start	end	text
0	5940	All right, cool. We're going to start going now. So my name is Justin. I work for Delphi
5940	10840	Automotive, who is sponsoring the Car Hacking Village. I run the red team testing lab there.
10880	14280	So my team, who you'll see around here, is the ones that are going to be doing demos and
14280	19240	doing a lot of this stuff for us. But we hack our own modules to help our engineers secure
19240	24820	them better. So to get into this a little bit, starting off at the Car Hacking Village, we
24820	29160	do have a CTF there this year. It's really, really cool. They've got lots of different
29160	34000	interfaces, lots of different systems to hack into. The first place prize is this truck
34000	39260	over here. So if you guys want to play around, you can win a truck. Another prize that we're
39260	42900	going to be giving away is this antenna that we're going to be demoing for you guys. So you
42900	48540	can see right here, this is a GPS helical directional antenna. We'll go into the making of
48540	55180	that as well in a little bit. So to, yeah, going back to our day job. So we're a Delphi
55180	60540	cybersecurity testing team. We do pen testing for the company, process and tool development as
60540	64060	well as research and development. This is what our facility looks like. We've got a bunch of
64060	70040	garage bays we can pull cars into and a pretty big facility to do testing on modules. So
70040	74000	now moving into the outline, we're going to talk about different test interfaces on the
74000	78080	wireless side as well as tool kits for it. Just to help you guys out in case you may not have
78080	81360	tested or done this stuff before. So we'll just kind of give you the rundown of what we're
81360	86120	using and what works for us. Then we're going to do a demo on key fob analysis. So we're
86120	90600	going to use GNU radio and a hack RF to do some analysis on key fob to show you how to pull
90600	94640	those out of the air and do a deep dive into those. And then we're going to go into building
94640	99500	directional antenna, which is this guy over here in the front, Brian, who's the mastermind
99500	104000	behind that. And then we're going to get into the demo of actually directionally pointing GPS
104000	109060	over here and showing you how that antenna works. All right, so now this stuff I'll run
109060	112660	through quick because you guys probably know a lot of this. This is just a typical Wi-Fi
112660	116780	standards. So I just wanted to throw this in here so you had it all. Here's some tools that
116780	122240	you guys can use for Wi-Fi. We don't do too much Wi-Fi stuff in cars. I mean pretty much
122240	127600	most of them have WPA2. So unless you can bypass the password, which they're getting a
127600	131120	little bit better. The car companies are slowly getting better at making good passwords on
132460	137360	WPA2. But that's really the only weakness that we're seeing. So yeah, we'll go to the next
137360	141220	one, which is going to be Bluetooth. Bluetooth was a lot more vulnerable in the older
141220	146060	versions. So any older cars that have older versions of Bluetooth in it are extremely
146060	152160	vulnerable to those types of attacks. Here's some more specs on that. It's another RF
152160	158240	spectrum that sits in the 2.4 gigahertz range. The Bluetooth version 5 is really nice
158240	162840	because it's bumping up the speed like crazy. And mainly the, whoops, mainly the distance
162840	167200	which is nice. Just because all these different devices people are making in their houses,
167200	170920	you can go a lot more farther in your house. But then for us, if we want to do drive-bys, we
170920	176080	can also get into their stuff. So here's some tools that we use for Bluetooth testing. The
176080	179940	UberTooth one is really helpful. And then we just use this adapter. It's really easy. We
179940	183160	can transmit on this. We can do whatever we want with this device. Some Bluetooth devices
183160	188180	won't allow you to. So now moving into cellular, there's three different areas that we
188180	192360	focus on in cellular. This is just giving you a rundown of spectrums. So whenever we're
192360	196040	trying to dig into a new technology or understand it more, this is the type of data we
196040	199760	compile to start digging and understanding what tools we want to buy. And then we start
199760	204680	reaching out to vendors or coming to events like this and buying all the hacker tools. So
204680	211100	when you're getting into cellular related stuff or any wireless stuff on cars, it's
211100	215300	recommended to look for this type of content on any of the modules. Mainly something with
215300	219680	the FCC ID or even an IMEI number. It's going to let you know there's a cell network in
219680	223960	here and there's transmitting some kind of RF somewhere. So this is how we quickly can
223960	229060	move on to understanding what's coming out of this module. So now looking into the tools
229060	233960	that we use, we're, um, trying to find what works best for us. So we buy a lot of industry
233960	237200	based tools like this guy up here. This is from Roden Schwartz. It's a cell site
237200	241700	simulator. So this will actually put up a cell tower for you. You put a SIM card in your
241700	245160	phone or whatever you need to and now you can see all the data streams and everything
245160	248300	that's going back and forth from that phone. So it's really helpful for us when we're
248300	251480	trying to test apps in cars that people are building to understand if they're actually
251480	254960	communicating to the server securely and what type of data they're sending back and forth.
255340	259860	Um, and then for putting up base stations, um, on a cheaper way, you can use a blade RF
259860	265700	with the HBTS or this USRP device with the HBTS as well. Those are a little bit cheaper
265700	271680	routes to go and you get a lot more custom, uh, customizability with those. Um, next is
271680	275500	moving on to key fob, which we're going to show you the demo on. This is something that was
275500	280460	introduced in 1980 by Ford. Um, there's two main frequencies, which is 3.5 megahertz and
281240	287320	433.92 megahertz. Um, the distance is 5 to 20 meters and the security on this is mainly
287320	292500	rolling codes and challenge response. A couple years ago you guys may have seen a guy named
292500	299060	Sammy Kamkar create a device that was able to bypass or, you know, leverage rolling codes to
299060	303440	be able to get into people's cars. Um, there's also passive key entry systems, which are
303440	307480	running stuff in the, uh, kilohertz range. So when you walk up to your car and you want to
307480	311360	unlock it with just your button, uh, or the handle on the car, that's usually using
311360	316600	something in the kilohertz range. And that's called passive key entry. So here's some
316600	321620	tools that we use for, uh, the key fob stuff. We mainly are using the hacker refs, but the
321620	326800	spectrum analyzer is really helpful to see those packets coming across. Um, and then we
326800	331880	also use the yardstick one because that goes down to the lower kilohertz. So now moving on
331880	336280	to GPS, which we'll show you a demo on that as well. This is something that was created by the
336280	340520	United States in the 70s. Um, there's a few different bands. The ones that are mainly
340520	346740	public are L1 and L2. Uh, if you want to lock down GPS properly, use both radios in your
346740	351540	devices. Most people don't. I know Apple doesn't and we can show you what happens with that
351540	356120	because they don't. Um, we'll pretty much can put anybody's phone wherever we want if you're
356120	359640	only using one band because your phone's only relying on that band so it's not getting
359640	364680	another source to say, hey, you're not actually here, you should be here. Um, so we'll show
364680	369700	you what, how that can be messed with. Um, some different tools we're using for this. You
369700	373740	can use a hacker ref. Uh, they're kind of hard because you got to stack a bunch because you
373740	379020	have to do transmitting and receiving. Um, and then we mainly use a blader ref, um, which we
379020	383740	have set up here connected to this antenna. So we'll show you that in a moment. And then the
383740	386900	next one, the last one, which is a fun one, which you guys may not have heard of yet. This
386900	390300	is something that's coming in cars. It's kind of scary from my perspective because of what
390300	394300	they're trying to do with it. But it is something that's needed. Cars do need to talk. If
394300	397820	we're going to have autonomous cars down the road, they do have to talk to each other in some
397820	401860	manner. So this is currently the automotive solution for that. It's called vehicle to
401860	409460	everything. Um, it runs just above, uh, the 5 gigahertz range and it has a protocol of 80211P
409460	415940	which is very similar to all the WiFi standards. It's really not that much different. The
415940	422840	only difference is it's got this IEEE 1609 application layer on top of it. And then here's
422840	427300	some tools that we use for that. Um, if you're looking into development tools, these are
427300	430740	just the hacker type tools besides this one. But another development tool you can look to is
430740	435760	something called Coda Wireless or MK5. Um, that'll allow you to actually transmit and do
435760	439680	some V2X based stuff. And another one from the auto industry is pretty big. It's Vector
439680	443940	Canoe. They're really expensive so hopefully in the near future some hackers will release
443940	448380	some tools that are a lot cheaper for you guys. All right, now we can move into this, uh,
448380	467410	key fob analysis if you're ready, Dave. Hi everybody, my name is Dave Conant. I work for
467410	473510	Adelphi along with Justin and I'm sort of the radio guy, I guess, uh, over there. Is my
473510	499260	screen popping up here? No? How do I... Oh, there we go. That's interesting. Okay, so
499280	511680	well, if you can't see it, I'm gonna have a hard time demoing it. There we go. All right, so
511680	517240	who's used GNU radio before? Anybody in here? Has anybody, for the people who haven't used
517240	522480	it, have you heard GNU radio? Okay, so if you haven't used GNU radio or you've heard of it,
522480	526520	I'm gonna explain just the basics of what this thing does. It's a, it's a useful tool that we
526520	532360	use in the lab, uh, that we use to isolate different wireless signals. So Justin spoke
532360	537820	about GPS, you know, DSRC, but at the end of the day, in the radio frequency spectrum, you
537820	542580	know, vehicles themselves, they have like 15 different radios on them, your phone probably
542580	547720	has like 6 or 7, you know, you got Bluetooth, Wi-Fi, but then what about the non-standard
547720	552740	wireless? So I, you know, I've got my key fob here for my truck, for example. Now this thing
552740	559020	doesn't speak Wi-Fi, it doesn't speak GPS, so how do we deal with signals when we don't
559020	563620	really have, you know, like a Wi-Fi adapter to like just let us authenticate to it? Uh,
563620	568280	basically, uh, from the blue reverse engineering random wireless signals and looking at the
568280	573700	binary data, uh, inside of them. So I wanna show you 2 tools that we use in the lab, uh, to
573700	579300	isolate these signals and, and how we can decode the actual binary data, uh, off of that so we
579300	583920	can actually send and communicate with, uh, with these basic devices. It's actually
583920	590380	generally speaking easier to talk to these guys than something like using Wi-Fi. It's much
590380	594940	less complicated. So for example, with your key fob, it's just a series of bits and if the
594940	599720	car hears that, the right series of bits, there's no handshake, it just says, oh, I like
599720	603780	those bits, I'm gonna open up the, the car. It's that simple. So as long as you know that
603780	609200	code or how to generate that code, uh, then you can talk to it. So actually being able to
609200	612780	read the code off of the air if you don't know what the wireless signal looks like is a
612780	617580	very useful skill to have in general. Um, Defcon, we've seen talks that guys talk to
617580	622340	satellites using these techniques, you can talk to cars, uh, anything that transmits a
622340	627180	wireless signal that you can talk to. So I'm using a hack RF, I think the range on this
627180	635240	thing in frequency terms is, uh, it goes up to 6 gigahertz and down to 10 megahertz? 1
635240	639980	megahertz? 1 megahertz. That's a huge range. Uh, this is actually a monumental invention,
639980	644220	software defined radio in general. Uh, having this kind of power to be able to transmit and
644220	649400	receive on that wide a frequency range is something that 10 years ago even would have cost
649400	654040	millions of dollars in equipment and would have been military classified type technology. So
654040	660060	please get one and learn how to use them. They're very awesome. Alright, so I'm opening up
660060	666820	basically a utility called GQRX. GQRX, if you install GNU radio along with this, uh, you're
666820	672100	gonna be covered. So I'm gonna move this guy over here. GQRX, this, this guy right here is a
672100	676680	spectrum analyzer. Everybody knows what that is? It's our eyes and ears on the frequency, uh,
676680	681760	the frequency realm. This lets us see our wireless signals. This guy and most spectrum
681760	688480	analyzers cost between, mm, at least $10,000 up to $500,000 to a million dollars. Just to
688480	692480	give you an idea of what it's like just to see, uh, a spectrum range that we're talking about
692480	699440	here. HackRF costs I think $200 or $300 and it can see almost the same range as this guy. This,
699440	704120	this guy's still better, it's more accurate but the HackRF's good enough for us hackers. And
704120	711980	GQRX, I wanna show you, basically does the same thing that our $200,000 spectrum analyzer over
711980	719080	here does. And you can actually see they look very similar and I'm going to use GQRX to move
719080	725760	down and find my key fob signal to show you guys what that looks like. I happen to know that
725760	732300	it's 315 megahertz and everything, all your devices, they come with an FCC ID if they're
732300	737680	being sold commercially so they will tell you what the frequency is on the FCC's website. Super
737680	742600	useful website to look up all kinds of parameters that we're gonna use in GNU radio to decode
742600	747180	this signal. So you can see here when I press my little button for my HackRF there's a little
747180	753820	bumpity bump coming, it's a frequency shift key coming from my key fob. I do wanna show you as
753820	761960	well, so we're looking at, I think uh, what is this? 20 megahertz in bandwidth or 16 megahertz
761960	766500	I can't remember. I do wanna show you an important and difficult part in dealing with GNU radio
766500	771980	is setting up the filtering. And I wanna show you just what filtering looks like in GQRX. When
771980	776840	you click around you can see that little band there, it's actually filtering all the signals
776840	782520	out around it and if I had my audio on it would actually play the sound for the uh, the signal
782520	786460	that you're receiving. So you're narrowing in and zeroing in on that signal that you're
786460	792800	looking for despite capturing 20 megahertz worth of bandwidth. So, I uh, I think my computer
792800	804200	locked up. Yeah, okay. Well that's okay I was gonna close GQRX anyway and switch to GNU radio.
804200	808900	The important thing to understand is when we're gonna decode this signal in GNU radio and get
808900	815380	the binary bits out of there, um, there's basically 4 steps and essentially we have to capture
815380	820720	the signal from a source, that's obvious. And then we need to filter all the junk around it
820720	826520	out from the signal. And that, there's an entire series, you should watch Michael Osmond's uh,
826520	831280	SDR series if you haven't already. It's uh, HackR, it's, he's the guy who created the HackRF
831280	836220	and he's got an entire educational video series and he's got an entire one dedicated, an
836220	840340	entire hour dedicated to filtering. It's uh, it's a science and an art. There's a lot that
840340	845440	goes into it. Uh, there's many different kinds of filters, high pass, low pass, band pass,
845440	850980	exflating, fur filters, blah, blah, blah. Uh, learn them all, what they do, um, they're not
850980	855180	that tough but they're a little intimidating to get to at first. It's very important to zero
855180	859800	in on your signal uh, with those filters though. Okay, so once you've zeroed in on your
859800	865060	filter and uh, on your signal with your filter, the next step that you have to do is demodulate
865060	869580	it. Uh, demodulating is gonna come in a couple different flavors. There's frequency
869580	874920	demodulation and amplitude demodulation. So when you're playing around in GQRX, it will
874920	880320	behoove you to figure out and identify with your eye or your ear whether you're dealing with a
880320	885720	frequency shift key signal or an amplitude shift key signal. Amplitude sounds like Morse code
885720	890220	or it's changing in volume. A frequency shift key is gonna have differing tones that you'll
890220	896120	hear and it'll sound more like uh, like music or dubstep or something like that. So, and
896120	901960	once you identify that, you can pick your frequency shift keying or, or your amplitude shift
901960	915110	keying. So I've prepared new radio blocks here. Let's see if this works. Is it? No, it doesn't.
917870	928280	What's that? Oh, there we go. Now wait for it for a second. Okay, I have to be fast here. So my
928280	936320	program that I've written here, GNU radio, oh, whoa. It uses flowcharts to define your actual
936320	940680	software. In the background of each one of these flowcharts, there's actually a Python script
940680	945860	that gets executed. And you can see here, this is what I was talking about. I'm using the
945860	951860	Osmocom source which is my hack RF. I set the frequency to 315 megahertz because I know that
951860	955820	that's where my signal is and I set my sample rate to be about 4 megahertz. That means I'm
955820	960980	capturing 4 megahertz of bandwidth around the signal. That's a lot of bandwidth. The actual
960980	966820	bandwidth of this signal is like 200 kilohertz. It's not that wide. That's why I pass it into
967000	972380	a filter. I'm not gonna explain all of these different uh, parameters but basically I'm
972380	978260	zeroing in on the signal with this so uh, it's kind of offset from 315 megahertz. It's not
978260	984660	quite exactly. It's like 314.9. You can figure that out from the FCC website. So I'm offsetting
984660	990820	it to zero in on the signal and then I am shrinking down that 4 megahertz of bandwidth just
990820	995560	to capture this signal alone and none of the junk that's uh, flying around it especially here
995560	1000980	at DEF CON. I'm then piping the signal into a frequency sync which is exactly the same thing
1000980	1004320	as the spectrum analyzer that we see here. So we can actually see the signal that we're
1004320	1010340	capturing and confirm that uh, that we're getting it. Demodulating the signal. And now this
1010340	1015240	is the, the secret sauce to get the binary data out of it. So at this point, this is nice, you'll
1015240	1019320	actually be zeroed in on a signal. You can hear it, you can record it, you can save it and you
1019320	1025160	can import it into other analysis tools like Baudline and Spectrum or even Audacity, your
1025160	1032000	favorite music editing program is able to read uh, this data coming out of here. So you can
1032000	1037020	just put that into a file sync right there. But if you just wanna pull the bits out, you put
1037020	1042280	it into a clock recovery block. The only thing you need to know to use this block is your
1042280	1046940	baud rate of the signal. And you can look at that visually or you can look it up on the FCC.
1047240	1054720	My key is I think 115 uh, 115,000 symbols per second. And once I know that, then I put it into
1054820	1060820	a binary slicer that slices it into bits and I save it to a file on the temp FS. I'm gonna show
1060820	1067960	you what that looks like when it runs right now. And I know there's a lot of information, I
1067960	1071560	have a ton of resources for you folks that you can like walk through chapter by chapter.
1071560	1075740	There's a lot of authors out there that have done this exact same thing and uh, they explain
1075740	1080880	everything in far more detail than I can here today. Alright, so I'm gonna run the program,
1080880	1102010	hopefully it'll work. I'm gonna click okay, that's fine. Alright, there's my signal. And now I'm
1102010	1110830	just gonna exit cause I've captured what I need. So I save that to temp test. I'm gonna go
1110830	1118230	ahead and just dump that with a hexadecimal viewer. And bingo, so you can see the pattern
1118230	1124110	there in the bits. Zero one, zero one, zero one is basically all ones. It's a bunch of, it's a
1124110	1128850	preamble for the signal saying hey, you're about to receive some interesting data. And right
1128850	1133750	after that you can see that there's uh, there's the code right here. Now something I didn't
1133750	1140210	show you in my block that if you actually wanna use this in the field, is there's something
1140210	1144310	called uh, there's a way that you can set an access code. So hey, look for the ones in a row
1144310	1149130	and only capture the bits that come after that. It's useful so you don't get this uh, file
1149130	1154430	that I showed you that has all of the uh, the repeating signal here. It'll just grab the, the
1154430	1157930	signal that you're interested in but just for the purposes of this demo I wanted to show you
1157930	1162570	the preamble and the code, the preamble and the code, the preamble and the code. And that is
1162570	1166550	literally the key fob signal for my truck. So if somebody wanted to take a picture of those
1166550	1170470	ones and zeros and can find my truck in the parking lot, you could re-digitize the signal
1170470	1174570	over the air and break into my truck. And that would be that. Anybody else wanna try pressing
1174570	1178010	their unlock key and let me record it and uh, tell me where to make and model and where it's
1178010	1183470	parked? No? It's really cool stuff. That's all I have for you today for my demo but that's how
1183470	1188170	you decode a binary signal arbitrarily broadcasted over the air. You reverse the entire
1188170	1193710	process to broadcast it out and uh, please learn how to use GNU Radio GQRX and buy yourself a
1193710	1198050	hack RF uh, to get into this stuff. And uh, thank you very much. I'll pass it back to Justin.
1200150	1206410	Thanks Dave. Uh, we gotta flip laptops. I gotta, I gotta flip the laptop again. Open, yeah,
1206410	1229820	pull the HDMI. Sorry, one second while we uh, switch the demo stuff up. Alright, now we're
1229820	1236220	gonna get into uh, the making of the antenna over there. Whenever the screen wants to load.
1236220	1264740	Yeah, one moment. Um, HDMI. Sorry guys. Alright, here we go. Nope, no source found. Sorry,
1264740	1289200	I, it's, I have it set up to duplicate. It looks like it's not really going in. It looks like it
1295440	1343720	is. Sorry guys. Yeah. Um, no, it's HDMI. Actually, sure, we can try it. Oh, alright, never mind.
1346120	1356010	We'll try this. If not, then I'll try this little dongle. There we go. Sweetness. Sorry about the
1356010	1360030	delay guys. Alright, so now we're gonna get into uh, building a helical antenna. So this is
1360030	1365110	gonna be presented by Brian Gillespie. This guy's a badass physics guy. He knows a lot of
1365110	1370150	stuff in physics and now he's becoming a hacker. So, here you go, here's Brian. Alright, thank
1370150	1381700	you Justin. Um, are you gonna index the slides since you uh, since you took? Okay, so um, I'm
1381700	1386060	gonna just review some of the fundamentals of the, of radio physics ways as most of you probably
1386060	1390440	know, but we need to understand that with more building things like this and uh, doing things
1390440	1396420	that Dave's doing and other people. So, so the quick review. So here's our whole uh, RF
1396420	1404780	spectrum of uh, that we have. You know, increasing uh, wavelength uh, we get, have the lower
1404780	1410460	frequency and then we have uh, higher frequency, smaller, smaller wavelengths. And if you see
1410460	1415300	where I've got that arrow pointed, radio frequencies are typically frequencies above 1
1415300	1421920	gigahertz or 10 to the 9 hertz. Um, and they travel at the speed of light and so we go to the
1421920	1425940	next slide here. Uh, so they travel in a straight line and they reflect. So when you're above
1425940	1433480	that uh, frequency range, they'll bounce off uh, things like the walls. When you have the lower
1433480	1438960	frequencies, you can have um, environmental effects on them. But for what we're doing, you know,
1438960	1443540	the travel's at the speed of light and it's important to remember our wave equation here where
1443540	1449380	we have uh, you know, the frequency, the frequency times the wavelength gives us the speed. So
1449380	1455920	that's gonna be helpful when I build the antenna. And forward. So, helical antenna. This is,
1455940	1464240	this is the main part of the talk here. So, uh, oh, backwards. So, you got your center, your
1464240	1469620	center support here, which is uh, which is this uh, B here. And you can see that in the antenna
1469620	1476420	over there. Uh, the coaxial feed line and then you have the insulating supports because we don't
1476420	1482060	want any uh, connectivity anywhere else. You got the reflector ground plane and then um, you
1482060	1489460	got your um, coaxial that feeds your signal in. Or if you want to receive, then it goes the other
1489460	1493620	way. So there's two modes that these helical antennas can operate in. And that's the normal
1493620	1501500	mode, uh, where the helix pitch and diameter are small compared to the wavelength and are
1501500	1506920	omnidirectional. And then the axial mode type, N-FIRE, which is what that antenna over here is,
1506920	1511200	is um, the diameter and the pitch are comparable to the wavelength. And you'll see that when I'm
1511200	1516700	gonna show up here next, or coming up. So this is just kind of a visual of what it looks like from
1516700	1522140	some simulations between an omnidirectional type antenna, which just kind of radiates out and
1522140	1527080	spreads out, where the N-FIRE directional, which is the helical, which means we can point it at
1527080	1536350	things, is this one here. Here's a little more animation here for us, just to show uh, what
1536350	1543310	happens when we have a helical antenna. And that is, depending on which way the helix is oriented,
1543310	1551050	we, uh, the waves will spin one way, or the vectors here will show the polarization. We'll be right-handed or
1551050	1558610	left-handed, and so that's based on how this, which way that's turned. Now I don't know, uh, you took the
1558610	1565610	animation out, it looks like. That's okay. But you can see down here, as it comes out, these waves are
1565610	1572070	spinning around. That's the representation up here, and that's the N-FIRE for that. Okay. So this gets to
1572070	1577050	the heart of the manner here of how to make the antenna. So I found this nice website up here that did
1577050	1584710	most of the calculations for us. So plug in the frequency, how many turns you want, and then it pops out
1584710	1589190	all this information that we need to build the antenna. So this is the general schematics that I, we had to
1589190	1596210	take and interpret to, uh, you know, build that antenna that's sitting over there, so that we can use it for
1596210	1603570	our work and, um, looking at what happens when we, uh, GPS is pointed at something that has it, and what
1603570	1614330	impact it's gonna have for us. All right. Whoops. Okay. So real quick, take some tools to build that, and
1614330	1620330	some design work from, from the previous slide to make all these parts here. So this is a bridge report
1620330	1625650	mill that I was using. I was in the process of putting in the holes. All these holes are spaced, based on
1625650	1630550	fractions of the, of wavelength on that, from that slide I, uh, showed you before. So that tells me what the
1630550	1635670	spacing needs to be here. And then, um, from there, you need to use the lathe to make some of the other
1635670	1641430	round parts, basically items you need. And one thing that I'm, remember that an antenna is just a wire. So
1641430	1646770	all that is, is just a wire configured a certain way to get the frequency we need, uh, for this application,
1646770	1654230	and some plastic, some aluminum, and other tools. All right. So there's the, oops, backwards. There's the
1654230	1659930	antenna. And I think we're ready for the demo. So this is some things we're doing in the lab here. So you can
1659930	1664870	see we're getting the signal. We've got a blade RF. Nick over there has got us all set up. Some of you, he's
1664870	1670850	been broadcasting that for the whole time. So depending on your device, it could show you that it might be a
1670850	1675150	thousand feet above Moscow. So if he points it over here, let me get out of the way, you should see the
1675150	1682230	signal get, get stronger as he points it over here. That's the purpose of it. Now if you put your hand in
1682230	1685050	front of it, now see it's bouncing off the wall. Put your hand in front of it when you turn it over there,
1685050	1689110	because I checked it earlier. See, it's now, it's now, because it's reflecting off the wall, like I was
1689110	1697750	mentioning, because it's behaving like light. So just bounce off the wall. So, and that's, uh, that's
1697750	1698330	everything.
1698890	1705920	We're like, this thing's not working. We're like, this thing's not working. But then we're like, oh, yeah,
1705920	1711620	reflection, light. It's just light. So that's why if you do, I don't know if this is going to go the whole
1711620	1715160	way, but if you do that and put your hand in front of it, it's going to put it away because now it
1715160	1719140	can't reflect off the walls anymore. But if you do this, now it's starting to reflect off the
1719140	1724220	wall, the walls in the room and the ceiling just like light does. Um, another thing too, we don't
1724220	1729620	have the amp plugged in on this, so we're not giving it enough power. We could pump this thing
1729620	1731040	or, here, I'll let Nick talk about that.
1731040	1731800	Yeah, go ahead.
1732180	1737480	With proper amplification, you can cover this entire casino in whatever signal you want. This
1737480	1742640	will render all navigation GPS completely useless. You'll be wherever I tell you you are.
1743500	1748020	Yeah, so pretty scary stuff, especially with autonomous cars coming down the road. Um,
1748020	1752280	obviously we care about safety a lot, which is why we designed stuff like this. So we're not just
1752280	1756680	putting everybody in the whole entire place in Moscow. Um, we're just putting everything that's
1756680	1761680	directional over there. Um, it's a safer way of doing tests like this. Um, you know, you don't
1761680	1766920	really want to get FCC calls. Um, so doing stuff like this and having the proper facility to do
1766920	1771340	this stuff in is, is also really helpful. The lab we do all this testing in is pretty much a
1771340	1776520	Faraday cage. We don't have cell inside the building. We can't get anything in or out. So we
1776520	1781660	know the tests that we're doing inside are not affecting systems externally from our lab. So
1781660	1785980	yeah, that's about it. Um, if you guys want to get into cars, we'll be here the whole entire
1785980	1790980	time during DEF CON. We do, we're a part of the CTF, so we have some stuff over there you guys
1790980	1794360	can hack into, try to find some flags and maybe win that Jeep or that truck or, uh, this
1794360	1802930	antenna. So yeah, thank you guys for coming out and, uh, enjoy the CON. We've got a
1802930	1808570	question for you. We're doing questions now. I realize we do have some extra time. Uh, he
1815580	1821520	said... so if you're using both L1 and L2, that would stop an attack like this, uh, from a
1821520	1826720	SCID if they were doing one radio. You can sync two radios, broadcast L1 and L2 for the
1826720	1831540	correct position, but it requires manual math or a very well written program. Um, what you
1831540	1835860	would see with both receivers is you would see that L2 is getting where you would expect,
1835860	1841320	where L1 is not. And L2, if they broadcast, there's no open source GitHub project for that
1841320	1847880	yet, um, but I'm gonna post it. Um, you would be able to tell also by the difference in
1847880	1853080	timing. So we need less than five parts per million accuracy to be, or precision, to be able
1853080	1858580	to get this to be received by your phones or any other consumer grade device. It is very
1858580	1862500	unlikely for someone to be able to do the wiring correctly to get that kind of accuracy to be
1862500	1868060	consistent through two radios at the exact same time. So that's a good stop for this type of,
1868060	1874580	uh, attack. Great question. Any other questions? Yeah, we'll go with you in the red first.
1880680	1885280	So with this attack, the question was, uh, could we impact timing? The answer is yes. Uh,
1885280	1890220	whatever time I broadcast, um, it, it, you kind of need to know more about the, the packet
1890220	1894700	that gets broadcast from the satellite. But basically it's, it's, it's latitude, longitude, and
1894700	1899840	it's time of broadcast. And then your radio takes in all those signals it picks up and says,
1899840	1904460	ah, I see the time of flight was so and so, therefore I'm here. So if I were to broadcast
1904460	1910640	consistently a different time, yes, you would receive it and trust it. It's a very, uh, weird
1910640	1920450	phenomenon, but people do it. They use their GPS as timers. Uh, with your RSA certificates, uh,
1920450	1925370	time is usually a factor in that. And you can completely set the seed value for a lot of
1925370	1929310	these embedded controllers because they'll generate the same certificate given the same
1929310	1934590	time. So if you know what it was once, you can just tell it it's the same time over and over
1934590	1939830	again. And all of a sudden you're able to get the same certificate all the time. Which means
1939830	1946990	now you can man the middle, even if they rotate their certs. Funky little CS problems become
1946990	1964560	very big security holes. Any other questions? Cool. So that's a good question. Um, we don't
1964560	1969280	directly focus on the full vehicle yet. Uh, we're mainly focused on modules. So if you guys
1969280	1974000	don't know what Delphi does, they create a lot of the safety, uh, systems in your cars as
1974000	1978480	well as infotainment systems in your vehicles. Um, so right now our focus is strictly on
1978480	1983200	protecting our parts. Um, down the road we do want to have, uh, offerings to like our
1983200	1987100	customers, OEMs, where we could do full vehicle assessments for them. But right now it's
1987100	1993620	strictly on the, um, module side. I did a talk, um, a few months ago at SANS that kind of laid
1993620	1997060	out a lot of this stuff. I can get you that link and there's a presentation in there that'll
1997060	2009940	show you more details of what we did for that. Yep. Uh, we do, yes. And we also focus, uh,
2009940	2014760	sorry, the question was, um, are we only focusing on like our ECUs or the interfaces that
2014760	2019120	are coming in from other stuff? Uh, and the answer is absolutely the stuff that's coming
2019120	2022800	from other systems. And that's why even the wireless stuff, you know, when stuff's coming
2022800	2027380	over wireless, we're testing that. We don't only look inside our systems, we look on the
2027380	2031000	interfaces and anything that's connecting to the systems. Um, a lot of that's hard to test
2031000	2034880	when you only have the module because you don't know how everything's going to be talking to
2034880	2038460	it. So that's why we're trying to build our systems up to eventually do full vehicle
2038460	2050880	assessments. So, good question. Yeah, yeah. Oh, cool. We'll talk later. Any other questions?
2052900	2057720	Alright, if you guys have any, just ask or if not, just stop by our booth. Uh, thanks again.