:34,180 Cars do need to talk. 100 00:06:34,180 --> 00:06:38,520 If we're going to have autonomous cars down the road, they do have to talk to each other in some manner. 101 00:06:38,580 --> 00:06:41,120 So this is currently the automotive solution for that. 102 00:06:41,120 --> 00:06:42,580 It's called vehicle to everything. 103 00:06:42,820 --> 00:06:52,660 Um, it runs just above, uh, the 5 gigahertz range and it has a protocol of 80211P which is very similar to all the WiFi standards. 104 00:06:52,660 --> 00:06:54,220 It's really not that much different. 105 00:06:55,540 --> 00:07:00,860 The only difference is it's got this IEEE 1609 application layer on top of it. 106 00:07:02,000 --> 00:07:04,740 And then here's some tools that we use for that. 107 00:07:05,000 --> 00:07:08,900 Um, if you're looking into development tools, these are just the hacker type tools besides this one. 108 00:07:08,900 --> 00:07:13,060 But another development tool you can look to is something called Coda Wireless or MK5. 109 00:07:13,280 --> 00:07:17,380 Um, that'll allow you to actually transmit and do some V2X based stuff. 110 00:07:17,420 --> 00:07:19,340 And another one from the auto industry is pretty big. 111 00:07:19,340 --> 00:07:20,220 It's Vector Canoe. 112 00:07:20,220 --> 00:07:25,840 They're really expensive so hopefully in the near future some hackers will release some tools that are a lot cheaper for you guys. 113 00:07:26,500 --> 00:07:30,240 All right, now we can move into this, uh, key fob analysis if you're ready, Dave. 114 00:07:45,150 --> 00:07:46,830 Hi everybody, my name is Dave Conant. 115 00:07:46,830 --> 00:07:52,970 I work for Adelphi along with Justin and I'm sort of the radio guy, I guess, uh, over there. 116 00:07:53,070 --> 00:07:54,890 Is my screen popping up here? 117 00:07:55,990 --> 00:07:56,690 No? 118 00:08:00,620 --> 00:08:06,020 How do I... Oh, there we go. 119 00:08:08,240 --> 00:08:09,400 That's interesting. 120 00:08:18,860 --> 00:08:23,240 Okay, so well, if you can't see it, I'm gonna have a hard time demoing it. 121 00:08:28,780 --> 00:08:30,020 There we go. 122 00:08:30,640 --> 00:08:33,280 All right, so who's used GNU radio before? 123 00:08:33,280 --> 00:08:34,480 Anybody in here? 124 00:08:34,980 --> 00:08:38,740 Has anybody, for the people who haven't used it, have you heard GNU radio? 125 00:08:39,280 --> 00:08:45,320 Okay, so if you haven't used GNU radio or you've heard of it, I'm gonna explain just the basics of what this thing does. 126 00:08:45,320 --> 00:08:51,400 It's a, it's a useful tool that we use in the lab, uh, that we use to isolate different wireless signals. 127 00:08:51,400 --> 00:09:08,600 So Justin spoke about GPS, you know, DSRC, but at the end of the day, in the radio frequency spectrum, you know, vehicles themselves, they have like 15 different radios on them, your phone probably has like 6 or 7, you know, you got Bluetooth, Wi-Fi, but then what about the non-standard wireless? 128 00:09:08,620 --> 00:09:12,240 So I, you know, I've got my key fob here for my truck, for example. 129 00:09:12,240 --> 00:09:23,420 Now this thing doesn't speak Wi-Fi, it doesn't speak GPS, so how do we deal with signals when we don't really have, you know, like a Wi-Fi adapter to like just let us authenticate to it? 130 00:09:23,420 --> 00:09:30,640 Uh, basically, uh, from the blue reverse engineering random wireless signals and looking at the binary data, uh, inside of them. 131 00:09:30,640 --> 00:09:43,320 So I wanna show you 2 tools that we use in the lab, uh, to isolate these signals and, and how we can decode the actual binary data, uh, off of that so we can actually send and communicate with, uh, with these basic devices. 132 00:09:43,440 --> 00:09:50,120 It's actually generally speaking easier to talk to these guys than something like using Wi-Fi. 133 00:09:50,120 --> 00:09:51,500 It's much less complicated. 134 00:09:51,500 --> 00:10:02,160 So for example, with your key fob, it's just a series of bits and if the car hears that, the right series of bits, there's no handshake, it just says, oh, I like those bits, I'm gonna open up the, the car. 135 00:10:02,160 --> 00:10:02,940 It's that simple. 136 00:10:02,940 --> 00:10:07,420 So as long as you know that code or how to generate that code, uh, then you can talk to it. 137 00:10:07,420 --> 00:10:15,060 So actually being able to read the code off of the air if you don't know what the wireless signal looks like is a very useful skill to have in general. 138 00:10:15,060 --> 00:10:23,840 Um, Defcon, we've seen talks that guys talk to satellites using these techniques, you can talk to cars, uh, anything that transmits a wireless signal that you can talk to. 139 00:10:23,840 --> 00:10:34,340 So I'm using a hack RF, I think the range on this thing in frequency terms is, uh, it goes up to 6 gigahertz and down to 10 megahertz? 140 00:10:34,340 --> 00:10:35,460 1 megahertz ? 141 00:10:35,460 --> 00:10:36,240 1 megahertz. 142 00:10:36,240 --> 00:10:37,740 That's a huge range. 143 00:10:37,740 --> 00:10:41,740 Uh, this is actually a monumental invention, software defined radio in general. 144 00:10:41,740 --> 00:10:53,940 Uh, having this kind of power to be able to transmit and receive on that wide a frequency range is something that 10 years ago even would have cost millions of dollars in equipment and would have been military classified type technology. 145 00:10:53,940 --> 00:10:55,760 So please get one and learn how to use them. 146 00:10:55,760 --> 00:10:56,820 They're very awesome. 147 00:10:58,400 --> 00:11:03,060 Alright, so I'm opening up basically a utility called GQRX. 148 00:11:03,280 --> 00:11:07,460 GQRX, if you install GNU radio along with this, uh, you're gonna be covered. 149 00:11:07,460 --> 00:11:09,480 So I'm gonna move this guy over here. 150 00:11:10,160 --> 00:11:12,640 GQRX, this, this guy right here is a spectrum analyzer. 151 00:11:12,640 --> 00:11:14,020 Everybody knows what that is? 152 00:11:14,180 --> 00:11:17,520 It's our eyes and ears on the frequency, uh, the frequency realm. 153 00:11:17,520 --> 00:11:19,560 This lets us see our wireless signals. 154 00:11:19,560 --> 00:11:27,960 This guy and most spectrum analyzers cost between, mm, at least $10,000 up to $500,000 to a million dollars. 155 00:11:27,960 --> 00:11:32,940 Just to give you an idea of what it's like just to see, uh, a spectrum range that we're talking about here. 156 00:11:33,120 --> 00:11:39,140 HackRF costs I think $200 or $300 and it can see almost the same range as this guy. 157 00:11:39,140 --> 00:11:43,860 This, this guy's still better, it's more accurate but the HackRF's good enough for us hackers. 158 00:11:43,860 --> 00:11:53,120 And GQRX, I wanna show you, basically does the same thing that our $200,000 spectrum analyzer over here does. 159 00:11:53,120 --> 00:12:03,340 And you can actually see they look very similar and I'm going to use GQRX to move down and find my key fob signal to show you guys what that looks like. 160 00:12:04,240 --> 00:12:17,300 I happen to know that it's 315 megahertz and everything, all your devices, they come with an FCC ID if they're being sold commercially so they will tell you what the frequency is on the FCC's website. 161 00:12:17,300 --> 00:12:23,580 Super useful website to look up all kinds of parameters that we're gonna use in GNU radio to decode this signal. 162 00:12:23,580 --> 00:12:32,520 So you can see here when I press my little button for my HackRF there's a little bumpity bump coming, it's a frequency shift key coming from my key fob. 163 00:12:32,520 --> 00:12:38,220 I do wanna show you as well, so we're looking at, I think uh, what is this? 164 00:12:39,620 --> 00:12:42,960 20 megahertz in bandwidth or 16 megahertz I can't remember. 165 00:12:42,960 --> 00:12:47,980 I do wanna show you an important and difficult part in dealing with GNU radio is setting up the filtering. 166 00:12:47,980 --> 00:12:51,820 And I wanna show you just what filtering looks like in GQRX. 167 00:12:51,820 --> 00:13:03,500 When you click around you can see that little band there, it's actually filtering all the signals out around it and if I had my audio on it would actually play the sound for the uh, the signal that you're receiving. 168 00:13:03,500 --> 00:13:10,260 So you're narrowing in and zeroing in on that signal that you're looking for despite capturing 20 megahertz worth of bandwidth. 169 00:13:10,300 --> 00:13:13,940 So, I uh, I think my computer locked up. 170 00:13:16,060 --> 00:13:17,720 Yeah, okay. 171 00:13:20,420 --> 00:13:24,200 Well that's okay I was gonna close GQRX anyway and switch to GNU radio. 172 00:13:24,200 --> 00:13:37,620 The important thing to understand is when we're gonna decode this signal in GNU radio and get the binary bits out of there, um, there's basically 4 steps and essentially we have to capture the signal from a source, that's obvious. 173 00:13:37,620 --> 00:13:42,040 And then we need to filter all the junk around it out from the signal. 174 00:13:42,080 --> 00:13:48,500 And that, there's an entire series, you should watch Michael Osmond's uh, SDR series if you haven't already. 175 00:13:48,500 --> 00:13:58,100 It's uh, HackR, it's, he's the guy who created the HackRF and he's got an entire educational video series and he's got an entire one dedicated, an entire hour dedicated to filtering. 176 00:13:58,100 --> 00:13:59,840 It's uh, it's a science and an art. 177 00:13:59,840 --> 00:14:01,340 There's a lot that goes into it. 178 00:14:01,340 --> 00:14:08,140 Uh, there's many different kinds of filters, high pass, low pass, band pass, exflating, fur filters, blah, blah, blah. 179 00:14:08,140 --> 00:14:14,040 Uh, learn them all, what they do, um, they're not that tough but they're a little intimidating to get to at first. 180 00:14:14,040 --> 00:14:17,960 It's very important to zero in on your signal uh, with those filters though. 181 00:14:17,960 --> 00:14:25,680 Okay, so once you've zeroed in on your filter and uh, on your signal with your filter, the next step that you have to do is demodulate it. 182 00:14:25,680 --> 00:14:28,800 Uh, demodulating is gonna come in a couple different flavors. 183 00:14:28,800 --> 00:14:32,540 There's frequency demodulation and amplitude demodulation. 184 00:14:32,540 --> 00:14:44,220 So when you're playing around in GQRX, it will behoove you to figure out and identify with your eye or your ear whether you're dealing with a frequency shift key signal or an amplitude shift key signal. 185 00:14:44,220 --> 00:14:47,400 Amplitude sounds like Morse code or it's changing in volume. 186 00:14:47,400 --> 00:14:55,340 A frequency shift key is gonna have differing tones that you'll hear and it'll sound more like uh, like music or dubstep or something like that. 187 00:14:55,340 --> 00:15:02,720 So, and once you identify that, you can pick your frequency shift keying or, or your amplitude shift keying. 188 00:15:02,720 --> 00:15:06,320 So I've prepared new radio blocks here. 189 00:15:06,680 --> 00:15:08,640 Let's see if this works. 190 00:15:09,240 --> 00:15:10,340 Is it? 191 00:15:13,590 --> 00:15:15,110 No, it doesn't. 192 00:15:17,870 --> 00:15:18,870 What's that? 193 00:15:19,110 --> 00:15:20,350 Oh, there we go. 194 00:15:23,120 --> 00:15:24,940 Now wait for it for a second. 195 00:15:26,000 --> 00:15:27,740 Okay, I have to be fast here. 196 00:15:27,740 --> 00:15:32,320 So my program that I've written here, GNU radio, oh, whoa. 197 00:15:33,520 --> 00:15:36,880 It uses flowcharts to define your actual software. 198 00:15:36,880 --> 00:15:42,280 In the background of each one of these flowcharts, there's actually a Python script that gets executed. 199 00:15:42,660 --> 00:15:45,140 And you can see here, this is what I was talking about. 200 00:15:45,140 --> 00:15:48,420 I'm using the Osmocom source which is my hack RF. 201 00:15:48,420 --> 00:15:55,480 I set the frequency to 315 megahertz because I know that that's where my signal is and I set my sample rate to be about 4 megahertz. 202 00:15:55,480 --> 00:15:58,900 That means I'm capturing 4 megahertz of bandwidth around the signal. 203 00:15:58,900 --> 00:16:00,420 That's a lot of bandwidth. 204 00:16:00,420 --> 00:16:03,900 The actual bandwidth of this signal is like 200 kilohertz. 205 00:16:03,900 --> 00:16:05,260 It's not that wide. 206 00:16:05,260 --> 00:16:07,800 That's why I pass it into a filter. 207 00:16:07,800 --> 00:16:18,120 I'm not gonna explain all of these different uh, parameters but basically I'm zeroing in on the signal with this so uh, it's kind of offset from 315 megahertz. 208 00:16:18,120 --> 00:16:19,480 It's not quite exactly. 209 00:16:19,480 --> 00:16:21,620 It's like 314.9. 210 00:16:21,620 --> 00:16:23,840 You can figure that out from the FCC website. 211 00:16:23,840 --> 00:16:36,580 So I'm offsetting it to zero in on the signal and then I am shrinking down that 4 megahertz of bandwidth just to capture this signal alone and none of the junk that's uh, flying around it especially here at DEF CON. 212 00:16:36,840 --> 00:16:42,880 I'm then piping the signal into a frequency sync which is exactly the same thing as the spectrum analyzer that we see here. 213 00:16:42,880 --> 00:16:47,300 So we can actually see the signal that we're capturing and confirm that uh, that we're getting it. 214 00:16:48,220 --> 00:16:49,540 Demodulating the signal. 215 00:16:49,640 --> 00:16:53,400 And now this is the, the secret sauce to get the binary data out of it. 216 00:16:53,400 --> 00:16:56,640 So at this point, this is nice, you'll actually be zeroed in on a signal. 217 00:16:56,640 --> 00:17:11,420 You can hear it, you can record it, you can save it and you can import it into other analysis tools like Baudline and Spectrum or even Audacity, your favorite music editing program is able to read uh, this data coming out of here. 218 00:17:11,420 --> 00:17:14,280 So you can just put that into a file sync right there. 219 00:17:14,280 --> 00:17:19,340 But if you just wanna pull the bits out, you put it into a clock recovery block. 220 00:17:19,340 --> 00:17:23,860 The only thing you need to know to use this block is your baud rate of the signal. 221 00:17:23,860 --> 00:17:26,940 And you can look at that visually or you can look it up on the FCC. 222 00:17:27,240 --> 00:17:32,380 My key is I think 115 uh, 115,000 symbols per second. 223 00:17:32,380 --> 00:17:39,880 And once I know that, then I put it into a binary slicer that slices it into bits and I save it to a file on the temp FS. 224 00:17:40,160 --> 00:17:43,580 I'm gonna show you what that looks like when it runs right now. 225 00:17:46,220 --> 00:17:51,560 And I know there's a lot of information, I have a ton of resources for you folks that you can like walk through chapter by chapter. 226 00:17:51,560 --> 00:17:58,580 There's a lot of authors out there that have done this exact same thing and uh, they explain everything in far more detail than I can here today. 227 00:17:58,580 --> 00:18:02,540 Alright, so I'm gonna run the program, hopefully it'll work. 228 00:18:04,400 --> 00:18:07,700 I'm gonna click okay, that's fine. 229 00:18:18,250 --> 00:18:20,570 Alright, there's my signal. 230 00:18:21,130 --> 00:18:24,870 And now I'm just gonna exit cause I've captured what I need. 231 00:18:27,090 --> 00:18:30,370 So I save that to temp test. 232 00:18:30,370 --> 00:18:35,250 I'm gonna go ahead and just dump that with a hexadecimal viewer. 233 00:18:35,890 --> 00:18:39,690 And bingo, so you can see the pattern there in the bits. 234 00:18:39,690 --> 00:18:42,870 Zero one, zero one, zero one is basically all ones. 235 00:18:42,870 --> 00:18:47,470 It's a bunch of, it's a preamble for the signal saying hey, you're about to receive some interesting data. 236 00:18:47,510 --> 00:18:52,170 And right after that you can see that there's uh, there's the code right here. 237 00:18:52,230 --> 00:19:02,310 Now something I didn't show you in my block that if you actually wanna use this in the field, is there's something called uh, there's a way that you can set an access code. 238 00:19:02,310 --> 00:19:06,550 So hey, look for the ones in a row and only capture the bits that come after that. 239 00:19:06,550 --> 00:19:13,190 It's useful so you don't get this uh, file that I showed you that has all of the uh, the repeating signal here. 240 00:19:13,190 --> 00:19:21,950 It'll just grab the, the signal that you're interested in but just for the purposes of this demo I wanted to show you the preamble and the code, the preamble and the code, the preamble and the code. 241 00:19:21,950 --> 00:19:24,670 And that is literally the key fob signal for my truck. 242 00:19:24,670 --> 00:19:32,130 So if somebody wanted to take a picture of those ones and zeros and can find my truck in the parking lot, you could re-digitize the signal over the air and break into my truck. 243 00:19:32,270 --> 00:19:33,330 And that would be that. 244 00:19:33,330 --> 00:19:38,670 Anybody else wanna try pressing their unlock key and let me record it and uh, tell me where to make and model and where it's parked? 245 00:19:38,970 --> 00:19:39,630 No? 246 00:19:40,110 --> 00:19:41,410 It's really cool stuff. 247 00:19:41,410 --> 00:19:46,890 That's all I have for you today for my demo but that's how you decode a binary signal arbitrarily broadcasted over the air. 248 00:19:46,890 --> 00:19:55,750 You reverse the entire process to broadcast it out and uh, please learn how to use GNU Radio GQRX and buy yourself a hack RF uh, to get into this stuff. 249 00:19:55,830 --> 00:19:56,790 And uh, thank you very much. 250 00:19:56,790 --> 00:19:58,050 I'll pass it back to Justin. 251 00:20:00,150 --> 00:20:01,590 Thanks Dave. 252 00:20:01,670 --> 00:20:03,470 Uh, we gotta flip laptops. 253 00:20:03,490 --> 00:20:05,430 I gotta, I gotta flip the laptop again. 254 00:20:05,430 --> 00:20:07,370 Open, yeah, pull the HDMI. 255 00:20:08,590 --> 00:20:11,790 Sorry, one second while we uh, switch the demo stuff up. 256 00:20:29,040 --> 00:20:33,920 Alright, now we're gonna get into uh, the making of the antenna over there. 257 00:20:34,060 --> 00:20:36,220 Whenever the screen wants to load. 258 00:20:36,220 --> 00:20:37,340 Yeah, one moment. 259 00:20:39,240 --> 00:20:42,100 Um, HDMI. 260 00:20:53,100 --> 00:20:54,260 Sorry guys. 261 00:20:58,960 --> 00:20:59,940 Alright, here we go. 262 00:20:59,940 --> 00:21:01,640 Nope, no source found. 263 00:21:04,240 --> 00:21:09,000 Sorry, I, it's, I have it set up to duplicate. 264 00:21:12,550 --> 00:21:14,190 It looks like it's not really going in. 265 00:21:28,640 --> 00:21:29,200 It looks like it 266 00:21:35,440 --> 00:21:35,880 is. 267 00:21:35,880 --> 00:21:36,760 Sorry guys. 268 00:21:38,740 --> 00:21:39,460 Yeah. 269 00:22:15,640 --> 00:22:18,160 Um, no, it's HDMI. 270 00:22:18,820 --> 00:22:20,440 Actually, sure, we can try it. 271 00:22:22,300 --> 00:22:23,720 Oh, alright, never mind. 272 00:22:26,120 --> 00:22:27,020 We'll try this. 273 00:22:27,020 --> 00:22:29,020 If not, then I'll try this little dongle. 274 00:22:34,290 --> 00:22:34,850 There we go. 275 00:22:34,950 --> 00:22:35,490 Sweetness. 276 00:22:35,490 --> 00:22:36,850 Sorry about the delay guys. 277 00:22:36,950 --> 00:22:39,610 Alright, so now we're gonna get into uh, building a helical antenna. 278 00:22:39,610 --> 00:22:42,090 So this is gonna be presented by Brian Gillespie. 279 00:22:42,490 --> 00:22:44,290 This guy's a badass physics guy. 280 00:22:44,290 --> 00:22:47,230 He knows a lot of stuff in physics and now he's becoming a hacker. 281 00:22:47,230 --> 00:22:48,930 So, here you go, here's Brian. 282 00:22:49,390 --> 00:22:51,050 Alright, thank you Justin. 283 00:22:51,090 --> 00:22:54,850 Um, are you gonna index the slides since you uh, since you took? 284 00:22:59,380 --> 00:23:12,860 Okay, so um, I'm gonna just review some of the fundamentals of the, of radio physics ways as most of you probably know, but we need to understand that with more building things like this and uh, doing things that Dave's doing and other people. 285 00:23:12,860 --> 00:23:15,040 So, so the quick review. 286 00:23:15,040 --> 00:23:19,640 So here's our whole uh, RF spectrum of uh, that we have. 287 00:23:19,760 --> 00:23:29,620 You know, increasing uh, wavelength uh, we get, have the lower frequency and then we have uh, higher frequency, smaller, smaller wavelengths. 288 00:23:29,620 --> 00:23:37,520 And if you see where I've got that arrow pointed, radio frequencies are typically frequencies above 1 gigahertz or 10 to the 9 hertz. 289 00:23:37,800 --> 00:23:42,840 Um, and they travel at the speed of light and so we go to the next slide here. 290 00:23:42,840 --> 00:23:45,400 Uh, so they travel in a straight line and they reflect. 291 00:23:45,400 --> 00:23:52,860 So when you're above that uh, frequency range, they'll bounce off uh, things like the walls. 292 00:23:52,940 --> 00:23:57,080 When you have the lower frequencies, you can have um, environmental effects on them. 293 00:23:57,120 --> 00:24:09,160 But for what we're doing, you know, the travel's at the speed of light and it's important to remember our wave equation here where we have uh, you know, the frequency, the frequency times the wavelength gives us the speed. 294 00:24:09,160 --> 00:24:11,580 So that's gonna be helpful when I build the antenna. 295 00:24:12,500 --> 00:24:13,980 And forward. 296 00:24:13,980 --> 00:24:15,240 So, helical antenna. 297 00:24:15,240 --> 00:24:18,140 This is, this is the main part of the talk here. 298 00:24:18,140 --> 00:24:20,340 So, uh, oh, backwards. 299 00:24:21,780 --> 00:24:28,540 So, you got your center, your center support here, which is uh, which is this uh, B here. 300 00:24:28,540 --> 00:24:30,560 And you can see that in the antenna over there. 301 00:24:30,560 --> 00:24:38,580 Uh, the coaxial feed line and then you have the insulating supports because we don't want any uh, connectivity anywhere else. 302 00:24:38,580 --> 00:24:46,280 You got the reflector ground plane and then um, you got your um, coaxial that feeds your signal in. 303 00:24:46,280 --> 00:24:50,020 Or if you want to receive, then it goes the other way. 304 00:24:50,020 --> 00:24:53,020 So there's two modes that these helical antennas can operate in. 305 00:24:53,020 --> 00:25:02,440 And that's the normal mode, uh, where the helix pitch and diameter are small compared to the wavelength and are omnidirectional. 306 00:25:02,440 --> 00:25:10,460 And then the axial mode type, N-FIRE, which is what that antenna over here is, is um, the diameter and the pitch are comparable to the wavelength. 307 00:25:10,460 --> 00:25:14,840 And you'll see that when I'm gonna show up here next, or coming up. 308 00:25:14,840 --> 00:25:27,500 So this is just kind of a visual of what it looks like from some simulations between an omnidirectional type antenna, which just kind of radiates out and spreads out, where the N-FIRE directional, which is the helical, which means we can point it at things, 309 00:25:27,500 --> 00:25:29,220 is this one here. 310 00:25:32,410 --> 00:25:38,610 Here's a little more animation here for us, just to show uh, what happens when we have a helical antenna. 311 00:25:38,730 --> 00:25:50,030 And that is, depending on which way the helix is oriented, we, uh, the waves will spin one way, or the vectors here will show the polarization. 312 00:25:50,030 --> 00:25:56,590 We'll be right-handed or left-handed, and so that's based on how this, which way that's turned. 313 00:25:56,710 --> 00:25:59,950 Now I don't know, uh, you took the animation out, it looks like. 314 00:25:59,950 --> 00:26:01,010 That's okay. 315 00:26:01,570 --> 00:26:06,370 But you can see down here, as it comes out, these waves are spinning around. 316 00:26:06,370 --> 00:26:10,370 That's the representation up here, and that's the N-FIRE for that. 317 00:26:10,470 --> 00:26:11,350 Okay. 318 00:26:11,350 --> 00:26:14,010 So this gets to the heart of the manner here of how to make the antenna. 319 00:26:14,010 --> 00:26:18,890 So I found this nice website up here that did most of the calculations for us. 320 00:26:20,910 --> 00:26:26,850 So plug in the frequency, how many turns you want, and then it pops out all this information that we need to build the antenna. 321 00:26:26,850 --> 00:26:43,210 So this is the general schematics that I, we had to take and interpret to, uh, you know, build that antenna that's sitting over there, so that we can use it for our work and, um, looking at what happens when we, uh, GPS is pointed at something that has it, 322 00:26:43,210 --> 00:26:45,250 and what impact it's gonna have for us. 323 00:26:45,870 --> 00:26:47,050 All right. 324 00:26:47,530 --> 00:26:48,110 Whoops. 325 00:26:48,810 --> 00:26:49,650 Okay. 326 00:26:49,650 --> 00:26:58,550 So real quick, take some tools to build that, and some design work from, from the previous slide to make all these parts here. 327 00:26:58,550 --> 00:27:01,710 So this is a bridge report mill that I was using. 328 00:27:01,710 --> 00:27:03,970 I was in the process of putting in the holes. 329 00:27:03,970 --> 00:27:09,410 All these holes are spaced, based on fractions of the, of wavelength on that, from that slide I, uh, showed you before. 330 00:27:09,450 --> 00:27:12,050 So that tells me what the spacing needs to be here. 331 00:27:12,410 --> 00:27:17,990 And then, um, from there, you need to use the lathe to make some of the other round parts, basically items you need. 332 00:27:17,990 --> 00:27:21,270 And one thing that I'm, remember that an antenna is just a wire. 333 00:27:21,270 --> 00:27:30,010 So all that is, is just a wire configured a certain way to get the frequency we need, uh, for this application, and some plastic, some aluminum, and other tools. 334 00:27:31,230 --> 00:27:31,610 All right. 335 00:27:31,610 --> 00:27:33,490 So there's the, oops, backwards. 336 00:27:33,730 --> 00:27:34,830 There's the antenna. 337 00:27:35,490 --> 00:27:36,890 And I think we're ready for the demo. 338 00:27:36,890 --> 00:27:39,630 So this is some things we're doing in the lab here. 339 00:27:39,630 --> 00:27:41,110 So you can see we're getting the signal. 340 00:27:41,450 --> 00:27:42,510 We've got a blade RF. 341 00:27:42,510 --> 00:27:44,270 Nick over there has got us all set up. 342 00:27:44,270 --> 00:27:47,390 Some of you, he's been broadcasting that for the whole time. 343 00:27:47,390 --> 00:27:51,950 So depending on your device, it could show you that it might be a thousand feet above Moscow. 344 00:27:52,130 --> 00:27:59,430 So if he points it over here, let me get out of the way, you should see the signal get, get stronger as he points it over here. 345 00:28:00,110 --> 00:28:01,230 That's the purpose of it. 346 00:28:01,230 --> 00:28:03,490 Now if you put your hand in front of it, now see it's bouncing off the wall. 347 00:28:03,490 --> 00:28:06,230 Put your hand in front of it when you turn it over there, because I checked it earlier. 348 00:28:06,490 --> 00:28:11,370 See, it's now, it's now, because it's reflecting off the wall, like I was mentioning, because it's behaving like light. 349 00:28:11,370 --> 00:28:12,830 So just bounce off the wall. 350 00:28:15,050 --> 00:28:18,330 So, and that's, uh, that's everything. 351 00:28:18,890 --> 00:28:23,180 We're like, this thing's not working. 352 00:28:23,720 --> 00:28:25,020 We're like, this thing's not working. 353 00:28:25,020 --> 00:28:26,920 But then we're like, oh, yeah, reflection, light. 354 00:28:26,920 --> 00:28:27,840 It's just light. 355 00:28:28,200 --> 00:28:37,140 So that's why if you do, I don't know if this is going to go the whole way, but if you do that and put your hand in front of it, it's going to put it away because now it can't reflect off the walls anymore. 356 00:28:37,360 --> 00:28:42,280 But if you do this, now it's starting to reflect off the wall, the walls in the room and the ceiling just like light does. 357 00:28:42,780 --> 00:28:47,900 Um, another thing too, we don't have the amp plugged in on this, so we're not giving it enough power. 358 00:28:47,900 --> 00:28:51,040 We could pump this thing or, here, I'll let Nick talk about that. 359 00:28:51,040 --> 00:28:51,800 Yeah, go ahead. 360 00:28:52,180 --> 00:28:57,120 With proper amplification, you can cover this entire casino in whatever signal you want. 361 00:28:57,200 --> 00:29:00,680 This will render all navigation GPS completely useless. 362 00:29:00,760 --> 00:29:02,640 You'll be wherever I tell you you are. 363 00:29:03,500 --> 00:29:07,620 Yeah, so pretty scary stuff, especially with autonomous cars coming down the road. 364 00:29:07,960 --> 00:29:11,560 Um, obviously we care about safety a lot, which is why we designed stuff like this. 365 00:29:11,560 --> 00:29:14,840 So we're not just putting everybody in the whole entire place in Moscow. 366 00:29:14,980 --> 00:29:17,840 Um, we're just putting everything that's directional over there. 367 00:29:17,920 --> 00:29:20,540 Um, it's a safer way of doing tests like this. 368 00:29:20,540 --> 00:29:23,440 Um, you know, you don't really want to get FCC calls. 369 00:29:23,500 --> 00:29:28,980 Um, so doing stuff like this and having the proper facility to do this stuff in is, is also really helpful. 370 00:29:29,120 --> 00:29:31,900 The lab we do all this testing in is pretty much a Faraday cage. 371 00:29:31,900 --> 00:29:33,760 We don't have cell inside the building. 372 00:29:33,760 --> 00:29:35,060 We can't get anything in or out. 373 00:29:35,260 --> 00:29:40,540 So we know the tests that we're doing inside are not affecting systems externally from our lab. 374 00:29:40,960 --> 00:29:42,360 So yeah, that's about it. 375 00:29:42,360 --> 00:29:46,560 Um, if you guys want to get into cars, we'll be here the whole entire time during DEF CON. 376 00:29:46,560 --> 00:29:55,060 We do, we're a part of the CTF, so we have some stuff over there you guys can hack into, try to find some flags and maybe win that Jeep or that truck or, uh, this antenna. 377 00:29:55,400 --> 00:29:58,300 So yeah, thank you guys for coming out and, uh, enjoy the CON. 378 00:30:02,130 --> 00:30:03,350 We've got a question for you. 379 00:30:03,350 --> 00:30:04,590 We're doing questions now. 380 00:30:04,590 --> 00:30:06,490 I realize we do have some extra time. 381 00:30:06,810 --> 00:30:08,570 Uh, he said... 382 00:30:15,580 --> 00:30:23,140 so if you're using both L1 and L2, that would stop an attack like this, uh, from a SCID if they were doing one radio. 383 00:30:23,140 --> 00:30:30,660 You can sync two radios, broadcast L1 and L2 for the correct position , but it requires manual math or a very well written program. 384 00:30:30,880 --> 00:30:37,300 Um, what you would see with both receivers is you would see that L2 is getting where you would expect, where L1 is not. 385 00:30:37,300 --> 00:30:43,780 And L2, if they broadcast, there's no open source GitHub project for that yet, um, but I'm gonna post it. 386 00:30:43,780 --> 00:30:48,600 Um, you would be able to tell also by the difference in timing. 387 00:30:48,700 --> 00:30:57,620 So we need less than five parts per million accuracy to be, or precision, to be able to get this to be received by your phones or any other consumer grade device. 388 00:30:58,040 --> 00:31:05,260 It is very unlikely for someone to be able to do the wiring correctly to get that kind of accuracy to be consistent through two radios at the exact same time. 389 00:31:06,160 --> 00:31:09,000 So that's a good stop for this type of, uh, attack. 390 00:31:10,340 --> 00:31:11,360 Great question. 391 00:31:11,360 --> 00:31:12,540 Any other questions? 392 00:31:12,780 --> 00:31:14,580 Yeah, we'll go with you in the red first. 393 00:31:20,680 --> 00:31:23,860 So with this attack, the question was, uh, could we impact timing? 394 00:31:23,860 --> 00:31:24,940 The answer is yes. 395 00:31:24,940 --> 00:31:31,840 Uh, whatever time I broadcast, um, it, it, you kind of need to know more about the, the packet that gets broadcast from the satellite. 396 00:31:31,860 --> 00:31:36,040 But basically it's, it's, it's latitude, longitude, and it's time of broadcast. 397 00:31:36,040 --> 00:31:42,740 And then your radio takes in all those signals it picks up and says, ah, I see the time of flight was so and so, therefore I'm here. 398 00:31:42,900 --> 00:31:49,460 So if I were to broadcast consistently a different time, yes, you would receive it and trust it. 399 00:31:49,460 --> 00:31:52,000 It's a very, uh, weird phenomenon, but people do it. 400 00:31:52,000 --> 00:31:53,620 They use their GPS as timers. 401 00:31:56,710 --> 00:32:02,250 Uh, with your RSA certificates, uh, time is usually a factor in that. 402 00:32:02,430 --> 00:32:10,110 And you can completely set the seed value for a lot of these embedded controllers because they'll generate the same certificate given the same time. 403 00:32:10,510 --> 00:32:15,190 So if you know what it was once, you can just tell it it's the same time over and over again. 404 00:32:15,190 --> 00:32:18,970 And all of a sudden you're able to get the same certificate all the time. 405 00:32:19,090 --> 00:32:22,310 Which means now you can man the middle, even if they rotate their certs. 406 00:32:23,670 --> 00:32:28,530 Funky little CS problems become very big security holes. 407 00:32:30,070 --> 00:32:31,710 Any other questions? 408 00:32:34,110 --> 00:32:34,710 Cool. 409 00:32:41,140 --> 00:32:43,520 So that's a good question. 410 00:32:43,520 --> 00:32:46,820 Um, we don't directly focus on the full vehicle yet. 411 00:32:46,820 --> 00:32:48,700 Uh, we're mainly focused on modules. 412 00:32:48,700 --> 00:32:55,920 So if you guys don't know what Delphi does, they create a lot of the safety, uh, systems in your cars as well as infotainment systems in your vehicles. 413 00:32:56,060 --> 00:33:00,060 Um, so right now our focus is strictly on protecting our parts. 414 00:33:00,420 --> 00:33:06,300 Um, down the road we do want to have, uh, offerings to like our customers, OEMs, where we could do full vehicle assessments for them. 415 00:33:06,300 --> 00:33:09,840 But right now it's strictly on the, um, module side. 416 00:33:09,840 --> 00:33:14,800 I did a talk, um, a few months ago at SANS that kind of laid out a lot of this stuff. 417 00:33:14,800 --> 00:33:19,260 I can get you that link and there's a presentation in there that'll show you more details of what we did for that. 418 00:33:20,280 --> 00:33:21,020 Yep. 419 00:33:26,320 --> 00:33:27,780 Uh, we do, yes. 420 00:33:27,780 --> 00:33:36,420 And we also focus, uh, sorry, the question was, um, are we only focusing on like our ECUs or the interfaces that are coming in from other stuff? 421 00:33:36,560 --> 00:33:40,380 Uh, and the answer is absolutely the stuff that's coming from other systems. 422 00:33:40,380 --> 00:33:44,280 And that's why even the wireless stuff, you know, when stuff's coming over wireless, we're testing that. 423 00:33:44,280 --> 00:33:49,620 We don't only look inside our systems, we look on the interfaces and anything that's connecting to the systems. 424 00:33:49,620 --> 00:33:55,240 Um, a lot of that's hard to test when you only have the module because you don't know how everything's going to be talking to it. 425 00:33:55,240 --> 00:33:59,380 So that's why we're trying to build our systems up to eventually do full vehicle assessments. 426 00:34:00,000 --> 00:34:01,300 So, good question. 427 00:34:02,680 --> 00:34:03,840 Yeah, yeah. 428 00:34:06,500 --> 00:34:07,580 Oh, cool. 429 00:34:07,600 --> 00:34:08,660 We'll talk later. 430 00:34:09,560 --> 00:34:10,880 Any other questions? 431 00:34:12,900 --> 00:34:16,460 Alright, if you guys have any, just ask or if not, just stop by our booth. 432 00:34:16,460 --> 00:34:17,720 Uh, thanks again.