1
00:00:00,000 --> 00:00:07,080
Gentlemen, his name is Eric Escobar. Apparently he goes by Justice Beaver. One word, not two,

2
00:00:07,180 --> 00:00:13,920
but camel case. He's the principal consultant at SecureWorks and he likes raspberry pies and

3
00:00:13,920 --> 00:00:20,800
long walks on the beach. I actually, I'm not reading his bio. It's boring and standard. The

4
00:00:20,800 --> 00:00:26,120
truth of the matter is this man can actually fly. I am not kidding at all. If you go on the

5
00:00:26,120 --> 00:00:31,120
DEFCON press pages, you can see his picture from last year. After his second first place

6
00:00:31,120 --> 00:00:36,140
victory in the wireless capture the flag, he's actually flying in the picture. It is

7
00:00:36,140 --> 00:00:41,000
absolutely amazing. You can't miss it. So if anything else this man has ever done isn't fun,

8
00:00:41,160 --> 00:00:45,160
just check out that picture. He can fly. Ask him about it after the show. He's really going

9
00:00:45,160 --> 00:00:52,020
to appreciate it. Try the veal. This is Eric Escobar and my personal, one of my favorite

10
00:00:52,020 --> 00:00:55,860
talks that we've approved, SDR replay attacks against home security systems.

11
00:00:56,120 --> 00:01:07,620
So please, enjoy. Hey, Rick. Rick. Can you do me a favor? Can you take a picture for me?

12
00:01:07,720 --> 00:01:14,860
None of my guys are going to do it. Hey, thanks. Appreciate that. Watch him. Hey, guys. My

13
00:01:14,860 --> 00:01:20,400
name is Eric Escobar. I got started here a couple, I think this is my fourth year here at

14
00:01:20,400 --> 00:01:26,100
DEFCON. When I started out here first, it was trying to find the fox. And after the fox, I

15
00:01:26,100 --> 00:01:30,340
started to do a lot of things. I've grown to breaking WPA2, breaking WEP, and then getting a

16
00:01:30,340 --> 00:01:35,700
gig breaking into really big companies and assessing all their wireless. So right now I work

17
00:01:35,700 --> 00:01:40,220
for SecureWorks. I'm a principal consultant where we do pen testing. We do internal, external

18
00:01:41,140 --> 00:01:46,580
wireless and everything in between. So I did not go to school for any of this. So people are

19
00:01:46,580 --> 00:01:50,380
saying, oh, you know, what did you go to college for? How did you get involved in doing all these

20
00:01:50,380 --> 00:01:55,040
wireless attacks and learning all this? Literally all of it was Google and talking to people that

21
00:01:55,040 --> 00:01:56,080
are like doing the CTF. So I'm going to do a little bit of that. So I'm going to do a little bit of that.

22
00:01:56,080 --> 00:02:00,680
That's how I learned pretty much everything that I know. My original schooling, I went to go

23
00:02:00,680 --> 00:02:04,700
civil engineering. So doing like dirt, water, and bridges. Really boring stuff compared to what I do

24
00:02:04,700 --> 00:02:10,220
now. So now I'm a consultant. This is my fourth DEFCON. So okay. So I'm going to be talking

25
00:02:10,220 --> 00:02:16,080
about wireless replay attacks. And so replay attack is exactly what it sounds like. So it's,

26
00:02:16,080 --> 00:02:21,420
I'm catching a signal and I'm just playing it again. That's all that it is. It's pretty simple.

27
00:02:21,620 --> 00:02:25,580
It's like if you overheard somebody say a password to get into a club, you say that same

28
00:02:25,580 --> 00:02:30,660
password, boom, you're in. That's all that it is. There's nothing more complicated than that.

29
00:02:31,600 --> 00:02:36,240
And so basically you wonder like, well, how can that be a thing? That seems like the most insecure

30
00:02:36,240 --> 00:02:39,960
thing in the entire world. Well, the reason that's the thing is it's really easy to program

31
00:02:39,960 --> 00:02:44,140
into. It's really easy to code. It's really easy to troubleshoot. You know, there's no timing.

32
00:02:44,280 --> 00:02:49,800
There's no salt. There's no encryption. It's just you send one, you know, serial or one bite of

33
00:02:49,800 --> 00:02:54,600
text or, you know, one string of text and that's it. You know, that goes across the wire and it's

34
00:02:54,600 --> 00:02:55,320
really easy.

35
00:02:55,580 --> 00:02:59,280
Uh, to debug and do stuff. And so that's why it's a thing. You have cheap electronics that come

36
00:02:59,280 --> 00:03:03,800
from China and, uh, you know, they want to do it as easy as possible and keep costs as low as

37
00:03:03,800 --> 00:03:10,920
possible. And for the most part, it's not a problem until one of us comes up, right? Um, so in

38
00:03:10,920 --> 00:03:13,620
doing this, I use something called software defined radio. If you're not familiar with it,

39
00:03:13,640 --> 00:03:18,120
software defined radio or SDR, uh, it's basically just a tool that allows you to analyze

40
00:03:18,120 --> 00:03:22,920
frequencies. Some will allow you to send and transmit. I'm not going to go super deep into

41
00:03:22,920 --> 00:03:25,560
that, but, uh, you know, if you want to Google something or look at that, you can do that.

42
00:03:25,580 --> 00:03:28,380
If you want to look at something for later, uh, you're going to look for SDR software defined

43
00:03:28,380 --> 00:03:32,960
radio and it makes things way easier. I don't need to like tune a physical radio. Uh, it plugs

44
00:03:32,960 --> 00:03:38,900
right into my laptop via USB. It just makes life a lot easier and they're coming in a smaller and

45
00:03:38,900 --> 00:03:43,160
smaller form factors now. Now I have some, you know, some SDRs that I have that look like a USB

46
00:03:43,160 --> 00:03:49,720
stick with an antenna or just like a normal wireless, uh, adapter for your laptop. Um, okay.

47
00:03:49,800 --> 00:03:55,080
So, so this, you can't see the front of it, but on the back of this, there's an FCC ID and this FCC,

48
00:03:55,580 --> 00:03:59,840
uh, that, that red box is moved or should be moved over, but you can see the FCC ID on the back of

49
00:03:59,840 --> 00:04:03,940
any electronics sold in the United States legally should be there. And, uh, there's a lot of

50
00:04:03,940 --> 00:04:07,880
information on the FCC website. So if you don't want to go looking around, analyzing streams,

51
00:04:08,160 --> 00:04:11,460
you know, analyzing a waterfall display and trying to see, you know, Hey, what's happening

52
00:04:11,460 --> 00:04:15,960
here? It's super easy. If you go to FCC website, it'll say how it's encoded, what frequency it's

53
00:04:15,960 --> 00:04:19,720
supposed to be on. It'll give you all the information that you really need to know. And

54
00:04:19,720 --> 00:04:23,620
that's kind of cheating, right? But at the same time, if you're just getting started out, if you

55
00:04:23,620 --> 00:04:25,560
want to understand this and you want to minimize how much data you're going to be able to use,

56
00:04:25,560 --> 00:04:29,560
how much time you're doing to do this stuff, you know, it's a real easy and nice way. And plus

57
00:04:29,560 --> 00:04:33,360
it's kind of fun to look around and see, Hey, what else do these vendors have? You know, what

58
00:04:33,360 --> 00:04:37,940
other stuff uses this scheme? Because you could find something that like, okay, well maybe this

59
00:04:37,940 --> 00:04:43,300
is for like a motion detector. Uh, but also maybe it's for like, you know, an insulin pump,

60
00:04:43,480 --> 00:04:47,640
right? You don't know where the schemes are used. Um, and so it's really interesting just to go

61
00:04:47,640 --> 00:04:51,500
through and look, uh, and it is kind of cheating, you know, but if it's yours and you're doing

62
00:04:51,500 --> 00:04:54,940
testing, um, you know, a lot of these things, if you were to look at them on the table for the

63
00:04:54,940 --> 00:04:55,540
wireless capture, they're not going to be there. Um, and so it's really interesting just to go

64
00:04:55,540 --> 00:04:59,740
through the flags. You can go up and you can look at the back and see an FCC ID on them and you

65
00:04:59,740 --> 00:05:03,420
can pull it all up and get all the information from it. And you don't have to do really any

66
00:05:03,420 --> 00:05:07,940
analysis because you know exactly what it is because the specs that the manufacturer provided

67
00:05:07,940 --> 00:05:14,860
are on the FCC's website. So by law, it's all there. Um, anyway, so let's see. Uh, and so

68
00:05:14,860 --> 00:05:18,560
this is an example. You go to the FCC website for this motion detector and boom, look what I can

69
00:05:18,560 --> 00:05:23,240
download the test reports, the user manual and test setup photos. So I can see exactly what it

70
00:05:23,240 --> 00:05:25,520
is. Now the FCC website is incredible. It's got a lot of information. It's got a lot of

71
00:05:25,520 --> 00:05:29,260
information. It's incredibly hard to use like any government agency period. So somebody did

72
00:05:29,260 --> 00:05:35,220
some awesome work and they have FCC.io. FCC.io, you can just slash right off the end of it and put

73
00:05:35,220 --> 00:05:40,720
the FCC ID and it will forward you to the exact page you need to be on on the FCC website. So it's

74
00:05:40,720 --> 00:05:45,020
a really cool, really easy way to do it instead of spending, you know, days and days, not days

75
00:05:45,020 --> 00:05:50,400
and days, like more than a half an hour looking for exactly what you're looking for. Um, and so

76
00:05:50,400 --> 00:05:55,380
yeah, you can see all the stuff like frequency, modulation, and just kind of go from there. So

77
00:05:55,380 --> 00:05:59,140
if you guys don't know what modulation is, again, you know, they're beginners. I didn't know any

78
00:05:59,140 --> 00:06:02,860
of this when I started out. There's frequency modula- and these, these are just two main types.

79
00:06:03,060 --> 00:06:07,240
Amplitude modulation, frequency modulation. Uh, a lot of the attacks that, that I've done or

80
00:06:07,240 --> 00:06:12,280
that I've seen are they do, uh, amplitude modulation and that's on-off keying or it's a form

81
00:06:12,280 --> 00:06:16,720
of amplitude modulation. And you can probably think of AM and FM. That's, you know, your AM

82
00:06:16,720 --> 00:06:20,980
radio, FM radio. That's how these things are modulated. And so what I'm specifically talking

83
00:06:20,980 --> 00:06:22,420
about is on-off keying.

84
00:06:25,380 --> 00:06:29,440
Yeah, and, and just kind of going back here. That, this is what a lot of cheap, you know, wireless

85
00:06:30,080 --> 00:06:35,620
434 megahertz electronics have. So, um, if you're looking for software on how to do this stuff,

86
00:06:35,720 --> 00:06:39,980
after you have the tools, um, you know, there's HackRF. That's aw- that's, it's amazing. For

87
00:06:39,980 --> 00:06:43,600
like $300, it sounds kind of pricey. It was definitely pricey for me when I was starting out

88
00:06:43,600 --> 00:06:48,060
and doing this all on my own shoestring budget. Um, but, but that thing, I mean, I still use it to

89
00:06:48,060 --> 00:06:53,480
this day. It's, it's awesome. Um, and then there's GQRX, SDR Sharp if you just are a Windows

90
00:06:53,480 --> 00:06:55,360
user and you just kind of want to get your feet wet, but you don't want to get your feet wet,

91
00:06:55,360 --> 00:06:58,580
you don't want to have to install a brand new operating system. That works really well. And

92
00:06:58,580 --> 00:07:03,420
there's some pretty cool things you can do with it. With just the $20 TV dongle with SDR Sharp,

93
00:07:03,580 --> 00:07:08,800
you can decode, uh, uh, air traffic. Air traffic that's going over the beacons, you can decode

94
00:07:08,800 --> 00:07:12,920
that with that. It's kind of neat. Um, there's RFCAT. There's one that I just found recently

95
00:07:12,920 --> 00:07:18,360
called OOK Tools, um, or OOK Tools, uh, for on-off keying. And then GNU Radio is just the

96
00:07:18,360 --> 00:07:22,720
Swiss Army knife of you can pipe anything to do whatever you want. And it's, uh, there's

97
00:07:22,720 --> 00:07:25,340
definitely a steep learning curve for it. It's a steep learning curve for it. It's a steep

98
00:07:25,340 --> 00:07:29,400
learning curve to it, in my opinion. But once you get the hang of it, uh, you know, it can do

99
00:07:29,400 --> 00:07:34,980
pretty much anything that you want with whatever inputs you want to give it. Um, so this is the

100
00:07:34,980 --> 00:07:39,240
hardware that I use the most. HackRF1, like I mentioned before. $300 software-defined radio.

101
00:07:39,420 --> 00:07:44,340
And then you have the Yardstick1. Um, that is, like, maybe $100-something. I have links to all

102
00:07:44,340 --> 00:07:49,240
this later in the slides that you'll be able to see and download. Um, but these two things,

103
00:07:49,280 --> 00:07:54,100
that's what I primarily use for all of this. HackRF is a little bit more expensive, but it

104
00:07:54,100 --> 00:07:55,320
gets you a bigger frequency range. Um, it's a little bit more expensive, but it gets you a

105
00:07:55,320 --> 00:07:58,600
little bit more stuff. The Yardstick, if you're just starting out and you don't want to drop a

106
00:07:58,600 --> 00:08:04,080
ton of money on it, you can still do a bunch of awesome hacks with this. So, okay, so this is

107
00:08:04,080 --> 00:08:09,040
OOK Tools. Um, and this is one that, that I've been using recently. It's, it's just this

108
00:08:09,040 --> 00:08:13,700
simple. So say you're trying to record for something. You found the frequency on the FCC, uh,

109
00:08:13,820 --> 00:08:18,600
website. So you know, okay, this is in megahertz. That's why it's so long. So when I say 434

110
00:08:18,600 --> 00:08:24,760
megahertz, the M is million. And so you can see that's, you know, that's, you know, 4.333, you

111
00:08:24,760 --> 00:08:25,300
know, million. So, you know, that's, you know, 4.333, you know, million. So, you know, that's, you

112
00:08:25,320 --> 00:08:29,540
know, million. Uh, that's the frequency. Frame count is just how long is it going to pull and

113
00:08:29,540 --> 00:08:34,800
listen for something. The destination signal dot JSON, that's just sending it to a JSON file, you

114
00:08:34,800 --> 00:08:39,100
know, somewhere on your hard drive. And all you have to do is, so, you set this and it'll go for,

115
00:08:39,220 --> 00:08:43,400
you know, maybe around 30 seconds to record how it's actually, you know, what it's going to. You

116
00:08:43,400 --> 00:08:47,420
set it to record. You hit the play button like you're programming a universal remote. And then

117
00:08:47,420 --> 00:08:51,420
it, wait for it to finish. And then all you have to do is go back in, type in signal play, and

118
00:08:51,420 --> 00:08:55,300
give it the file that you just played to. And you can literally just play it right back to the

119
00:08:55,300 --> 00:08:59,300
signal that happened. It's literally just two lines. I broke them up into multiple lines just

120
00:08:59,300 --> 00:09:03,660
so it was easy to read. But that's two line command and a little bit of time to wait. Um, and

121
00:09:03,660 --> 00:09:07,620
that's all that it really takes. So that's if you, this, this is what I use with the HackRF, or

122
00:09:07,620 --> 00:09:12,940
not the HackRF, with the, uh, um, Yardstick. Then there's, uh, this is with the HackRF. Same

123
00:09:12,940 --> 00:09:17,700
thing, just easy. Two lines. You give it, uh, you know, where, uh, the frequency and where it's

124
00:09:17,700 --> 00:09:22,380
going to go to. And same thing, you just, you know, R, dash R is for receive, dash T is for

125
00:09:22,380 --> 00:09:25,280
transmit. Just that easy. Um, and again, the reason why it's so easy is because, uh, the

126
00:09:25,300 --> 00:09:30,120
reason why this is possible is because it's the same, it's the same, you know, code that's going

127
00:09:30,120 --> 00:09:33,940
across. You know, it's the same string of text that's going across every time. So all you're

128
00:09:33,940 --> 00:09:39,020
doing is replaying it. How this is different from something like, say, uh, like newer garage

129
00:09:39,020 --> 00:09:43,800
door openers or something like that is they'll have a rolling code. So every time, you know, a

130
00:09:43,800 --> 00:09:48,980
code goes through, a new code will come up the next time. So it's, it's, it's not, it doesn't

131
00:09:48,980 --> 00:09:53,080
lend itself well to being easily attacked with a, you know, with a replay attack. There are ways

132
00:09:53,080 --> 00:09:54,840
that you can do it with like, you know, um,

133
00:09:55,360 --> 00:09:58,700
jamming a frequency or something like that. But, but really for the most part, this is only for

134
00:09:58,700 --> 00:10:04,740
like the cheaper electronics where security is thought to typically not be an issue. Uh, so this

135
00:10:04,740 --> 00:10:09,000
is like, you know, the raw data. If you do it, you can see the blips, uh, kind of, uh, lends

136
00:10:09,000 --> 00:10:13,240
itself to the image that I showed before of the, of the on off key and the amplitude modulation.

137
00:10:16,040 --> 00:10:20,420
Um, all right. So what can you do with like the RF cat and the stuff that I showed you? Well, you

138
00:10:20,420 --> 00:10:25,200
can, these sensors, the way that they work is they just yell and scream what their code is.

139
00:10:25,200 --> 00:10:29,520
And typically what they do is there's no, you know, act, there's no response saying like, hey, I

140
00:10:29,520 --> 00:10:33,140
got the code, you're good to go. It's, you know, somebody just, you know, the sensor just yells,

141
00:10:33,200 --> 00:10:36,740
this is my code, this is my code a couple of times and that's it. There's no other

142
00:10:36,740 --> 00:10:41,340
information that, that goes across. So if you yell louder with your, you know, software

143
00:10:41,340 --> 00:10:46,500
defined radio, then you, then you're going to drown it all out and the receiver will not be

144
00:10:46,500 --> 00:10:49,720
able to hear anything. So in the real world, if you think about this, if I have a motion

145
00:10:49,720 --> 00:10:53,640
sensor and I want to like say break into my parents' house who have all these motion sensors

146
00:10:53,640 --> 00:10:55,180
everywhere, all I have to do is throw my phone in there and I'm going to be able to hear the

147
00:10:55,180 --> 00:10:57,960
signal. I'm going to turn this on and now all of a sudden I can walk up and the sensor will

148
00:10:57,960 --> 00:11:01,680
still detect me and it'll transmit the signal saying, hey, somebody's here. But because I'm

149
00:11:01,680 --> 00:11:06,800
drowning it out, because I'm drowning out all that noise, there's absolutely no way that, that

150
00:11:06,800 --> 00:11:10,380
sensor is going to hear me because I'm just, you know, sending static or I'm sending junk over

151
00:11:10,380 --> 00:11:14,080
the frequency. Now the other thing that you can do, the exact opposite, you can do a replay

152
00:11:14,080 --> 00:11:19,960
attack like I just said. And so I could sit in my car and make my dad think that, hey, somebody

153
00:11:19,960 --> 00:11:23,680
just opened the front door, you know, and so he'll, you know, maybe get a text message on his

154
00:11:23,680 --> 00:11:25,160
phone or like, you know, get an alert or something like that. And then I can just, you know,

155
00:11:25,160 --> 00:11:28,860
send the alert or the phone or the alarm company will come out and all I'm doing is doing a

156
00:11:28,860 --> 00:11:32,840
replay attack, that's all that's happening. And so if you do a replay attack, the base station

157
00:11:32,840 --> 00:11:38,240
thinks that, that that sensor went off. That's basically all that's happening. So, okay, so

158
00:11:38,620 --> 00:11:44,560
what stuff is vulnerable? If you just go in, search eBay for 434 megahertz stuff, you know,

159
00:11:44,580 --> 00:11:47,920
that's, that's typically stuff that you're going to see as being vulnerable. And so this, this

160
00:11:47,920 --> 00:11:51,540
is a door sensor, you put it on your door and it will send a signal out every time your door

161
00:11:51,540 --> 00:11:55,140
opens and closes. Pretty simple stuff. And that's what's going to happen. So, this is a door

162
00:11:55,160 --> 00:11:58,140
sensor that's vulnerable to a replay attack. So if you were to catch this signal, then you could

163
00:11:58,140 --> 00:12:02,460
make whoever's alarm system think that their door is opening up maybe 100 times a second, you

164
00:12:02,460 --> 00:12:05,840
know, maybe in the middle of the night, maybe you want to set off an alarm, or maybe you just

165
00:12:05,840 --> 00:12:09,900
want to make somebody think that, hey, my alarm system is bugging, it's not working, so I'm

166
00:12:09,900 --> 00:12:14,740
going to ignore all those, you know, transmissions that go off. So, okay, that one's kind of

167
00:12:14,740 --> 00:12:20,120
fun. The next one that you have is motion detectors and doorbells. So this is really fun if

168
00:12:20,120 --> 00:12:24,380
you just want to be a troll and you want to go doorbell ditch somebody, is go find somebody that

169
00:12:24,380 --> 00:12:25,140
has a wireless doorbell.

170
00:12:25,160 --> 00:12:28,580
Because those trains have been on the same thing because there's no security really needed for a

171
00:12:28,580 --> 00:12:32,620
doorbell, but it's really funny to sit in your car and hit, you know, play and watch somebody come

172
00:12:32,620 --> 00:12:35,980
out and not realize, you know, what's actually happening. And of course, who's going to think

173
00:12:35,980 --> 00:12:39,780
that it's some hacker sitting in a car just trolling you, right? But that's something that I

174
00:12:39,780 --> 00:12:44,840
would probably do. So this is an example of a motion detector. And so you can see that the

175
00:12:44,840 --> 00:12:49,000
battery is out of this detector. Let's see if this plays. Oh, wow, I didn't expect that to

176
00:12:49,000 --> 00:12:54,640
actually play. So you can see that this detector just went off even though there's no motion

177
00:12:54,640 --> 00:12:55,040
happening.

178
00:12:55,160 --> 00:13:00,620
So, right? It's a really cheap, easy example to see what's happening there. And so this is the

179
00:13:00,620 --> 00:13:05,280
reverse of that. This is me jamming it. And so you can see initially the light goes off and, you

180
00:13:05,280 --> 00:13:10,220
know, the sensor activates. And then, you know, you jam it and you'll see this little light go off

181
00:13:10,220 --> 00:13:14,360
right here, but nothing will happen here. And so that's effectively jamming it. And you see how

182
00:13:14,360 --> 00:13:19,520
close they are and you see that obviously the radio is not within that vicinity. So that you're

183
00:13:19,520 --> 00:13:23,940
effectively jamming that even though they're so close together. This receiver is just being

184
00:13:23,940 --> 00:13:25,140
screamed at and can't get out. And so you can see that the radio is not within that vicinity. So

185
00:13:25,140 --> 00:13:29,860
you can hear anything else that's happening. This is another really fun one. This is a super

186
00:13:29,860 --> 00:13:35,180
swanky gated neighborhood. And it's super vulnerable to this exact same thing. Let's see if

187
00:13:35,180 --> 00:13:39,360
this video plays. So you can see I'm sitting there. No cars are coming. And I just open the

188
00:13:39,360 --> 00:13:43,180
gate. So you think if you're a thief and you're like, oh, you know what, I'm just going to sit

189
00:13:43,180 --> 00:13:46,520
there. I'm going to wait for some guy to come through. Caught the signal. Now I'm going to go

190
00:13:46,520 --> 00:13:50,960
back by at 1 in the morning. And really there's not a good way to defend against that because

191
00:13:50,960 --> 00:13:55,040
they have, you know, hundreds of people that live in this gated neighborhood. So, you know, to do a

192
00:13:55,140 --> 00:13:59,480
rolling code or something like that, this kind of technology is, you know, there's a reason why

193
00:13:59,480 --> 00:14:04,040
it's there. Because honestly people think, you know, the risk factors are, well, is somebody

194
00:14:04,040 --> 00:14:07,900
really going to go sit out there and do this? Well, I mean, this is, you know, less than $200

195
00:14:07,900 --> 00:14:14,620
worth of hardware that I have just sitting in my car, right? So that's just talking about all the

196
00:14:14,620 --> 00:14:18,840
vulnerable stuff, right? Now, I like to build things. I, you know, started out in college as an

197
00:14:18,840 --> 00:14:22,760
engineer. So I like to build things. So I thought, okay, well, if I can receive all these

198
00:14:22,760 --> 00:14:25,120
signals, I can surely do something cool with them, right? So I thought, okay, well, if I can

199
00:14:25,140 --> 00:14:30,500
do that. And so what I have is I got a super cheap little receiver. So this isn't, you know, an

200
00:14:30,500 --> 00:14:36,540
SDR. This is an actual physical radio that receives that 433, 434 megahertz-ish. It takes that

201
00:14:36,540 --> 00:14:42,340
signal, puts it to an Arduino, which then decodes it and gives it to a Raspberry Pi. So what can

202
00:14:42,340 --> 00:14:50,960
you do with that? Whoa. Did I go too far? No, maybe I didn't. Okay. So sure, you can make your

203
00:14:50,960 --> 00:14:54,040
own security system. You can do whatever you want. But if you're a tinker, if you're somebody

204
00:14:54,040 --> 00:14:55,120
like me that likes to, you know, do whatever you want, you can do whatever you want. But if you're

205
00:14:55,120 --> 00:14:58,740
a, you know, mess with stuff and make your own custom stuff, the hardware for this is cheap.

206
00:14:58,820 --> 00:15:05,920
Raspberry Pi, you can get a Raspberry Pi for $10. You can get that little 434 megahertz module for

207
00:15:05,920 --> 00:15:10,600
$4 or $5. And then you can get a Raspberry, or not a Raspberry Pi, an Arduino for another

208
00:15:10,600 --> 00:15:15,060
$3 online. And you're talking for the base station for an entire, you know, wireless-based,

209
00:15:15,980 --> 00:15:20,940
you know, security system. Like, you could not buy that anywhere else. And it's adaptable, and

210
00:15:20,940 --> 00:15:24,360
you can use it for a ton of different things. So I know some farmers that I've helped with, like,

211
00:15:24,360 --> 00:15:29,180
oh, hey, you want to know, like, when X, Y, or Z happens. You know, maybe you want to see motion

212
00:15:29,180 --> 00:15:35,260
on this road, and you, you know, you want multiple detectors to go off before you're alerted, right?

213
00:15:35,380 --> 00:15:38,740
Because there could be a false positive. And so you can scale this and build this to do whatever

214
00:15:38,740 --> 00:15:42,220
you want. And it's super easy to integrate because there's all the tutorials on the world for

215
00:15:42,220 --> 00:15:47,880
Raspberry Pi. So basically the way that it works, just a simplified diagram, is alarm goes off,

216
00:15:47,920 --> 00:15:52,920
goes to here. This takes it to the Raspberry Pi, which logs into SQLite database. And then you can

217
00:15:52,920 --> 00:15:54,340
program it to do whatever you want. So you can do whatever you want. So you can do whatever you want.

218
00:15:54,680 --> 00:15:57,480
SMS, you know, if you just want to get a text message on your phone every time your mailbox

219
00:15:57,480 --> 00:16:01,620
opens. Super easy. If you want to just get an email, all right. And then Woof. If you know

220
00:16:01,620 --> 00:16:06,940
what Woof is, then great. This is just a quick little schematic. It's super easy. There's three

221
00:16:06,940 --> 00:16:13,040
wires that connect the, you know, the radio to it, to the Arduino. I mean, so when I first

222
00:16:13,040 --> 00:16:16,140
started out on all this, I was really gun shy about, like, oh, there's all these little wires.

223
00:16:16,220 --> 00:16:19,900
I don't really know what to do. But I got over it really quick. And when you see these little

224
00:16:19,900 --> 00:16:23,360
diagrams, it's like, yeah, you literally connect a wire from there to there, there to there. And

225
00:16:24,360 --> 00:16:29,900
then you see it's, you know, that's literally all the wires that are involved in this. And so

226
00:16:29,900 --> 00:16:34,020
all the different sensor types that you can have, I mean, there's the door ones, there's smoke

227
00:16:34,020 --> 00:16:38,000
alarms. And people wonder, like, why is a smoke alarm wireless? Why is a smoke alarm, you

228
00:16:38,000 --> 00:16:42,560
know, on 434 megahertz? Like, that seems stupid. Well, if you have a building or, like, an

229
00:16:42,560 --> 00:16:47,860
office complex and you want all the alarms to go off when, you know, one alarm goes off, that's

230
00:16:47,860 --> 00:16:51,380
what they're there for. So that could be terrible if you find out that frequency and do a replay

231
00:16:51,380 --> 00:16:54,340
attack on it. Or it could be great in the sense of, like, oh, no, it's not going to work.

232
00:16:54,360 --> 00:16:58,180
Now when my, you know, smoke alarm goes off, I can get a text message and it cost me, you know,

233
00:16:58,240 --> 00:17:02,580
like, three Starbucks drinks. Some of the other things, door open, door closed sensors, the

234
00:17:02,580 --> 00:17:06,300
motion sensors, and then, like, water sensors if you have, like, a sump pump or something like

235
00:17:06,300 --> 00:17:11,460
that. Again, this is just, like, a very small sample. There is a lot of stuff that all operates

236
00:17:11,460 --> 00:17:19,360
in this way, you know, with these kinds of modulation of frequencies. So all the code to do

237
00:17:19,360 --> 00:17:23,740
that is on that repo. And I also posted links to all the hardware that I was talking about and,

238
00:17:23,780 --> 00:17:24,340
like, links to all the hardware that I was talking about and, like, links to, like, all the

239
00:17:24,360 --> 00:17:27,980
software I was talking about. So if you guys want to take a picture of that, that's the, like,

240
00:17:28,480 --> 00:17:32,220
this is, like, basically what I did for everything. It's not super clean code because I'm a hacker,

241
00:17:32,260 --> 00:17:36,120
not a programmer, so I don't really care. My e-mail is also on there. So if you have a

242
00:17:36,120 --> 00:17:40,000
question, you know, feel free to shoot me an e-mail. You know, I'd love to hear feature

243
00:17:40,000 --> 00:17:44,860
requests and that kind of stuff. But, yeah, this is just something that I think is really cool and

244
00:17:44,860 --> 00:17:49,700
kind of fun. And, again, if you want to learn any more about this stuff, you know,

245
00:17:50,480 --> 00:17:54,340
greatscottgadgets.com slash SDR is Michael Osmond's full, like, website. So if you want to

246
00:17:54,340 --> 00:17:59,640
like software-defined radio hack RF class for free, it's normally, like, I think a 40 or a

247
00:17:59,640 --> 00:18:06,200
two-day, it's a two-day class that I think they maybe offered here this year. But it's a really

248
00:18:06,200 --> 00:18:10,400
great class from, like, hey, I don't even really know what, you know, software-defined radio is

249
00:18:10,400 --> 00:18:14,360
to, like, yeah, I can perform a replay attack in no time at all. This will walk you through the

250
00:18:14,360 --> 00:18:19,640
entire process, no problem. And then RTLSDR, there's just a ton of good forum posts of people

251
00:18:19,640 --> 00:18:23,620
doing, you know, pretty incredible things. And I always reference it for, like, whoa,

252
00:18:23,900 --> 00:18:24,320
that's a lot of people doing pretty incredible things. And I always reference it for, like,

253
00:18:24,340 --> 00:18:27,380
that would be kind of cool to do or, like, that would be kind of cool to mess with. So,

254
00:18:27,460 --> 00:18:32,860
again, RTLSDR. And this is just a link to that same GitHub deal. So, yeah. I think I have five

255
00:18:32,860 --> 00:18:43,340
minutes left. So if anybody has any questions. Please use the mic. Cool. That was really

256
00:18:43,340 --> 00:18:50,660
great. Oh, you have a question. Run.

257
00:18:54,240 --> 00:19:02,560
Can I go now? Okay. Sorry. What about motion sensors that, like, turn on a light? So for home

258
00:19:02,560 --> 00:19:05,720
security, they have it over their garage or something like that, motion sensors. Is there a

259
00:19:05,720 --> 00:19:10,100
way to jam that so that it doesn't trigger? So, no, there's no way to jam it because the

260
00:19:10,100 --> 00:19:16,320
circuitry, what that does is the PIR sensor goes off. So there's no wireless involved. It's just

261
00:19:16,320 --> 00:19:20,000
saying, hey, it went off. And instead of triggering a wireless signal, I'm just going to hit the

262
00:19:20,000 --> 00:19:20,640
relay to turn it off. So, yeah. So, yeah. So, yeah. So, yeah. So, yeah. So, yeah. So, yeah.

263
00:19:20,980 --> 00:19:25,140
So, yeah. But if that was connected to their home security system over wireless, then that

264
00:19:25,140 --> 00:19:28,520
would jam it. The other thing that you want to do if you want to bypass that, just get a can of

265
00:19:28,520 --> 00:19:33,600
air spray, you know, like the can spray to clear off your keyboard. Because all that's doing is

266
00:19:33,600 --> 00:19:37,020
looking for a change in temperature. So if it's just a constant temperature, you know, it won't

267
00:19:37,020 --> 00:19:42,280
know that you're there. So same, I mean, sorry, that's not how you do it. That was not a part of

268
00:19:42,280 --> 00:19:47,160
the talk, but that's if you wanted to. That's how you would do it. Anybody else? Going once.

269
00:19:47,620 --> 00:19:49,560
Going twice. Sold.

270
00:19:50,640 --> 00:19:50,840
Woo!