WEBVTT 00:00.000 --> 00:00.760 All right, cool. 00:00.760 --> 00:02.540 We're going to start going now. 00:02.540 --> 00:03.980 So my name is Justin. 00:03.980 --> 00:08.400 I work for Delphi Automotive, who is sponsoring the Car Hacking Village. 00:08.420 --> 00:10.840 I run the red team testing lab there. 00:10.880 --> 00:15.480 So my team, who you'll see around here, is the ones that are going to be doing demos and doing a lot of this stuff for us. 00:15.480 --> 00:20.000 But we hack our own modules to help our engineers secure them better. 00:20.820 --> 00:26.420 So to get into this a little bit, starting off at the Car Hacking Village, we do have a CTF there this year. 00:26.540 --> 00:27.920 It's really, really cool. 00:27.920 --> 00:32.080 They've got lots of different interfaces, lots of different systems to hack into. 00:32.280 --> 00:34.800 The first place prize is this truck over here. 00:35.500 --> 00:38.180 So if you guys want to play around, you can win a truck. 00:38.440 --> 00:42.500 Another prize that we're going to be giving away is this antenna that we're going to be demoing for you guys. 00:42.560 --> 00:47.260 So you can see right here, this is a GPS helical directional antenna. 00:47.460 --> 00:50.120 We'll go into the making of that as well in a little bit. 00:51.280 --> 00:53.460 So to, yeah, going back to our day job. 00:53.460 --> 00:57.480 So we're a Delphi cybersecurity testing team. 00:57.620 --> 01:01.880 We do pen testing for the company, process and tool development as well as research and development. 01:02.040 --> 01:03.500 This is what our facility looks like. 01:03.500 --> 01:08.680 We've got a bunch of garage bays we can pull cars into and a pretty big facility to do testing on modules. 01:09.860 --> 01:16.140 So now moving into the outline, we're going to talk about different test interfaces on the wireless side as well as tool kits for it. 01:16.140 --> 01:19.680 Just to help you guys out in case you may not have tested or done this stuff before. 01:19.800 --> 01:23.300 So we'll just kind of give you the rundown of what we're using and what works for us. 01:23.520 --> 01:26.020 Then we're going to do a demo on key fob analysis. 01:26.020 --> 01:33.440 So we're going to use GNU radio and a hack RF to do some analysis on key fob to show you how to pull those out of the air and do a deep dive into those. 01:33.640 --> 01:40.400 And then we're going to go into building directional antenna, which is this guy over here in the front, Brian, who's the mastermind behind that. 01:40.440 --> 01:46.420 And then we're going to get into the demo of actually directionally pointing GPS over here and showing you how that antenna works. 01:47.580 --> 01:51.020 All right, so now this stuff I'll run through quick because you guys probably know a lot of this. 01:51.180 --> 01:53.620 This is just a typical Wi-Fi standards. 01:53.620 --> 01:55.640 So I just wanted to throw this in here so you had it all. 01:55.880 --> 01:58.640 Here's some tools that you guys can use for Wi-Fi. 01:59.080 --> 02:01.580 We don't do too much Wi-Fi stuff in cars. 02:01.700 --> 02:03.860 I mean pretty much most of them have WPA2. 02:03.900 --> 02:08.020 So unless you can bypass the password, which they're getting a little bit better. 02:08.020 --> 02:12.820 The car companies are slowly getting better at making good passwords on WPA2 . 02:12.820 --> 02:15.600 But that's really the only weakness that we're seeing. 02:15.860 --> 02:18.740 So yeah, we'll go to the next one, which is going to be Bluetooth. 02:19.060 --> 02:22.080 Bluetooth was a lot more vulnerable in the older versions. 02:22.080 --> 02:27.980 So any older cars that have older versions of Bluetooth in it are extremely vulnerable to those types of attacks. 02:28.160 --> 02:29.760 Here's some more specs on that. 02:29.760 --> 02:35.040 It's another RF spectrum that sits in the 2.4 gigahertz range. 02:36.320 --> 02:40.600 The Bluetooth version 5 is really nice because it's bumping up the speed like crazy. 02:40.600 --> 02:43.820 And mainly the, whoops, mainly the distance which is nice. 02:43.860 --> 02:49.160 Just because all these different devices people are making in their houses, you can go a lot more farther in your house. 02:49.160 --> 02:52.460 But then for us, if we want to do drive-bys, we can also get into their stuff. 02:53.580 --> 02:55.980 So here's some tools that we use for Bluetooth testing. 02:55.980 --> 02:57.520 The UberTooth one is really helpful. 02:57.520 --> 02:59.120 And then we just use this adapter. 02:59.140 --> 02:59.900 It's really easy. 02:59.900 --> 03:00.840 We can transmit on this. 03:00.840 --> 03:02.300 We can do whatever we want with this device. 03:02.300 --> 03:04.180 Some Bluetooth devices won't allow you to. 03:05.280 --> 03:09.380 So now moving into cellular, there's three different areas that we focus on in cellular. 03:09.380 --> 03:11.580 This is just giving you a rundown of spectrums. 03:11.580 --> 03:19.120 So whenever we're trying to dig into a new technology or understand it more, this is the type of data we compile to start digging and understanding what tools we want to buy. 03:19.220 --> 03:23.440 And then we start reaching out to vendors or coming to events like this and buying all the hacker tools. 03:24.280 --> 03:34.560 So when you're getting into cellular related stuff or any wireless stuff on cars, it's recommended to look for this type of content on any of the modules. 03:34.560 --> 03:38.220 Mainly something with the FCC ID or even an IMEI number. 03:38.280 --> 03:42.480 It's going to let you know there's a cell network in here and there's transmitting some kind of RF somewhere. 03:42.740 --> 03:46.920 So this is how we quickly can move on to understanding what's coming out of this module. 03:48.040 --> 03:52.700 So now looking into the tools that we use, we're, um, trying to find what works best for us. 03:52.700 --> 03:55.600 So we buy a lot of industry based tools like this guy up here. 03:55.600 --> 03:56.600 This is from Roden Schwartz. 03:56.600 --> 03:58.000 It's a cell site simulator. 03:58.180 --> 04:00.400 So this will actually put up a cell tower for you. 04:00.400 --> 04:06.880 You put a SIM card in your phone or whatever you need to and now you can see all the data streams and everything that's going back and forth from that phone. 04:07.020 --> 04:14.960 So it's really helpful for us when we're trying to test apps in cars that people are building to understand if they're actually communicating to the server securely and what type of data they're sending back and forth. 04:15.340 --> 04:24.580 Um, and then for putting up base stations, um, on a cheaper way, you can use a blade RF with the HBTS or this USRP device with the HBTS as well. 04:24.580 --> 04:30.340 Those are a little bit cheaper routes to go and you get a lot more custom, uh, customizability with those. 04:30.840 --> 04:34.580 Um, next is moving on to key fob, which we're going to show you the demo on. 04:34.660 --> 04:37.520 This is something that was introduced in 1980 by Ford. 04:37.520 --> 04:43.360 Um, there's two main frequencies, which is 3.5 megahertz and 433.92 megahertz. 04:43.540 --> 04:49.960 Um, the distance is 5 to 20 meters and the security on this is mainly rolling codes and challenge response. 04:49.960 --> 05:00.600 A couple years ago you guys may have seen a guy named Sammy Kamkar create a device that was able to bypass or, you know, leverage rolling codes to be able to get into people's cars. 05:00.760 --> 05:05.460 Um, there's also passive key entry systems, which are running stuff in the, uh, kilohertz range. 05:05.460 --> 05:13.000 So when you walk up to your car and you want to unlock it with just your button, uh, or the handle on the car, that's usually using something in the kilohertz range. 05:13.080 --> 05:14.940 And that's called passive key entry. 05:15.840 --> 05:19.140 So here's some tools that we use for, uh, the key fob stuff. 05:19.220 --> 05:25.000 We mainly are using the hacker refs, but the spectrum analyzer is really helpful to see those packets coming across. 05:25.440 --> 05:29.860 Um, and then we also use the yardstick one because that goes down to the lower kilohertz. 05:31.100 --> 05:34.980 So now moving on to GPS, which we'll show you a demo on that as well. 05:34.980 --> 05:38.040 This is something that was created by the United States in the 70s. 05:38.040 --> 05:39.820 Um, there's a few different bands. 05:39.820 --> 05:42.400 The ones that are mainly public are L1 and L2. 05:42.580 --> 05:47.580 Uh, if you want to lock down GPS properly, use both radios in your devices. 05:47.740 --> 05:48.780 Most people don't. 05:48.780 --> 05:52.700 I know Apple doesn't and we can show you what happens with that because they don't. 05:52.700 --> 06:03.240 Um, we'll pretty much can put anybody's phone wherever we want if you're only using one band because your phone's only relying on that band so it's not getting another source to say, hey, you're not actually here, you should be here. 06:03.860 --> 06:06.900 Um, so we'll show you what, how that can be messed with. 06:07.560 --> 06:09.600 Um, some different tools we're using for this. 06:09.600 --> 06:10.960 You can use a hacker ref. 06:11.240 --> 06:15.280 Uh, they're kind of hard because you got to stack a bunch because you have to do transmitting and receiving. 06:15.560 --> 06:20.820 Um, and then we mainly use a blader ref, um, which we have set up here connected to this antenna. 06:20.980 --> 06:22.360 So we'll show you that in a moment. 06:23.220 --> 06:26.760 And then the next one, the last one, which is a fun one, which you guys may not have heard of yet. 06:26.760 --> 06:28.300 This is something that's coming in cars. 06:28.300 --> 06:31.160 It's kind of scary from my perspective because of what they're trying to do with it. 06:31.160 --> 06:33.140 But it is something that's needed. 06:33.140 --> 06:34.180 Cars do need to talk. 06:34.180 --> 06:38.520 If we're going to have autonomous cars down the road, they do have to talk to each other in some manner. 06:38.580 --> 06:41.120 So this is currently the automotive solution for that. 06:41.120 --> 06:42.580 It's called vehicle to everything. 06:42.820 --> 06:52.660 Um, it runs just above, uh, the 5 gigahertz range and it has a protocol of 80211P which is very similar to all the WiFi standards. 06:52.660 --> 06:54.220 It's really not that much different. 06:55.540 --> 07:00.860 The only difference is it's got this IEEE 1609 application layer on top of it. 07:02.000 --> 07:04.740 And then here's some tools that we use for that. 07:05.000 --> 07:08.900 Um, if you're looking into development tools, these are just the hacker type tools besides this one. 07:08.900 --> 07:13.060 But another development tool you can look to is something called Coda Wireless or MK5. 07:13.280 --> 07:17.380 Um, that'll allow you to actually transmit and do some V2X based stuff. 07:17.420 --> 07:19.340 And another one from the auto industry is pretty big. 07:19.340 --> 07:20.220 It's Vector Canoe. 07:20.220 --> 07:25.840 They're really expensive so hopefully in the near future some hackers will release some tools that are a lot cheaper for you guys. 07:26.500 --> 07:30.240 All right, now we can move into this, uh, key fob analysis if you're ready, Dave. 07:45.150 --> 07:46.830 Hi everybody, my name is Dave Conant. 07:46.830 --> 07:52.970 I work for Adelphi along with Justin and I'm sort of the radio guy, I guess, uh, over there. 07:53.070 --> 07:54.890 Is my screen popping up here? 07:55.990 --> 07:56.690 No? 08:00.620 --> 08:06.020 How do I... Oh, there we go. 08:08.240 --> 08:09.400 That's interesting. 08:18.860 --> 08:23.240 Okay, so well, if you can't see it, I'm gonna have a hard time demoing it. 08:28.780 --> 08:30.020 There we go. 08:30.640 --> 08:33.280 All right, so who's used GNU radio before? 08:33.280 --> 08:34.480 Anybody in here? 08:34.980 --> 08:38.740 Has anybody, for the people who haven't used it, have you heard GNU radio? 08:39.280 --> 08:45.320 Okay, so if you haven't used GNU radio or you've heard of it, I'm gonna explain just the basics of what this thing does. 08:45.320 --> 08:51.400 It's a, it's a useful tool that we use in the lab, uh, that we use to isolate different wireless signals. 08:51.400 --> 09:08.600 So Justin spoke about GPS, you know, DSRC, but at the end of the day, in the radio frequency spectrum, you know, vehicles themselves, they have like 15 different radios on them, your phone probably has like 6 or 7, you know, you got Bluetooth, Wi-Fi, but then what about the non-standard wireless? 09:08.620 --> 09:12.240 So I, you know, I've got my key fob here for my truck, for example. 09:12.240 --> 09:23.420 Now this thing doesn't speak Wi-Fi, it doesn't speak GPS, so how do we deal with signals when we don't really have, you know, like a Wi-Fi adapter to like just let us authenticate to it? 09:23.420 --> 09:30.640 Uh, basically, uh, from the blue reverse engineering random wireless signals and looking at the binary data, uh, inside of them. 09:30.640 --> 09:43.320 So I wanna show you 2 tools that we use in the lab, uh, to isolate these signals and, and how we can decode the actual binary data, uh, off of that so we can actually send and communicate with, uh, with these basic devices. 09:43.440 --> 09:50.120 It's actually generally speaking easier to talk to these guys than something like using Wi-Fi. 09:50.120 --> 09:51.500 It's much less complicated. 09:51.500 --> 10:02.160 So for example, with your key fob, it's just a series of bits and if the car hears that, the right series of bits, there's no handshake, it just says, oh, I like those bits, I'm gonna open up the, the car. 10:02.160 --> 10:02.940 It's that simple. 10:02.940 --> 10:07.420 So as long as you know that code or how to generate that code, uh, then you can talk to it. 10:07.420 --> 10:15.060 So actually being able to read the code off of the air if you don't know what the wireless signal looks like is a very useful skill to have in general. 10:15.060 --> 10:23.840 Um, Defcon, we've seen talks that guys talk to satellites using these techniques, you can talk to cars, uh, anything that transmits a wireless signal that you can talk to. 10:23.840 --> 10:34.340 So I'm using a hack RF, I think the range on this thing in frequency terms is, uh, it goes up to 6 gigahertz and down to 10 megahertz? 10:34.340 --> 10:35.460 1 megahertz ? 10:35.460 --> 10:36.240 1 megahertz. 10:36.240 --> 10:37.740 That's a huge range. 10:37.740 --> 10:41.740 Uh, this is actually a monumental invention, software defined radio in general. 10:41.740 --> 10:53.940 Uh, having this kind of power to be able to transmit and receive on that wide a frequency range is something that 10 years ago even would have cost millions of dollars in equipment and would have been military classified type technology. 10:53.940 --> 10:55.760 So please get one and learn how to use them. 10:55.760 --> 10:56.820 They're very awesome. 10:58.400 --> 11:03.060 Alright, so I'm opening up basically a utility called GQRX. 11:03.280 --> 11:07.460 GQRX, if you install GNU radio along with this, uh, you're gonna be covered. 11:07.460 --> 11:09.480 So I'm gonna move this guy over here. 11:10.160 --> 11:12.640 GQRX, this, this guy right here is a spectrum analyzer. 11:12.640 --> 11:14.020 Everybody knows what that is? 11:14.180 --> 11:17.520 It's our eyes and ears on the frequency, uh, the frequency realm. 11:17.520 --> 11:19.560 This lets us see our wireless signals. 11:19.560 --> 11:27.960 This guy and most spectrum analyzers cost between, mm, at least $10,000 up to $500,000 to a million dollars. 11:27.960 --> 11:32.940 Just to give you an idea of what it's like just to see, uh, a spectrum range that we're talking about here. 11:33.120 --> 11:39.140 HackRF costs I think $200 or $300 and it can see almost the same range as this guy. 11:39.140 --> 11:43.860 This, this guy's still better, it's more accurate but the HackRF's good enough for us hackers. 11:43.860 --> 11:53.120 And GQRX, I wanna show you, basically does the same thing that our $200,000 spectrum analyzer over here does. 11:53.120 --> 12:03.340 And you can actually see they look very similar and I'm going to use GQRX to move down and find my key fob signal to show you guys what that looks like. 12:04.240 --> 12:17.300 I happen to know that it's 315 megahertz and everything, all your devices, they come with an FCC ID if they're being sold commercially so they will tell you what the frequency is on the FCC's website. 12:17.300 --> 12:23.580 Super useful website to look up all kinds of parameters that we're gonna use in GNU radio to decode this signal. 12:23.580 --> 12:32.520 So you can see here when I press my little button for my HackRF there's a little bumpity bump coming, it's a frequency shift key coming from my key fob. 12:32.520 --> 12:38.220 I do wanna show you as well, so we're looking at, I think uh, what is this? 12:39.620 --> 12:42.960 20 megahertz in bandwidth or 16 megahertz I can't remember. 12:42.960 --> 12:47.980 I do wanna show you an important and difficult part in dealing with GNU radio is setting up the filtering. 12:47.980 --> 12:51.820 And I wanna show you just what filtering looks like in GQRX. 12:51.820 --> 13:03.500 When you click around you can see that little band there, it's actually filtering all the signals out around it and if I had my audio on it would actually play the sound for the uh, the signal that you're receiving. 13:03.500 --> 13:10.260 So you're narrowing in and zeroing in on that signal that you're looking for despite capturing 20 megahertz worth of bandwidth. 13:10.300 --> 13:13.940 So, I uh, I think my computer locked up. 13:16.060 --> 13:17.720 Yeah, okay. 13:20.420 --> 13:24.200 Well that's okay I was gonna close GQRX anyway and switch to GNU radio. 13:24.200 --> 13:37.620 The important thing to understand is when we're gonna decode this signal in GNU radio and get the binary bits out of there, um, there's basically 4 steps and essentially we have to capture the signal from a source, that's obvious. 13:37.620 --> 13:42.040 And then we need to filter all the junk around it out from the signal. 13:42.080 --> 13:48.500 And that, there's an entire series, you should watch Michael Osmond's uh, SDR series if you haven't already. 13:48.500 --> 13:58.100 It's uh, HackR, it's, he's the guy who created the HackRF and he's got an entire educational video series and he's got an entire one dedicated, an entire hour dedicated to filtering. 13:58.100 --> 13:59.840 It's uh, it's a science and an art. 13:59.840 --> 14:01.340 There's a lot that goes into it. 14:01.340 --> 14:08.140 Uh, there's many different kinds of filters, high pass, low pass, band pass, exflating, fur filters, blah, blah, blah. 14:08.140 --> 14:14.040 Uh, learn them all, what they do, um, they're not that tough but they're a little intimidating to get to at first. 14:14.040 --> 14:17.960 It's very important to zero in on your signal uh, with those filters though. 14:17.960 --> 14:25.680 Okay, so once you've zeroed in on your filter and uh, on your signal with your filter, the next step that you have to do is demodulate it. 14:25.680 --> 14:28.800 Uh, demodulating is gonna come in a couple different flavors. 14:28.800 --> 14:32.540 There's frequency demodulation and amplitude demodulation. 14:32.540 --> 14:44.220 So when you're playing around in GQRX, it will behoove you to figure out and identify with your eye or your ear whether you're dealing with a frequency shift key signal or an amplitude shift key signal. 14:44.220 --> 14:47.400 Amplitude sounds like Morse code or it's changing in volume. 14:47.400 --> 14:55.340 A frequency shift key is gonna have differing tones that you'll hear and it'll sound more like uh, like music or dubstep or something like that. 14:55.340 --> 15:02.720 So, and once you identify that, you can pick your frequency shift keying or, or your amplitude shift keying. 15:02.720 --> 15:06.320 So I've prepared new radio blocks here. 15:06.680 --> 15:08.640 Let's see if this works. 15:09.240 --> 15:10.340 Is it? 15:13.590 --> 15:15.110 No, it doesn't. 15:17.870 --> 15:18.870 What's that? 15:19.110 --> 15:20.350 Oh, there we go. 15:23.120 --> 15:24.940 Now wait for it for a second. 15:26.000 --> 15:27.740 Okay, I have to be fast here. 15:27.740 --> 15:32.320 So my program that I've written here, GNU radio, oh, whoa. 15:33.520 --> 15:36.880 It uses flowcharts to define your actual software. 15:36.880 --> 15:42.280 In the background of each one of these flowcharts, there's actually a Python script that gets executed. 15:42.660 --> 15:45.140 And you can see here, this is what I was talking about. 15:45.140 --> 15:48.420 I'm using the Osmocom source which is my hack RF. 15:48.420 --> 15:55.480 I set the frequency to 315 megahertz because I know that that's where my signal is and I set my sample rate to be about 4 megahertz. 15:55.480 --> 15:58.900 That means I'm capturing 4 megahertz of bandwidth around the signal. 15:58.900 --> 16:00.420 That's a lot of bandwidth. 16:00.420 --> 16:03.900 The actual bandwidth of this signal is like 200 kilohertz. 16:03.900 --> 16:05.260 It's not that wide. 16:05.260 --> 16:07.800 That's why I pass it into a filter. 16:07.800 --> 16:18.120 I'm not gonna explain all of these different uh, parameters but basically I'm zeroing in on the signal with this so uh, it's kind of offset from 315 megahertz. 16:18.120 --> 16:19.480 It's not quite exactly. 16:19.480 --> 16:21.620 It's like 314.9. 16:21.620 --> 16:23.840 You can figure that out from the FCC website. 16:23.840 --> 16:36.580 So I'm offsetting it to zero in on the signal and then I am shrinking down that 4 megahertz of bandwidth just to capture this signal alone and none of the junk that's uh, flying around it especially here at DEF CON. 16:36.840 --> 16:42.880 I'm then piping the signal into a frequency sync which is exactly the same thing as the spectrum analyzer that we see here. 16:42.880 --> 16:47.300 So we can actually see the signal that we're capturing and confirm that uh, that we're getting it. 16:48.220 --> 16:49.540 Demodulating the signal. 16:49.640 --> 16:53.400 And now this is the, the secret sauce to get the binary data out of it. 16:53.400 --> 16:56.640 So at this point, this is nice, you'll actually be zeroed in on a signal. 16:56.640 --> 17:11.420 You can hear it, you can record it, you can save it and you can import it into other analysis tools like Baudline and Spectrum or even Audacity, your favorite music editing program is able to read uh, this data coming out of here. 17:11.420 --> 17:14.280 So you can just put that into a file sync right there. 17:14.280 --> 17:19.340 But if you just wanna pull the bits out, you put it into a clock recovery block. 17:19.340 --> 17:23.860 The only thing you need to know to use this block is your baud rate of the signal. 17:23.860 --> 17:26.940 And you can look at that visually or you can look it up on the FCC. 17:27.240 --> 17:32.380 My key is I think 115 uh, 115,000 symbols per second. 17:32.380 --> 17:39.880 And once I know that, then I put it into a binary slicer that slices it into bits and I save it to a file on the temp FS. 17:40.160 --> 17:43.580 I'm gonna show you what that looks like when it runs right now. 17:46.220 --> 17:51.560 And I know there's a lot of information, I have a ton of resources for you folks that you can like walk through chapter by chapter. 17:51.560 --> 17:58.580 There's a lot of authors out there that have done this exact same thing and uh, they explain everything in far more detail than I can here today. 17:58.580 --> 18:02.540 Alright, so I'm gonna run the program, hopefully it'll work. 18:04.400 --> 18:07.700 I'm gonna click okay, that's fine. 18:18.250 --> 18:20.570 Alright, there's my signal. 18:21.130 --> 18:24.870 And now I'm just gonna exit cause I've captured what I need. 18:27.090 --> 18:30.370 So I save that to temp test. 18:30.370 --> 18:35.250 I'm gonna go ahead and just dump that with a hexadecimal viewer. 18:35.890 --> 18:39.690 And bingo, so you can see the pattern there in the bits. 18:39.690 --> 18:42.870 Zero one, zero one, zero one is basically all ones. 18:42.870 --> 18:47.470 It's a bunch of, it's a preamble for the signal saying hey, you're about to receive some interesting data. 18:47.510 --> 18:52.170 And right after that you can see that there's uh, there's the code right here. 18:52.230 --> 19:02.310 Now something I didn't show you in my block that if you actually wanna use this in the field, is there's something called uh, there's a way that you can set an access code. 19:02.310 --> 19:06.550 So hey, look for the ones in a row and only capture the bits that come after that. 19:06.550 --> 19:13.190 It's useful so you don't get this uh, file that I showed you that has all of the uh, the repeating signal here. 19:13.190 --> 19:21.950 It'll just grab the, the signal that you're interested in but just for the purposes of this demo I wanted to show you the preamble and the code, the preamble and the code, the preamble and the code. 19:21.950 --> 19:24.670 And that is literally the key fob signal for my truck. 19:24.670 --> 19:32.130 So if somebody wanted to take a picture of those ones and zeros and can find my truck in the parking lot, you could re-digitize the signal over the air and break into my truck. 19:32.270 --> 19:33.330 And that would be that. 19:33.330 --> 19:38.670 Anybody else wanna try pressing their unlock key and let me record it and uh, tell me where to make and model and where it's parked? 19:38.970 --> 19:39.630 No? 19:40.110 --> 19:41.410 It's really cool stuff. 19:41.410 --> 19:46.890 That's all I have for you today for my demo but that's how you decode a binary signal arbitrarily broadcasted over the air. 19:46.890 --> 19:55.750 You reverse the entire process to broadcast it out and uh, please learn how to use GNU Radio GQRX and buy yourself a hack RF uh, to get into this stuff. 19:55.830 --> 19:56.790 And uh, thank you very much. 19:56.790 --> 19:58.050 I'll pass it back to Justin. 20:00.150 --> 20:01.590 Thanks Dave. 20:01.670 --> 20:03.470 Uh, we gotta flip laptops. 20:03.490 --> 20:05.430 I gotta, I gotta flip the laptop again. 20:05.430 --> 20:07.370 Open, yeah, pull the HDMI. 20:08.590 --> 20:11.790 Sorry, one second while we uh, switch the demo stuff up. 20:29.040 --> 20:33.920 Alright, now we're gonna get into uh, the making of the antenna over there. 20:34.060 --> 20:36.220 Whenever the screen wants to load. 20:36.220 --> 20:37.340 Yeah, one moment. 20:39.240 --> 20:42.100 Um, HDMI. 20:53.100 --> 20:54.260 Sorry guys. 20:58.960 --> 20:59.940 Alright, here we go. 20:59.940 --> 21:01.640 Nope, no source found. 21:04.240 --> 21:09.000 Sorry, I, it's, I have it set up to duplicate. 21:12.550 --> 21:14.190 It looks like it's not really going in. 21:28.640 --> 21:29.200 It looks like it 21:35.440 --> 21:35.880 is. 21:35.880 --> 21:36.760 Sorry guys. 21:38.740 --> 21:39.460 Yeah. 22:15.640 --> 22:18.160 Um, no, it's HDMI. 22:18.820 --> 22:20.440 Actually, sure, we can try it. 22:22.300 --> 22:23.720 Oh, alright, never mind. 22:26.120 --> 22:27.020 We'll try this. 22:27.020 --> 22:29.020 If not, then I'll try this little dongle. 22:34.290 --> 22:34.850 There we go. 22:34.950 --> 22:35.490 Sweetness. 22:35.490 --> 22:36.850 Sorry about the delay guys. 22:36.950 --> 22:39.610 Alright, so now we're gonna get into uh, building a helical antenna. 22:39.610 --> 22:42.090 So this is gonna be presented by Brian Gillespie. 22:42.490 --> 22:44.290 This guy's a badass physics guy. 22:44.290 --> 22:47.230 He knows a lot of stuff in physics and now he's becoming a hacker. 22:47.230 --> 22:48.930 So, here you go, here's Brian. 22:49.390 --> 22:51.050 Alright, thank you Justin. 22:51.090 --> 22:54.850 Um, are you gonna index the slides since you uh, since you took? 22:59.380 --> 23:12.860 Okay, so um, I'm gonna just review some of the fundamentals of the, of radio physics ways as most of you probably know, but we need to understand that with more building things like this and uh, doing things that Dave's doing and other people. 23:12.860 --> 23:15.040 So, so the quick review. 23:15.040 --> 23:19.640 So here's our whole uh, RF spectrum of uh, that we have. 23:19.760 --> 23:29.620 You know, increasing uh, wavelength uh, we get, have the lower frequency and then we have uh, higher frequency, smaller, smaller wavelengths. 23:29.620 --> 23:37.520 And if you see where I've got that arrow pointed, radio frequencies are typically frequencies above 1 gigahertz or 10 to the 9 hertz. 23:37.800 --> 23:42.840 Um, and they travel at the speed of light and so we go to the next slide here. 23:42.840 --> 23:45.400 Uh, so they travel in a straight line and they reflect. 23:45.400 --> 23:52.860 So when you're above that uh, frequency range, they'll bounce off uh, things like the walls. 23:52.940 --> 23:57.080 When you have the lower frequencies, you can have um, environmental effects on them. 23:57.120 --> 24:09.160 But for what we're doing, you know, the travel's at the speed of light and it's important to remember our wave equation here where we have uh, you know, the frequency, the frequency times the wavelength gives us the speed. 24:09.160 --> 24:11.580 So that's gonna be helpful when I build the antenna. 24:12.500 --> 24:13.980 And forward. 24:13.980 --> 24:15.240 So, helical antenna. 24:15.240 --> 24:18.140 This is, this is the main part of the talk here. 24:18.140 --> 24:20.340 So, uh, oh, backwards. 24:21.780 --> 24:28.540 So, you got your center, your center support here, which is uh, which is this uh, B here. 24:28.540 --> 24:30.560 And you can see that in the antenna over there. 24:30.560 --> 24:38.580 Uh, the coaxial feed line and then you have the insulating supports because we don't want any uh, connectivity anywhere else. 24:38.580 --> 24:46.280 You got the reflector ground plane and then um, you got your um, coaxial that feeds your signal in. 24:46.280 --> 24:50.020 Or if you want to receive, then it goes the other way. 24:50.020 --> 24:53.020 So there's two modes that these helical antennas can operate in. 24:53.020 --> 25:02.440 And that's the normal mode, uh, where the helix pitch and diameter are small compared to the wavelength and are omnidirectional. 25:02.440 --> 25:10.460 And then the axial mode type, N-FIRE, which is what that antenna over here is, is um, the diameter and the pitch are comparable to the wavelength. 25:10.460 --> 25:14.840 And you'll see that when I'm gonna show up here next, or coming up. 25:14.840 --> 25:27.500 So this is just kind of a visual of what it looks like from some simulations between an omnidirectional type antenna, which just kind of radiates out and spreads out, where the N-FIRE directional, which is the helical, which means we can point it at things, 25:27.500 --> 25:29.220 is this one here. 25:32.410 --> 25:38.610 Here's a little more animation here for us, just to show uh, what happens when we have a helical antenna. 25:38.730 --> 25:50.030 And that is, depending on which way the helix is oriented, we, uh, the waves will spin one way, or the vectors here will show the polarization. 25:50.030 --> 25:56.590 We'll be right-handed or left-handed, and so that's based on how this, which way that's turned. 25:56.710 --> 25:59.950 Now I don't know, uh, you took the animation out, it looks like. 25:59.950 --> 26:01.010 That's okay. 26:01.570 --> 26:06.370 But you can see down here, as it comes out, these waves are spinning around. 26:06.370 --> 26:10.370 That's the representation up here, and that's the N-FIRE for that. 26:10.470 --> 26:11.350 Okay. 26:11.350 --> 26:14.010 So this gets to the heart of the manner here of how to make the antenna. 26:14.010 --> 26:18.890 So I found this nice website up here that did most of the calculations for us. 26:20.910 --> 26:26.850 So plug in the frequency, how many turns you want, and then it pops out all this information that we need to build the antenna. 26:26.850 --> 26:43.210 So this is the general schematics that I, we had to take and interpret to, uh, you know, build that antenna that's sitting over there, so that we can use it for our work and, um, looking at what happens when we, uh, GPS is pointed at something that has it, 26:43.210 --> 26:45.250 and what impact it's gonna have for us. 26:45.870 --> 26:47.050 All right. 26:47.530 --> 26:48.110 Whoops. 26:48.810 --> 26:49.650 Okay. 26:49.650 --> 26:58.550 So real quick, take some tools to build that, and some design work from, from the previous slide to make all these parts here. 26:58.550 --> 27:01.710 So this is a bridge report mill that I was using. 27:01.710 --> 27:03.970 I was in the process of putting in the holes. 27:03.970 --> 27:09.410 All these holes are spaced, based on fractions of the, of wavelength on that, from that slide I, uh, showed you before. 27:09.450 --> 27:12.050 So that tells me what the spacing needs to be here. 27:12.410 --> 27:17.990 And then, um, from there, you need to use the lathe to make some of the other round parts, basically items you need. 27:17.990 --> 27:21.270 And one thing that I'm, remember that an antenna is just a wire. 27:21.270 --> 27:30.010 So all that is, is just a wire configured a certain way to get the frequency we need, uh, for this application, and some plastic, some aluminum, and other tools. 27:31.230 --> 27:31.610 All right. 27:31.610 --> 27:33.490 So there's the, oops, backwards. 27:33.730 --> 27:34.830 There's the antenna. 27:35.490 --> 27:36.890 And I think we're ready for the demo. 27:36.890 --> 27:39.630 So this is some things we're doing in the lab here. 27:39.630 --> 27:41.110 So you can see we're getting the signal. 27:41.450 --> 27:42.510 We've got a blade RF. 27:42.510 --> 27:44.270 Nick over there has got us all set up. 27:44.270 --> 27:47.390 Some of you, he's been broadcasting that for the whole time. 27:47.390 --> 27:51.950 So depending on your device, it could show you that it might be a thousand feet above Moscow. 27:52.130 --> 27:59.430 So if he points it over here, let me get out of the way, you should see the signal get, get stronger as he points it over here. 28:00.110 --> 28:01.230 That's the purpose of it. 28:01.230 --> 28:03.490 Now if you put your hand in front of it, now see it's bouncing off the wall. 28:03.490 --> 28:06.230 Put your hand in front of it when you turn it over there, because I checked it earlier. 28:06.490 --> 28:11.370 See, it's now, it's now, because it's reflecting off the wall, like I was mentioning, because it's behaving like light. 28:11.370 --> 28:12.830 So just bounce off the wall. 28:15.050 --> 28:18.330 So, and that's, uh, that's everything. 28:18.890 --> 28:23.180 We're like, this thing's not working. 28:23.720 --> 28:25.020 We're like, this thing's not working. 28:25.020 --> 28:26.920 But then we're like, oh, yeah, reflection, light. 28:26.920 --> 28:27.840 It's just light. 28:28.200 --> 28:37.140 So that's why if you do, I don't know if this is going to go the whole way, but if you do that and put your hand in front of it, it's going to put it away because now it can't reflect off the walls anymore. 28:37.360 --> 28:42.280 But if you do this, now it's starting to reflect off the wall, the walls in the room and the ceiling just like light does. 28:42.780 --> 28:47.900 Um, another thing too, we don't have the amp plugged in on this, so we're not giving it enough power. 28:47.900 --> 28:51.040 We could pump this thing or, here, I'll let Nick talk about that. 28:51.040 --> 28:51.800 Yeah, go ahead. 28:52.180 --> 28:57.120 With proper amplification, you can cover this entire casino in whatever signal you want. 28:57.200 --> 29:00.680 This will render all navigation GPS completely useless. 29:00.760 --> 29:02.640 You'll be wherever I tell you you are. 29:03.500 --> 29:07.620 Yeah, so pretty scary stuff, especially with autonomous cars coming down the road. 29:07.960 --> 29:11.560 Um, obviously we care about safety a lot, which is why we designed stuff like this. 29:11.560 --> 29:14.840 So we're not just putting everybody in the whole entire place in Moscow. 29:14.980 --> 29:17.840 Um, we're just putting everything that's directional over there. 29:17.920 --> 29:20.540 Um, it's a safer way of doing tests like this. 29:20.540 --> 29:23.440 Um, you know, you don't really want to get FCC calls. 29:23.500 --> 29:28.980 Um, so doing stuff like this and having the proper facility to do this stuff in is, is also really helpful. 29:29.120 --> 29:31.900 The lab we do all this testing in is pretty much a Faraday cage. 29:31.900 --> 29:33.760 We don't have cell inside the building. 29:33.760 --> 29:35.060 We can't get anything in or out. 29:35.260 --> 29:40.540 So we know the tests that we're doing inside are not affecting systems externally from our lab. 29:40.960 --> 29:42.360 So yeah, that's about it. 29:42.360 --> 29:46.560 Um, if you guys want to get into cars, we'll be here the whole entire time during DEF CON. 29:46.560 --> 29:55.060 We do, we're a part of the CTF, so we have some stuff over there you guys can hack into, try to find some flags and maybe win that Jeep or that truck or, uh, this antenna. 29:55.400 --> 29:58.300 So yeah, thank you guys for coming out and, uh, enjoy the CON. 30:02.130 --> 30:03.350 We've got a question for you. 30:03.350 --> 30:04.590 We're doing questions now. 30:04.590 --> 30:06.490 I realize we do have some extra time. 30:06.810 --> 30:08.570 Uh, he said... 30:15.580 --> 30:23.140 so if you're using both L1 and L2, that would stop an attack like this, uh, from a SCID if they were doing one radio. 30:23.140 --> 30:30.660 You can sync two radios, broadcast L1 and L2 for the correct position , but it requires manual math or a very well written program. 30:30.880 --> 30:37.300 Um, what you would see with both receivers is you would see that L2 is getting where you would expect, where L1 is not. 30:37.300 --> 30:43.780 And L2, if they broadcast, there's no open source GitHub project for that yet, um, but I'm gonna post it. 30:43.780 --> 30:48.600 Um, you would be able to tell also by the difference in timing. 30:48.700 --> 30:57.620 So we need less than five parts per million accuracy to be, or precision, to be able to get this to be received by your phones or any other consumer grade device. 30:58.040 --> 31:05.260 It is very unlikely for someone to be able to do the wiring correctly to get that kind of accuracy to be consistent through two radios at the exact same time. 31:06.160 --> 31:09.000 So that's a good stop for this type of, uh, attack. 31:10.340 --> 31:11.360 Great question. 31:11.360 --> 31:12.540 Any other questions? 31:12.780 --> 31:14.580 Yeah, we'll go with you in the red first. 31:20.680 --> 31:23.860 So with this attack, the question was, uh, could we impact timing? 31:23.860 --> 31:24.940 The answer is yes. 31:24.940 --> 31:31.840 Uh, whatever time I broadcast, um, it, it, you kind of need to know more about the, the packet that gets broadcast from the satellite. 31:31.860 --> 31:36.040 But basically it's, it's, it's latitude, longitude, and it's time of broadcast. 31:36.040 --> 31:42.740 And then your radio takes in all those signals it picks up and says, ah, I see the time of flight was so and so, therefore I'm here. 31:42.900 --> 31:49.460 So if I were to broadcast consistently a different time, yes, you would receive it and trust it. 31:49.460 --> 31:52.000 It's a very, uh, weird phenomenon, but people do it. 31:52.000 --> 31:53.620 They use their GPS as timers. 31:56.710 --> 32:02.250 Uh, with your RSA certificates, uh, time is usually a factor in that. 32:02.430 --> 32:10.110 And you can completely set the seed value for a lot of these embedded controllers because they'll generate the same certificate given the same time. 32:10.510 --> 32:15.190 So if you know what it was once, you can just tell it it's the same time over and over again. 32:15.190 --> 32:18.970 And all of a sudden you're able to get the same certificate all the time. 32:19.090 --> 32:22.310 Which means now you can man the middle, even if they rotate their certs. 32:23.670 --> 32:28.530 Funky little CS problems become very big security holes. 32:30.070 --> 32:31.710 Any other questions? 32:34.110 --> 32:34.710 Cool. 32:41.140 --> 32:43.520 So that's a good question. 32:43.520 --> 32:46.820 Um, we don't directly focus on the full vehicle yet. 32:46.820 --> 32:48.700 Uh, we're mainly focused on modules. 32:48.700 --> 32:55.920 So if you guys don't know what Delphi does, they create a lot of the safety, uh, systems in your cars as well as infotainment systems in your vehicles. 32:56.060 --> 33:00.060 Um, so right now our focus is strictly on protecting our parts. 33:00.420 --> 33:06.300 Um, down the road we do want to have, uh, offerings to like our customers, OEMs, where we could do full vehicle assessments for them. 33:06.300 --> 33:09.840 But right now it's strictly on the, um, module side. 33:09.840 --> 33:14.800 I did a talk, um, a few months ago at SANS that kind of laid out a lot of this stuff. 33:14.800 --> 33:19.260 I can get you that link and there's a presentation in there that'll show you more details of what we did for that. 33:20.280 --> 33:21.020 Yep. 33:26.320 --> 33:27.780 Uh, we do, yes. 33:27.780 --> 33:36.420 And we also focus, uh, sorry, the question was, um, are we only focusing on like our ECUs or the interfaces that are coming in from other stuff? 33:36.560 --> 33:40.380 Uh, and the answer is absolutely the stuff that's coming from other systems. 33:40.380 --> 33:44.280 And that's why even the wireless stuff, you know, when stuff's coming over wireless, we're testing that. 33:44.280 --> 33:49.620 We don't only look inside our systems, we look on the interfaces and anything that's connecting to the systems. 33:49.620 --> 33:55.240 Um, a lot of that's hard to test when you only have the module because you don't know how everything's going to be talking to it. 33:55.240 --> 33:59.380 So that's why we're trying to build our systems up to eventually do full vehicle assessments. 34:00.000 --> 34:01.300 So, good question. 34:02.680 --> 34:03.840 Yeah, yeah. 34:06.500 --> 34:07.580 Oh, cool. 34:07.600 --> 34:08.660 We'll talk later. 34:09.560 --> 34:10.880 Any other questions? 34:12.900 --> 34:16.460 Alright, if you guys have any, just ask or if not, just stop by our booth. 34:16.460 --> 34:17.720 Uh, thanks again.