1 00:00:00,000 --> 00:00:04,840 Next we have Hacking and Robotics Version 2 by Aaron Owens. 2 00:00:05,220 --> 00:00:07,100 My name is Aaron Patrick Owens. 3 00:00:07,920 --> 00:00:10,180 I've been with Roots for five years. 4 00:00:10,720 --> 00:00:17,040 I've been a CISO for 10 companies and been in security for about 20 years now. 5 00:00:17,800 --> 00:00:19,380 It's a very exciting area. 6 00:00:19,460 --> 00:00:24,440 I'm really glad to see this many young people that are involved with cybersecurity every day. 7 00:00:24,800 --> 00:00:28,660 And the STEM programs that you're going to find in Roots are absolutely exciting. 8 00:00:29,360 --> 00:00:32,060 With that, I'm going to introduce you to two people. 9 00:00:32,440 --> 00:00:37,480 I have here with me Duncan Owens, and he goes by Stealth Rock. 10 00:00:38,180 --> 00:00:39,060 Go ahead and say hi. 11 00:00:40,220 --> 00:00:41,140 Say hi, please. 12 00:00:41,700 --> 00:00:43,140 Go ahead and just say hi, everyone. 13 00:00:43,480 --> 00:00:44,080 Hi there. 14 00:00:44,720 --> 00:00:45,360 All right. 15 00:00:45,900 --> 00:00:51,440 Duncan is 15 years old, and he's been coming to Roots now for five years. 16 00:00:52,980 --> 00:00:56,880 He's won some of the contests like the crypto programs and things in the past, 17 00:00:57,060 --> 00:00:58,640 and we became a part of... 18 00:00:58,660 --> 00:01:04,440 The Roots program as far as introducing kids to technology over the past three years 19 00:01:04,440 --> 00:01:06,080 by hosting some of the workstations. 20 00:01:06,240 --> 00:01:09,640 So I want to talk to you today about one of our workstations, 21 00:01:10,200 --> 00:01:13,500 the hacking and robotics workstation that we had here last year. 22 00:01:14,060 --> 00:01:17,220 You can see that we're full on space. 23 00:01:17,400 --> 00:01:21,980 So we have the drone wars workstation instead of the hacking and robotics. 24 00:01:22,080 --> 00:01:24,240 So that's one thing that's changed just a little bit. 25 00:01:24,960 --> 00:01:27,620 We should have our robots back next year, 26 00:01:27,620 --> 00:01:30,980 but they're currently, they didn't make it through customs. 27 00:01:31,800 --> 00:01:35,480 So having said that, I want to introduce you to drone wars. 28 00:01:35,600 --> 00:01:40,060 But before we get started, could I have everyone's attention just for one moment? 29 00:01:41,560 --> 00:01:42,400 One second. 30 00:01:43,440 --> 00:01:48,600 I have one drone that has gone missing off the drone wars table. 31 00:01:50,100 --> 00:01:52,120 These are not inexpensive drones. 32 00:01:52,220 --> 00:01:53,320 They're part of the workstation. 33 00:01:53,520 --> 00:01:57,140 If someone could help me find this one drone, that'd be fantastic. 34 00:01:58,200 --> 00:02:01,900 The person that helps me find that will be the first person to be able to come over 35 00:02:01,900 --> 00:02:04,100 and participate in the drone wars workstation. 36 00:02:04,280 --> 00:02:05,040 It starts at one o'clock. 37 00:02:05,780 --> 00:02:07,560 Okay, thank you for your attention on that. 38 00:02:08,720 --> 00:02:11,480 We'll be presenting the full drone wars workstation tomorrow. 39 00:02:11,500 --> 00:02:13,340 I'm going to talk to you about the three major parts. 40 00:02:14,480 --> 00:02:18,580 The first part of drone wars and our hacking and robotics program 41 00:02:18,580 --> 00:02:22,520 is that we designed our own distribution of Kali Linux. 42 00:02:23,780 --> 00:02:27,600 Kali Linux is a hacking version of the Kali Linux. 43 00:02:27,600 --> 00:02:29,920 It's a version of Linux for the Raspberry Pi. 44 00:02:30,160 --> 00:02:34,980 So we put that on Raspberry Pi early last year, and now it's available to the public. 45 00:02:35,140 --> 00:02:36,980 So you should see that up on the websites. 46 00:02:38,180 --> 00:02:47,420 Having said that, our workstation is using and consuming Raspberry Pi distros on the Raspberry Pi. 47 00:02:47,640 --> 00:02:51,220 Everyone that comes by the workstation will leave with a Raspberry Pi 48 00:02:51,960 --> 00:02:54,920 and with that distro and the SD card to get working. 49 00:02:55,380 --> 00:02:56,880 So we'll work you through. 50 00:02:56,940 --> 00:02:57,240 How? 51 00:02:57,600 --> 00:03:01,600 How to use and load the Raspberry Pi with Kali Linux. 52 00:03:02,280 --> 00:03:05,180 The second major thing you're going to see at our workstation, 53 00:03:05,400 --> 00:03:06,660 that's tomorrow, by the way, 54 00:03:07,120 --> 00:03:11,140 then the second major thing you're going to see is the drone wars program. 55 00:03:11,480 --> 00:03:14,600 How many of you have watched Drone Racing League on ESPN? 56 00:03:15,400 --> 00:03:16,320 Show of hands. 57 00:03:17,380 --> 00:03:18,500 All right, a few of you. 58 00:03:18,620 --> 00:03:19,000 Okay. 59 00:03:19,420 --> 00:03:23,440 So we have a beta version of the Drone Racing League simulators, 60 00:03:23,520 --> 00:03:27,340 and we have one of the Drone Racing League robots or drones. 61 00:03:27,340 --> 00:03:31,260 We have two drones with us, and what we've done is two unique things with these. 62 00:03:31,320 --> 00:03:35,160 So we're going to run a multiplayer game and let you guys come over and race against each other. 63 00:03:35,460 --> 00:03:40,600 If you've never flown a drone before, we're going to help you with the simulator on how to do that. 64 00:03:40,660 --> 00:03:43,780 You'll use a real drone controller to do that. 65 00:03:44,180 --> 00:03:49,740 The second thing that you'll do as part of the racing is that we're going to give away some of these drones to our winners. 66 00:03:50,420 --> 00:03:53,700 So you'll be able to walk away with one of these out of the workstation as well. 67 00:03:55,240 --> 00:03:57,320 The third thing that you're going to see in the workstation is that we're going to be able to run a drone race against each other. 68 00:03:57,320 --> 00:04:00,220 And the third thing that you'll see in the workstation is you'll be able to build a custom drone. 69 00:04:01,240 --> 00:04:02,500 Here's the TIE Fighter. 70 00:04:05,560 --> 00:04:07,140 You want to introduce people to that? 71 00:04:08,800 --> 00:04:12,920 This is our custom drone so far. 72 00:04:14,980 --> 00:04:22,180 We're going to put the motors in and the chip, and the controller will connect to that. 73 00:04:22,880 --> 00:04:24,160 It's like a TIE Fighter. 74 00:04:24,300 --> 00:04:24,980 It can fly around. 75 00:04:25,060 --> 00:04:27,240 We also have a black one. 76 00:04:27,320 --> 00:04:28,600 And a yellow and black one. 77 00:04:29,220 --> 00:04:31,860 But this is the only yellow one. 78 00:04:32,980 --> 00:04:34,900 Now where did this come from? 79 00:04:34,960 --> 00:04:35,740 Where did this come from? 80 00:04:37,300 --> 00:04:39,660 This came from a 3D printer. 81 00:04:39,940 --> 00:04:41,120 We 3D printed it. 82 00:04:43,540 --> 00:04:45,360 It's our own custom design. 83 00:04:49,940 --> 00:04:56,600 And this is kind of fragile. 84 00:04:56,600 --> 00:05:04,400 But if you're good at flying it, and even if you're not, then you can still fly it. 85 00:05:04,460 --> 00:05:07,900 Because the things around it are supposed to protect it. 86 00:05:08,420 --> 00:05:09,140 The chip. 87 00:05:09,380 --> 00:05:12,120 So the chip won't get broken because of these. 88 00:05:13,120 --> 00:05:15,060 And it's pretty cool. 89 00:05:16,840 --> 00:05:23,860 We're going to introduce the TIE Fighter tomorrow on its full build. 90 00:05:23,860 --> 00:05:26,240 This was downloaded from Thingiverse. 91 00:05:26,460 --> 00:05:28,040 I don't know if you guys do 3D printing. 92 00:05:28,620 --> 00:05:33,040 But this is a design that we'll give the creds to tomorrow for who designed it. 93 00:05:33,340 --> 00:05:38,040 And you'll have the opportunity to build a drone and fly it on this platform. 94 00:05:38,440 --> 00:05:43,520 So this is a platform that will be made available at the workstation today and tomorrow. 95 00:05:44,340 --> 00:05:47,120 And so those are our three things just to sum up. 96 00:05:47,180 --> 00:05:50,240 We're filling in for the hacking and robotics presentation. 97 00:05:50,900 --> 00:05:53,560 So our full presentation with the full team is tomorrow. 98 00:05:53,560 --> 00:05:56,760 And we have six people on the team, six pilots. 99 00:05:57,380 --> 00:06:02,280 You're going to see some leaders in the industry that are on our team, some engineers. 100 00:06:03,200 --> 00:06:05,720 We also have our own custom drones. 101 00:06:06,380 --> 00:06:09,660 So how many of you in the room are familiar with what a red team is? 102 00:06:11,260 --> 00:06:12,200 Red teams? 103 00:06:12,300 --> 00:06:14,580 Two, three, four, five? 104 00:06:15,160 --> 00:06:15,640 Okay. 105 00:06:15,880 --> 00:06:18,020 How many of you know what a blue team is? 106 00:06:20,420 --> 00:06:23,240 Anybody participating in the Facebook CTF today? 107 00:06:24,580 --> 00:06:26,020 To capture the flag? 108 00:06:26,680 --> 00:06:27,200 Okay. 109 00:06:27,560 --> 00:06:31,720 So which team do you think you're on if you're participating in a CTF? 110 00:06:34,140 --> 00:06:35,740 Red, blue, white? 111 00:06:36,460 --> 00:06:38,140 You guys know what these terms are? 112 00:06:38,880 --> 00:06:39,400 Okay. 113 00:06:39,680 --> 00:06:41,700 So a red team is the attack team. 114 00:06:42,160 --> 00:06:48,660 So when we hire people to come in and test a computing system or to test a system for vulnerabilities, 115 00:06:49,120 --> 00:06:52,480 we hire a team of people that are put together. 116 00:06:52,480 --> 00:07:02,960 In order to be able to exploit or penetrate the system or the facility or the process that we've been engaged to attack. 117 00:07:03,360 --> 00:07:06,100 I participated in several red teams and led some. 118 00:07:06,280 --> 00:07:12,080 I've gotten into some of the largest banks in the United States, nuclear facilities, things like that. 119 00:07:12,320 --> 00:07:17,380 Bank vaults, credit card stock, check stock, things like that from these places. 120 00:07:17,560 --> 00:07:19,180 Take control of the system. 121 00:07:19,260 --> 00:07:20,840 We call that pwning the system. 122 00:07:21,640 --> 00:07:26,480 Escalating our privileges, taking over the network, and we win our trophies. 123 00:07:26,600 --> 00:07:28,720 A trophy is defined by our customer. 124 00:07:29,620 --> 00:07:37,280 In the playground where you guys are working as far as red and blue teams, the blue team is the defense team. 125 00:07:37,500 --> 00:07:40,840 And that is the team that is there to stop the red team. 126 00:07:41,420 --> 00:07:44,920 If you can keep the red team from attacking, you win. 127 00:07:45,100 --> 00:07:49,320 If the red team wins, captures the flag, they win. 128 00:07:49,320 --> 00:07:51,520 Sometimes that's time-based. 129 00:07:51,720 --> 00:07:55,040 Sometimes it's based on the trophies or a certain thing that you have to do. 130 00:07:55,760 --> 00:07:57,800 So how weird can the trophies get? 131 00:07:58,640 --> 00:08:00,340 Let's talk about some trophies. 132 00:08:00,800 --> 00:08:06,840 So anybody have an interesting trophy story they want to come up and share? 133 00:08:08,680 --> 00:08:09,980 I can give a couple. 134 00:08:11,120 --> 00:08:11,640 Okay. 135 00:08:11,940 --> 00:08:15,980 One trophy that a company might give you is, 136 00:08:16,080 --> 00:08:19,300 Hey, we would really like your team to get a picture. 137 00:08:19,300 --> 00:08:22,360 In the CEO's office next to this zebra. 138 00:08:22,920 --> 00:08:25,680 And it's a zebra statue in his office. 139 00:08:25,860 --> 00:08:27,940 And if you can get that picture, you win. 140 00:08:28,560 --> 00:08:30,940 And so that would be an example of a trophy. 141 00:08:31,440 --> 00:08:32,840 Another trophy might be, 142 00:08:32,880 --> 00:08:35,980 We'd like you to get domain admin privileges on our network. 143 00:08:36,300 --> 00:08:41,980 And we would like you to use that privilege to be able to exploit our domain controller 144 00:08:41,980 --> 00:08:45,340 and be able to create a new account on our domain controller 145 00:08:45,340 --> 00:08:47,620 so that you could show us that it can be done. 146 00:08:48,200 --> 00:08:49,780 That's another example of a trophy. 147 00:08:50,420 --> 00:08:55,980 And then another example might be that we want you to be able to social engineer your way into our building 148 00:08:55,980 --> 00:08:59,660 and get the security guard to let you pass the front desk. 149 00:09:00,120 --> 00:09:01,560 That might be another trophy. 150 00:09:02,220 --> 00:09:04,960 So in a CTF, you're going to have trophies. 151 00:09:06,860 --> 00:09:11,700 And one of the things that you're going to see is that the red teams are getting better and better 152 00:09:11,700 --> 00:09:15,840 at how we're going to adapt to be able to go into a company. 153 00:09:15,960 --> 00:09:17,600 One of the ways that we attack companies, 154 00:09:17,620 --> 00:09:20,500 is we attack them through their Wi-Fi networks. 155 00:09:21,040 --> 00:09:23,460 How many of you guys in here know what a Wi-Fi is? 156 00:09:24,420 --> 00:09:25,440 All of you, right? 157 00:09:25,760 --> 00:09:26,280 Okay. 158 00:09:26,680 --> 00:09:32,400 Anyone connected to a Wi-Fi right now might want to rethink that at DEF CON. 159 00:09:33,160 --> 00:09:35,780 So if you're connecting to a Wi-Fi, 160 00:09:36,040 --> 00:09:38,660 you're connecting to an access point in the sky, 161 00:09:38,900 --> 00:09:43,340 and there's an SSID that's being sent from that access point, 162 00:09:43,480 --> 00:09:45,940 and it's communicating, broadcasting its name. 163 00:09:45,940 --> 00:09:49,340 Maybe you've seen in this room, there's a Roots2 name. 164 00:09:49,980 --> 00:09:51,180 Anybody seen that one? 165 00:09:52,520 --> 00:09:54,020 Roots2 on their Wi-Fi list? 166 00:09:54,420 --> 00:09:56,840 That's your Facebook CTF's Wi-Fi? 167 00:09:57,480 --> 00:09:59,780 So it's broadcasting and saying, here I am. 168 00:09:59,920 --> 00:10:03,440 You can connect to me, but I've secured with a password. 169 00:10:03,960 --> 00:10:05,640 Now companies do the same thing. 170 00:10:05,740 --> 00:10:09,100 They secure their systems just like you should at home. 171 00:10:09,300 --> 00:10:11,880 So if you are running a Wi-Fi system at home, 172 00:10:12,040 --> 00:10:15,920 how do you keep your neighbors or your friends off your Wi-Fi system? 173 00:10:18,300 --> 00:10:21,600 And that's going to be why we secure the system. 174 00:10:21,760 --> 00:10:25,020 What people want to test is they want to hire a team of people 175 00:10:25,020 --> 00:10:26,680 to see if you can break into their Wi-Fi. 176 00:10:26,880 --> 00:10:28,400 So they bring a red team in. 177 00:10:28,700 --> 00:10:32,140 The red team's goal is to break the Wi-Fi system, 178 00:10:32,340 --> 00:10:34,820 which requires a couple of things you need. 179 00:10:35,300 --> 00:10:38,840 To break a Wi-Fi system, we have to be close to it 180 00:10:38,840 --> 00:10:42,120 so that we can access that within proximity. 181 00:10:42,460 --> 00:10:43,400 Would you go grab that? 182 00:10:43,580 --> 00:10:44,020 Sorry. 183 00:10:50,500 --> 00:10:55,200 I'm going to show you a Wi-Fi attack or what we call a Wi-Fi assault system 184 00:10:55,940 --> 00:10:57,800 that is put out by Hack5. 185 00:10:58,760 --> 00:11:01,220 If you're looking, I'm not going to advertise that, 186 00:11:01,360 --> 00:11:03,180 but it has a few unique capabilities. 187 00:11:05,420 --> 00:11:07,800 This is called a Pineapple. 188 00:11:08,180 --> 00:11:10,020 So if you've ever Pineappled, 189 00:11:10,760 --> 00:11:13,940 we have the instruction books on how to Pineapple at our workstation. 190 00:11:14,860 --> 00:11:17,020 This has a couple of different antennae. 191 00:11:17,100 --> 00:11:19,440 So you guys can see how long these antennas are. 192 00:11:20,220 --> 00:11:24,020 These allow us to hack wireless signals at a long distance. 193 00:11:24,140 --> 00:11:25,660 So I don't have to be as close. 194 00:11:26,140 --> 00:11:27,420 But they are directional. 195 00:11:28,020 --> 00:11:30,380 These are omnidirectional antennas. 196 00:11:30,520 --> 00:11:33,880 So these are designed to be able to hit things at a longer distance 197 00:11:33,880 --> 00:11:34,800 in all directions. 198 00:11:35,600 --> 00:11:40,060 Now what we've done with our drones is we've attached these to our drones 199 00:11:40,060 --> 00:11:42,400 and we can hack from the sky. 200 00:11:44,400 --> 00:11:47,180 So that's some of the cool things that our RED teams are doing 201 00:11:47,180 --> 00:11:50,260 with drone technology in order to be able to use it 202 00:11:50,260 --> 00:11:51,600 for the cybersecurity community. 203 00:11:52,640 --> 00:11:55,920 Second thing that we're doing with the drones is we created 204 00:11:55,920 --> 00:11:58,800 and we will have available for the ROOTS program next year, 205 00:11:58,940 --> 00:12:02,420 and this is something our researchers will talk to you about tomorrow, 206 00:12:02,580 --> 00:12:05,180 is we created a capture the flag with drones 207 00:12:05,840 --> 00:12:08,120 so that you can actually capture the drone itself. 208 00:12:09,060 --> 00:12:11,020 To capture the drone out of the air, 209 00:12:11,200 --> 00:12:13,460 there's a couple of different ways that you can do that. 210 00:12:13,460 --> 00:12:19,420 You can take over its remote control communication system, 211 00:12:20,140 --> 00:12:23,100 which we've encrypted so that's a little bit harder to take over. 212 00:12:23,500 --> 00:12:26,660 Another thing you can do is you can jam the drone 213 00:12:26,660 --> 00:12:28,580 and keep the drone from flying, 214 00:12:28,760 --> 00:12:32,100 and that's just another way you haven't taken control of it, 215 00:12:32,140 --> 00:12:34,860 but you've prevented the user from actually using it. 216 00:12:35,380 --> 00:12:38,440 And then another thing you can do is you can do forensics on the drone 217 00:12:38,440 --> 00:12:41,660 and determine its flight path and where it's been, 218 00:12:41,860 --> 00:12:43,440 what it's taken pictures of, 219 00:12:43,460 --> 00:12:46,820 what kind of reconnaissance missions it's gone on, et cetera. 220 00:12:47,540 --> 00:12:51,880 So our capture the flag associated with drones for drone wars next year 221 00:12:51,880 --> 00:12:53,500 will offer all three of those things. 222 00:12:53,960 --> 00:12:56,980 You'll be able to do forensics on the drone to determine where it's been, 223 00:12:57,480 --> 00:13:00,140 and you'll be able to capture the drone out of the air, 224 00:13:00,560 --> 00:13:03,800 and you'll be able to jam the drone while it's in flight. 225 00:13:04,320 --> 00:13:05,720 So it's going to be really cool. 226 00:13:05,880 --> 00:13:09,720 DEF CON is we're looking at running this at DEF CON with about 25 drones, 227 00:13:09,860 --> 00:13:12,960 and I think you guys are going to really enjoy seeing that here at ROOTS as well. 228 00:13:13,480 --> 00:13:19,580 The Wi-Fi assault drones that we've built use a more portable version of this 229 00:13:19,580 --> 00:13:21,240 called the Hack5 Pineapple Nano, 230 00:13:21,740 --> 00:13:25,500 and then we built our own Raspberry Pi attack assault system 231 00:13:25,500 --> 00:13:31,100 that is working with a custom OS that we've developed just for this. 232 00:13:31,300 --> 00:13:32,880 You'll see some more on that tomorrow. 233 00:13:33,520 --> 00:13:37,100 So just as a preview, I wanted to introduce the Drone Wars program. 234 00:13:37,220 --> 00:13:38,460 It's new to ROOTS this year. 235 00:13:38,620 --> 00:13:41,360 It's over here under the tent so that when you fly the drone, 236 00:13:41,480 --> 00:13:42,140 which you will do, 237 00:13:42,140 --> 00:13:43,580 you won't hit the ceiling, 238 00:13:43,760 --> 00:13:45,460 and so we have a lot of room for that. 239 00:13:45,800 --> 00:13:49,900 And then some of our workstation volunteers like Firestarter here 240 00:13:50,300 --> 00:13:52,180 will be available to answer questions, 241 00:13:52,240 --> 00:13:54,120 and Stealth Rock here as well. 242 00:13:54,560 --> 00:13:56,880 So thank you for letting us come back to ROOTS. 243 00:13:57,420 --> 00:13:58,560 Fill in this time slot. 244 00:13:58,660 --> 00:14:00,680 You'll see the full presentation on Drone Wars tomorrow. 245 00:14:00,820 --> 00:14:01,200 Thank you.