1
00:00:00,000 --> 00:00:08,160
Today we're going to be discussing GNSS vulnerabilities, also known as GPS system, that we all come to rely on every single day.

2
00:00:09,480 --> 00:00:11,200
There's a few different classes of vulnerabilities.

3
00:00:11,920 --> 00:00:18,320
The most common one that you typically see in the news is GPS spoofing.

4
00:00:19,120 --> 00:00:24,400
That's essentially locating somebody in a location or a time other than where they actually are.

5
00:00:24,400 --> 00:00:37,460
Typically, the news articles and news headlines cover changing location, but changing time is actually a lot more common than attacks that you typically see and can actually lead to a lot more issues in the real world.

6
00:00:38,380 --> 00:00:41,240
Then we obviously have GPS jamming.

7
00:00:41,340 --> 00:00:49,600
It's a much simpler attack, and simply what it means is the denial of the ability to receive accurate and consistent GPS signal.

8
00:00:50,800 --> 00:00:54,200
And, of course, we actually see cyber attacks against the infrastructure.

9
00:00:54,400 --> 00:00:57,620
It actually broadcasts and retransmits the GNSS signal.

10
00:00:58,400 --> 00:01:03,120
And the rebroadcast of GNSS signal is something that we're going to touch upon in the next few slides.

11
00:01:04,460 --> 00:01:05,460
So a quick breakdown.

12
00:01:06,060 --> 00:01:09,800
Typically, when you talk about GPS, you just talk about the birds, the satellites.

13
00:01:11,020 --> 00:01:14,160
But the ground control tower is a very important element.

14
00:01:14,780 --> 00:01:21,360
Without the constant ground correction to the GPS satellites, the accuracy would start to degrade.

15
00:01:22,520 --> 00:01:24,260
First, the first.

16
00:01:24,400 --> 00:01:26,580
And then, of course, the first week or so, you might not even notice the difference.

17
00:01:27,920 --> 00:01:31,960
Within two to three weeks, the accuracy could be down to a few hundred feet.

18
00:01:32,180 --> 00:01:38,320
Then it would drift to miles, and, eventually, you would lose the ability to accurately calculate your GPS position.

19
00:01:39,320 --> 00:01:43,260
We've seen electronic attacks against the actual ground control systems.

20
00:01:44,620 --> 00:01:51,920
We've seen attempts at people actually trying to control the birds, which are typically controlled by the U.S. Air Force.

21
00:01:54,420 --> 00:01:56,440
In the next few slides, you're going to see some data.

22
00:01:57,160 --> 00:02:00,100
We do run a worldwide monitoring network.

23
00:02:00,640 --> 00:02:03,120
The data that we're going to show you is highly sanitized.

24
00:02:04,100 --> 00:02:06,300
We did scrub the data from the most sensitive sensors.

25
00:02:06,540 --> 00:02:08,140
I actually pulled it out of my data set.

26
00:02:08,800 --> 00:02:15,400
So if you happen to be one of our clients in a confidential facility, your data is not going to be in here.

27
00:02:17,640 --> 00:02:20,180
So this is a rough breakdown of where our sensors are.

28
00:02:20,560 --> 00:02:21,500
They're grayed out areas.

29
00:02:22,840 --> 00:02:24,220
Either it does not have sensors.

30
00:02:24,400 --> 00:02:25,100
Or it doesn't have sensors.

31
00:02:25,140 --> 00:02:25,760
We're going to disclose.

32
00:02:26,560 --> 00:02:29,420
The dark areas, we do have sensors.

33
00:02:29,660 --> 00:02:31,460
And we do have attacks that were detected.

34
00:02:31,860 --> 00:02:35,800
And the red areas is where we have the largest number of attacks.

35
00:02:36,760 --> 00:02:43,820
As you can see, when the slides were taken, we had 799 attacks that were detected within the time window within the United States.

36
00:02:47,280 --> 00:02:53,540
Moving over to South Korea, we saw 1,200 active attacks happening in that region.

37
00:02:54,400 --> 00:02:56,520
That's primarily because of some of their neighbors.

38
00:02:57,720 --> 00:02:59,800
Not to point fingers, but North Korea and China.

39
00:03:07,960 --> 00:03:09,460
So what is an attack?

40
00:03:09,660 --> 00:03:10,460
What does it look like?

41
00:03:11,220 --> 00:03:14,960
The most typical jamming attack is what we call the sawtooth signal.

42
00:03:15,520 --> 00:03:18,100
This is what a low-end jammer would generate.

43
00:03:19,160 --> 00:03:20,540
Either this or that.

44
00:03:21,740 --> 00:03:23,900
So you could actually see that this has...

45
00:03:24,400 --> 00:03:27,920
This is a clock-controlled radio, where this was just oscillator-controlled.

46
00:03:30,260 --> 00:03:33,120
These are the low-end jammers, fairly unsophisticated.

47
00:03:34,300 --> 00:03:36,780
Now, this is actually one of my favorite ones.

48
00:03:37,260 --> 00:03:38,940
That's actually a duty cycle radio.

49
00:03:40,360 --> 00:03:47,080
What it does is, it actually waits for the GPS broadcast from the satellite.

50
00:03:47,240 --> 00:03:50,980
And it syncs its transmit with the same time as the broadcast.

51
00:03:51,380 --> 00:03:53,760
So it actually allows its own radio to cool down.

52
00:03:53,760 --> 00:03:56,020
And perfectly jam the GPS signal.

53
00:03:56,220 --> 00:04:01,440
So it's actually using the GPS signal to sync its own clock to conduct a jamming attack.

54
00:04:02,360 --> 00:04:03,400
Which is pretty funny.

55
00:04:03,680 --> 00:04:05,920
Because you have a GPS-controlled GPS jammer.

56
00:04:11,820 --> 00:04:13,820
So the source for some of our captures.

57
00:04:17,540 --> 00:04:19,380
So that's a GSS-200.

58
00:04:20,040 --> 00:04:22,800
The one that was actually hijacked by my company.

59
00:04:22,860 --> 00:04:23,680
The GSS-100.

60
00:04:23,760 --> 00:04:26,520
And it's a GPS jamming detector.

61
00:04:26,880 --> 00:04:28,840
As I mentioned, we have a worldwide network of them.

62
00:04:29,560 --> 00:04:34,100
What it does is, it has an antenna that measures the time of arrival of the signal,

63
00:04:34,200 --> 00:04:37,220
the angle of arrival, and the direction of arrival of the signal.

64
00:04:37,740 --> 00:04:39,300
They're placed in stationary locations.

65
00:04:39,440 --> 00:04:40,360
They have a network uplink.

66
00:04:41,280 --> 00:04:46,300
And what we do is, by us knowing where the GPS satellites are located,

67
00:04:46,500 --> 00:04:49,240
and the signal that we expect to receive at any given time,

68
00:04:49,340 --> 00:04:51,320
we compare it with the signal we're actually receiving.

69
00:04:51,900 --> 00:04:53,640
So we're able to measure RF interference.

70
00:04:53,760 --> 00:04:56,540
And we're able to detect spoofing events.

71
00:04:56,800 --> 00:04:59,720
Because we know where the signal should be coming from and what it should look like.

72
00:04:59,920 --> 00:05:01,820
And we measure the differential between that.

73
00:05:05,040 --> 00:05:06,200
Now, why is this important?

74
00:05:07,760 --> 00:05:11,680
Because when the GPS signal gets hijacked, that kind of stuff happens.

75
00:05:12,600 --> 00:05:14,640
And that's a US QR-107.

76
00:05:14,800 --> 00:05:17,420
One of our most advanced spy drones at the time.

77
00:05:17,680 --> 00:05:19,060
That was hijacked by Iran.

78
00:05:20,600 --> 00:05:23,500
So the spy electronics on board that plane are very advanced.

79
00:05:23,500 --> 00:05:27,780
However, it had a fairly effective...

80
00:05:28,300 --> 00:05:29,220
Is that an issue?

81
00:05:30,080 --> 00:05:30,620
Thank you.

82
00:05:34,820 --> 00:05:36,740
It has a fairly advanced navigation system.

83
00:05:37,060 --> 00:05:42,840
However, if the command control system was jammed, it would fall back to the GPS system.

84
00:05:43,160 --> 00:05:47,460
So what Iran did is they jammed the command control signal from our bunkers in Nevada.

85
00:05:47,800 --> 00:05:52,520
And then they broadcast a fake GPS signal telling the drone that it was actually located...

86
00:05:53,500 --> 00:05:55,260
Over its base where it was launched from.

87
00:05:55,440 --> 00:05:57,000
And the drone went into auto-land mode.

88
00:05:57,460 --> 00:06:02,360
The reason the bottom is covered up is because they actually got the elevation for the area wrong.

89
00:06:02,580 --> 00:06:04,400
And when it landed, it tore off the landing gear.

90
00:06:08,720 --> 00:06:10,280
So, getting back to jamming.

91
00:06:10,520 --> 00:06:11,580
We have the RF jamming.

92
00:06:11,620 --> 00:06:12,880
Which is simple denial of the signal.

93
00:06:13,040 --> 00:06:15,000
That's the signal that you saw.

94
00:06:15,540 --> 00:06:17,040
You have the L1 signal.

95
00:06:17,520 --> 00:06:17,960
L2.

96
00:06:19,180 --> 00:06:21,860
And as I mentioned, I love the area research of...

97
00:06:21,860 --> 00:06:24,140
That can touch upon mass casualty events.

98
00:06:24,340 --> 00:06:25,220
You have the L5.

99
00:06:25,460 --> 00:06:26,880
Which is the safety of life.

100
00:06:28,120 --> 00:06:34,140
If a civilian aircraft was to go in for a landing and is using GPS assist, L5 is the signal it would trust.

101
00:06:35,080 --> 00:06:38,960
It broadcasts at roughly three times the power of the L1, L2 signal.

102
00:06:39,960 --> 00:06:40,980
It has more reach.

103
00:06:41,140 --> 00:06:42,580
It is a more accurate signal.

104
00:06:45,500 --> 00:06:47,540
When you're talking about RF jamming...

105
00:06:48,720 --> 00:06:51,020
Well, this is simple radio jamming.

106
00:06:51,860 --> 00:06:53,820
It's also possible to RF protocol jamming.

107
00:06:53,980 --> 00:06:57,280
You could actually broadcast a signal that looks a lot like the GPS signal.

108
00:06:57,820 --> 00:07:00,880
But it actually sends characters of the wrong length, wrong type.

109
00:07:02,220 --> 00:07:06,060
You could broadcast a signal to make one of the signals appear to be less accurate.

110
00:07:06,500 --> 00:07:10,720
So, for example, if a GPS broadcast is claiming to have 14 for the accuracy.

111
00:07:10,980 --> 00:07:15,980
You could actually broadcast a signal that would make the accuracy appear to be 50 feet, 200 feet.

112
00:07:18,080 --> 00:07:19,900
And obviously more data for aircraft.

113
00:07:20,220 --> 00:07:21,840
You could actually give the aircraft...

114
00:07:21,860 --> 00:07:23,160
More confidence in the signal.

115
00:07:23,320 --> 00:07:28,340
You could take a signal that claims to be 30 feet accurate or 10 meter accurate.

116
00:07:28,580 --> 00:07:31,380
And actually tell it that it has 2 centimeter resolution.

117
00:07:31,740 --> 00:07:32,660
Which is not realistic.

118
00:07:32,960 --> 00:07:36,600
But you as a human is not the one that's interpreting the signal.

119
00:07:36,800 --> 00:07:39,000
Your onboard system is what's interpreting it.

120
00:07:39,840 --> 00:07:42,720
And obviously you could place it to be somewhere else.

121
00:07:46,080 --> 00:07:47,080
So, a quick breakdown.

122
00:07:47,400 --> 00:07:49,580
That's what the GPS satellite would look like.

123
00:07:49,980 --> 00:07:50,480
Satellite...

124
00:07:50,480 --> 00:07:52,620
A GPS satellite network would look like at any given time.

125
00:07:53,760 --> 00:07:57,140
The green dots going down would be updates from the ground control stations.

126
00:07:57,540 --> 00:07:59,560
Sending a ledger update to the birds in the sky.

127
00:08:01,120 --> 00:08:03,440
And the GPS works by triliteration.

128
00:08:03,780 --> 00:08:09,120
Meaning your device gets at least 3 signals from at least 3 birds or any ground station assists.

129
00:08:09,780 --> 00:08:11,080
The more signal...

130
00:08:11,080 --> 00:08:13,240
The more data points you're receiving.

131
00:08:13,360 --> 00:08:16,920
The more accurately you're able to look at yourself on the ground.

132
00:08:17,920 --> 00:08:21,280
This is what your ground reception unit would see.

133
00:08:22,240 --> 00:08:25,420
You have the signal strength from a number of birds.

134
00:08:26,400 --> 00:08:29,140
And you have your exact date and time.

135
00:08:29,680 --> 00:08:30,160
Altitude.

136
00:08:31,180 --> 00:08:32,280
Signal quality indicator.

137
00:08:32,720 --> 00:08:36,220
And the indication of how accurately it can position yourself.

138
00:08:36,820 --> 00:08:38,360
So as you see it's a 2D fix.

139
00:08:38,460 --> 00:08:41,020
Meaning it's actually a vehicle GPS and not an airborne unit.

140
00:08:42,940 --> 00:08:44,000
This gets really fun.

141
00:08:44,120 --> 00:08:46,480
Because people will do anything that JRGPS tells them.

142
00:08:46,480 --> 00:08:48,300
People will drive down boat ramps.

143
00:08:48,320 --> 00:08:50,500
People will actually drive right off the docks.

144
00:08:51,320 --> 00:08:54,460
People will drive deep into the desert over unpaved roads.

145
00:08:54,580 --> 00:08:57,880
Because their GPS tells them in a nice soothing voice.

146
00:08:58,040 --> 00:08:58,840
Make a left.

147
00:08:59,020 --> 00:08:59,980
Continue 20 miles.

148
00:09:05,140 --> 00:09:07,440
Autonomous airborne platforms will do the same thing.

149
00:09:07,880 --> 00:09:11,240
By spoofing the signal you can actually locate them in a different grid.

150
00:09:13,800 --> 00:09:15,460
There was an event last year.

151
00:09:15,460 --> 00:09:18,500
Where the military was conducting GPS jamming tests.

152
00:09:18,720 --> 00:09:20,400
There was a 500 mile radius.

153
00:09:20,920 --> 00:09:21,920
No go zone.

154
00:09:22,080 --> 00:09:23,260
Well it wasn't a no go zone.

155
00:09:23,360 --> 00:09:29,920
But it was an area where civilian aircraft and civilian users were advised that GPS would be unavailable.

156
00:09:31,480 --> 00:09:34,800
The notam advisories went out over three weeks in advance.

157
00:09:35,180 --> 00:09:37,640
Everyone knew the GPS jamming event was going to be in progress.

158
00:09:37,920 --> 00:09:40,760
A civilian airliner was still relying on the GPS.

159
00:09:41,660 --> 00:09:43,620
For some reason the pilot wasn't paying attention.

160
00:09:43,620 --> 00:09:45,660
He ended up 20 miles off course.

161
00:09:45,780 --> 00:09:48,960
And there was actually an FAA near collision warning that went out.

162
00:09:49,980 --> 00:09:51,720
Because he didn't have GPS signal.

163
00:09:51,800 --> 00:09:53,800
It was just not an accurate GPS signal.

164
00:09:57,240 --> 00:10:00,000
We do see GPS spoofing happening with ships.

165
00:10:00,440 --> 00:10:04,000
The most common occurrence we've actually seen is off the coast of Africa.

166
00:10:04,380 --> 00:10:06,120
Where we do see a lot of pirate activity.

167
00:10:06,600 --> 00:10:09,620
We do see pirates conducting GPS jamming attacks.

168
00:10:09,860 --> 00:10:11,100
GPS spoofing attacks.

169
00:10:11,740 --> 00:10:13,460
And AIS ship hijacks.

170
00:10:13,620 --> 00:10:18,140
So ships have a system that's built in with their radio.

171
00:10:18,300 --> 00:10:19,960
It's supposed to prevent collisions.

172
00:10:20,400 --> 00:10:23,560
A ship constantly broadcasts using a protocol called APRS.

173
00:10:23,640 --> 00:10:24,980
Automatic Position Reporting System.

174
00:10:25,460 --> 00:10:28,520
It's the ship's name, direction, speed of travel.

175
00:10:28,700 --> 00:10:30,960
And pirates actually jam those broadcasts.

176
00:10:30,960 --> 00:10:35,300
So when they attack the ships, the nearby ships don't have an accurate fix on that ship.

177
00:10:35,420 --> 00:10:38,000
They have the last known location before jamming occurred.

178
00:10:38,320 --> 00:10:43,000
They also hijack the AIS radios of the ships they captured.

179
00:10:43,620 --> 00:10:44,820
They pretend to be a legitimate vessel.

180
00:10:44,920 --> 00:10:47,340
So they can get close to the ship before they start their attack.

181
00:10:49,100 --> 00:10:54,360
Now if you're a pirate, you could simply cause a vessel to run into a hazard.

182
00:10:54,500 --> 00:10:57,300
And then you could steal the crew, steal the cargo.

183
00:11:00,740 --> 00:11:04,100
And if you're a malicious government, you can even steal U.S. sailors.

184
00:11:04,440 --> 00:11:06,060
Again, another real unfortunate incident.

185
00:11:06,380 --> 00:11:08,060
The culprit was once again Iran.

186
00:11:09,320 --> 00:11:12,600
The U.S. crew claims the GPS puts them safely into international waters.

187
00:11:13,620 --> 00:11:16,100
Iran claims that the U.S. vessel was within Iran's territorial waters.

188
00:11:16,820 --> 00:11:19,400
There's a good chance that Iran was lying, as usual.

189
00:11:20,060 --> 00:11:23,260
However, there is a distinct possibility that there was GPS spoofing happening.

190
00:11:23,800 --> 00:11:28,400
And that, in fact, both sides are claiming that they were where they were.

191
00:11:28,520 --> 00:11:29,740
And they actually do believe that.

192
00:11:32,700 --> 00:11:33,920
We did quite a bit of research.

193
00:11:34,060 --> 00:11:35,700
You saw my black hat presentation.

194
00:11:36,220 --> 00:11:40,160
We actually went as far as hunting down some of the sources of GPS jamming.

195
00:11:41,300 --> 00:11:42,640
So these are some of the...

196
00:11:43,360 --> 00:11:44,500
stats that we gathered.

197
00:11:44,700 --> 00:11:46,500
This was for the United States.

198
00:11:46,580 --> 00:11:47,660
Northeast region.

199
00:11:47,960 --> 00:11:49,080
California area.

200
00:11:49,400 --> 00:11:53,020
As well as an area of England around London.

201
00:11:55,880 --> 00:11:56,940
One of my...

202
00:11:58,720 --> 00:12:01,380
One of the interesting areas is assholes.

203
00:12:02,040 --> 00:12:05,200
We've seen civilians with high-powered GPS jammers.

204
00:12:05,660 --> 00:12:09,740
Some of those jammers are actually not just GPS jammers.

205
00:12:09,860 --> 00:12:11,500
But they're also cell phone jammers.

206
00:12:11,500 --> 00:12:13,140
They're wideband radios.

207
00:12:13,480 --> 00:12:16,860
It's very common for them to actually have four radios built in onboard.

208
00:12:17,220 --> 00:12:20,660
So they're typically jamming cell phone, GPS, and Wi-Fi.

209
00:12:24,400 --> 00:12:29,540
In the United States, we do have a number of laws that make it a federal felony to conduct this kind of jamming.

210
00:12:30,760 --> 00:12:37,420
And they do carry consequences, including actually a fairly lengthy prison term and very high fines.

211
00:12:37,980 --> 00:12:39,920
I'm not going to bore you with reading through all of that.

212
00:12:39,980 --> 00:12:41,160
But you definitely shouldn't do it.

213
00:12:41,720 --> 00:12:46,420
If you do capture U.S. government attention, you're going to win a date with this gentleman.

214
00:12:46,660 --> 00:12:47,960
He is a federal agent.

215
00:12:48,120 --> 00:12:49,780
He does investigate the source stuff.

216
00:12:51,520 --> 00:12:53,500
I do get to work with him closely, unfortunately.

217
00:12:57,440 --> 00:12:58,940
How easy are they to obtain?

218
00:13:00,100 --> 00:13:01,420
Well, very easy.

219
00:13:01,560 --> 00:13:02,940
It does ship to the United States.

220
00:13:03,080 --> 00:13:06,180
And it costs less than a lot of company launches.

221
00:13:10,540 --> 00:13:11,980
Now this bad boy.

222
00:13:12,140 --> 00:13:14,480
This is the kind of stuff that you see military units deploying.

223
00:13:15,240 --> 00:13:19,720
These can actually be mounted as recon pods in helicopters and aircraft.

224
00:13:19,960 --> 00:13:22,160
They can be dropped in somewhere before an assault.

225
00:13:23,240 --> 00:13:26,480
That is a 320 watt unit from what I recall.

226
00:13:29,180 --> 00:13:30,220
Just one problem.

227
00:13:30,860 --> 00:13:33,940
That one is actually also a Chinese jammer that's for sale.

228
00:13:34,100 --> 00:13:35,660
A little bit more expensive.

229
00:13:35,660 --> 00:13:36,520
But still fairly affordable.

230
00:13:36,900 --> 00:13:43,980
The price code I got for it was I believe either $1800 in bulk or $2200 a single unit sample.

231
00:13:49,360 --> 00:13:51,000
This is car hacking village talk.

232
00:13:51,220 --> 00:13:52,340
So going back to cars.

233
00:13:53,380 --> 00:13:58,400
The GPS that you have in your vehicle shows you it's traveling down a road.

234
00:13:58,640 --> 00:14:00,360
It shows you a nice neat little line.

235
00:14:00,780 --> 00:14:02,560
What it is is actually a sweet little line.

236
00:14:04,360 --> 00:14:05,900
There's a concept called GPS drift.

237
00:14:06,360 --> 00:14:12,140
If you have a proper GPS that actually maps you on the grid, you'll see that there's a lot of jitter.

238
00:14:12,280 --> 00:14:15,800
If you're getting an actual GPS signal, I mentioned accuracy.

239
00:14:16,160 --> 00:14:20,680
What you see is a line moving back and forth and actually drawing almost a circle.

240
00:14:21,240 --> 00:14:24,420
And that circle is the accuracy of your current GPS position.

241
00:14:25,460 --> 00:14:31,280
Which means if you have a GPS that is plotting you accurately, even though you're traveling in one direction,

242
00:14:31,280 --> 00:14:33,240
you're going to see some jitter.

243
00:14:33,660 --> 00:14:36,600
So for example in that case, we had 270 meter accuracy.

244
00:14:36,820 --> 00:14:40,020
But if you're traveling in an open ocean, that's perfectly acceptable.

245
00:14:40,300 --> 00:14:43,300
As long as you know that the yoke of the yacht was not moving.

246
00:14:49,080 --> 00:14:50,040
Any questions?

247
00:14:54,180 --> 00:14:55,580
What about defense?

248
00:14:56,060 --> 00:14:59,580
Do you have recommendations on...

249
00:15:01,280 --> 00:15:03,540
What should the government do to...

250
00:15:07,720 --> 00:15:09,280
...GPS externalities of the government?

251
00:15:11,940 --> 00:15:17,300
The best defense is not blindly trusting the system, not blindly trusting the GPS,

252
00:15:17,500 --> 00:15:19,840
and actually thinking about where your GPS is showing you.

253
00:15:19,960 --> 00:15:24,160
If you know that you're supposed to be driving 287, getting onto northbound ramp,

254
00:15:24,340 --> 00:15:27,960
and your GPS is telling you to get onto southbound ramp, don't blindly trust your GPS.

255
00:15:29,480 --> 00:15:31,260
There's a few things that the government can actually do.

256
00:15:31,260 --> 00:15:33,200
To track down the sources of jamming.

257
00:15:33,500 --> 00:15:39,200
So there is, as I mentioned, there are several worldwide networks that do detect GPS jamming.

258
00:15:39,460 --> 00:15:42,840
But not a lot happens to actually track down the offenders.

259
00:15:43,100 --> 00:15:44,700
And it is fairly trivial to do.

260
00:15:46,920 --> 00:15:50,840
On an earlier slide you mentioned protocol attacks and buffer overflows.

261
00:15:51,020 --> 00:15:52,300
Can you go into that in any more detail?

262
00:15:53,100 --> 00:15:58,180
Yeah, so we actually have seen attacks against the satellite network and against the ground stations.

263
00:15:58,340 --> 00:16:00,820
Before actually trying to attack the connected infrastructure.

264
00:16:01,260 --> 00:16:03,480
That controls the satellite network.

265
00:16:04,880 --> 00:16:08,100
We do see some fairly advanced attacks against the car head units.

266
00:16:08,300 --> 00:16:14,260
Where people are actually creating malicious GPS file updates for vehicles.

267
00:16:14,600 --> 00:16:17,460
We've seen a number of attacks against Subarus about two months ago.

268
00:16:17,860 --> 00:16:20,240
Where there were buffer overflows in the head units.

269
00:16:20,320 --> 00:16:22,220
People could load it up through USB drive.

270
00:16:22,500 --> 00:16:25,260
We've seen a number of attacks against some of their competitors as well.

271
00:16:28,060 --> 00:16:30,320
Can you see any ways to use...

272
00:16:31,260 --> 00:16:36,200
consumer level hardware to either detect GPS abnormalities.

273
00:16:37,080 --> 00:16:40,040
Or detect and report GPS abnormalities.

274
00:16:40,160 --> 00:16:43,000
Say for example a cell phone app or something like that.

275
00:16:43,440 --> 00:16:44,460
Is that a possibility?

276
00:16:44,960 --> 00:16:45,620
Great question.

277
00:16:46,060 --> 00:16:48,740
So by actually having more than one GPS receiver.

278
00:16:48,940 --> 00:16:50,460
And synchronizing the antennas.

279
00:16:51,020 --> 00:16:52,500
Or using a hacker app.

280
00:16:52,640 --> 00:16:53,500
Sorry, not a hacker app.

281
00:16:53,600 --> 00:16:54,760
A blader app within the right.

282
00:16:56,100 --> 00:16:58,260
If you place it at a known location.

283
00:16:59,040 --> 00:17:00,140
At a known angle.

284
00:17:00,140 --> 00:17:02,720
You can actually monitor the GPS signals in an area.

285
00:17:03,700 --> 00:17:05,500
And as I mentioned there's a GPS drift.

286
00:17:05,980 --> 00:17:08,060
Once the drift either changes significantly.

287
00:17:08,380 --> 00:17:10,520
Or you start getting a perfect signal.

288
00:17:10,900 --> 00:17:12,860
That could be a pretty good indicator of an attack.

289
00:17:13,480 --> 00:17:14,680
Also on the ground level.

290
00:17:14,920 --> 00:17:16,680
If you're working with software defined radio.

291
00:17:16,920 --> 00:17:18,420
GPS looks like background noise.

292
00:17:18,620 --> 00:17:21,960
You actually need to use the time signal to go back.

293
00:17:22,060 --> 00:17:23,620
And pick GPS out of the line noise.

294
00:17:23,840 --> 00:17:25,360
Once you start getting a GPS signal.

295
00:17:25,580 --> 00:17:26,700
That actually comes out.

296
00:17:26,980 --> 00:17:28,420
Outside the range of ambient noise.

297
00:17:28,420 --> 00:17:30,200
That's a pretty good indicator of actually.

298
00:17:30,220 --> 00:17:31,580
A malicious transmitter being nearby.

299
00:17:33,060 --> 00:17:33,460
Yes.

300
00:17:33,640 --> 00:17:35,700
Can you say anything about jamming and spoofing.

301
00:17:35,700 --> 00:17:37,860
Of GNSS signals other than GPS.

302
00:17:38,260 --> 00:17:39,880
Like low mass and stuff like that.

303
00:17:40,020 --> 00:17:42,300
I have not done a ton of research about that.

304
00:17:42,820 --> 00:17:44,800
Primarily because I'm in the United States.

305
00:17:44,860 --> 00:17:47,000
And I care about the US GPS network.

306
00:17:47,480 --> 00:17:49,300
But if you are looking at Neptune systems.

307
00:17:49,680 --> 00:17:50,080
Etc.

308
00:17:50,800 --> 00:17:53,060
Primarily I'm going to be looking at attacks against the Russian systems.

309
00:17:53,460 --> 00:17:55,180
Primarily because, well, they're an enemy.

310
00:17:58,420 --> 00:18:01,900
So you've shown equipment that contributes to jammed GPS.

311
00:18:02,140 --> 00:18:03,340
How about spoofing GPS?

312
00:18:03,480 --> 00:18:05,420
What would it mean to actually put across GPS?

313
00:18:08,100 --> 00:18:10,060
So there's a number of solutions for that.

314
00:18:10,100 --> 00:18:10,780
And I do mean solutions.

315
00:18:11,520 --> 00:18:15,160
So there are blade RF setups that I've seen.

316
00:18:15,200 --> 00:18:16,340
That are pretty good at it.

317
00:18:16,980 --> 00:18:20,040
You do need a fairly beefy computer to be able to do that.

318
00:18:20,940 --> 00:18:24,020
A simple Raspberry Pi is not really going to be enough.

319
00:18:24,160 --> 00:18:25,440
But with a small nook.

320
00:18:25,500 --> 00:18:28,120
You can make remote nodes that are sufficiently powerful.

321
00:18:28,640 --> 00:18:32,440
The organization I work for actually creates GPS simulators.

322
00:18:32,540 --> 00:18:35,120
That you could use in your lab for legitimate testing.

323
00:18:35,600 --> 00:18:41,540
They crank out roughly double the power of what you would typically see of a GPS cell in the bottom.

324
00:18:41,940 --> 00:18:43,860
If somebody were to get their hands on one.

325
00:18:43,960 --> 00:18:45,100
And a decent RF amp.

326
00:18:45,220 --> 00:18:46,040
And the correct antenna.

327
00:18:46,820 --> 00:18:50,180
You could definitely create your own little macro environment.

328
00:18:50,840 --> 00:18:51,280
Hypothetically.

329
00:18:53,160 --> 00:18:53,920
Yes, in the back.

330
00:18:54,020 --> 00:18:55,220
For the map you showed at the beginning.

331
00:18:55,340 --> 00:18:57,300
With the jamming attacks.

332
00:18:57,880 --> 00:18:59,600
What was the time period for that?

333
00:18:59,780 --> 00:19:00,920
That was one week.

334
00:19:01,000 --> 00:19:01,560
One week.

335
00:19:01,660 --> 00:19:04,460
And that was taken two weeks before my blackout slides were due.

336
00:19:06,160 --> 00:19:06,600
Yes.

337
00:19:06,880 --> 00:19:07,700
I was just wondering.

338
00:19:08,360 --> 00:19:10,720
So you don't do PSA with the Galileo.

339
00:19:10,760 --> 00:19:11,720
The ClonidX section.

340
00:19:12,040 --> 00:19:12,720
Because I mean.

341
00:19:12,820 --> 00:19:13,800
According to one side.

342
00:19:13,940 --> 00:19:15,120
You can actually start seeing the difference.

343
00:19:15,360 --> 00:19:17,720
Because I'm not aware of any simulator software.

344
00:19:17,920 --> 00:19:21,320
But ClonidX and the Galileo.

345
00:19:22,320 --> 00:19:24,040
Why don't you use the GPS simulator.

346
00:19:24,760 --> 00:19:25,420
So yeah.

347
00:19:26,240 --> 00:19:27,920
So we have GPS simulators.

348
00:19:27,940 --> 00:19:28,820
And GPS emulators.

349
00:19:29,200 --> 00:19:29,560
Even.

350
00:19:29,820 --> 00:19:31,160
So our simulators.

351
00:19:31,280 --> 00:19:31,960
What we could do is.

352
00:19:32,060 --> 00:19:32,580
We typically.

353
00:19:32,740 --> 00:19:33,660
We'll drive around an area.

354
00:19:34,000 --> 00:19:35,540
And we'll record the GPS data.

355
00:19:35,840 --> 00:19:36,740
And what we could do.

356
00:19:36,780 --> 00:19:38,240
Is we could sync it up with a real time clock.

357
00:19:38,400 --> 00:19:39,080
And play it back.

358
00:19:39,380 --> 00:19:40,660
With the current time stamp.

359
00:19:41,000 --> 00:19:42,700
I don't know if you could do it with the Galileo.

360
00:19:42,820 --> 00:19:44,080
But we could definitely do a playback.

361
00:19:44,440 --> 00:19:45,880
Just as a raw RF.

362
00:20:03,460 --> 00:20:05,280
So I'm familiar with the news articles.

363
00:20:05,880 --> 00:20:06,900
Our network is.

364
00:20:07,960 --> 00:20:09,260
Needs a stationary position.

365
00:20:09,500 --> 00:20:10,840
If you don't have anything on board the ships.

366
00:20:11,360 --> 00:20:11,800
However.

367
00:20:11,920 --> 00:20:12,820
Some governments.

368
00:20:13,040 --> 00:20:13,240
Well.

369
00:20:13,360 --> 00:20:14,140
Many governments.

370
00:20:14,180 --> 00:20:15,000
Have the hardware.

371
00:20:15,100 --> 00:20:16,300
To do GPS spoofing.

372
00:20:16,300 --> 00:20:17,080
And GPS jamming.

373
00:20:17,120 --> 00:20:18,860
And there are legitimate reasons for doing it.

374
00:20:19,260 --> 00:20:19,700
So.

375
00:20:19,740 --> 00:20:20,940
I have no data at all.

376
00:20:21,000 --> 00:20:21,520
About that event.

377
00:20:22,040 --> 00:20:22,480
So.

378
00:20:22,520 --> 00:20:23,120
I have.

379
00:20:23,120 --> 00:20:24,300
Exactly the same news articles.

380
00:20:24,400 --> 00:20:24,760
That you do.

381
00:20:26,260 --> 00:20:26,620
Yes.

382
00:20:35,640 --> 00:20:36,520
That's an excellent question.

383
00:20:36,640 --> 00:20:36,820
Yes.

384
00:20:36,840 --> 00:20:37,420
I did forget to.

385
00:20:37,680 --> 00:20:38,520
Touch those points.

386
00:20:38,960 --> 00:20:39,600
You've seen attacks.

387
00:20:39,860 --> 00:20:40,560
Against data centers.

388
00:20:40,880 --> 00:20:41,540
Data centers.

389
00:20:41,580 --> 00:20:42,140
That process.

390
00:20:42,400 --> 00:20:43,060
Financial transactions.

391
00:20:43,580 --> 00:20:44,220
Data centers.

392
00:20:44,340 --> 00:20:44,620
That are known.

393
00:20:44,720 --> 00:20:45,140
To deal with.

394
00:20:45,180 --> 00:20:45,540
Bitcoin.

395
00:20:45,600 --> 00:20:46,280
And crypto ledger.

396
00:20:46,640 --> 00:20:47,260
They typically.

397
00:20:47,340 --> 00:20:48,220
Have GPS antennas.

398
00:20:48,260 --> 00:20:48,600
On the roof.

399
00:20:48,740 --> 00:20:49,640
And they're using it.

400
00:20:49,680 --> 00:20:50,020
For log.

401
00:20:50,360 --> 00:20:50,720
Consistency.

402
00:20:51,480 --> 00:20:52,320
And you see people.

403
00:20:52,540 --> 00:20:52,900
Conducting.

404
00:20:52,900 --> 00:20:53,100
Data.

405
00:20:53,120 --> 00:20:53,560
Spoofing.

406
00:20:53,560 --> 00:20:53,800
Jamming.

407
00:20:53,840 --> 00:20:54,340
And spoofing.

408
00:20:54,360 --> 00:20:54,740
Attacks.

409
00:20:54,800 --> 00:20:55,380
To try.

410
00:20:55,420 --> 00:20:55,680
And effect.

411
00:20:55,760 --> 00:20:56,540
Financial transactions.

412
00:20:56,560 --> 00:20:57,240
Of stocks.

413
00:20:57,440 --> 00:20:57,860
Bonds.

414
00:20:58,280 --> 00:20:59,180
And as I mentioned.

415
00:20:59,260 --> 00:20:59,780
Ledger transactions.

416
00:21:01,040 --> 00:21:01,800
People actually.

417
00:21:01,880 --> 00:21:02,560
Set up hardware.

418
00:21:02,800 --> 00:21:03,160
Or.

419
00:21:03,340 --> 00:21:03,980
Bring vehicles.

420
00:21:04,120 --> 00:21:04,900
Onto the parking lots.

421
00:21:04,980 --> 00:21:05,620
Of those data centers.

422
00:21:09,160 --> 00:21:09,980
Any more questions?

423
00:21:11,480 --> 00:21:11,920
Yes.

424
00:21:12,060 --> 00:21:12,500
How redundant.

425
00:21:12,720 --> 00:21:13,080
Are the.

426
00:21:13,200 --> 00:21:14,280
The ground control stations.

427
00:21:14,800 --> 00:21:15,240
Particularly.

428
00:21:15,680 --> 00:21:17,160
On location.

429
00:21:17,220 --> 00:21:17,740
Multiple locations?

430
00:21:18,680 --> 00:21:19,840
There are multiple locations.

431
00:21:20,100 --> 00:21:20,920
But primary one.

432
00:21:21,000 --> 00:21:21,940
Is at Cheyenne Mountain.

433
00:21:22,420 --> 00:21:22,860
Where.

434
00:21:23,120 --> 00:21:23,200
The home.

435
00:21:23,300 --> 00:21:23,620
Of U.S.

436
00:21:23,660 --> 00:21:24,040
Space Command.

437
00:21:24,540 --> 00:21:24,820
So.

438
00:21:24,900 --> 00:21:25,060
If.

439
00:21:25,180 --> 00:21:25,440
Everything.

440
00:21:25,520 --> 00:21:25,780
Is working.

441
00:21:25,980 --> 00:21:26,260
Correctly.

442
00:21:26,540 --> 00:21:26,820
Typically.

443
00:21:27,360 --> 00:21:27,640
That.

444
00:21:27,920 --> 00:21:28,200
Actual.

445
00:21:28,260 --> 00:21:28,320
Space.

446
00:21:28,440 --> 00:21:28,660
Command.

447
00:21:28,700 --> 00:21:29,040
Is based.

448
00:21:29,120 --> 00:21:29,320
There.

449
00:21:30,320 --> 00:21:30,860
And we have.

450
00:21:30,940 --> 00:21:31,180
A number.

451
00:21:31,280 --> 00:21:31,600
Of stations.

452
00:21:31,920 --> 00:21:32,060
To.

453
00:21:32,560 --> 00:21:32,840
Broadcast.

454
00:21:32,840 --> 00:21:33,220
The signal.

455
00:21:34,440 --> 00:21:34,720
And.

456
00:21:34,940 --> 00:21:35,220
Some.

457
00:21:35,360 --> 00:21:35,440
Of the.

458
00:21:35,480 --> 00:21:35,720
Attacks.

459
00:21:35,780 --> 00:21:35,880
We've.

460
00:21:35,940 --> 00:21:36,080
Seen.

461
00:21:36,100 --> 00:21:36,240
Are.

462
00:21:36,340 --> 00:21:36,620
Obviously.

463
00:21:36,700 --> 00:21:36,840
More.

464
00:21:53,440 --> 00:21:53,460
To.

465
00:21:53,620 --> 00:21:53,820
Broadcast.

466
00:21:53,860 --> 00:21:54,020
A.

467
00:21:54,160 --> 00:21:54,360
Stronger.

468
00:21:54,380 --> 00:21:54,580
Signal.

469
00:21:55,040 --> 00:21:55,240
Where.

470
00:21:55,320 --> 00:21:55,400
They.

471
00:21:55,560 --> 00:21:55,760
Try.

472
00:21:55,880 --> 00:21:55,960
And.

473
00:21:56,000 --> 00:21:56,020
Play.

474
00:21:56,220 --> 00:21:56,420
Timing.

475
00:21:56,520 --> 00:21:56,720
Games.

476
00:21:57,560 --> 00:21:57,760
Where.

477
00:21:57,860 --> 00:21:57,940
They're.

478
00:21:58,180 --> 00:21:58,380
They'll.

479
00:21:58,460 --> 00:21:58,620
Point.

480
00:21:58,660 --> 00:21:58,780
The.

481
00:21:58,860 --> 00:21:59,060
Azimuth.

482
00:21:59,240 --> 00:21:59,440
And.

483
00:21:59,480 --> 00:21:59,580
Try.

484
00:21:59,620 --> 00:21:59,680
To.

485
00:21:59,760 --> 00:21:59,880
Track.

486
00:21:59,960 --> 00:22:00,060
The.

487
00:22:00,180 --> 00:22:00,380
Satellite.

488
00:22:00,420 --> 00:22:00,620
First.

489
00:22:00,720 --> 00:22:00,920
Before.

490
00:22:00,920 --> 00:22:01,100
The.

491
00:22:01,360 --> 00:22:01,600
Station.

492
00:22:05,400 --> 00:22:05,640
Yes.

493
00:22:11,240 --> 00:22:11,480
So.

494
00:22:17,280 --> 00:22:17,520
There's.

495
00:22:17,600 --> 00:22:17,660
Been.

496
00:22:17,740 --> 00:22:17,840
Talk.

497
00:22:18,000 --> 00:22:18,240
About.

498
00:22:18,900 --> 00:22:19,140
In.

499
00:22:19,200 --> 00:22:19,340
The.

500
00:22:19,580 --> 00:22:19,820
Non.

501
00:22:19,920 --> 00:22:20,160
Crypto.

502
00:22:20,160 --> 00:22:20,360
Bus.

503
00:22:20,620 --> 00:22:20,860
Signed.

504
00:22:20,860 --> 00:22:21,080
A.

505
00:22:21,100 --> 00:22:21,320
GPS.

506
00:22:21,420 --> 00:22:21,660
Signal.

507
00:22:22,220 --> 00:22:22,460
Something.

508
00:22:22,560 --> 00:22:22,800
Similar.

509
00:22:22,860 --> 00:22:22,940
To.

510
00:22:22,980 --> 00:22:23,100
M.

511
00:22:23,120 --> 00:22:23,240
Code.

512
00:22:23,280 --> 00:22:23,440
Like.

513
00:22:23,460 --> 00:22:23,560
What.

514
00:22:23,600 --> 00:22:23,620
The.

515
00:22:23,680 --> 00:22:23,920
Military.

516
00:22:23,940 --> 00:22:24,080
Is.

517
00:22:24,100 --> 00:22:24,320
Doing.

518
00:22:24,860 --> 00:22:25,060
There.

519
00:22:25,280 --> 00:22:25,380
Supposed.

520
00:22:25,440 --> 00:22:25,520
To.

521
00:22:25,520 --> 00:22:25,560
Be.

522
00:22:25,600 --> 00:22:25,680
Around.

523
00:22:26,040 --> 00:22:26,240
2014.

524
00:22:26,660 --> 00:22:26,820
And.

525
00:22:26,980 --> 00:22:27,180
2016.

526
00:22:27,840 --> 00:22:28,040
Now.

527
00:22:28,100 --> 00:22:28,160
It's.

528
00:22:28,300 --> 00:22:28,500
2018.

529
00:22:29,200 --> 00:22:29,400
I.

530
00:22:29,600 --> 00:22:29,700
Think.

531
00:22:29,840 --> 00:22:30,040
Before.

532
00:22:30,120 --> 00:22:30,220
We.

533
00:22:30,320 --> 00:22:30,400
Have.

534
00:22:30,560 --> 00:22:30,740
More.

535
00:22:31,220 --> 00:22:31,420
UAVs.

536
00:22:31,440 --> 00:22:31,520
In.

537
00:22:31,780 --> 00:22:31,980
Civilian.

538
00:22:32,040 --> 00:22:32,240
Space.

539
00:22:33,300 --> 00:22:33,500
We.

540
00:22:33,560 --> 00:22:33,680
Are.

541
00:22:33,760 --> 00:22:33,960
We.

542
00:22:34,100 --> 00:22:34,160
Need.

543
00:22:34,240 --> 00:22:34,280
To.

544
00:22:34,340 --> 00:22:34,380
Do.

545
00:22:48,640 --> 00:22:48,840
Something.

546
00:22:49,500 --> 00:22:49,740
To.

547
00:22:52,340 --> 00:22:52,580
Help.

548
00:22:54,640 --> 00:22:54,880
To.

549
00:22:57,060 --> 00:22:57,300
Help.

550
00:23:01,160 --> 00:23:01,400
Using.

551
00:23:01,440 --> 00:23:01,600
A.

552
00:23:01,660 --> 00:23:01,820
Number.

553
00:23:01,940 --> 00:23:02,020
Of.

554
00:23:02,160 --> 00:23:02,400
Networks.

555
00:23:02,440 --> 00:23:02,680
Actually.

556
00:23:02,680 --> 00:23:02,880
Would.

557
00:23:02,940 --> 00:23:03,160
Help.

558
00:23:03,320 --> 00:23:03,560
And.

559
00:23:03,600 --> 00:23:03,720
The.

560
00:23:03,800 --> 00:23:03,920
Systems.

561
00:23:03,960 --> 00:23:04,100
You.

562
00:23:04,140 --> 00:23:04,360
Describe.

563
00:23:04,420 --> 00:23:04,580
Me.

564
00:23:04,580 --> 00:23:04,680
I.

565
00:23:04,680 --> 00:23:04,780
Do.

566
00:23:04,880 --> 00:23:05,100
Believe.

567
00:23:05,120 --> 00:23:05,240
They.

568
00:23:05,320 --> 00:23:05,380
Have.

569
00:23:05,440 --> 00:23:05,540
A.

570
00:23:05,600 --> 00:23:05,700
Ground.

571
00:23:05,820 --> 00:23:06,000
Element.

572
00:23:10,100 --> 00:23:10,340
Just.

573
00:23:10,560 --> 00:23:10,740
Actually.

574
00:23:10,820 --> 00:23:11,000
Control.

575
00:23:11,340 --> 00:23:11,580
It.

576
00:23:11,680 --> 00:23:11,800
Gives.

577
00:23:11,920 --> 00:23:12,000
You.

578
00:23:12,060 --> 00:23:12,120
A.

579
00:23:12,380 --> 00:23:12,520
More.

580
00:23:12,600 --> 00:23:12,840
RF.

581
00:23:13,040 --> 00:23:13,280
Output.

582
00:23:13,360 --> 00:23:13,480
Than.

583
00:23:13,500 --> 00:23:13,620
The.

584
00:23:13,640 --> 00:23:13,820
Bird.

585
00:23:13,900 --> 00:23:14,120
That's.

586
00:23:14,240 --> 00:23:14,480
Hundreds.

587
00:23:14,600 --> 00:23:14,680
Of.

588
00:23:14,760 --> 00:23:14,840
Miles.

589
00:23:14,920 --> 00:23:15,060
Up.

590
00:23:15,080 --> 00:23:15,180
In.

591
00:23:15,180 --> 00:23:15,260
The.

592
00:23:15,260 --> 00:23:15,340
Sky.

593
00:23:15,700 --> 00:23:15,940
So.

594
00:23:16,020 --> 00:23:16,260
Actually.

595
00:23:16,340 --> 00:23:16,480
Do.

596
00:23:16,540 --> 00:23:16,720
Like.

597
00:23:16,780 --> 00:23:16,860
That.

598
00:23:16,940 --> 00:23:17,100
Idea.

599
00:23:21,720 --> 00:23:21,920
Some.

600
00:23:28,360 --> 00:23:28,560
Of.

601
00:23:28,800 --> 00:23:28,940
Specs.

602
00:23:28,980 --> 00:23:29,060
Do.

603
00:23:29,160 --> 00:23:29,300
Call.

604
00:23:29,380 --> 00:23:29,520
For.

605
00:23:29,640 --> 00:23:29,840
Ground.

606
00:23:30,080 --> 00:23:30,280
Stations.

607
00:23:30,320 --> 00:23:30,520
Like.

608
00:23:30,560 --> 00:23:30,740
Lauren.

609
00:23:30,880 --> 00:23:31,020
But.

610
00:23:31,060 --> 00:23:31,180
I'm.

611
00:23:31,220 --> 00:23:31,280
Not.

612
00:23:31,340 --> 00:23:31,380
Sure.

613
00:23:31,440 --> 00:23:31,540
What.

614
00:23:31,580 --> 00:23:31,620
They.

615
00:23:31,640 --> 00:23:31,780
Actually.

616
00:23:32,000 --> 00:23:32,200
Implement.

617
00:23:35,220 --> 00:23:35,420
All.

618
00:23:35,840 --> 00:23:36,040
Right.

619
00:23:36,420 --> 00:23:36,620
I.

620
00:23:36,860 --> 00:23:37,060
Believe.

621
00:23:37,100 --> 00:23:37,220
I.

622
00:23:37,300 --> 00:23:37,360
Know.

623
00:23:37,420 --> 00:23:37,480
The.

624
00:23:37,500 --> 00:23:37,600
Room.

625
00:23:37,620 --> 00:23:37,740
To.

626
00:23:37,740 --> 00:23:37,900
Next.

627
00:23:37,960 --> 00:23:38,100
Speaker.

628
00:23:38,460 --> 00:23:38,660
If.

629
00:23:38,860 --> 00:23:38,880
Want.

630
00:23:38,920 --> 00:23:38,980
To.

631
00:23:39,100 --> 00:23:39,160
Catch.

632
00:23:39,280 --> 00:23:39,480
Me.

633
00:23:40,060 --> 00:23:40,260
Outside.

634
00:23:40,900 --> 00:23:41,100
With.

635
00:23:41,160 --> 00:23:41,220
Any.

636
00:23:41,260 --> 00:23:41,360
More.

637
00:23:41,420 --> 00:23:41,620
Questions.

638
00:23:42,400 --> 00:23:42,600
And.

639
00:23:42,660 --> 00:23:42,780
We're.

640
00:23:42,820 --> 00:23:42,860
Going.

641
00:23:42,940 --> 00:23:43,020
To.

642
00:23:43,080 --> 00:23:43,140
Be.

643
00:23:43,140 --> 00:23:43,260
In.

644
00:23:43,260 --> 00:23:43,380
Our.

645
00:23:43,500 --> 00:23:43,700
Hacking.

646
00:23:43,740 --> 00:23:43,940
Village.

647
00:23:44,460 --> 00:23:44,660
Table.