1
00:00:00,000 --> 00:00:06,380
Cool. We're going to start going now. So my name is Justin. I work for Delphi Automotive

2
00:00:06,380 --> 00:00:11,920
who's sponsoring the Car Hacking Village. I run the red team testing lab there. So my team who

3
00:00:11,920 --> 00:00:14,760
you'll see around here is the ones that are going to be doing demos and doing a lot of this

4
00:00:14,760 --> 00:00:21,220
stuff for us. But we hack our own modules to help our engineers secure them better. So to get

5
00:00:21,220 --> 00:00:25,840
into this a little bit, starting off at the Car Hacking Village we do have a CTF there this

6
00:00:25,840 --> 00:00:30,120
year. It's really, really cool. They got lots of different interfaces, lots of different

7
00:00:30,620 --> 00:00:36,920
systems to hack into. The first place prize is this truck over here. So if you guys want to play

8
00:00:36,920 --> 00:00:40,420
around you can win a truck. Another prize that we're going to be giving away is this antenna

9
00:00:40,420 --> 00:00:44,860
that we're going to be demoing for you guys. So you can see it right here. This is a GPS

10
00:00:45,580 --> 00:00:51,860
helical directional antenna. We'll go into the making of that as well in a little bit. So to

11
00:00:51,860 --> 00:00:55,660
yeah, going back to our day job. So we're a Delphi Cyber Security

12
00:00:56,260 --> 00:01:00,760
testing team. We do pen testing for the company, process and tool development as well as

13
00:01:00,760 --> 00:01:04,260
research and development. This is what our facility looks like. We've got a bunch of garage

14
00:01:04,260 --> 00:01:10,240
bays we can pull cars into and a pretty big facility to do testing on modules. So now moving

15
00:01:10,240 --> 00:01:14,760
into the outline, we're going to talk about different test interfaces on the wireless side as

16
00:01:14,760 --> 00:01:18,720
well as tool kits for it. Just to help you guys out in case you may not have tested or done

17
00:01:18,720 --> 00:01:22,220
this stuff before. So we'll just kind of give you the rundown of what we're using and what

18
00:01:22,220 --> 00:01:25,640
works for us. Then we're going to do a demo on key fob analysis. We're going to do a demo on key fob

19
00:01:25,640 --> 00:01:29,720
analysis. So we're going to use GNU radio and a HackRF to do some analysis on key fob to show you

20
00:01:29,720 --> 00:01:34,360
how to pull those out of the air and do a deep dive into those. And then we're going to go into

21
00:01:34,360 --> 00:01:39,040
building directional antenna, which is this guy over here in the front, Brian, who's the

22
00:01:39,040 --> 00:01:43,260
mastermind behind that. And then we're going to get into the demo of actually directionally

23
00:01:43,260 --> 00:01:49,060
pointing GPS over here and showing you how that antenna works. Alright, so now this stuff I'll run

24
00:01:49,060 --> 00:01:52,660
through quick because you guys probably know a lot of this. This is just the typical Wi-Fi

25
00:01:52,660 --> 00:01:55,620
standards. So I just wanted to throw this in here so you had it all. And then we're going to go

26
00:01:55,640 --> 00:02:00,500
to the next one. Here's some tools that you guys can use for Wi-Fi. We don't do too much Wi-Fi

27
00:02:00,500 --> 00:02:06,080
stuff in cars. I mean, pretty much most of them have WPA2. So unless you can bypass a password,

28
00:02:06,180 --> 00:02:09,420
which they're getting a little bit better. The car companies are slowly getting better at

29
00:02:09,420 --> 00:02:16,320
making good passwords on WPA2. But that's really the only weakness that we're seeing. So yeah,

30
00:02:16,340 --> 00:02:20,900
we'll go to the next one, which is going to be Bluetooth. Bluetooth was a lot more vulnerable in

31
00:02:20,900 --> 00:02:25,620
the older versions. So any older cars that have older versions of Bluetooth in it are

32
00:02:25,640 --> 00:02:32,020
extremely vulnerable to those types of attacks. Here's some more specs on that. It's another RF

33
00:02:32,020 --> 00:02:38,380
spectrum that sits in the 2.4 gigahertz range. The Bluetooth version 5 is really nice because

34
00:02:38,380 --> 00:02:43,080
it's bumping up the speed like crazy. And mainly the, whoops, mainly the distance, which is

35
00:02:43,080 --> 00:02:48,100
nice. Just because all these different devices people are making in their houses, you can go a

36
00:02:48,100 --> 00:02:51,560
lot more farther in your house. But then for us, if we want to do drive-bys, we can also get

37
00:02:51,560 --> 00:02:55,620
into their stuff. So here's some tools that we use for Bluetooth testing. We've got Bluetooth

38
00:02:55,640 --> 00:02:59,480
testing. The Ubertooth one is really helpful. And then we just use this adapter. It's really

39
00:02:59,480 --> 00:03:03,020
easy. We can transmit on this. We can do whatever we want with this device. Some Bluetooth devices

40
00:03:03,020 --> 00:03:08,180
won't allow you to. Um, so now moving into cellular. There's three different areas that we

41
00:03:08,180 --> 00:03:12,620
focus on in cellular. This is just giving you a rundown of spectrums. So whenever we're trying

42
00:03:12,620 --> 00:03:16,920
to dig into a new technology or understand it more, this is the type of data we compile to start

43
00:03:16,920 --> 00:03:20,220
digging and understanding what tools we want to buy. Um, and then we start reaching out to

44
00:03:20,220 --> 00:03:25,340
vendors or coming to events like this and buying all the hacker tools. So when you're getting into

45
00:03:25,340 --> 00:03:32,280
a cellular related stuff or any, uh, wireless stuff on cars, um, it's recommended to look for

46
00:03:32,280 --> 00:03:37,140
this type of content on any of the modules. Mainly something with the FCC ID or even an IMEI

47
00:03:37,140 --> 00:03:41,000
number. It's going to let you know there's a cell network in here and it's transmitting some

48
00:03:41,000 --> 00:03:46,000
kind of RF somewhere. So this is how we quickly can move on to understanding what's coming out of

49
00:03:46,000 --> 00:03:52,000
this module. So now looking into the tools that we use. We're, um, trying to find what works

50
00:03:52,000 --> 00:03:55,320
best for us. So we buy a lot of industry based tools. Like this guy up here, he's got a lot of

51
00:03:55,340 --> 00:03:59,260
stuff. This is from Roden Schwartz. It's a cell site simulator. So this will actually put up a

52
00:03:59,260 --> 00:04:03,980
cell tower for you. You put a SIM card in your phone or whatever you need to and now you can see

53
00:04:03,980 --> 00:04:07,420
all the data streams and everything that's going back and forth from that phone. So it's really

54
00:04:07,420 --> 00:04:11,180
helpful for us when we're trying to test apps and cars that people are building to understand if

55
00:04:11,180 --> 00:04:13,960
they're actually communicating to the server securely and what type of data they're sending

56
00:04:13,960 --> 00:04:19,300
back and forth. Um, and then for putting up base stations, um, on a cheaper way, you can use a

57
00:04:19,300 --> 00:04:25,320
BladeRF with YatesBTS or this USRP device with YatesBTS as well. Those are a little bit more

58
00:04:25,320 --> 00:04:31,660
cheaper routes to go. And you can have a lot more customizability with those. Um, next is

59
00:04:31,660 --> 00:04:35,460
moving on to KeyFob, which we're going to show you the demo on. This is something that was

60
00:04:35,460 --> 00:04:40,420
introduced in 1980 by Ford. Um, there's two main frequencies which is 3.5 megahertz and

61
00:04:40,420 --> 00:04:47,600
4, 33.92 megahertz. Um, the distance is 5 to 20 meters and the security on this is mainly rolling

62
00:04:47,600 --> 00:04:53,120
codes and challenge response. A couple years ago you guys may have seen a guy named Sammy Camcar

63
00:04:53,120 --> 00:04:55,300
create a device that was, uh, you know, you know, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh,

64
00:04:55,320 --> 00:05:00,860
able to bypass or, you know, leverage rolling codes to be able to get into people's cars. Um,

65
00:05:00,960 --> 00:05:05,800
there's also passive key entry systems which are running stuff in the, uh, kilohertz range. So

66
00:05:05,800 --> 00:05:09,440
when you walk up to your car and you want to unlock it with just your button, uh, or the

67
00:05:09,440 --> 00:05:13,720
handle on the car, that's usually using something in the kilohertz range. And that's called

68
00:05:13,720 --> 00:05:20,300
passive key entry. So here's some tools that we use for, uh, the KeyFob stuff. Uh, we mainly are

69
00:05:20,300 --> 00:05:24,120
using the hacker refs, but the spectrum analyzer is really helpful to see those packets coming

70
00:05:24,120 --> 00:05:28,940
across. Um, and then we also use the yardstick one because that goes down to the lower

71
00:05:28,940 --> 00:05:35,220
kilohertz. So now moving on to GPS which we'll show you in a demo on that as well. This is

72
00:05:35,220 --> 00:05:39,900
something that was created by the United States in the 70s. Um, there's a few different bands. The

73
00:05:39,900 --> 00:05:45,600
ones that are mainly public are L1 and L2. Uh, if you want to lock down GPS properly, use both

74
00:05:45,600 --> 00:05:50,280
radios in your devices. Most people don't. I know Apple doesn't and we can talk about that in a

75
00:05:50,280 --> 00:05:53,820
little bit. We can show you what happens with that because they don't. Um, we pretty much can

76
00:05:53,820 --> 00:05:57,720
put anybody's phone wherever we want if you're only using one band because your phone's only

77
00:05:57,720 --> 00:06:02,380
relying on that band so it's not getting another source to say, hey, you're not actually here, you

78
00:06:02,380 --> 00:06:08,300
should be here. Um, so we'll show you what, how that can be messed with. Um, some different

79
00:06:08,300 --> 00:06:12,800
tools we're using for this. You can use a hacker ref. Uh, they're kind of hard because you've

80
00:06:12,800 --> 00:06:17,060
got to stack a bunch because you have to do transmitting and receiving. Um, and then we

81
00:06:17,060 --> 00:06:20,200
mainly use the blade ref, um, which we have set up here connected to this

82
00:06:20,200 --> 00:06:24,940
antenna. So we'll show you that in a moment. And then the next one, the last one, which is a

83
00:06:24,940 --> 00:06:28,400
fun one, which you guys may not have heard of yet. This is something that's coming in cars. It's

84
00:06:28,400 --> 00:06:32,360
kind of scary from my perspective because of what they're trying to do with it, but it is

85
00:06:32,360 --> 00:06:35,780
something that's needed. Cars do need to talk. If we're going to have autonomous cars down the

86
00:06:35,780 --> 00:06:40,060
road, they do have to talk to each other in some manner. So this is currently the automotive

87
00:06:40,060 --> 00:06:44,860
solution for that. It's called vehicle to everything. Um, it runs just above, uh, the 5

88
00:06:44,860 --> 00:06:50,180
gigahertz range and it has a protocol of 802.11p, which is a protocol that allows you to

89
00:06:50,200 --> 00:06:54,460
use it. It's very similar to all the wifi standards. It's really not that much different. The

90
00:06:54,460 --> 00:07:02,820
biggest thing is, uh, it's got this IEEE 1609 application layer on top of it. And then here's

91
00:07:02,820 --> 00:07:07,300
some tools that we use for that. Um, if you're looking into development tools, so these are

92
00:07:07,300 --> 00:07:10,720
just the hacker type tools besides this one, but another development tool you can look to is

93
00:07:10,720 --> 00:07:16,020
something called CODA Wireless or MK5. Um, that'll allow you to actually transmit and do some

94
00:07:16,020 --> 00:07:20,080
V2X based stuff. And another one from the auto industry is pretty big. It's Vector Canoe.

95
00:07:20,200 --> 00:07:24,280
They're really expensive, so hopefully in the near future some hackers will release some tools

96
00:07:24,280 --> 00:07:29,260
that are a lot cheaper for you guys. Alright, now we can move into this, uh, key fob analysis if

97
00:07:29,260 --> 00:07:47,420
you're ready, Dave. Right here. Right here. Hi, everybody. My name is Dave Conant. I work for

98
00:07:47,420 --> 00:07:50,180
Adelphi along with Justin, and I'm sort of the radiest hacker in the world. I work for

99
00:07:50,200 --> 00:07:55,320
Adelphi and I'm a video guy, I guess, uh, over there. Okay, so is my screen popping up here? No?

100
00:08:00,480 --> 00:08:20,180
How do I... Oh, there we go. That's interesting. Well, if you can't do it, you can do it.

101
00:08:20,200 --> 00:08:32,320
Can't see it, I'm gonna have a hard time demoing it. There we go. Alright, so who's used GANOO

102
00:08:32,320 --> 00:08:37,760
Radio before? Anybody in here? Has anybody... For the people who haven't used it, have you heard

103
00:08:37,760 --> 00:08:43,040
GANOO Radio? Okay, so if you haven't used GANOO Radio, or you've heard of it, uh, I'm going to

104
00:08:43,040 --> 00:08:47,220
explain just the basics of what this thing does. It's a, it's a useful tool that we use in the lab,

105
00:08:47,220 --> 00:08:54,520
that we use to isolate different wireless signals. So Justin spoke about GPS, you know, DSRC,

106
00:08:54,680 --> 00:08:59,260
but at the end of the day, in the radio frequency spectrum, you know, vehicles themselves, they

107
00:08:59,260 --> 00:09:04,540
have, like, 15 different radios on them. Your phone probably has, like, six or seven. You

108
00:09:04,540 --> 00:09:08,940
know, you've got Bluetooth, Wi-Fi, but then what about the non-standard wireless? So, you

109
00:09:08,940 --> 00:09:13,260
know, I've got my key fob here for my truck, for example. Now, this thing doesn't speak

110
00:09:13,260 --> 00:09:19,900
Wi-Fi. It doesn't speak GPS. So how do we deal with signals when we don't really have, you

111
00:09:19,900 --> 00:09:25,220
know, like, a Wi-Fi adapter to, like, just let us authenticate to it? Basically, from the blue,

112
00:09:25,300 --> 00:09:30,900
reverse engineering random wireless signals and looking at the binary data inside of them. So I

113
00:09:30,900 --> 00:09:36,680
want to show you two tools that we use in the lab to isolate these signals and how we can decode

114
00:09:36,680 --> 00:09:42,380
the actual binary data off of that so we can actually send and communicate with these basic

115
00:09:42,380 --> 00:09:42,940
devices.

116
00:09:43,260 --> 00:09:49,480
It's actually, generally speaking, easier to talk to these guys than something like using

117
00:09:49,480 --> 00:09:54,140
Wi-Fi. It's much less complicated. So, for example, with your key fob, it's just a series of

118
00:09:54,140 --> 00:09:59,460
bits, and if the car hears the right series of bits, there's no handshake. It just says, oh, I

119
00:09:59,460 --> 00:10:03,740
like those bits. I'm going to open up the car. It's that simple. So as long as you know that

120
00:10:03,740 --> 00:10:09,520
code or how to generate that code, then you can talk to it. So actually being able to read the

121
00:10:09,520 --> 00:10:13,240
code off of the air if you don't know what the wireless signal looks like is a very useful

122
00:10:13,260 --> 00:10:18,520
skill to have in general. DEF CON, we've seen talks that guys talk to satellites using these

123
00:10:18,520 --> 00:10:23,540
techniques. You can talk to cars. Anything that transmits a wireless signal that you can talk to.

124
00:10:23,720 --> 00:10:31,560
So I'm using a HackRF. I think the range on this thing in frequency terms is, it goes up to 6

125
00:10:31,560 --> 00:10:38,120
gigahertz and down to 10 megahertz? 1 megahertz? 1 megahertz. That's a huge range. This is

126
00:10:38,120 --> 00:10:43,180
actually a monumental invention, software defined radio in general. Having this kind of power to be

127
00:10:43,260 --> 00:10:48,660
able to transmit and receive on that wide a frequency range is something that 10 years ago even

128
00:10:48,660 --> 00:10:53,340
would have cost millions of dollars in equipment and would have been military classified type

129
00:10:53,340 --> 00:10:59,480
technology. So please get one and learn how to use them. They're very awesome. All right. So I'm

130
00:10:59,480 --> 00:11:06,220
opening up basically a utility called GQRX. GQRX, if you install a new radio along with this,

131
00:11:06,260 --> 00:11:11,780
you're going to be covered. So I'm going to move this guy over here. GQRX, this guy right here is a

132
00:11:11,780 --> 00:11:16,600
spectrum analyzer. Everybody knows what that is? It's our eyes and ears on the frequency, the

133
00:11:16,600 --> 00:11:22,000
frequency realm. This lets us see our wireless signals. This guy and most spectrum analyzers cost

134
00:11:22,000 --> 00:11:29,160
between at least $10,000 up to $500,000 to $1 million. Just to give you an idea of what it's

135
00:11:29,160 --> 00:11:34,640
like just to see a spectrum range that we're talking about here. HackRF costs I think $200 or

136
00:11:34,640 --> 00:11:40,720
$300 and it can see almost the same range as this guy. This guy is still better. It's more

137
00:11:40,720 --> 00:11:46,940
accurate. But the HackRF is good enough for us hackers. And GQRX, I want to show you, basically

138
00:11:46,940 --> 00:11:54,040
does the same thing that our $200,000 spectrum analyzer over here does. And you can actually see

139
00:11:54,040 --> 00:12:01,580
they look very similar. And I'm going to use GQRX to move down and find my key fob signal to show

140
00:12:01,580 --> 00:12:10,020
you guys what that looks like. I happen to know that it's 315 megahertz and everything, all your

141
00:12:10,020 --> 00:12:15,000
devices, they come with an FCC ID if they're being sold commercially. So they will tell you what

142
00:12:15,000 --> 00:12:19,860
the frequency is on the FCC's website. Super useful website to look up all kinds of parameters

143
00:12:19,860 --> 00:12:24,940
that we're going to use in GNU radio to decode this signal. So you can see here when I press my

144
00:12:24,940 --> 00:12:29,880
little button for my HackRF, there's a little bumpity bump coming. That's a frequency shift key

145
00:12:30,660 --> 00:12:37,520
coming from my key fob. I do want to show you as well, so we're looking at, I think, what is this?

146
00:12:40,020 --> 00:12:44,420
20 megahertz in bandwidth or 16 megahertz, I can't remember. I do want to show you an important

147
00:12:44,420 --> 00:12:49,000
and difficult part in dealing with GNU radio is setting up the filtering. And I want to show you

148
00:12:49,000 --> 00:12:54,400
just what filtering looks like in GQRX. When you click around, you can see that little band

149
00:12:54,400 --> 00:12:59,480
there. It's actually filtering all the signals out around it. And if I had my audio on, it would

150
00:12:59,480 --> 00:13:05,380
actually play the sound for the signal that you're receiving. So you're narrowing in and zeroing

151
00:13:05,380 --> 00:13:09,700
in on that signal that you're looking for despite capturing 20 megahertz worth of bandwidth.

152
00:13:10,020 --> 00:13:22,380
So I think my computer locked up. Yeah, okay. Well, that's okay. I was going to close GQRX

153
00:13:22,380 --> 00:13:27,440
anyway and switch to GNU radio. The important thing to understand is when we're going to decode

154
00:13:27,440 --> 00:13:33,200
this signal in GNU radio and get the binary bits out of there, there's basically four steps and

155
00:13:33,200 --> 00:13:38,320
essentially we have to capture the signal from a source. That's obvious. And then we need to

156
00:13:38,320 --> 00:13:39,820
filter all the junk.

157
00:13:40,020 --> 00:13:44,240
And then we need to filter all the junk around it out from the signal. And there's an entire

158
00:13:44,240 --> 00:13:50,260
series. You should watch Michael Osmond's SDR series if you haven't already. He's the guy who

159
00:13:50,260 --> 00:13:54,700
created the HackRF. And he's got an entire educational video series. And he's got an entire

160
00:13:54,700 --> 00:14:00,000
one dedicated, an entire hour dedicated to filtering. It's a science and an art. There's a

161
00:14:00,000 --> 00:14:04,800
lot that goes into it. There's many different kinds of filters, high pass, low pass, band pass,

162
00:14:05,420 --> 00:14:10,000
X-flating, fur filters, blah, blah, blah. Learn them all, what they do, what they do, what they do,

163
00:14:10,000 --> 00:14:14,380
they're not that tough, but they're a little intimidating to get to at first. It's very

164
00:14:14,380 --> 00:14:19,640
important to zero in on your signal with those filters though. Okay. So once you've zeroed in on

165
00:14:19,640 --> 00:14:24,980
your filter and on your signal with your filter, the next step that you have to do is demodulate

166
00:14:24,980 --> 00:14:29,480
it. Demodulating is going to come in a couple different flavors. There's frequency

167
00:14:29,480 --> 00:14:34,880
demodulation and amplitude demodulation. So when you're playing around in GQRX, it will

168
00:14:34,880 --> 00:14:39,960
behoove you to figure out and identify with your eye or your ear whether you're dealing with a

169
00:14:40,000 --> 00:14:45,920
frequency shift key signal or an amplitude shift key signal. Amplitude sounds like Morse code or

170
00:14:45,920 --> 00:14:50,420
it's changing in volume. A frequency shift key is going to have differing tones that you'll hear

171
00:14:50,420 --> 00:14:57,000
and it'll sound more like music or dubstep or something like that. So once you identify that,

172
00:14:57,100 --> 00:15:04,420
you can pick your frequency shift keying or your amplitude shift keying. So I've prepared new

173
00:15:04,420 --> 00:15:09,980
radio blocks here. Let's see if this works. Is it? Okay. So I'm going to go ahead and turn this

174
00:15:12,480 --> 00:15:26,980
on. No, it doesn't. What's that? Oh, there we go. Wait for it for a second. Okay. I have to be

175
00:15:26,980 --> 00:15:35,380
fast here. So my program that I've written here, GNU radio, oh, whoa. It uses flowcharts to

176
00:15:35,380 --> 00:15:39,640
define your actual software. In the background of each one of these flowcharts, there's actually a

177
00:15:39,640 --> 00:15:45,480
Python script that gets executed. And you can see here, this is what I was talking about. I'm

178
00:15:45,480 --> 00:15:51,660
using the Osmocom source, which is my HackRF. I set the frequency to 315 megahertz because I know

179
00:15:51,660 --> 00:15:55,640
that that's where my signal is. And I set my sample rate to be about 4 megahertz. That means

180
00:15:55,640 --> 00:16:00,900
I'm capturing 4 megahertz of bandwidth around the signal. That's a lot of bandwidth. The actual

181
00:16:00,900 --> 00:16:06,940
bandwidth of this signal is like 200 kilohertz. It's not that wide. That's why I pass it into a

182
00:16:06,940 --> 00:16:09,620
filter. I'm not going to explain all of these details. I'm just going to go ahead and run this.

183
00:16:09,640 --> 00:16:14,120
You can see it's a lot of different parameters. But basically, I'm zeroing in on the signal with

184
00:16:14,120 --> 00:16:22,020
this. So it's kind of offset from 315 megahertz. It's not quite exactly. It's like 314.9. You can

185
00:16:22,020 --> 00:16:27,060
figure that out from the FCC website. So I'm offsetting it to zero in on the signal. And then I

186
00:16:27,060 --> 00:16:33,160
am shrinking down that 4 megahertz of bandwidth just to capture this signal alone and none of the

187
00:16:33,160 --> 00:16:38,660
junk that's flying around it, especially here at DEF CON. I'm then piping the signal into a

188
00:16:38,660 --> 00:16:39,340
frequency sync.

189
00:16:39,640 --> 00:16:43,600
Which is exactly the same thing as the spectrum analyzer that we see here. So we can actually see

190
00:16:43,600 --> 00:16:49,920
the signal that we're capturing and confirm that we're getting it. De-modulating the signal. And

191
00:16:49,920 --> 00:16:54,880
now this is the secret sauce to get the binary data out of it. So at this point, this is nice,

192
00:16:55,020 --> 00:16:59,200
you'll actually be zeroed in on a signal. You can hear it. You can record it. You can save it. And

193
00:16:59,200 --> 00:17:05,120
you can import it into other analysis tools like Baudline and Spectrum or even Audacity, your

194
00:17:05,120 --> 00:17:09,620
favorite music editing program, is able to read this. So you can actually see the signal and then you can

195
00:17:09,620 --> 00:17:14,540
see the data coming out of here. So you can just put that into a file sync right there. But if you

196
00:17:14,540 --> 00:17:20,420
just want to pull the bits out, you put it into a clock recovery block. The only thing you need to

197
00:17:20,420 --> 00:17:25,560
know to use this block is your baud rate of the signal. And you can look at that visually or you

198
00:17:25,560 --> 00:17:33,220
can look it up on the FCC. My key is I think 115,000 symbols per second. And once I know that,

199
00:17:33,700 --> 00:17:39,440
then I put it into a binary slicer that slices it into bits. And I save it to a file on the TempFS.

200
00:17:40,040 --> 00:17:47,320
I'm going to show you what that looks like when it runs right now. And I know there's a lot of

201
00:17:47,320 --> 00:17:51,100
information. I have a ton of resources for you folks that you can like walk through chapter by

202
00:17:51,100 --> 00:17:55,620
chapter. There's a lot of authors out there that have done this exact same thing. And they explain

203
00:17:55,620 --> 00:18:00,420
everything in far more detail than I can here today. All right. So I'm going to run the program.

204
00:18:00,720 --> 00:18:09,600
Hopefully it'll work. I'm going to click okay. That's fine. So I'm going to run the program.

205
00:18:17,660 --> 00:18:24,180
All right. There's my signal. And now I'm just going to exit because I've captured what I need.

206
00:18:27,000 --> 00:18:34,480
So I save that to temp test. I'm going to go ahead and just dump that with a hexadecimal viewer.

207
00:18:35,600 --> 00:18:39,220
And bingo. So you can see the pattern there in the bits.

208
00:18:41,340 --> 00:18:46,260
It's basically all ones. It's a preamble for the signal saying, hey, you're about to receive some

209
00:18:46,260 --> 00:18:52,420
interesting data. And right after that you can see that there's the code right here. Now

210
00:18:52,420 --> 00:18:58,120
something I didn't show you in my block, that if you actually want to use this in the field, is

211
00:18:58,120 --> 00:19:03,100
there's something called a... There's a way that you can set the access code. So hey, look for

212
00:19:03,100 --> 00:19:07,700
the ones in a row and only capture the bits that come after that. It's useful so you don't get this

213
00:19:07,700 --> 00:19:14,160
this file that I showed you that has all of the repeating signal here. It'll just grab the

214
00:19:14,160 --> 00:19:17,900
signal that you're interested in. But just for the purposes of this demo I wanted to show you

215
00:19:18,280 --> 00:19:22,560
the preamble and the code, the preamble and the code, the preamble and the code. And that is

216
00:19:22,560 --> 00:19:26,700
literally the key fob signal for my truck. So if somebody wanted to take a picture of those ones

217
00:19:26,700 --> 00:19:30,720
and zeros and could find my truck in the parking lot, you could redigitize the signal over the

218
00:19:30,720 --> 00:19:34,700
air and break into my truck. And that would be that. Anybody else want to try pressing their

219
00:19:34,700 --> 00:19:39,240
unlock key and let me record it and tell me where the make and model and where it's parked? No?

220
00:19:39,960 --> 00:19:44,080
It's really cool stuff. That's all I have for you today for my demo. But that's how you decode a

221
00:19:44,080 --> 00:19:49,060
binary signal arbitrarily broadcasted over the air. You reverse the entire process to broadcast

222
00:19:49,060 --> 00:19:55,060
it out. And please learn how to use GNU Radio GQRX and buy yourself a HackRF to get into this

223
00:19:55,060 --> 00:20:02,440
stuff. And thank you very much. I'll pass it back to Justin. Thanks Dave. We got to flip

224
00:20:02,440 --> 00:20:04,680
laptops. I got to flip the laptop.

225
00:20:04,700 --> 00:20:10,640
I got to flip the laptop again. Open. Yeah, pull the HDMI. Sorry, one second while we switch the

226
00:20:10,640 --> 00:20:33,380
demo stuff up. Alright, now we're going to get into the making of the antenna over there.

227
00:20:33,380 --> 00:20:59,680
Whenever the screen wants to load. Yeah, one moment. HDMI. Sorry guys. Alright, here we go.

228
00:20:59,820 --> 00:21:01,060
Nope. No source found.

229
00:21:04,160 --> 00:21:13,720
Sorry, I, it's, I have it set up to duplicate. Looks like it's not really going in.

230
00:21:15,020 --> 00:21:22,900
Looks like it wasn't going in. Yeah, there it goes. You're right. Huh.

231
00:21:27,180 --> 00:21:32,280
So we're going to try and unplug, try to get it to read effect. Oh, hold it. Yeah, oh shit.

232
00:21:35,420 --> 00:21:36,200
Sorry guys.

233
00:21:37,000 --> 00:21:38,900
Got to love technology. Yeah.

234
00:21:39,140 --> 00:21:40,640
And that way you've got to watch it.

235
00:21:41,540 --> 00:21:41,980
.

236
00:21:41,980 --> 00:21:42,120
.

237
00:21:46,160 --> 00:21:46,600
.

238
00:21:47,280 --> 00:21:47,720
.

239
00:21:47,720 --> 00:21:47,940
.

240
00:21:56,260 --> 00:22:01,460
. . Oh yeah, I look, I see you already or how did you get in their technology

241
00:22:01,460 --> 00:22:02,400
. . . . I got it on spaghetti here.

242
00:22:02,400 --> 00:22:06,600
Just the normal thing. Yeah, it's just the source

243
00:22:06,600 --> 00:22:07,680
. .

244
00:22:16,560 --> 00:22:27,280
No, it's HDMI. Sure, we can try it. All right. Never mind. We'll try this. If not,

245
00:22:27,400 --> 00:22:36,460
then I'll try this little dongle. There we go. Sweetness. Sorry about the delay, guys.

246
00:22:36,460 --> 00:22:40,240
All right. So now we're going to get into building a helical antenna. So this is going to be

247
00:22:40,240 --> 00:22:45,420
presented by Brian Gillespie. This guy is a bad ass physics guy. He knows a lot of stuff in

248
00:22:45,420 --> 00:22:50,260
physics. And now he's becoming a hacker. So here you go. Here's Brian. All right. Thank you,

249
00:22:50,280 --> 00:23:02,680
Justin. Are you going to index the slides since you took? Okay. So I'm going to just review some

250
00:23:02,680 --> 00:23:06,440
of the fundamentals of the radio physics ways as most of you probably know. But I'm going to

251
00:23:06,440 --> 00:23:10,900
tell you what we need to understand with building things like this and doing things that Dave's

252
00:23:10,900 --> 00:23:20,120
doing and other people. So the quick review. So here's our whole spectrum that we have. You

253
00:23:20,120 --> 00:23:27,620
know, increasing wavelength. We have the lower frequency. And then we have higher frequency,

254
00:23:27,880 --> 00:23:33,620
smaller wavelengths. And if you see where I've got that arrow pointed, radio frequencies are

255
00:23:33,620 --> 00:23:36,420
typically frequencies above 1 gigahertz or 10 to the 10th of a second. And then we have the

256
00:23:36,420 --> 00:23:43,260
9 hertz. And they travel at the speed of light. And so we'll go to the next slide here. So

257
00:23:43,260 --> 00:23:48,680
they travel in a straight line and they are reflect. So when you're above that frequency

258
00:23:48,680 --> 00:23:54,260
range, they'll bounce off things like the walls. When you have the lower frequencies, you can

259
00:23:54,260 --> 00:23:59,500
have environmental effects on them. But for what we're doing, you know, the travel's at the

260
00:23:59,500 --> 00:24:05,560
speed of light. And it's important to remember our wave equation here where we have, you know, the

261
00:24:05,560 --> 00:24:06,400
frequency . . . Or it's not there. Okay. So when you're down the tube and you're over that wave, you're not able to see the lights. That's not

262
00:24:06,400 --> 00:24:08,660
The frequency times the wavelength gives us the speed.

263
00:24:08,900 --> 00:24:10,920
So that's going to be helpful when I build the antenna.

264
00:24:12,520 --> 00:24:13,440
And forward.

265
00:24:13,700 --> 00:24:14,800
So helical antenna.

266
00:24:15,060 --> 00:24:17,900
This is what the main part of the talk here is.

267
00:24:22,560 --> 00:24:28,200
So you've got your center support here, which is this B here.

268
00:24:28,440 --> 00:24:32,440
And you can see that in the antenna over there, the coaxial feed line.

269
00:24:33,620 --> 00:24:38,440
And then you have the insulating supports because we don't want any connectivity anywhere else.

270
00:24:38,460 --> 00:24:40,300
You've got the reflector ground plane.

271
00:24:40,600 --> 00:24:45,720
And then you've got your coaxial that feeds your signal in.

272
00:24:46,120 --> 00:24:49,620
Or if you want to receive, then it goes the other way.

273
00:24:49,780 --> 00:24:52,880
So there's two modes that these helical antennas can operate in.

274
00:24:52,960 --> 00:25:00,160
And that's the normal mode, where the helix pitch and diameter are small compared to the wavelength.

275
00:25:00,740 --> 00:25:02,260
And are omnidirectional.

276
00:25:02,440 --> 00:25:06,520
And then the axial mode type, N-fire, which is what that antenna over here is,

277
00:25:06,560 --> 00:25:10,260
is the diameter and the pitch are comparable to the wavelength.

278
00:25:10,400 --> 00:25:14,420
And you'll see that when I'm going to show up here next, or coming up.

279
00:25:14,600 --> 00:25:17,220
So this is just kind of a visual of what it looks like from some simulations

280
00:25:17,220 --> 00:25:22,620
between an omnidirectional type antenna, which just kind of radiates out and spreads out.

281
00:25:22,820 --> 00:25:28,700
Where the N-fire directional, which is the helical, which means we can point it at things, is this one here.

282
00:25:30,580 --> 00:25:30,980
So.

283
00:25:32,440 --> 00:25:38,000
Here's a little more animation here for us, just to show what happens when we have a helical antenna.

284
00:25:38,500 --> 00:25:47,660
And that is, depending on which way the helix is oriented, the waves will spin one way, or the vectors here,

285
00:25:48,340 --> 00:25:51,540
will show the polarization, and will be right-handed or left-handed.

286
00:25:51,820 --> 00:25:56,000
And so that's based on how this, which way that's turned.

287
00:25:56,460 --> 00:25:59,540
Now I don't know, you took the animation out, it looks like.

288
00:25:59,780 --> 00:26:00,480
That's okay.

289
00:26:01,280 --> 00:26:02,240
But you can see.

290
00:26:02,440 --> 00:26:06,280
Down here, as it comes out, these waves are spinning around.

291
00:26:06,360 --> 00:26:09,780
That's the representation up here, and that's the N-fire for that.

292
00:26:10,420 --> 00:26:10,780
Okay.

293
00:26:11,100 --> 00:26:13,800
So this gets to the heart of the manner here of how to make the antenna.

294
00:26:13,980 --> 00:26:18,420
So I found this nice website up here that did most of the calculations for us.

295
00:26:20,720 --> 00:26:23,720
So plug in the frequency, how many turns you want,

296
00:26:23,860 --> 00:26:26,660
and then it pops out all this information that we need to build the antenna.

297
00:26:26,820 --> 00:26:31,580
So this is the general schematics that I had to take and interpret to,

298
00:26:32,180 --> 00:26:36,640
you know, build that antenna that's sitting over there so that we can use it for our work

299
00:26:36,640 --> 00:26:43,000
and looking at what happens when we, GPS is pointed at something that has it

300
00:26:43,000 --> 00:26:44,740
and what impact it's going to have for us.

301
00:26:45,800 --> 00:26:46,480
All right.

302
00:26:47,320 --> 00:26:47,780
Whoops.

303
00:26:48,720 --> 00:26:49,180
Okay.

304
00:26:49,520 --> 00:26:56,680
So real quick, take some tools to build that and some design work from the previous slide

305
00:26:56,680 --> 00:26:58,100
to make all these parts here.

306
00:26:58,400 --> 00:27:01,120
So this is our bridge-up-art mill that I was using.

307
00:27:01,580 --> 00:27:03,840
I was in the process of putting in the holes.

308
00:27:03,920 --> 00:27:09,020
All these holes are spaced on fractions of wavelength from that slide I showed you before.

309
00:27:09,380 --> 00:27:11,720
So that tells me what the spacing needs to be here.

310
00:27:12,320 --> 00:27:16,260
And then from there, you need to use the lathe to make some of the other round parts,

311
00:27:16,400 --> 00:27:17,720
basically the items you need.

312
00:27:17,960 --> 00:27:21,200
And one thing to remember that an antenna is just a wire.

313
00:27:21,260 --> 00:27:26,480
So all that is is just a wire configured a certain way to get the frequency we need for this application

314
00:27:26,480 --> 00:27:29,540
and some plastic, some aluminum, and other tools.

315
00:27:30,900 --> 00:27:31,500
All right.

316
00:27:31,580 --> 00:27:33,080
So there's the, oops, backwards.

317
00:27:33,760 --> 00:27:34,420
There's the antenna.

318
00:27:35,260 --> 00:27:36,760
And I think we're ready for the demo.

319
00:27:36,840 --> 00:27:39,380
So this is some things we're doing in the lab here.

320
00:27:39,520 --> 00:27:40,780
So you can see we're getting the signal.

321
00:27:41,240 --> 00:27:42,240
We've got a blade RF.

322
00:27:42,460 --> 00:27:43,900
Nick over there has got us all set up.

323
00:27:44,100 --> 00:27:47,080
Some of you, he's been broadcasting that for the whole time.

324
00:27:47,200 --> 00:27:51,560
So depending on your device, it could show you that it might be 1,000 feet above Moscow.

325
00:27:51,960 --> 00:27:54,360
So if he points it over here, let me get it out of the way.

326
00:27:54,400 --> 00:27:59,060
You should see the signal get stronger as he points it over here.

327
00:27:59,900 --> 00:28:01,180
And that's the purpose of it.

328
00:28:01,180 --> 00:28:02,480
But now if you put your hand in front of it.

329
00:28:02,540 --> 00:28:03,420
Now, see, it's bouncing off the wall.

330
00:28:03,480 --> 00:28:05,880
Put your hand in front of it when you turn it over there, because I checked it earlier.

331
00:28:06,280 --> 00:28:09,420
See, it's now, because it's reflecting off the wall, like I was mentioning,

332
00:28:09,440 --> 00:28:11,120
because it behaves like light.

333
00:28:11,240 --> 00:28:12,480
So it'll just bounce off the wall.

334
00:28:15,680 --> 00:28:17,800
So, and that's everything.

335
00:28:18,620 --> 00:28:20,900
It was a common issue we were having in the lab.

336
00:28:21,040 --> 00:28:21,760
It was like we were tilted.

337
00:28:21,880 --> 00:28:22,860
We're like, this thing's not working.

338
00:28:23,160 --> 00:28:24,800
We're like, this thing's not working.

339
00:28:24,920 --> 00:28:26,800
But then we're like, oh, yeah, reflection, light.

340
00:28:26,900 --> 00:28:27,480
It's just light.

341
00:28:28,840 --> 00:28:31,040
So that's why if you do, I don't know if this is going to work.

342
00:28:31,040 --> 00:28:31,800
It's just going to go the whole way.

343
00:28:32,040 --> 00:28:34,460
But if you do that and put your hand in front of it, it's going to put it away,

344
00:28:34,560 --> 00:28:36,660
because now it can't reflect off the walls anymore.

345
00:28:37,100 --> 00:28:40,980
But if you do this, now it's starting to reflect off the walls and the room and the ceiling,

346
00:28:41,080 --> 00:28:41,860
just like light does.

347
00:28:42,920 --> 00:28:46,040
Another thing, too, we don't have the amp plugged in on this,

348
00:28:46,120 --> 00:28:47,580
so we're not giving it enough power.

349
00:28:47,740 --> 00:28:50,880
We could pump this thing, or here, I'll let Nick talk about that.

350
00:28:51,040 --> 00:28:51,400
Yeah, go ahead.

351
00:28:52,200 --> 00:28:56,700
With proper amplification, you can cover this entire casino in whatever signal you want.

352
00:28:57,080 --> 00:29:00,140
This will render all navigation GPS completely useless.

353
00:29:00,700 --> 00:29:01,020
You'll be able to do that.

354
00:29:01,040 --> 00:29:02,200
You'll be wherever I tell you you are.

355
00:29:03,420 --> 00:29:07,140
Yeah, so pretty scary stuff, especially with autonomous cars coming down the road.

356
00:29:07,740 --> 00:29:11,460
Obviously, we care about safety a lot, which is why we design stuff like this,

357
00:29:11,560 --> 00:29:14,500
so we're not just putting everybody in the whole entire place in Moscow.

358
00:29:15,180 --> 00:29:17,540
We're just putting everything that's directional over there.

359
00:29:18,080 --> 00:29:20,180
It's a safer way of doing tests like this.

360
00:29:20,960 --> 00:29:22,820
You don't really want to get FCC calls.

361
00:29:23,740 --> 00:29:28,540
So doing stuff like this and having the proper facility to do this stuff in is also really helpful.

362
00:29:28,820 --> 00:29:30,860
The lab we do all this testing in is pretty much,

363
00:29:30,860 --> 00:29:31,560
it's pretty much a Faraday cage.

364
00:29:31,800 --> 00:29:33,480
We don't have cell inside the building.

365
00:29:33,680 --> 00:29:34,840
We can't get anything in or out,

366
00:29:34,960 --> 00:29:40,080
so we know the tests that we're doing inside are not affecting systems externally from our lab.

367
00:29:40,900 --> 00:29:42,100
So yeah, that's about it.

368
00:29:42,600 --> 00:29:46,100
If you guys want to get into cars, we'll be here the whole entire time during DEF CON.

369
00:29:46,480 --> 00:29:50,660
We're a part of the CTF, so we have some stuff over there you guys can hack into,

370
00:29:50,900 --> 00:29:54,540
try to find some flags, and maybe win that Jeep, or that truck, or this antenna.

371
00:29:55,120 --> 00:29:57,780
So yeah, thank you guys for coming out, and enjoy the CON.

372
00:30:02,040 --> 00:30:03,200
We've got a question for you.

373
00:30:03,300 --> 00:30:04,380
We're doing questions now.

374
00:30:04,540 --> 00:30:06,000
I realize we do have some extra time.

375
00:30:06,860 --> 00:30:07,820
He said...

376
00:30:07,820 --> 00:30:12,440
It was about, without using both L1 and L2 to lock down your GPS signal,

377
00:30:12,500 --> 00:30:15,100
how do you push someone into Moscow?

378
00:30:15,540 --> 00:30:17,680
So if you're using both L1 and L2,

379
00:30:17,800 --> 00:30:22,680
that would stop an attack like this from a SCID if they were doing one radio.

380
00:30:22,900 --> 00:30:26,600
You can sync two radios, broadcast L1 and L2 for the correct position,

381
00:30:26,780 --> 00:30:30,140
but it requires manual math or a very well-written program.

382
00:30:30,900 --> 00:30:35,300
What you would see with both receivers is you would see that L2 is getting where you would expect,

383
00:30:35,520 --> 00:30:36,720
where L1 is not.

384
00:30:36,980 --> 00:30:41,520
And L2, if they broadcast, there's no open source GitHub project for that yet,

385
00:30:42,260 --> 00:30:43,320
but I'm going to post it.

386
00:30:45,100 --> 00:30:48,160
You would be able to tell also by the difference in timing.

387
00:30:48,400 --> 00:30:52,220
So we need less than five parts per million accuracy, or precision,

388
00:30:52,380 --> 00:30:57,040
to be able to get this to be received by your phones or any other consumer-grade device.

389
00:30:57,720 --> 00:31:00,660
It is very unlikely for someone to be able to do the wiring correctly,

390
00:31:00,860 --> 00:31:04,820
to get that kind of accuracy to be consistent through two radios at the exact same time.

391
00:31:05,940 --> 00:31:08,480
So that's a good stop for this type of attack.

392
00:31:10,220 --> 00:31:11,980
Great question. Any other questions?

393
00:31:12,720 --> 00:31:14,100
We'll go with you in the red first.

394
00:31:15,300 --> 00:31:23,620
So with this attack, the question was, could we impact timing?

395
00:31:23,780 --> 00:31:24,440
The answer is yes.

396
00:31:24,960 --> 00:31:30,840
Whatever time I broadcast, you kind of need to know more about the packet that gets broadcasted,

397
00:31:30,840 --> 00:31:31,340
from the satellite.

398
00:31:31,540 --> 00:31:35,580
But basically, it's its latitude, longitude, and its time of broadcast.

399
00:31:35,980 --> 00:31:39,600
And then your radio takes in all those signals it picks up and says,

400
00:31:39,700 --> 00:31:42,300
ah, I see the time of flight was so-and-so, therefore I'm here.

401
00:31:42,640 --> 00:31:49,280
So if I were to broadcast consistently a different time, yes, you would receive it and trust it.

402
00:31:49,400 --> 00:31:51,880
It's a very weird phenomenon, but people do it.

403
00:31:51,960 --> 00:31:53,180
They use their GPS as timers.

404
00:31:58,060 --> 00:31:59,640
With your RSA certificates,

405
00:32:00,120 --> 00:32:01,780
time is usually a factor in that,

406
00:32:01,900 --> 00:32:06,340
and you can completely set the seed value for a lot of these embedded controllers,

407
00:32:06,540 --> 00:32:09,680
because they'll generate the same certificate given the same time.

408
00:32:10,200 --> 00:32:12,100
So if you know what it was once,

409
00:32:12,280 --> 00:32:14,820
you can just tell it it's the same time over and over again,

410
00:32:14,960 --> 00:32:18,540
and all of a sudden you're able to get the same certificate all the time.

411
00:32:19,000 --> 00:32:21,920
Which means now you can man the middle, even if they rotate their certs.

412
00:32:23,600 --> 00:32:27,940
Funky little CS problems become very big security holes.

413
00:32:29,780 --> 00:32:31,080
Any other questions?

414
00:32:33,900 --> 00:32:34,380
Cool.

415
00:32:35,280 --> 00:32:37,960
Just generally, when you take a look at a car,

416
00:32:38,040 --> 00:32:39,540
what do you start going after?

417
00:32:41,540 --> 00:32:43,040
So that's a good question.

418
00:32:43,600 --> 00:32:46,340
We don't directly focus on the full vehicle yet.

419
00:32:46,840 --> 00:32:48,200
We're mainly focused on modules.

420
00:32:48,540 --> 00:32:50,000
So if you guys don't know what Delphi does,

421
00:32:50,320 --> 00:32:53,560
they create a lot of the safety systems in your cars,

422
00:32:53,760 --> 00:32:55,520
as well as infotainment systems in your vehicles.

423
00:32:56,300 --> 00:32:59,560
So right now our focus is strictly on protecting our parts.

424
00:32:59,560 --> 00:33:03,500
Down the road we do want to have offerings to our customers,

425
00:33:03,660 --> 00:33:05,940
OEMs, where we could do full vehicle assessments for them.

426
00:33:06,120 --> 00:33:09,340
But right now it's strictly on the module side.

427
00:33:09,700 --> 00:33:14,360
I did a talk a few months ago at SANS that kind of laid out a lot of this stuff.

428
00:33:14,600 --> 00:33:16,820
I can get you that link, and there's a presentation in there

429
00:33:16,820 --> 00:33:18,800
that'll show you more details of what we did for that.

430
00:33:20,200 --> 00:33:20,600
Yep?

431
00:33:20,900 --> 00:33:25,860
Are you focusing on the MDRC or the interface to the OEM?

432
00:33:26,480 --> 00:33:27,460
We do, yes.

433
00:33:27,640 --> 00:33:28,880
And we also focus,

434
00:33:28,880 --> 00:33:33,580
sorry, the question was are we only focusing on like our ECUs

435
00:33:33,580 --> 00:33:35,920
or the interfaces that are coming in from other stuff?

436
00:33:36,420 --> 00:33:40,080
And the answer is absolutely the stuff that's coming from other systems.

437
00:33:40,280 --> 00:33:42,020
And that's why even the wireless stuff,

438
00:33:42,160 --> 00:33:43,900
you know, when stuff's coming over wireless, we're testing that.

439
00:33:44,060 --> 00:33:45,900
We don't only look inside our systems.

440
00:33:46,080 --> 00:33:49,220
We look on the interfaces and anything that's connecting to the systems.

441
00:33:49,560 --> 00:33:51,880
A lot of that's hard to test when you only have the module

442
00:33:51,880 --> 00:33:55,020
because you don't know how everything's going to be talking to it.

443
00:33:55,120 --> 00:33:57,180
So that's why we're trying to build our systems up

444
00:33:57,180 --> 00:33:58,760
to eventually do full vehicle assessments.

445
00:33:59,640 --> 00:34:00,800
So, good question.

446
00:34:01,080 --> 00:34:01,480
.

447
00:34:02,440 --> 00:34:03,360
Yeah, yeah.

448
00:34:04,160 --> 00:34:04,560
.

449
00:34:06,340 --> 00:34:07,080
Oh, cool.

450
00:34:07,360 --> 00:34:08,180
We'll talk later.

451
00:34:09,420 --> 00:34:10,440
Any other questions?

452
00:34:12,780 --> 00:34:13,380
All right.

453
00:34:13,420 --> 00:34:14,780
If you guys have any, just ask.

454
00:34:14,820 --> 00:34:16,040
Or if not, just stop by our booth.

455
00:34:16,500 --> 00:34:17,180
Thanks again.