1
00:00:00,000 --> 00:00:06,460
Let me introduce Matt Blaze. He told us he's a professor at UPenn where he does various kinds of hackery.

2
00:00:06,720 --> 00:00:10,560
And I have to say, one of the very few times I'm ever going to say this,

3
00:00:10,760 --> 00:00:14,740
if there's an academic paper with this man's name on it and you like what he's talking about,

4
00:00:14,800 --> 00:00:19,760
you probably want to read it, especially all this fun B-25 stuff, but quite a bit of other things.

5
00:00:19,860 --> 00:00:26,620
It's very interesting. And just the silly things this man does to get himself in trouble

6
00:00:26,620 --> 00:00:30,760
but somehow gets out of trouble, I really can't speak too highly of his work.

7
00:00:30,980 --> 00:00:37,740
So today we'll be talking about SIGINT for the rest of us. So thank you very much, Matt.

8
00:00:38,120 --> 00:00:46,580
Okay, so thanks. Hope you can hear me. Hi, morning. Congratulations for making it up before the crack of noon,

9
00:00:46,780 --> 00:00:50,140
which is an accomplishment, at least for me.

10
00:00:50,880 --> 00:00:54,500
So I'm going to talk a little bit about some work I did in my lab

11
00:00:54,500 --> 00:00:56,600
with a bunch of people.

12
00:00:56,620 --> 00:01:00,940
I've got a bunch of incredibly talented other people, including Sandy Clark, Mouse,

13
00:01:01,140 --> 00:01:05,840
who I think everybody either knows or should know, and she's around somewhere,

14
00:01:06,100 --> 00:01:10,900
and Travis Goodspeed, a hacker of ill repute who is also around,

15
00:01:11,620 --> 00:01:17,580
as well as Perry Metzger, Zach Wasserman, and Kevin Zhu,

16
00:01:17,720 --> 00:01:22,300
who are undergraduates in my lab.

17
00:01:22,540 --> 00:01:26,120
So I got this grant from the...

18
00:01:26,620 --> 00:01:27,780
from the National Science Foundation.

19
00:01:28,420 --> 00:01:31,400
There's nobody from the National Science Foundation here, right?

20
00:01:32,400 --> 00:01:40,100
Okay. So they gave us this pile of money to look at security in open telecommunications networks.

21
00:01:40,480 --> 00:01:46,060
And basically that kind of meant, I think they thought that that meant, cell phone networks.

22
00:01:46,660 --> 00:01:49,940
And I thought, okay, that's kind of interesting to look at.

23
00:01:50,640 --> 00:01:56,600
But we decided to start out by looking at other kinds of wireless networks.

24
00:01:58,180 --> 00:02:00,180
Wireless communications networks.

25
00:02:00,380 --> 00:02:03,100
And I just decided to, you know, kind of on a lark,

26
00:02:03,160 --> 00:02:10,160
to look at the security standards used by public safety two-way radios.

27
00:02:11,000 --> 00:02:13,480
In particular, the P25 standard.

28
00:02:14,020 --> 00:02:20,080
And so, you know, that was kind of an excuse to buy lots of RF equipment

29
00:02:20,620 --> 00:02:25,560
and start playing with it in the lab and putting antennas up

30
00:02:25,560 --> 00:02:29,340
and doing all sorts of fun stuff that, you know, you kind of...

31
00:02:29,340 --> 00:02:32,120
Otherwise, you don't normally get to call research.

32
00:02:33,860 --> 00:02:39,160
And, you know, as soon as I put in a receiver,

33
00:02:39,320 --> 00:02:45,580
we turned it on and noticed that we could demodulate a digital signal

34
00:02:45,580 --> 00:02:50,960
and there's this, like, surveillance operation going on literally, like, two blocks away.

35
00:02:51,080 --> 00:02:53,600
And they're reading off license plates and describing people.

36
00:02:53,860 --> 00:02:55,540
And I could look out the window and see them.

37
00:02:55,560 --> 00:02:56,760
I could see the people they were describing.

38
00:02:57,000 --> 00:03:00,460
And this was, like, literally in the first 45 minutes

39
00:03:00,460 --> 00:03:09,840
after unpacking this fancy pants piece of RF intercept gear that we had picked up.

40
00:03:09,940 --> 00:03:11,620
And I thought, hmm, that's interesting.

41
00:03:11,780 --> 00:03:14,520
I'll bet they think that this is secure.

42
00:03:15,500 --> 00:03:17,340
And so what is this?

43
00:03:17,840 --> 00:03:22,780
So there's a system called APCO Project 25,

44
00:03:23,100 --> 00:03:24,900
which is the successor

45
00:03:25,560 --> 00:03:28,040
to something called APCO Project 16.

46
00:03:29,280 --> 00:03:31,640
So I'm not sure why...

47
00:03:31,640 --> 00:03:35,940
what happened to nine of them in there along the way.

48
00:03:36,040 --> 00:03:39,200
This is the current standard

49
00:03:39,200 --> 00:03:42,260
for digital two-way radio

50
00:03:42,260 --> 00:03:45,900
for public safety and federal users.

51
00:03:46,460 --> 00:03:48,740
And so there are two kind of dominant standards

52
00:03:48,740 --> 00:03:50,860
for digital land mobile radio.

53
00:03:51,180 --> 00:03:53,000
One of them is DMR.

54
00:03:53,080 --> 00:03:54,880
A lot of hams like DMR.

55
00:03:55,560 --> 00:03:59,140
An incompatible but remarkably similar standard

56
00:03:59,140 --> 00:04:01,240
is called APCO Project 25.

57
00:04:01,700 --> 00:04:03,940
It started a little bit earlier.

58
00:04:04,420 --> 00:04:08,840
The standards started in the early 1990s.

59
00:04:09,220 --> 00:04:12,220
And the intention

60
00:04:12,220 --> 00:04:16,660
was to be a drop-in replacement for analog FM radio,

61
00:04:16,980 --> 00:04:20,220
which means narrowband channels,

62
00:04:20,660 --> 00:04:23,080
12.5 kilohertz channel spacing,

63
00:04:23,080 --> 00:04:26,800
and some modulation technique

64
00:04:26,800 --> 00:04:29,740
that would fit into the same size channel

65
00:04:29,740 --> 00:04:32,200
as an existing narrowband FM,

66
00:04:32,760 --> 00:04:35,120
but also allow it to be digital,

67
00:04:35,240 --> 00:04:36,500
allow a messaging service,

68
00:04:37,060 --> 00:04:38,620
but the primary application

69
00:04:38,620 --> 00:04:41,500
being the same kind of two-way voice.

70
00:04:41,880 --> 00:04:44,060
Okay, so this is, first of all,

71
00:04:44,080 --> 00:04:46,320
an interesting limitation right from the beginning,

72
00:04:46,460 --> 00:04:47,760
because if you were designing

73
00:04:47,760 --> 00:04:50,540
a digital communication system completely from scratch,

74
00:04:50,660 --> 00:04:52,840
and you just had all the spectrum in the world

75
00:04:53,080 --> 00:04:53,620
that you might want,

76
00:04:54,300 --> 00:04:56,980
you would probably prefer

77
00:04:56,980 --> 00:04:59,780
a spread-spectrum style option,

78
00:05:00,000 --> 00:05:01,640
which has all sorts of properties

79
00:05:01,640 --> 00:05:04,560
that are, in a lot of ways,

80
00:05:04,620 --> 00:05:05,440
much more favorable

81
00:05:05,440 --> 00:05:08,300
than individual channelized spectrum use.

82
00:05:08,580 --> 00:05:10,780
But this is, you know, starting out

83
00:05:10,780 --> 00:05:12,540
with a kind of legacy problem.

84
00:05:12,960 --> 00:05:15,440
But this is the state of the art.

85
00:05:15,600 --> 00:05:18,540
Now, they added, later on,

86
00:05:19,380 --> 00:05:21,220
cryptographic security options

87
00:05:21,220 --> 00:05:22,960
to the P25.

88
00:05:23,080 --> 00:05:25,340
So this was, you know,

89
00:05:25,340 --> 00:05:26,900
not exactly an afterthought,

90
00:05:27,000 --> 00:05:29,960
but it wasn't part of the initial standard.

91
00:05:30,220 --> 00:05:32,460
So they kind of figured out the bearer channels

92
00:05:32,460 --> 00:05:34,500
and all of the basic signaling

93
00:05:34,500 --> 00:05:36,920
and the modulation and the vocoder,

94
00:05:37,100 --> 00:05:37,920
and then they said,

95
00:05:38,000 --> 00:05:40,860
we should definitely get a working group

96
00:05:40,860 --> 00:05:43,360
to come up with crypto standards for this.

97
00:05:43,540 --> 00:05:45,140
So throughout the 1990s,

98
00:05:45,140 --> 00:05:46,420
they were kind of grafting on

99
00:05:46,960 --> 00:05:48,160
more and more crypto standards,

100
00:05:48,400 --> 00:05:49,740
and then 2000,

101
00:05:50,060 --> 00:05:51,780
kind of the first encrypted versions

102
00:05:51,780 --> 00:05:52,980
of P25 equipment.

103
00:05:53,080 --> 00:05:55,680
Started to become commercially available

104
00:05:55,680 --> 00:05:58,980
on a wide scale

105
00:05:58,980 --> 00:06:00,420
and deployed on a wide scale.

106
00:06:00,620 --> 00:06:03,580
And the encryption standards,

107
00:06:03,880 --> 00:06:05,320
the security standards group,

108
00:06:05,580 --> 00:06:06,780
working on P25,

109
00:06:06,960 --> 00:06:09,100
continues its work today.

110
00:06:09,340 --> 00:06:10,800
So this was not something

111
00:06:10,800 --> 00:06:13,340
that security was really designed in,

112
00:06:13,420 --> 00:06:14,840
talked about them from the beginning.

113
00:06:15,060 --> 00:06:15,780
So here we are,

114
00:06:15,880 --> 00:06:17,440
a group of radio geeks

115
00:06:17,440 --> 00:06:20,280
at a security geek-oriented conference,

116
00:06:20,640 --> 00:06:22,000
and you can kind of,

117
00:06:22,000 --> 00:06:23,620
from the beginning,

118
00:06:23,900 --> 00:06:26,160
your skepticism should be

119
00:06:29,660 --> 00:06:31,300
heavily attuned.

120
00:06:31,620 --> 00:06:33,420
Okay, so here's some examples

121
00:06:33,910 --> 00:06:35,860
of typical P25.

122
00:06:36,160 --> 00:06:39,100
This is a Motorola XTS5000.

123
00:06:39,580 --> 00:06:43,560
That's the radios that the goons use here.

124
00:06:43,860 --> 00:06:46,340
So this is kind of a first generation

125
00:06:46,340 --> 00:06:47,540
or second generation

126
00:06:47,540 --> 00:06:50,460
of the subscriber equipment that's available.

127
00:06:50,460 --> 00:06:53,520
Motorola is by far the dominant vendor,

128
00:06:53,640 --> 00:06:55,240
although there are other vendors

129
00:06:55,240 --> 00:06:56,320
of the equipment.

130
00:06:56,820 --> 00:06:58,780
Motorola is also, interestingly,

131
00:06:59,060 --> 00:07:01,860
the only vendor that produces key loaders.

132
00:07:02,060 --> 00:07:04,180
So if you want to use the encryption option,

133
00:07:04,400 --> 00:07:07,300
you're kind of bought into Motorola

134
00:07:07,300 --> 00:07:09,740
as it is because they're the only company

135
00:07:09,740 --> 00:07:11,200
that actually makes the equipment

136
00:07:11,200 --> 00:07:14,200
that can load keys into the radios.

137
00:07:14,700 --> 00:07:17,660
So there's a fairly wide range of equipment.

138
00:07:17,780 --> 00:07:19,500
All of it is shockingly expensive.

139
00:07:20,720 --> 00:07:22,360
The, you know, here's,

140
00:07:22,380 --> 00:07:25,200
these can be bought on the surplus market

141
00:07:25,200 --> 00:07:28,180
for, you know, in the neighborhood of 500 bucks.

142
00:07:28,820 --> 00:07:32,240
This is the current latest and greatest version of this.

143
00:07:32,320 --> 00:07:33,320
This is an all-band.

144
00:07:33,500 --> 00:07:40,160
That is VHF, UHF, 700, 800 megahertz P25 radio.

145
00:07:40,520 --> 00:07:42,780
It has speakers on both sides

146
00:07:42,780 --> 00:07:44,840
and a keypad and a fancy display.

147
00:07:45,040 --> 00:07:47,920
And, you know, it costs some shockingly large

148
00:07:47,920 --> 00:07:48,760
amount of money.

149
00:07:48,880 --> 00:07:49,480
But anyway,

150
00:07:49,500 --> 00:07:51,500
it can, you know, interoperate with anything.

151
00:07:51,720 --> 00:07:54,400
So there's a fairly wide range of equipment available.

152
00:07:54,820 --> 00:07:57,560
And, you know, they look like walkie-talkies

153
00:07:57,560 --> 00:08:00,320
from police movies in the 1980s

154
00:08:00,320 --> 00:08:02,440
because they're all kind of big and clumsy.

155
00:08:02,640 --> 00:08:03,080
Okay.

156
00:08:03,160 --> 00:08:09,020
Now, the P25 is intended not just,

157
00:08:09,340 --> 00:08:13,400
is intended primarily for public safety users.

158
00:08:13,620 --> 00:08:16,540
That's the sort of, and like for police, fire,

159
00:08:16,780 --> 00:08:17,740
ambulance services.

160
00:08:17,740 --> 00:08:20,300
Not all of them need security options.

161
00:08:20,640 --> 00:08:24,240
And the basic model for it, you know,

162
00:08:24,240 --> 00:08:27,020
is assuming things like traffic analysis and so on,

163
00:08:27,120 --> 00:08:28,520
even for the encrypted users,

164
00:08:28,820 --> 00:08:30,420
are not a particular threat.

165
00:08:31,320 --> 00:08:35,080
But in fact, if you kind of poke around,

166
00:08:35,360 --> 00:08:36,520
you can see that, well,

167
00:08:36,640 --> 00:08:39,620
here's an encrypted radio standard that exists

168
00:08:39,620 --> 00:08:42,020
and you can just buy off-the-shelf equipment

169
00:08:42,020 --> 00:08:43,680
and it has some security options.

170
00:08:43,920 --> 00:08:46,780
So it has more users than it was,

171
00:08:46,780 --> 00:08:49,460
more different kinds of users than it was designed for.

172
00:08:49,960 --> 00:08:51,760
Here's a picture from,

173
00:08:52,660 --> 00:08:55,260
I believe this was from Afghanistan.

174
00:08:55,360 --> 00:08:57,400
And if you look really closely,

175
00:08:57,540 --> 00:08:59,840
you can see one of those XPS 5000s

176
00:08:59,840 --> 00:09:02,060
on the front of that war fighter.

177
00:09:03,200 --> 00:09:05,760
Here's a photo from a White House event.

178
00:09:06,000 --> 00:09:08,140
This is the back of a, whoops,

179
00:09:08,300 --> 00:09:10,500
back of a Secret Service agent

180
00:09:11,680 --> 00:09:15,160
who has a P25 radio in her evening gown

181
00:09:15,800 --> 00:09:18,460
with one of those little earphones.

182
00:09:18,760 --> 00:09:21,620
So these are used by everything from the military

183
00:09:21,620 --> 00:09:23,940
to the Secret Service to, you know,

184
00:09:23,940 --> 00:09:26,520
pretty much all of the federal law enforcement agencies,

185
00:09:27,360 --> 00:09:30,480
but also, you know, local police and fire and so on.

186
00:09:31,300 --> 00:09:33,960
P25, by the way, can work with both trunked

187
00:09:33,960 --> 00:09:36,220
and conventional systems.

188
00:09:37,060 --> 00:09:39,840
So you can kind of drop it into a trunked system

189
00:09:39,840 --> 00:09:42,060
or you can just drop it into conventional repeater

190
00:09:43,120 --> 00:09:44,020
channelized options.

191
00:09:44,020 --> 00:09:44,640
It has both.

192
00:09:44,820 --> 00:09:46,320
For the most part,

193
00:09:47,600 --> 00:09:50,220
state and local is using trunked systems

194
00:09:51,560 --> 00:09:54,320
more than non-military federal.

195
00:09:55,140 --> 00:09:57,580
Military is using chiefly trunked systems.

196
00:09:57,880 --> 00:10:01,060
Federal law enforcement is using chiefly conventional systems,

197
00:10:01,120 --> 00:10:03,880
although, you know, this varies based on area.

198
00:10:04,080 --> 00:10:05,020
So how does this work?

199
00:10:05,400 --> 00:10:06,880
Okay, so basically,

200
00:10:07,760 --> 00:10:10,100
you have an existing narrowband channel.

201
00:10:10,360 --> 00:10:13,240
And so the first question is how much bandwidth

202
00:10:13,240 --> 00:10:14,700
can you fit in there digitally?

203
00:10:15,120 --> 00:10:17,540
And they're being fairly conservative

204
00:10:18,060 --> 00:10:23,140
in that they're using a 4,800 symbols per second.

205
00:10:23,240 --> 00:10:24,360
Those are two-bit symbols.

206
00:10:24,660 --> 00:10:28,580
So that's 9,600 bits per second for the encoding,

207
00:10:28,840 --> 00:10:34,380
which pretty comfortably fits into a 12.5 kilohertz channel

208
00:10:34,380 --> 00:10:40,360
if you kind of do the Nyquist math.

209
00:10:41,060 --> 00:10:43,000
And it can kind of coexist

210
00:10:43,240 --> 00:10:45,940
relatively comfortably with analog FM

211
00:10:45,940 --> 00:10:49,660
in that it, you know,

212
00:10:49,660 --> 00:10:52,260
has a pretty similar shape of the curves

213
00:10:52,260 --> 00:10:54,560
and the spillover to adjacent channels.

214
00:10:54,740 --> 00:10:57,700
So the vocoder for the audio

215
00:10:58,240 --> 00:11:03,100
is a proprietary system called IMBE.

216
00:11:04,070 --> 00:11:06,580
Most DMR and so on is using AMBE.

217
00:11:06,900 --> 00:11:10,440
This is very, very similar, except it's incompatible.

218
00:11:10,520 --> 00:11:11,580
That's its main difference.

219
00:11:11,580 --> 00:11:14,800
But it's, you know, fundamentally very similar.

220
00:11:14,900 --> 00:11:16,580
The audio sounds the same.

221
00:11:16,660 --> 00:11:19,540
It does a respectable job of replicating human voice

222
00:11:19,540 --> 00:11:23,300
in 9,600 bits per second.

223
00:11:23,820 --> 00:11:26,860
Interestingly, it really, really, really

224
00:11:27,580 --> 00:11:29,800
wants to be implemented in hardware.

225
00:11:30,620 --> 00:11:32,460
If you do a software implementation,

226
00:11:32,620 --> 00:11:34,380
you need a pretty fast computer

227
00:11:34,380 --> 00:11:38,860
to keep up with the audio streaming,

228
00:11:39,080 --> 00:11:41,240
particularly on the decoding side.

229
00:11:41,240 --> 00:11:43,860
So you really want hardware

230
00:11:43,860 --> 00:11:45,480
to be able to just do the vocoder

231
00:11:46,240 --> 00:11:48,580
digital-to-analog conversion for that.

232
00:11:49,280 --> 00:11:51,260
The way they do this is

233
00:11:51,260 --> 00:11:54,420
they basically have

234
00:11:55,240 --> 00:11:59,520
a train of voice frames

235
00:12:00,240 --> 00:12:05,420
that are each 1,728 bits long,

236
00:12:05,700 --> 00:12:07,760
which, if you divide this up,

237
00:12:07,900 --> 00:12:09,860
is 180 milliseconds of audio.

238
00:12:09,860 --> 00:12:12,300
So every 180 milliseconds of audio

239
00:12:12,300 --> 00:12:14,680
is kind of separately encoded

240
00:12:14,680 --> 00:12:19,020
into these two voice frames that they've got.

241
00:12:19,240 --> 00:12:20,680
Now, it's not quite that simple.

242
00:12:20,860 --> 00:12:24,620
In fact, there are two kinds of these voice frames

243
00:12:24,620 --> 00:12:27,420
called a logical data unit one

244
00:12:27,420 --> 00:12:29,200
and a logical data unit two.

245
00:12:29,380 --> 00:12:33,060
They both contain 180 milliseconds of audio.

246
00:12:33,300 --> 00:12:35,800
The difference is that half of the metadata

247
00:12:35,800 --> 00:12:38,620
that's thrown along with it is in the first one

248
00:12:38,620 --> 00:12:39,780
and half is in the second one.

249
00:12:39,780 --> 00:12:41,000
And they keep repeating.

250
00:12:41,200 --> 00:12:44,400
And the idea is that after two of these frames,

251
00:12:44,700 --> 00:12:46,040
you've now got enough information

252
00:12:46,040 --> 00:12:48,440
to start decoding the rest of it,

253
00:12:48,520 --> 00:12:50,720
and you have all the metadata that's associated with it.

254
00:12:51,340 --> 00:12:54,360
Now, another interesting kind of design constraint,

255
00:12:54,560 --> 00:12:57,980
and this is no surprise to radio geeks,

256
00:12:58,000 --> 00:13:01,020
but is a surprise to computer security

257
00:13:01,020 --> 00:13:02,660
and protocol design geeks,

258
00:13:02,780 --> 00:13:04,840
is that this is designed,

259
00:13:04,840 --> 00:13:07,320
even though we call these things

260
00:13:07,320 --> 00:13:09,340
two-way radios,

261
00:13:09,780 --> 00:13:11,620
this is a one-way protocol.

262
00:13:11,960 --> 00:13:14,760
This is a broadcast-oriented protocol.

263
00:13:15,180 --> 00:13:18,440
And I'm stating the obvious kind of slowly,

264
00:13:18,760 --> 00:13:20,200
partly because I'm a professor

265
00:13:20,200 --> 00:13:21,740
and that's what I do for a living,

266
00:13:21,880 --> 00:13:24,940
but also because this will be important

267
00:13:24,940 --> 00:13:26,720
as we go forward.

268
00:13:26,940 --> 00:13:30,000
When you're designing a security protocol,

269
00:13:30,180 --> 00:13:33,260
almost all of the security protocols that we design

270
00:13:33,780 --> 00:13:36,000
involve two-way handshakes

271
00:13:36,000 --> 00:13:39,760
between the initiator and the researcher.

272
00:13:39,780 --> 00:13:42,940
And we tend to design protocols

273
00:13:42,940 --> 00:13:44,220
in which I say,

274
00:13:44,380 --> 00:13:46,360
here's what I'm about to send you,

275
00:13:46,580 --> 00:13:47,860
here's my key material,

276
00:13:48,140 --> 00:13:49,820
send me yours back.

277
00:13:49,980 --> 00:13:51,440
Oh, yes, we're happy to communicate.

278
00:13:51,720 --> 00:13:53,840
Now we've done our handshake

279
00:13:53,840 --> 00:13:55,020
and we are synced up.

280
00:13:55,340 --> 00:13:59,260
And almost everything that we know how to design

281
00:13:59,780 --> 00:14:02,800
starts with the premise that you can do round trips

282
00:14:02,800 --> 00:14:05,420
between the sender and the receiver.

283
00:14:06,040 --> 00:14:08,420
Here, even though all of the receivers

284
00:14:08,420 --> 00:14:09,760
have the capability to do that,

285
00:14:09,780 --> 00:14:10,000
or to transmit,

286
00:14:10,400 --> 00:14:12,400
we're operating on a broadcast model

287
00:14:12,400 --> 00:14:15,000
in which you basically put stuff over the air

288
00:14:15,000 --> 00:14:16,760
and it is up to the recipient

289
00:14:16,760 --> 00:14:21,360
to pick out everything they need to decode it

290
00:14:21,840 --> 00:14:24,580
without any round trips with you.

291
00:14:24,720 --> 00:14:26,420
And that's partly so that you don't have to know

292
00:14:26,420 --> 00:14:28,060
who all the recipients are in advance

293
00:14:28,760 --> 00:14:32,060
and you have kind of a standard broadcast model.

294
00:14:32,560 --> 00:14:35,120
Now, there are a few things that do involve round trips

295
00:14:35,120 --> 00:14:38,180
for the messaging protocols that are built on top of this,

296
00:14:38,180 --> 00:14:40,420
but chiefly, this is basically

297
00:14:40,420 --> 00:14:43,380
a one-way protocol for two-way radio.

298
00:14:44,220 --> 00:14:48,320
Okay, so how does security get grafted onto this?

299
00:14:49,140 --> 00:14:52,800
Okay, first of all, there is no public-key cryptography at all,

300
00:14:52,940 --> 00:14:55,500
and that's unsurprising given that this is a one-way protocol.

301
00:14:55,720 --> 00:15:01,760
Instead, it's built entirely based on symmetric encryption.

302
00:15:02,880 --> 00:15:05,220
You know, it supports AES, DES,

303
00:15:05,220 --> 00:15:10,020
and a couple of proprietary systems

304
00:15:10,020 --> 00:15:11,500
that you'd never want to use.

305
00:15:11,680 --> 00:15:13,580
Most of them are 40-bit RC4.

306
00:15:14,460 --> 00:15:21,460
As well as an option to include type 1 classified ciphers

307
00:15:21,460 --> 00:15:24,740
or suite A classified ciphers, as they now call them,

308
00:15:24,800 --> 00:15:27,980
although I have never seen any evidence in the wild

309
00:15:27,980 --> 00:15:30,680
of anything other than AES and DES

310
00:15:31,000 --> 00:15:35,200
and god-awful RC4 being used out there.

311
00:15:35,220 --> 00:15:38,460
Almost everybody on current systems

312
00:15:38,460 --> 00:15:42,540
is using AES, DES or RC4 in practice.

313
00:15:43,140 --> 00:15:47,600
The keys need to be loaded into the radio in advance

314
00:15:49,820 --> 00:15:52,880
before being able to be using them,

315
00:15:53,100 --> 00:15:56,980
and the sender and recipient have to share keys

316
00:15:56,980 --> 00:15:59,380
because it's symmetric key encryption.

317
00:15:59,840 --> 00:16:04,320
Now, keys can get into these radios in one of two ways.

318
00:16:04,320 --> 00:16:07,980
One way is to use a key-loading device.

319
00:16:08,440 --> 00:16:11,520
So if you were to look at these radios,

320
00:16:12,080 --> 00:16:14,860
if you have very good eyesight, you can look at mine.

321
00:16:15,000 --> 00:16:19,100
If you don't have good eyesight, buy one and look at it.

322
00:16:20,040 --> 00:16:22,220
You can see there are a whole bunch of pins on here.

323
00:16:22,320 --> 00:16:24,980
A couple of them are serial ports

324
00:16:24,980 --> 00:16:29,280
that go directly into the encryption module.

325
00:16:29,920 --> 00:16:32,940
So there's a kind of direct path into the encryption module

326
00:16:33,940 --> 00:16:35,540
to the key-loader

327
00:16:35,540 --> 00:16:39,440
that can blast key material into the radio.

328
00:16:39,900 --> 00:16:43,580
Another way to do it is through an over-the-air protocol

329
00:16:43,580 --> 00:16:46,220
called OTAR, over-the-air re-keying,

330
00:16:46,400 --> 00:16:50,340
in which the radio has an initial key set up dedicated to it.

331
00:16:50,440 --> 00:16:52,520
It can communicate with a base station

332
00:16:52,520 --> 00:16:58,260
to get the current traffic keys to be used over the air.

333
00:16:58,540 --> 00:17:02,920
And essentially, it's up to the radio

334
00:17:02,940 --> 00:17:04,860
to have the correct keys

335
00:17:06,640 --> 00:17:11,900
that are being used by whatever group they're communicating with.

336
00:17:12,200 --> 00:17:15,360
And if you don't have the correct keys, you're out of luck.

337
00:17:15,480 --> 00:17:16,700
And if you do, then great.

338
00:17:17,600 --> 00:17:20,720
Now, again, there are no sessions in a communication

339
00:17:20,720 --> 00:17:22,860
because this is a one-way protocol.

340
00:17:23,180 --> 00:17:25,620
You just transmit, you encrypt,

341
00:17:25,660 --> 00:17:29,400
and you now can be received by people who have the key material

342
00:17:29,400 --> 00:17:30,980
who are tuned to the correct channel.

343
00:17:30,980 --> 00:17:33,680
Okay, so that's the kind of security model.

344
00:17:33,900 --> 00:17:36,160
Now, that security model means

345
00:17:36,800 --> 00:17:40,700
the sender makes all the security decisions.

346
00:17:41,100 --> 00:17:48,720
The recipient has no role in negotiating with the sender.

347
00:17:48,800 --> 00:17:55,360
The sender basically has to select encryption to be turned on,

348
00:17:55,560 --> 00:17:58,440
and it's up to the receiver to receive.

349
00:17:58,660 --> 00:17:59,120
Now,

350
00:17:59,120 --> 00:18:03,620
this design is intended for public safety users.

351
00:18:03,960 --> 00:18:07,280
That is, the people who they were thinking of

352
00:18:07,280 --> 00:18:10,440
when they designed this were cops and firefighters

353
00:18:10,940 --> 00:18:14,420
and paramedics out there in the field.

354
00:18:14,880 --> 00:18:17,000
And the model for them is

355
00:18:17,000 --> 00:18:20,300
you want to err on the side of ability to communicate.

356
00:18:20,720 --> 00:18:25,220
And so they made a design decision

357
00:18:25,220 --> 00:18:27,460
that actually makes a lot of sense

358
00:18:27,460 --> 00:18:29,160
for that category of users,

359
00:18:29,460 --> 00:18:34,460
which is that receivers try aggressively to receive.

360
00:18:35,380 --> 00:18:38,240
If you send something with a key

361
00:18:38,240 --> 00:18:42,420
and the receiver has that key loaded in their radio,

362
00:18:42,740 --> 00:18:44,260
they will demodulate it.

363
00:18:44,860 --> 00:18:47,960
If you send something in the clear

364
00:18:48,740 --> 00:18:51,880
and the recipient is set to encryption mode,

365
00:18:52,140 --> 00:18:53,420
they'll demodulate it.

366
00:18:53,540 --> 00:18:55,660
So we err on the side of demodulation,

367
00:18:55,800 --> 00:18:56,920
and that kind of makes sense

368
00:18:56,920 --> 00:18:58,620
because it's, you know, you're saying,

369
00:18:58,740 --> 00:19:00,440
help someone shooting at me.

370
00:19:00,860 --> 00:19:02,640
I hope my mic wasn't keyed.

371
00:19:02,980 --> 00:19:04,700
Help someone shooting at me.

372
00:19:06,380 --> 00:19:09,060
You really want people to be able to receive it

373
00:19:09,060 --> 00:19:11,780
if your crypto switch was in the wrong place.

374
00:19:12,240 --> 00:19:12,620
Okay.

375
00:19:12,680 --> 00:19:15,840
So there's no authentication.

376
00:19:18,120 --> 00:19:22,000
And there's no protection against things like replay

377
00:19:22,000 --> 00:19:23,140
or anything like that

378
00:19:23,140 --> 00:19:25,260
because those all require the concept

379
00:19:25,260 --> 00:19:26,900
of a communication system.

380
00:19:26,920 --> 00:19:28,260
There's no protection that doesn't exist.

381
00:19:28,640 --> 00:19:29,300
Okay.

382
00:19:29,380 --> 00:19:32,480
So we looked at this protocol

383
00:19:32,480 --> 00:19:39,580
and we discovered a number of weaknesses of the design.

384
00:19:39,820 --> 00:19:42,760
First of all, it's pretty ad hoc.

385
00:19:43,500 --> 00:19:47,240
The security stuff was clearly grafted on at the end.

386
00:19:47,460 --> 00:19:50,660
But interestingly, they seemed to make

387
00:19:50,660 --> 00:19:53,820
all of the bearer channel encryption stuff

388
00:19:53,820 --> 00:19:56,120
does not make a lot of the mistakes

389
00:19:56,120 --> 00:19:57,580
that you could make.

390
00:19:57,740 --> 00:20:01,140
For example, if you XOR the first frame

391
00:20:01,140 --> 00:20:02,320
with the second frame,

392
00:20:02,600 --> 00:20:04,780
the key doesn't fall out, right,

393
00:20:04,840 --> 00:20:06,040
or anything like that.

394
00:20:06,300 --> 00:20:10,240
So they seem to have done the actual AESDS encryption

395
00:20:12,560 --> 00:20:13,680
reasonably competently

396
00:20:13,680 --> 00:20:16,820
with the exception that there's no authentication built in.

397
00:20:16,920 --> 00:20:20,520
But in terms of actually successfully encrypting

398
00:20:20,520 --> 00:20:22,060
when the encryption is turned on,

399
00:20:22,180 --> 00:20:24,600
it seems to actually do that

400
00:20:24,600 --> 00:20:27,380
without any embarrassing cryptographic mistakes

401
00:20:27,380 --> 00:20:29,380
that we've found yet.

402
00:20:30,420 --> 00:20:31,980
You know, I have to add that.

403
00:20:33,340 --> 00:20:38,860
But it does have some significant protocol weaknesses

404
00:20:39,460 --> 00:20:41,140
that can be exploited in practice.

405
00:20:41,520 --> 00:20:44,160
Some of them are consequences of the lack of authentication.

406
00:20:45,560 --> 00:20:47,120
Some of them are consequences

407
00:20:47,120 --> 00:20:51,180
of the enormous susceptibility to traffic analysis,

408
00:20:51,460 --> 00:20:52,820
which I'll talk about in a second.

409
00:20:52,820 --> 00:20:55,100
In particular, there seems to have been

410
00:20:55,100 --> 00:20:56,660
a simple mistake made

411
00:20:56,660 --> 00:20:58,680
that there's metadata sent

412
00:20:58,680 --> 00:21:01,080
that includes a unique unit identifier

413
00:21:01,080 --> 00:21:02,560
for every radio.

414
00:21:02,780 --> 00:21:05,120
So your radio has a unique serial number

415
00:21:05,120 --> 00:21:07,260
that it sends over the air with each packet.

416
00:21:07,400 --> 00:21:08,860
If you turn encryption on,

417
00:21:08,960 --> 00:21:10,420
that stays in the clear.

418
00:21:10,840 --> 00:21:12,760
So even if you're encrypting,

419
00:21:12,780 --> 00:21:15,420
somebody doing intercept

420
00:21:15,420 --> 00:21:18,520
can kind of keep track of what units are in the area,

421
00:21:18,620 --> 00:21:19,800
when they're on, when they're off,

422
00:21:19,880 --> 00:21:22,580
what channels they're on, and who they're working.

423
00:21:23,780 --> 00:21:27,060
And that appears to have simply been a design error

424
00:21:27,060 --> 00:21:29,440
in the way it was constructed.

425
00:21:29,660 --> 00:21:30,880
It doesn't appear to be necessary

426
00:21:30,880 --> 00:21:33,800
for anything about how the system operates.

427
00:21:34,180 --> 00:21:36,020
The second is we found that it was vulnerable

428
00:21:36,020 --> 00:21:38,480
because of the way they're doing forward error correction.

429
00:21:38,860 --> 00:21:40,460
Radio systems really need

430
00:21:40,460 --> 00:21:42,200
some sort of error correction going on.

431
00:21:42,640 --> 00:21:44,780
They do something very aggressive

432
00:21:44,780 --> 00:21:46,800
in that they error correct

433
00:21:46,800 --> 00:21:49,480
every metadata field separately.

434
00:21:49,820 --> 00:21:51,940
So we send things like the unit ID,

435
00:21:51,940 --> 00:21:53,340
and that has its own error correction.

436
00:21:53,620 --> 00:21:54,600
And then we send the,

437
00:21:54,660 --> 00:21:56,580
what kind of a packet is this?

438
00:21:56,800 --> 00:21:58,620
And that's error corrected separately.

439
00:21:58,860 --> 00:22:00,440
And then we have the bulk voice,

440
00:22:01,140 --> 00:22:03,100
and that's sent separately.

441
00:22:03,360 --> 00:22:05,620
And that turned out to allow for

442
00:22:05,620 --> 00:22:09,740
a uniquely favorable to the attacker

443
00:22:09,740 --> 00:22:11,240
denial of service attack,

444
00:22:11,520 --> 00:22:13,320
where this is the only system I've seen

445
00:22:13,670 --> 00:22:16,240
that requires less energy to jam

446
00:22:16,940 --> 00:22:18,960
than it does to legitimately use.

447
00:22:19,320 --> 00:22:21,280
So usually you want to design a system

448
00:22:21,940 --> 00:22:23,740
where you need more energy to jam.

449
00:22:23,940 --> 00:22:25,360
This actually requires less,

450
00:22:25,540 --> 00:22:27,160
and I'll describe how you'd actually do that.

451
00:22:27,480 --> 00:22:29,220
So here's some sort of,

452
00:22:29,260 --> 00:22:31,480
here's the smart stuff we found.

453
00:22:31,860 --> 00:22:33,900
Okay, first is that voice traffic

454
00:22:33,900 --> 00:22:35,280
is not authenticated.

455
00:22:35,560 --> 00:22:38,560
And one of the things that that means

456
00:22:38,560 --> 00:22:44,160
is that you can replay

457
00:22:44,830 --> 00:22:46,540
encrypted traffic at will.

458
00:22:46,760 --> 00:22:49,000
So you might not be able to demodulate it,

459
00:22:49,060 --> 00:22:51,360
but you can just grab the RF off of it

460
00:22:51,360 --> 00:22:52,620
and play it back,

461
00:22:52,800 --> 00:22:53,880
and it will happily do that

462
00:22:53,880 --> 00:22:55,260
in the voice of whatever they said.

463
00:22:55,440 --> 00:22:57,040
And if you can figure out what's going on,

464
00:22:57,460 --> 00:22:59,080
you might be able to use that

465
00:22:59,080 --> 00:23:00,760
to your advantage as an active attacker.

466
00:23:03,120 --> 00:23:06,900
Another issue is the susceptibility

467
00:23:06,900 --> 00:23:10,800
to both passive and active traffic analysis.

468
00:23:11,040 --> 00:23:13,420
So passive traffic analysis is easy

469
00:23:13,420 --> 00:23:15,140
because even when encryption is on,

470
00:23:15,300 --> 00:23:18,620
the 24-bit unit ID is sent in the clear.

471
00:23:18,900 --> 00:23:21,280
But that only works when they choose

472
00:23:21,360 --> 00:23:21,900
to transmit.

473
00:23:22,340 --> 00:23:24,880
So we also found an active attack

474
00:23:24,880 --> 00:23:28,440
that allows you to ping radios to,

475
00:23:29,600 --> 00:23:31,800
that allows you to ping radios

476
00:23:31,800 --> 00:23:35,260
to basically induce them to transmit.

477
00:23:35,560 --> 00:23:37,000
And the interesting thing about this

478
00:23:37,000 --> 00:23:38,400
is that it takes advantage

479
00:23:38,400 --> 00:23:41,620
of the one area of the data service

480
00:23:42,060 --> 00:23:44,840
that does actually do authentication.

481
00:23:45,480 --> 00:23:49,040
Except this system includes both AXE and NAXE.

482
00:23:49,040 --> 00:23:51,980
So if I send you something,

483
00:23:52,160 --> 00:23:54,520
a text message over this,

484
00:23:54,720 --> 00:23:58,040
and you have the correct key material

485
00:23:58,040 --> 00:23:59,100
to decrypt it,

486
00:23:59,300 --> 00:24:00,420
you'll send back an,

487
00:24:00,480 --> 00:24:01,780
I got your text message.

488
00:24:02,060 --> 00:24:04,560
If I don't have the correct key material

489
00:24:04,560 --> 00:24:05,420
to decrypt it,

490
00:24:05,500 --> 00:24:06,880
it will send me back a,

491
00:24:06,940 --> 00:24:07,760
get lost.

492
00:24:08,680 --> 00:24:10,820
You don't have the right key material

493
00:24:11,720 --> 00:24:15,560
with the unit ID helpfully included.

494
00:24:15,940 --> 00:24:18,440
And so what that means is that

495
00:24:18,440 --> 00:24:22,660
you can create kind of Harry Potter's Marauders map

496
00:24:23,380 --> 00:24:26,180
of all of the local law enforcement agencies

497
00:24:26,180 --> 00:24:28,440
by simply going down the list and pinging

498
00:24:28,440 --> 00:24:30,220
and setting up a little system

499
00:24:30,220 --> 00:24:32,040
to direction find and triangulate

500
00:24:32,040 --> 00:24:33,100
where they're located.

501
00:24:33,420 --> 00:24:36,040
And you can do that with kind of SDR equipment

502
00:24:36,040 --> 00:24:39,480
and three or four base stations

503
00:24:39,480 --> 00:24:41,400
at regular intervals

504
00:24:41,400 --> 00:24:44,060
and do it infrequently enough,

505
00:24:44,260 --> 00:24:46,560
occupy little enough bandwidth

506
00:24:46,560 --> 00:24:50,520
that nobody is ever going to notice.

507
00:24:51,240 --> 00:24:56,560
Okay, so that is probably more of a threat

508
00:24:56,560 --> 00:24:57,740
for the military users

509
00:24:57,740 --> 00:25:00,740
than it is for the local public safety

510
00:25:00,740 --> 00:25:03,420
because police cars have like markings

511
00:25:03,420 --> 00:25:04,800
that say police on the side

512
00:25:04,800 --> 00:25:06,560
and lights and sirens.

513
00:25:06,680 --> 00:25:07,920
So, you know, where they're located

514
00:25:07,920 --> 00:25:08,920
isn't all that secret.

515
00:25:09,040 --> 00:25:11,600
But military operations are often kind of concerned

516
00:25:11,600 --> 00:25:12,440
with this sort of stuff.

517
00:25:12,700 --> 00:25:14,500
Okay, so denial of service

518
00:25:14,500 --> 00:25:16,220
was kind of the most fun

519
00:25:16,560 --> 00:25:18,060
of the active attacks that we saw.

520
00:25:19,920 --> 00:25:23,700
And so here's basically the idea.

521
00:25:24,060 --> 00:25:27,680
So there's this aggressive error correction going on.

522
00:25:28,320 --> 00:25:31,200
And what that means is every field

523
00:25:31,200 --> 00:25:36,580
of these 1728-bit 180-millisecond frames,

524
00:25:36,900 --> 00:25:40,640
every subfield of that is separately error corrected.

525
00:25:40,900 --> 00:25:43,620
One of those subfields identifies

526
00:25:43,620 --> 00:25:46,340
what kind of packet this is.

527
00:25:46,560 --> 00:25:48,740
One of the types of packets is,

528
00:25:48,840 --> 00:25:50,020
this is a voice frame.

529
00:25:50,300 --> 00:25:55,280
And basically there's four bits encoded over 64 bits

530
00:25:55,280 --> 00:25:57,760
that say, you know, this is a voice frame,

531
00:25:57,880 --> 00:25:58,820
this is a text message,

532
00:25:59,000 --> 00:25:59,880
this is something else.

533
00:26:00,920 --> 00:26:05,620
If the recipient isn't able to decode that frame,

534
00:26:06,000 --> 00:26:07,380
they ignore the rest of it

535
00:26:07,380 --> 00:26:09,300
because it basically tells you

536
00:26:09,300 --> 00:26:10,920
what the meaning of the rest of the frame is

537
00:26:10,920 --> 00:26:12,020
sent toward the beginning.

538
00:26:12,360 --> 00:26:14,620
Now, helpfully, this frame is sent

539
00:26:14,620 --> 00:26:16,500
immediately after a synchronization

540
00:26:16,560 --> 00:26:18,420
frame that tells you,

541
00:26:18,480 --> 00:26:21,300
I'm about to send you this all-important

542
00:26:21,300 --> 00:26:23,840
64-bit error corrected field

543
00:26:24,520 --> 00:26:27,280
that you very definitely want to be able to receive.

544
00:26:27,520 --> 00:26:29,960
So you could, in principle,

545
00:26:30,400 --> 00:26:34,360
you know, jam 32 symbols

546
00:26:34,360 --> 00:26:37,120
out of 864 symbols

547
00:26:37,120 --> 00:26:40,440
and render the entire 864-bit

548
00:26:40,440 --> 00:26:44,120
symbol packet unusable

549
00:26:44,120 --> 00:26:46,480
by the recipient just by selecting

550
00:26:46,560 --> 00:26:47,900
effectively at the right time

551
00:26:48,560 --> 00:26:51,080
transmitting more energy than the recipient

552
00:26:51,080 --> 00:26:53,680
for that brief instant of time.

553
00:26:54,300 --> 00:26:56,360
And, you know, if you do a calculation,

554
00:26:56,520 --> 00:26:58,020
that means the energy use

555
00:26:58,550 --> 00:27:03,980
that you're using compared with the legitimate user

556
00:27:03,980 --> 00:27:06,160
is 14 dBs less

557
00:27:06,160 --> 00:27:10,540
than you're required to communicate.

558
00:27:10,820 --> 00:27:13,480
So this is phenomenally awful

559
00:27:13,480 --> 00:27:16,220
in terms of traffic analysis

560
00:27:16,560 --> 00:27:16,740
and it's incredibly resistant.

561
00:27:17,000 --> 00:27:20,680
And it helpfully provides a synchronization symbol

562
00:27:21,540 --> 00:27:24,000
built in for you to use.

563
00:27:24,320 --> 00:27:27,140
So we really wanted to kind of implement this attack.

564
00:27:27,400 --> 00:27:28,440
And, you know, we were thinking about,

565
00:27:28,520 --> 00:27:29,920
well, how do we implement this?

566
00:27:30,040 --> 00:27:31,800
Well, we're going to have to build some sort of SDR

567
00:27:31,800 --> 00:27:35,520
and we're going to have to load some custom FPGA in there

568
00:27:35,520 --> 00:27:37,400
in order to be able to get the timing right

569
00:27:37,400 --> 00:27:40,760
to decode this synchronization frame.

570
00:27:41,180 --> 00:27:42,840
This is going to be really expensive.

571
00:27:43,120 --> 00:27:45,320
We better ask the NSF for more money

572
00:27:45,320 --> 00:27:48,620
so we can buy, you know, big racks of equipment.

573
00:27:48,820 --> 00:27:50,500
And then Travis came along and said,

574
00:27:50,580 --> 00:27:51,560
oh, I can do that.

575
00:27:52,300 --> 00:27:53,960
And so what Travis did

576
00:27:53,960 --> 00:27:56,760
is he took this little device called a girl tech

577
00:27:59,120 --> 00:28:00,760
IME instant messenger,

578
00:28:00,880 --> 00:28:03,840
which he observed has a chip in it

579
00:28:03,840 --> 00:28:10,020
that does an over-the-air C4FM protocol

580
00:28:10,840 --> 00:28:12,740
similar enough to P25

581
00:28:13,320 --> 00:28:14,840
that it can be abused

582
00:28:15,320 --> 00:28:17,980
into decoding it in real time.

583
00:28:18,440 --> 00:28:21,380
And then he loaded some firmware.

584
00:28:21,500 --> 00:28:24,040
This is the same device that a spectrum analyzer,

585
00:28:24,080 --> 00:28:26,080
he also built a spectrum analyzer out of.

586
00:28:26,440 --> 00:28:28,520
He loaded some firmware into it

587
00:28:28,520 --> 00:28:31,740
to recognize the synchronization train

588
00:28:32,320 --> 00:28:36,820
and transmit well above its designed maximum power

589
00:28:36,820 --> 00:28:40,740
for the few milliseconds required

590
00:28:40,740 --> 00:28:44,620
to jam those 32 symbols at just the right time.

591
00:28:44,620 --> 00:28:46,860
Now, these devices are kind of interesting.

592
00:28:48,300 --> 00:28:50,520
First of all, the chip that you want

593
00:28:50,520 --> 00:28:53,600
is called a TICC1110,

594
00:28:53,800 --> 00:28:57,980
but the chip costs more than these devices do

595
00:28:57,980 --> 00:28:59,540
on the surplus market.

596
00:28:59,680 --> 00:29:03,560
So you can buy these for about $10 a pair on eBay,

597
00:29:03,820 --> 00:29:05,340
although after we give this talk,

598
00:29:05,440 --> 00:29:06,680
the price goes up a little bit,

599
00:29:06,740 --> 00:29:07,960
so, you know, wait a little while.

600
00:29:08,700 --> 00:29:11,400
You can buy these things on eBay.

601
00:29:11,440 --> 00:29:13,780
The development kit with a sample chip

602
00:29:13,780 --> 00:29:14,780
costs about $40,

603
00:29:15,000 --> 00:29:17,640
but you can get two of them for about $10 in these,

604
00:29:17,820 --> 00:29:19,920
and this helpfully comes with a power supply

605
00:29:19,920 --> 00:29:21,720
and a nice purple case.

606
00:29:23,140 --> 00:29:25,600
And so we call it the My First Jammer,

607
00:29:27,680 --> 00:29:31,160
and basically it will look for the synchronization train

608
00:29:31,160 --> 00:29:33,220
on a given channel and transmit.

609
00:29:33,540 --> 00:29:36,920
Now, that's sort of interesting

610
00:29:36,920 --> 00:29:38,500
because this also gives you

611
00:29:38,500 --> 00:29:41,160
about a 20 dB price advantage,

612
00:29:42,620 --> 00:29:43,760
assuming that power supply

613
00:29:43,780 --> 00:29:44,240
is money,

614
00:29:45,140 --> 00:29:47,740
over the legitimate user as well.

615
00:29:47,880 --> 00:29:50,040
The jamming equipment is both low energy

616
00:29:50,040 --> 00:29:53,340
and phenomenally cheaper than this stuff.

617
00:29:53,700 --> 00:29:55,340
And you can imagine sprinkling these

618
00:29:55,340 --> 00:29:56,960
around a metropolitan area.

619
00:29:57,240 --> 00:30:00,420
Ideally, you'd want to put them near the receivers of repeaters

620
00:30:01,080 --> 00:30:03,520
so that they just jam the equipment

621
00:30:03,520 --> 00:30:06,620
so that you can get the maximum energy advantage

622
00:30:06,620 --> 00:30:07,440
that you'd have.

623
00:30:08,040 --> 00:30:11,240
And this would be a fairly economical thing to do.

624
00:30:11,840 --> 00:30:13,420
Don't do this, by the way.

625
00:30:14,320 --> 00:30:17,200
Okay, so that was one thing you could do,

626
00:30:17,260 --> 00:30:19,080
but okay, that just causes havoc.

627
00:30:19,820 --> 00:30:22,160
That might not be...

628
00:30:24,020 --> 00:30:27,060
Turning off your local FBI surveillance

629
00:30:27,060 --> 00:30:29,420
or whatever is one thing,

630
00:30:29,520 --> 00:30:32,960
but another more interesting use of this

631
00:30:32,960 --> 00:30:36,080
might be to train your local law enforcement agency

632
00:30:36,080 --> 00:30:38,260
that encryption doesn't work.

633
00:30:38,680 --> 00:30:43,260
And so rather than just looking for the synchronization train,

634
00:30:43,260 --> 00:30:45,940
what we looked for was the synchronization train

635
00:30:45,940 --> 00:30:48,260
followed by the packet type that says this is encrypted

636
00:30:48,260 --> 00:30:51,540
and only jammed encrypted traffic.

637
00:30:52,020 --> 00:30:54,440
And so you can make...

638
00:30:54,440 --> 00:30:56,680
You can selectively jam

639
00:30:57,260 --> 00:31:00,720
only certain kinds of signals to train users

640
00:31:01,260 --> 00:31:05,400
in various kinds of behavior that you'd like.

641
00:31:05,560 --> 00:31:07,380
Now, we published this paper...

642
00:31:08,080 --> 00:31:09,360
When we published this paper,

643
00:31:09,460 --> 00:31:12,220
kind of an interesting side note,

644
00:31:12,220 --> 00:31:13,020
we published this paper,

645
00:31:13,160 --> 00:31:15,240
and at the same time our paper came out,

646
00:31:15,360 --> 00:31:18,840
Kevin Mitnick's memoir of his life on the run came out.

647
00:31:19,140 --> 00:31:22,460
And apparently, he was back in the old analog days

648
00:31:22,460 --> 00:31:26,140
monitoring the FBI people who were looking for him.

649
00:31:26,360 --> 00:31:30,520
And they had some encrypted radios as well at the time,

650
00:31:30,560 --> 00:31:32,000
although this was before P25,

651
00:31:32,360 --> 00:31:34,320
and he was really annoyed

652
00:31:34,320 --> 00:31:36,000
when they would switch to encrypted mode.

653
00:31:36,200 --> 00:31:39,700
And so he apparently got a walkie-talkie,

654
00:31:39,780 --> 00:31:41,500
and any time he saw encrypted traffic,

655
00:31:41,500 --> 00:31:42,460
he would jam it,

656
00:31:42,600 --> 00:31:45,340
and eventually he would hear them in the clear say,

657
00:31:45,580 --> 00:31:47,060
hey, is it working now?

658
00:31:47,400 --> 00:31:49,300
I don't know, there was something wrong with the switch.

659
00:31:49,820 --> 00:31:55,180
So it turns out we had a sort of parallel discovery

660
00:31:55,180 --> 00:31:56,920
of the same attack,

661
00:31:57,560 --> 00:31:59,720
except that we didn't actually go on the run

662
00:31:59,720 --> 00:32:01,300
and field this, I will point out.

663
00:32:01,740 --> 00:32:04,080
Okay, so how does this work in practice?

664
00:32:04,920 --> 00:32:06,680
Okay, so this symbol

665
00:32:07,240 --> 00:32:11,480
is the symbol on the encryption network

666
00:32:11,500 --> 00:32:11,800
and the encryption switch.

667
00:32:12,320 --> 00:32:14,800
As you can see, it's very obvious what it is.

668
00:32:15,320 --> 00:32:19,020
So, you know, there are some potential usability problems

669
00:32:19,020 --> 00:32:20,100
with these systems.

670
00:32:20,280 --> 00:32:22,180
One is that there's poor feedback

671
00:32:22,180 --> 00:32:24,880
about whether you're encrypted

672
00:32:24,880 --> 00:32:26,800
when you're using the radio.

673
00:32:28,240 --> 00:32:31,940
So basically, the recipient does nothing about this.

674
00:32:32,080 --> 00:32:35,160
The transmitter makes all the decisions,

675
00:32:35,320 --> 00:32:37,920
and whether it is in encrypted mode or not

676
00:32:39,060 --> 00:32:40,340
depends entirely

677
00:32:41,500 --> 00:32:44,200
on a toggle switch on the radio.

678
00:32:44,540 --> 00:32:48,000
And I'll show you what that looks like in a bit.

679
00:32:48,560 --> 00:32:50,520
The second problem is that

680
00:32:51,200 --> 00:32:53,720
the over-the-air re-keying protocol

681
00:32:54,500 --> 00:32:59,640
is used to very frequently re-key sensitive agencies,

682
00:33:00,280 --> 00:33:03,460
because we all know that you're supposed to change

683
00:33:03,460 --> 00:33:05,180
your passwords more frequently

684
00:33:05,180 --> 00:33:06,660
to make them more secure.

685
00:33:06,920 --> 00:33:09,700
And that is also federal practice

686
00:33:09,700 --> 00:33:14,320
for crypto keys for sensitive agencies as well.

687
00:33:14,440 --> 00:33:16,700
And the more sensitive the operation,

688
00:33:16,980 --> 00:33:19,100
the more frequently they're expected to re-key.

689
00:33:21,600 --> 00:33:23,960
Unfortunately, the over-the-air re-keying

690
00:33:23,960 --> 00:33:28,320
is itself, oh, you are the best person on Earth.

691
00:33:28,400 --> 00:33:29,140
Thank you, sir.

692
00:33:33,900 --> 00:33:36,120
This is not vodka, right?

693
00:33:36,880 --> 00:33:37,480
Okay.

694
00:33:37,480 --> 00:33:41,060
Okay, so unfortunately,

695
00:33:41,900 --> 00:33:44,040
the over-the-air re-keying protocol itself

696
00:33:44,040 --> 00:33:46,100
is an unreliable protocol,

697
00:33:46,320 --> 00:33:48,580
and what often happens is

698
00:33:49,420 --> 00:33:52,860
some users re-key to the new key

699
00:33:53,250 --> 00:33:56,180
while other users are left with the old key.

700
00:33:56,280 --> 00:33:58,080
There's no mass synchronization

701
00:33:58,080 --> 00:34:01,200
that causes everybody to switch over at the same instant.

702
00:34:01,780 --> 00:34:04,120
And so if some users have old key material,

703
00:34:04,340 --> 00:34:05,920
some users have new key material,

704
00:34:05,920 --> 00:34:08,100
they can't interoperate with each other.

705
00:34:08,720 --> 00:34:11,840
Now, there was a famous paper

706
00:34:11,840 --> 00:34:16,160
by Alma Witten and Doug Tygar from 1999

707
00:34:16,160 --> 00:34:18,520
called Why Johnny Can't Encrypt.

708
00:34:18,760 --> 00:34:22,160
And the interesting thing is that this paper

709
00:34:22,160 --> 00:34:25,960
made almost exactly the same observations

710
00:34:26,780 --> 00:34:30,420
that we made about P25 radio usability

711
00:34:30,420 --> 00:34:33,100
about PGP email usability.

712
00:34:33,100 --> 00:34:36,120
And, you know, it is almost as if

713
00:34:36,120 --> 00:34:39,420
the designers of the system looked at that paper

714
00:34:39,420 --> 00:34:43,120
and said, well, we can't give them a monopoly

715
00:34:43,120 --> 00:34:44,020
on these mistakes.

716
00:34:44,980 --> 00:34:48,460
You know, we're going to do this ourselves.

717
00:34:48,800 --> 00:34:52,700
So here's the Motorola XTS 5000 radio,

718
00:34:53,260 --> 00:34:57,780
and this is how it is set up in clear mode.

719
00:34:58,100 --> 00:34:59,720
And this is what it looks like

720
00:34:59,720 --> 00:35:01,280
when you're using it in the clear mode.

721
00:35:01,280 --> 00:35:05,960
And, you know, that's what the display looks like,

722
00:35:06,040 --> 00:35:07,740
and that's what the radio looks like.

723
00:35:07,940 --> 00:35:10,020
On the other hand, when it's in secure mode,

724
00:35:10,760 --> 00:35:12,760
that's how you configure it.

725
00:35:13,100 --> 00:35:15,300
Now, what's the difference between those two things?

726
00:35:15,440 --> 00:35:17,120
Well, there are two differences

727
00:35:17,120 --> 00:35:20,020
for those of you who are very sharp-eyed and pedantic.

728
00:35:20,220 --> 00:35:22,640
One is that there's this little circle

729
00:35:22,640 --> 00:35:23,960
with a slash through it

730
00:35:24,580 --> 00:35:26,540
that shows up on the display,

731
00:35:26,780 --> 00:35:29,200
and there's a toggle switch there

732
00:35:29,200 --> 00:35:30,840
with a circle

733
00:35:31,280 --> 00:35:33,040
versus a circle with a slash through it.

734
00:35:33,580 --> 00:35:34,880
Now, the interesting thing is

735
00:35:34,880 --> 00:35:37,560
that there appears to be great disagreement

736
00:35:38,280 --> 00:35:39,260
among the users

737
00:35:39,260 --> 00:35:41,960
about which one of these means encrypted

738
00:35:41,960 --> 00:35:44,600
and which one of these means clear

739
00:35:45,280 --> 00:35:46,840
or what it does at all.

740
00:35:47,100 --> 00:35:48,720
The only precedent I can find

741
00:35:48,720 --> 00:35:50,800
for these exact symbols being used

742
00:35:50,800 --> 00:35:53,980
is car air conditioner vents

743
00:35:53,980 --> 00:35:55,460
for open and close.

744
00:35:56,720 --> 00:35:59,720
But, you know, so the metaphor

745
00:35:59,720 --> 00:36:01,240
appears to be open

746
00:36:01,280 --> 00:36:02,480
versus closed.

747
00:36:03,580 --> 00:36:05,420
But on the one hand,

748
00:36:05,440 --> 00:36:07,240
the circle with the slash through it

749
00:36:07,240 --> 00:36:08,440
might mean don't

750
00:36:09,280 --> 00:36:11,060
versus the open one meaning,

751
00:36:11,160 --> 00:36:12,400
okay, go ahead and do.

752
00:36:12,580 --> 00:36:14,320
And a lot of people have really said,

753
00:36:14,440 --> 00:36:16,160
you know, that's obviously what it means.

754
00:36:16,320 --> 00:36:18,240
Whereas other people think, well, obviously,

755
00:36:18,320 --> 00:36:21,080
this means, you know,

756
00:36:21,080 --> 00:36:23,060
don't means the circle

757
00:36:23,060 --> 00:36:25,180
and the slash through it means do.

758
00:36:25,680 --> 00:36:27,760
And so there's great disagreement

759
00:36:27,760 --> 00:36:28,740
about which is which.

760
00:36:28,860 --> 00:36:30,320
But it doesn't really matter,

761
00:36:31,280 --> 00:36:33,080
because you're talking into

762
00:36:33,080 --> 00:36:34,520
a different part of the radio

763
00:36:34,520 --> 00:36:36,180
and can't see any of these things

764
00:36:36,180 --> 00:36:38,020
when you're actually transmitting.

765
00:36:39,860 --> 00:36:41,440
So what happens?

766
00:36:41,720 --> 00:36:43,740
Well, it becomes very easy

767
00:36:44,280 --> 00:36:46,920
for users of this system

768
00:36:46,920 --> 00:36:50,160
to inadvertently use,

769
00:36:50,240 --> 00:36:52,840
mix clear mode and encryption mode.

770
00:36:53,280 --> 00:36:55,340
And we, you know, it's very easy

771
00:36:55,340 --> 00:36:56,900
for one user to be in the clear

772
00:36:56,900 --> 00:36:58,640
while other users are encrypted.

773
00:36:58,880 --> 00:37:00,620
And if they all have the same key material,

774
00:37:01,280 --> 00:37:03,920
they're communicating quite successfully

775
00:37:04,580 --> 00:37:06,280
when they're doing this,

776
00:37:06,440 --> 00:37:08,920
just with more people than they think they are.

777
00:37:09,460 --> 00:37:11,140
And that happens,

778
00:37:11,240 --> 00:37:13,180
as we will see in a moment,

779
00:37:13,300 --> 00:37:14,540
fairly frequently.

780
00:37:15,080 --> 00:37:17,180
The next problem is this cumbersome re-keying.

781
00:37:17,360 --> 00:37:19,460
The over-the-air re-keying protocol

782
00:37:20,260 --> 00:37:21,460
is unreliable.

783
00:37:21,540 --> 00:37:23,620
Users tend not to have current key material.

784
00:37:24,000 --> 00:37:26,720
And there's no real way to ad hoc re-key

785
00:37:27,120 --> 00:37:27,920
in the field.

786
00:37:28,400 --> 00:37:31,060
And so this is the Motorola

787
00:37:31,280 --> 00:37:31,920
key loader.

788
00:37:32,020 --> 00:37:34,300
It's kind of larger than the radio.

789
00:37:34,900 --> 00:37:37,540
And they're really expensive and cumbersome.

790
00:37:37,660 --> 00:37:39,320
And they erase keys on their own

791
00:37:39,320 --> 00:37:40,900
fairly often.

792
00:37:41,380 --> 00:37:43,440
And you kind of plug it into the radio

793
00:37:43,440 --> 00:37:44,820
to load keys into it.

794
00:37:44,960 --> 00:37:46,000
So that's one way.

795
00:37:46,060 --> 00:37:47,640
The other is with this over-the-air protocol.

796
00:37:47,900 --> 00:37:49,840
So one of the questions we wanted to ask

797
00:37:49,840 --> 00:37:53,780
is we discovered a whole bunch of active attacks

798
00:37:53,780 --> 00:37:56,780
and a whole bunch of passive attacks.

799
00:37:57,080 --> 00:37:59,080
We discovered ways to jam these systems.

800
00:37:59,080 --> 00:38:02,940
We discovered ways to see who is where

801
00:38:02,940 --> 00:38:04,740
by pinging radios.

802
00:38:04,800 --> 00:38:06,320
And we discovered

803
00:38:06,320 --> 00:38:09,040
a number of ways in which encryption

804
00:38:09,040 --> 00:38:10,940
potentially could be turned off.

805
00:38:11,360 --> 00:38:11,840
Now,

806
00:38:13,020 --> 00:38:14,540
I'm old enough

807
00:38:15,030 --> 00:38:15,780
to have

808
00:38:16,770 --> 00:38:20,460
been at the Crypto95 conference

809
00:38:20,460 --> 00:38:21,620
in Santa Barbara.

810
00:38:22,160 --> 00:38:25,420
And Crypto95 was particularly notable.

811
00:38:25,600 --> 00:38:27,160
Crypto is the conference for crypto geeks.

812
00:38:27,260 --> 00:38:28,400
They meet in Santa Barbara.

813
00:38:29,080 --> 00:38:29,700
They're not Las Vegas.

814
00:38:29,880 --> 00:38:31,320
They're smarter than we are.

815
00:38:32,600 --> 00:38:33,840
Every year in August.

816
00:38:33,940 --> 00:38:35,980
And have a big beach barbecue and give talks.

817
00:38:36,280 --> 00:38:37,800
They invited as their keynote speaker

818
00:38:37,800 --> 00:38:39,720
a fellow by the name of Bob Morris.

819
00:38:40,140 --> 00:38:41,400
He used to work at Bell Labs

820
00:38:41,400 --> 00:38:43,540
and then went to work for the National Security Agency.

821
00:38:44,020 --> 00:38:46,080
So it was a kind of big coup

822
00:38:46,080 --> 00:38:48,260
to get him to come and give a public talk

823
00:38:48,260 --> 00:38:49,980
at the crypto conference.

824
00:38:50,440 --> 00:38:51,260
And he said he would

825
00:38:51,260 --> 00:38:53,500
and what he talked about was he said

826
00:38:53,500 --> 00:38:54,700
OK, I'm going to tell you

827
00:38:55,860 --> 00:38:57,140
got up on stage and he said

828
00:38:59,080 --> 00:39:00,600
this is NSA's first rule of cryptanalysis.

829
00:39:00,840 --> 00:39:02,200
And I got out my pen

830
00:39:02,200 --> 00:39:03,540
and everybody said ooh

831
00:39:03,540 --> 00:39:05,380
NSA's first rule of cryptanalysis.

832
00:39:05,540 --> 00:39:07,000
This is going to be good.

833
00:39:07,540 --> 00:39:10,760
This is NSA's first rule of cryptanalysis.

834
00:39:11,080 --> 00:39:12,960
NSA's first rule of cryptanalysis

835
00:39:12,960 --> 00:39:14,200
according to Bob Morris is

836
00:39:14,200 --> 00:39:16,220
first, look for clear text.

837
00:39:17,400 --> 00:39:18,320
And so

838
00:39:19,380 --> 00:39:20,500
we decided

839
00:39:21,040 --> 00:39:21,320
to

840
00:39:22,360 --> 00:39:23,860
take that to heart

841
00:39:23,860 --> 00:39:25,460
and see how successful

842
00:39:25,460 --> 00:39:27,780
a SIGINT operation is

843
00:39:29,080 --> 00:39:30,780
looks out there for SIGINT.

844
00:39:30,900 --> 00:39:32,760
That is to say we decided to build

845
00:39:32,760 --> 00:39:33,780
the wall of sheep

846
00:39:33,780 --> 00:39:36,180
at a large scale.

847
00:39:37,680 --> 00:39:38,320
So

848
00:39:39,040 --> 00:39:41,140
how much

849
00:39:41,140 --> 00:39:42,360
unintended

850
00:39:43,400 --> 00:39:44,040
sensitive

851
00:39:44,960 --> 00:39:46,600
P25 clear text

852
00:39:46,600 --> 00:39:48,600
is there in the field?

853
00:39:49,040 --> 00:39:50,760
So we don't

854
00:39:50,760 --> 00:39:52,540
quite have the resources of NSA

855
00:39:52,840 --> 00:39:54,660
and this was about 2010

856
00:39:54,660 --> 00:39:57,040
that we kind of started to do this.

857
00:39:57,180 --> 00:39:58,820
So we were looking at

858
00:39:59,080 --> 00:40:00,800
2010 technology for our

859
00:40:00,800 --> 00:40:02,820
model. So one question is

860
00:40:02,820 --> 00:40:04,320
how would you build such a thing?

861
00:40:05,020 --> 00:40:07,180
So first of all you'd need to get

862
00:40:07,180 --> 00:40:09,100
some locations to put sensors

863
00:40:09,100 --> 00:40:10,580
to put receivers.

864
00:40:11,320 --> 00:40:12,340
And you know

865
00:40:12,340 --> 00:40:15,040
if you were a national government

866
00:40:15,040 --> 00:40:16,680
you might put them in your embassies

867
00:40:16,680 --> 00:40:18,580
in different places or rent spaces

868
00:40:18,580 --> 00:40:20,840
on towers or what have you.

869
00:40:20,980 --> 00:40:23,040
We just used all of our

870
00:40:23,040 --> 00:40:25,280
friends in as many cities as we could find.

871
00:40:25,520 --> 00:40:26,940
And that basically means

872
00:40:26,940 --> 00:40:28,380
we could find sites in Philadelphia

873
00:40:29,080 --> 00:40:29,600
which is where we are.

874
00:40:29,800 --> 00:40:31,800
And we had one up in New York

875
00:40:31,800 --> 00:40:33,640
and one in central New Jersey

876
00:40:33,640 --> 00:40:35,760
and we had one in Boston for a while

877
00:40:35,760 --> 00:40:37,260
and Chicago for a while

878
00:40:37,260 --> 00:40:39,000
and Berkeley for a while

879
00:40:39,000 --> 00:40:41,040
and so on.

880
00:40:41,120 --> 00:40:42,800
So we just ad hoc picked some

881
00:40:42,800 --> 00:40:45,160
the metropolitan areas that we had friends

882
00:40:45,160 --> 00:40:47,220
who were good enough friends

883
00:40:47,220 --> 00:40:49,100
to say we're going to put this box

884
00:40:49,100 --> 00:40:50,580
with an antenna in your apartment

885
00:40:50,580 --> 00:40:52,100
don't ask any questions

886
00:40:53,720 --> 00:40:55,520
and hook it up to your network.

887
00:40:57,060 --> 00:40:58,220
And you know

888
00:41:00,420 --> 00:41:02,640
we basically built a little

889
00:41:02,640 --> 00:41:04,260
sensor monitoring network

890
00:41:04,260 --> 00:41:07,060
in these various cities.

891
00:41:07,320 --> 00:41:08,440
But now the question is

892
00:41:08,440 --> 00:41:10,200
well what actually should we monitor?

893
00:41:10,620 --> 00:41:12,600
So it turns out

894
00:41:12,600 --> 00:41:13,560
there are two

895
00:41:14,840 --> 00:41:16,040
frequency bands

896
00:41:16,040 --> 00:41:18,160
used by the federal government

897
00:41:18,160 --> 00:41:20,120
we decided to focus specifically

898
00:41:20,120 --> 00:41:22,720
on federal law enforcement users

899
00:41:23,640 --> 00:41:25,700
who are doing sensitive stuff

900
00:41:25,700 --> 00:41:28,360
that is not ever supposed to be

901
00:41:28,360 --> 00:41:29,040
in the clear.

902
00:41:29,080 --> 00:41:31,080
And so

903
00:41:32,220 --> 00:41:34,000
there are a lot of different

904
00:41:34,000 --> 00:41:34,840
federal users

905
00:41:34,840 --> 00:41:36,860
a lot of them are completely

906
00:41:36,860 --> 00:41:37,940
unsensitive.

907
00:41:38,200 --> 00:41:39,680
The post office trucks

908
00:41:39,680 --> 00:41:41,100
have radios in them

909
00:41:41,100 --> 00:41:42,660
and they use those frequency bands.

910
00:41:42,820 --> 00:41:44,060
But those same frequency bands

911
00:41:44,060 --> 00:41:46,800
are also used by Homeland Security

912
00:41:46,800 --> 00:41:48,800
investigations and the Secret Service

913
00:41:48,800 --> 00:41:51,200
and the FBI and the postal inspector

914
00:41:51,200 --> 00:41:52,900
and customs

915
00:41:52,900 --> 00:41:56,060
and all of these other various agencies.

916
00:41:56,320 --> 00:41:57,320
So the first task

917
00:41:59,080 --> 00:42:00,620
is to find out what channels

918
00:42:00,620 --> 00:42:01,860
they're using.

919
00:42:02,060 --> 00:42:04,460
There are about 2,000 discrete channels

920
00:42:04,460 --> 00:42:07,360
allocated exclusively in VHF and UHF

921
00:42:07,360 --> 00:42:08,820
to the federal government.

922
00:42:09,020 --> 00:42:11,920
In the 162 to 174 band

923
00:42:11,920 --> 00:42:15,140
and in the 406 to 420 band.

924
00:42:15,480 --> 00:42:16,580
And you know

925
00:42:16,580 --> 00:42:19,320
12 and a half kilohertz spacing

926
00:42:19,320 --> 00:42:20,700
between them.

927
00:42:20,820 --> 00:42:22,860
A lot of them are not in use

928
00:42:22,860 --> 00:42:24,660
in any given area

929
00:42:24,660 --> 00:42:26,220
a lot of them are used

930
00:42:26,220 --> 00:42:27,480
by non-sensitive agencies

931
00:42:27,480 --> 00:42:28,760
but mixed in there

932
00:42:29,080 --> 00:42:31,280
are some that are used by sensitive agencies.

933
00:42:31,960 --> 00:42:33,020
So today

934
00:42:33,020 --> 00:42:34,860
if we were doing this

935
00:42:34,860 --> 00:42:37,100
what I would do is go and buy

936
00:42:37,100 --> 00:42:38,880
a sort of medium

937
00:42:38,880 --> 00:42:40,280
end SDR

938
00:42:40,280 --> 00:42:42,740
something along the lines of a LIME SDR

939
00:42:42,740 --> 00:42:44,320
get one for each band

940
00:42:45,320 --> 00:42:47,060
conceptually that has enough

941
00:42:47,860 --> 00:42:48,440
output

942
00:42:48,850 --> 00:42:50,420
throughput to be able to

943
00:42:50,850 --> 00:42:52,960
record all of the spectrum

944
00:42:53,980 --> 00:42:54,920
for later

945
00:42:54,920 --> 00:42:55,960
offline analysis

946
00:42:56,850 --> 00:42:58,660
within all of the federal frequency bands.

947
00:42:59,080 --> 00:43:01,260
So in 2010

948
00:43:01,260 --> 00:43:02,560
that wasn't quite true

949
00:43:02,970 --> 00:43:04,980
in 2010 that would require

950
00:43:04,980 --> 00:43:07,500
in the north of $100,000

951
00:43:07,500 --> 00:43:09,180
level SDR equipment

952
00:43:09,180 --> 00:43:11,940
today it's the south of $1,000

953
00:43:11,940 --> 00:43:13,120
levels

954
00:43:13,120 --> 00:43:14,480
would allow you to just record

955
00:43:14,480 --> 00:43:16,340
all of that spectrum

956
00:43:17,080 --> 00:43:18,600
and pick out the P25

957
00:43:18,600 --> 00:43:21,040
signals later for offline analysis.

958
00:43:21,360 --> 00:43:22,760
This was not practical

959
00:43:22,760 --> 00:43:24,120
on our limited budget

960
00:43:24,120 --> 00:43:26,000
because actually by the time

961
00:43:26,000 --> 00:43:28,300
we started doing this all our money had run out.

962
00:43:29,080 --> 00:43:30,260
So we

963
00:43:31,160 --> 00:43:32,840
found that the best

964
00:43:32,840 --> 00:43:34,660
price performance P25

965
00:43:34,660 --> 00:43:36,680
receiver was a

966
00:43:36,680 --> 00:43:37,700
consumer grade

967
00:43:38,870 --> 00:43:40,240
ICOM software

968
00:43:40,240 --> 00:43:41,860
controlled radio

969
00:43:42,930 --> 00:43:45,180
called an R2500

970
00:43:45,180 --> 00:43:46,840
sold to the

971
00:43:46,840 --> 00:43:48,860
hobbyist market and it has a P25

972
00:43:48,860 --> 00:43:50,120
board in it.

973
00:43:50,260 --> 00:43:52,760
So it's not an SDR but it is a software

974
00:43:52,760 --> 00:43:54,300
controllable radio

975
00:43:54,300 --> 00:43:56,820
that has a remarkably

976
00:43:56,820 --> 00:43:58,320
good RF front end.

977
00:43:59,080 --> 00:44:01,120
For our purposes in our frequency band.

978
00:44:01,260 --> 00:44:03,200
And so the first thing we did

979
00:44:03,200 --> 00:44:05,020
was we configured this

980
00:44:05,020 --> 00:44:05,980
to

981
00:44:07,380 --> 00:44:09,240
identify every channel

982
00:44:09,240 --> 00:44:11,160
with encrypted traffic on it.

983
00:44:11,340 --> 00:44:12,880
Why did we want

984
00:44:12,880 --> 00:44:14,440
encrypted traffic? Because

985
00:44:14,440 --> 00:44:16,820
those are the channels that

986
00:44:16,820 --> 00:44:19,040
have the sensitive operations on them.

987
00:44:19,620 --> 00:44:20,920
And then

988
00:44:20,920 --> 00:44:22,960
so we actually put

989
00:44:22,960 --> 00:44:24,320
two of these in each location.

990
00:44:24,620 --> 00:44:27,080
One scanning looking for encrypted traffic

991
00:44:27,080 --> 00:44:29,060
on frequencies we don't know about

992
00:44:29,080 --> 00:44:30,840
and another recording

993
00:44:30,840 --> 00:44:32,280
all traffic and metadata

994
00:44:32,800 --> 00:44:35,140
on every channel that we did know about

995
00:44:35,140 --> 00:44:36,760
and that would allow us to not miss

996
00:44:36,760 --> 00:44:39,080
very much. So this two receiver

997
00:44:39,080 --> 00:44:40,560
configuration although a bit

998
00:44:40,840 --> 00:44:43,040
clunky and suboptimal by modern standards

999
00:44:43,040 --> 00:44:45,040
effectively would allow us

1000
00:44:45,040 --> 00:44:46,960
within a few weeks to discover

1001
00:44:46,960 --> 00:44:49,120
a large fraction of the

1002
00:44:49,120 --> 00:44:50,880
channels used for sensitive

1003
00:44:50,880 --> 00:44:53,000
things and then record

1004
00:44:53,000 --> 00:44:54,840
basically all the metadata and

1005
00:44:54,840 --> 00:44:56,200
unencrypted voice traffic

1006
00:44:56,200 --> 00:44:57,440
that appears

1007
00:44:59,080 --> 00:45:00,820
on them. Okay so

1008
00:45:00,820 --> 00:45:02,040
what did we discover?

1009
00:45:03,080 --> 00:45:04,540
So basically

1010
00:45:04,630 --> 00:45:06,580
what we discovered was that

1011
00:45:06,580 --> 00:45:09,020
with the exception

1012
00:45:09,020 --> 00:45:10,000
of

1013
00:45:10,790 --> 00:45:12,120
one agency

1014
00:45:13,080 --> 00:45:14,820
and I'll

1015
00:45:14,820 --> 00:45:17,080
leave you to wonder what agency that was

1016
00:45:17,080 --> 00:45:18,300
every

1017
00:45:18,970 --> 00:45:20,740
federal law enforcement

1018
00:45:20,740 --> 00:45:23,180
agency engaged in sensitive

1019
00:45:23,180 --> 00:45:23,840
operations

1020
00:45:24,730 --> 00:45:25,220
has

1021
00:45:27,020 --> 00:45:28,000
some

1022
00:45:29,080 --> 00:45:30,520
unintentionally clear

1023
00:45:30,740 --> 00:45:31,260
traffic

1024
00:45:31,260 --> 00:45:33,240
every day.

1025
00:45:34,040 --> 00:45:36,760
And sometimes it's

1026
00:45:36,760 --> 00:45:37,980
entirely clear

1027
00:45:37,980 --> 00:45:41,020
and sometimes it's clear mixed in

1028
00:45:41,020 --> 00:45:41,800
with

1029
00:45:42,660 --> 00:45:43,180
encrypted.

1030
00:45:43,540 --> 00:45:45,800
And invariably

1031
00:45:45,800 --> 00:45:48,000
the clear guy

1032
00:45:48,580 --> 00:45:50,740
would be the one who has the

1033
00:45:50,740 --> 00:45:52,620
transmissions along the lines of

1034
00:45:52,620 --> 00:45:54,840
okay everyone here's the plan.

1035
00:45:55,720 --> 00:45:58,940
And so okay everyone

1036
00:45:59,080 --> 00:46:00,100
here's the plan

1037
00:46:00,100 --> 00:46:02,380
was one of the most common things

1038
00:46:02,380 --> 00:46:04,540
that we would record along

1039
00:46:04,900 --> 00:46:06,720
with alright I'm in

1040
00:46:06,720 --> 00:46:07,980
encrypted mode now.

1041
00:46:10,000 --> 00:46:10,640
So

1042
00:46:11,860 --> 00:46:14,120
we would actually hear that and

1043
00:46:14,120 --> 00:46:16,180
if I were

1044
00:46:16,180 --> 00:46:18,640
less discreet than I am I would have

1045
00:46:18,640 --> 00:46:20,060
brought a greatest hits tape

1046
00:46:20,060 --> 00:46:20,760
of

1047
00:46:22,180 --> 00:46:24,200
those things. See me later.

1048
00:46:25,480 --> 00:46:26,700
Okay we would

1049
00:46:26,700 --> 00:46:29,060
get an average of about 30 minutes a day.

1050
00:46:29,080 --> 00:46:30,260
per agency

1051
00:46:30,260 --> 00:46:32,760
per metropolitan area

1052
00:46:32,760 --> 00:46:34,400
of just unintentionally

1053
00:46:34,720 --> 00:46:36,880
clear traffic. So how sensitive is

1054
00:46:36,880 --> 00:46:38,900
sensitive? What did we

1055
00:46:38,900 --> 00:46:40,480
discover? Well we

1056
00:46:40,900 --> 00:46:42,780
actually found kind of some of the

1057
00:46:42,780 --> 00:46:44,600
most sensitive stuff you could

1058
00:46:44,600 --> 00:46:46,700
imagine. So we would get

1059
00:46:46,700 --> 00:46:48,860
the names

1060
00:46:48,860 --> 00:46:50,860
and other identifying

1061
00:46:50,860 --> 00:46:52,860
features not only

1062
00:46:52,860 --> 00:46:54,340
of the targets of surveillance

1063
00:46:54,780 --> 00:46:56,740
but also of things like confidential

1064
00:46:56,740 --> 00:46:58,900
informants. So

1065
00:46:59,080 --> 00:47:00,840
we would hear

1066
00:47:00,840 --> 00:47:02,880
I've got Jose with me right

1067
00:47:02,880 --> 00:47:04,960
now. He's going to go and talk to

1068
00:47:04,960 --> 00:47:06,920
the target. You'll know him because

1069
00:47:06,920 --> 00:47:09,080
he's going to be the guy wearing the white hat

1070
00:47:09,080 --> 00:47:09,660
and

1071
00:47:10,500 --> 00:47:12,280
that sort of thing. So

1072
00:47:13,000 --> 00:47:14,900
that's kind of useful information if you're

1073
00:47:14,900 --> 00:47:16,420
the target and

1074
00:47:16,920 --> 00:47:18,180
not so great for Jose

1075
00:47:19,380 --> 00:47:20,340
if somebody

1076
00:47:20,340 --> 00:47:22,900
picks that up. We would

1077
00:47:22,900 --> 00:47:24,720
frequently get and

1078
00:47:24,720 --> 00:47:26,960
it was kind of like having your own private

1079
00:47:26,960 --> 00:47:28,680
version of the TV show The Wire

1080
00:47:29,080 --> 00:47:31,020
which was still on that time. We would

1081
00:47:31,020 --> 00:47:32,880
get the wire tap

1082
00:47:32,880 --> 00:47:35,020
plant that was set up to look at

1083
00:47:35,020 --> 00:47:37,180
a target would often set up a radio

1084
00:47:37,180 --> 00:47:38,960
base station and kind of broadcast

1085
00:47:38,960 --> 00:47:40,640
out a summary of

1086
00:47:40,640 --> 00:47:43,000
what's going on on the wire tap of the

1087
00:47:43,000 --> 00:47:44,660
target. So we would hear

1088
00:47:44,660 --> 00:47:47,000
the target has just gotten a phone call from

1089
00:47:47,000 --> 00:47:48,700
my favorite was

1090
00:47:48,700 --> 00:47:50,720
an operation in which

1091
00:47:51,880 --> 00:47:52,780
there was a

1092
00:47:52,780 --> 00:47:54,840
the target of the attack was named

1093
00:47:54,840 --> 00:47:57,000
some name like we'll call him

1094
00:47:57,000 --> 00:47:58,760
Bobby but he was

1095
00:47:59,080 --> 00:48:00,840
fencing stuff

1096
00:48:00,840 --> 00:48:02,900
that he was buying with stolen credit cards

1097
00:48:02,900 --> 00:48:05,000
and this was a large carding operation

1098
00:48:05,000 --> 00:48:06,620
and his fence

1099
00:48:06,620 --> 00:48:08,960
was named Louie

1100
00:48:08,960 --> 00:48:11,000
the fence which is like the

1101
00:48:11,000 --> 00:48:12,760
worst criminal name ever but

1102
00:48:12,760 --> 00:48:13,580
the

1103
00:48:15,600 --> 00:48:16,900
so you know

1104
00:48:16,900 --> 00:48:18,380
we would hear the ongoing

1105
00:48:19,040 --> 00:48:20,860
narrative of what was going on on the

1106
00:48:20,860 --> 00:48:22,880
target's wire tap quite frequently.

1107
00:48:23,100 --> 00:48:25,020
Body wires were

1108
00:48:25,020 --> 00:48:27,080
often so when they would wire up

1109
00:48:27,080 --> 00:48:28,980
an informant the audio from

1110
00:48:29,080 --> 00:48:30,940
an audio body wire would often be

1111
00:48:30,940 --> 00:48:32,520
sent over a local

1112
00:48:32,860 --> 00:48:34,960
tactical repeater more often

1113
00:48:34,960 --> 00:48:36,520
than not in clear mode

1114
00:48:36,800 --> 00:48:38,700
as well as traffic

1115
00:48:39,640 --> 00:48:40,280
for

1116
00:48:42,400 --> 00:48:44,300
things like protective details

1117
00:48:44,800 --> 00:48:46,740
of dignitaries

1118
00:48:46,740 --> 00:48:48,460
going all the way up to the president

1119
00:48:48,460 --> 00:48:50,940
so secret service and state department

1120
00:48:50,940 --> 00:48:52,260
protective operations

1121
00:48:52,960 --> 00:48:54,820
so you know we would you know one of the

1122
00:48:54,820 --> 00:48:56,320
interesting things is that during

1123
00:48:56,320 --> 00:48:58,920
the presidential

1124
00:48:59,080 --> 00:49:00,800
conventions we would know the code

1125
00:49:00,800 --> 00:49:01,680
names of the

1126
00:49:01,680 --> 00:49:04,820
candidates before they would get

1127
00:49:04,820 --> 00:49:06,600
leaked to the news media so

1128
00:49:06,600 --> 00:49:08,600
you know we would get a couple

1129
00:49:08,600 --> 00:49:10,980
secret service would start using them a few days

1130
00:49:10,980 --> 00:49:12,940
after a few days before they got made

1131
00:49:12,940 --> 00:49:14,880
public so that was

1132
00:49:14,880 --> 00:49:16,980
you know that was sort of entertaining but

1133
00:49:16,980 --> 00:49:18,860
we would also learn like where they were moving

1134
00:49:18,860 --> 00:49:20,900
to and what the plan was and so

1135
00:49:20,900 --> 00:49:23,080
forth so we would really

1136
00:49:23,080 --> 00:49:25,080
hear a lot of kind of some of the

1137
00:49:25,080 --> 00:49:26,660
most sensitive stuff ever

1138
00:49:26,660 --> 00:49:28,620
the interesting thing is we would

1139
00:49:29,080 --> 00:49:30,960
and it was easy to identify what

1140
00:49:30,960 --> 00:49:32,820
agency was what because we could

1141
00:49:32,820 --> 00:49:35,080
direction find to where it was and also

1142
00:49:35,080 --> 00:49:37,020
different agencies would be assigned

1143
00:49:37,020 --> 00:49:39,020
different blocks of user

1144
00:49:39,020 --> 00:49:40,620
IDs so we could use the

1145
00:49:40,620 --> 00:49:43,100
metadata to determine what agency

1146
00:49:43,100 --> 00:49:44,980
was operating on a

1147
00:49:44,980 --> 00:49:46,920
different channel because that's coordinated

1148
00:49:46,920 --> 00:49:48,820
across the entire federal government

1149
00:49:48,820 --> 00:49:49,880
and

1150
00:49:51,020 --> 00:49:53,180
interestingly there was one agency

1151
00:49:53,180 --> 00:49:54,400
that we have never

1152
00:49:54,980 --> 00:49:56,720
collected a single

1153
00:49:56,720 --> 00:49:58,340
clear transmission from

1154
00:49:59,080 --> 00:50:01,000
any I guess I've told

1155
00:50:01,000 --> 00:50:02,620
some people this but any idea

1156
00:50:03,580 --> 00:50:04,940
no actually the

1157
00:50:04,940 --> 00:50:06,920
CIA well the

1158
00:50:06,920 --> 00:50:08,940
CIA doesn't operate covertly within

1159
00:50:08,940 --> 00:50:11,080
the United States but the security

1160
00:50:11,080 --> 00:50:12,560
guards at CIA headquarters

1161
00:50:13,080 --> 00:50:14,540
do and

1162
00:50:14,940 --> 00:50:16,220
interestingly if you

1163
00:50:17,080 --> 00:50:18,820
if your car

1164
00:50:18,820 --> 00:50:20,740
runs out of battery in the CIA

1165
00:50:20,740 --> 00:50:22,800
parking lot they will help the

1166
00:50:22,800 --> 00:50:24,360
security guards will helpfully

1167
00:50:25,300 --> 00:50:26,920
jump your car for

1168
00:50:26,920 --> 00:50:29,060
you but they'll also read your license plate

1169
00:50:29,080 --> 00:50:30,920
out over their unencrypted

1170
00:50:30,920 --> 00:50:33,060
channel so no not the CIA

1171
00:50:34,220 --> 00:50:34,740
yeah

1172
00:50:36,060 --> 00:50:36,860
ATF is

1173
00:50:37,940 --> 00:50:38,980
very entertaining

1174
00:50:41,460 --> 00:50:41,980
the

1175
00:50:44,340 --> 00:50:45,380
the postal

1176
00:50:45,380 --> 00:50:45,820
inspector

1177
00:50:48,040 --> 00:50:49,100
don't mess with

1178
00:50:49,100 --> 00:50:49,900
the postal inspector

1179
00:50:51,000 --> 00:50:52,500
they know what they're doing

1180
00:50:52,500 --> 00:50:54,800
on encrypted radios and I actually was

1181
00:50:54,800 --> 00:50:56,940
wondering about this and I found out and I asked a friend

1182
00:50:56,940 --> 00:50:58,780
of mine who runs the radio system for

1183
00:50:59,080 --> 00:50:59,760
the police department he said

1184
00:50:59,760 --> 00:51:02,960
and he said oh yeah I met the radio

1185
00:51:02,960 --> 00:51:04,740
guy for the postal

1186
00:51:04,740 --> 00:51:06,800
inspector and he was just this

1187
00:51:06,800 --> 00:51:08,480
encryption fanatic and he

1188
00:51:09,080 --> 00:51:11,080
basically anytime they would get a radio

1189
00:51:11,080 --> 00:51:12,760
he would take some super glue

1190
00:51:12,760 --> 00:51:15,040
and glue the encryption switch

1191
00:51:15,040 --> 00:51:16,940
into the encrypted position

1192
00:51:16,940 --> 00:51:18,560
and apparently

1193
00:51:19,050 --> 00:51:19,420
that

1194
00:51:20,920 --> 00:51:22,900
continues to this day

1195
00:51:22,900 --> 00:51:24,920
and that's why the

1196
00:51:24,920 --> 00:51:27,140
postal inspector's office

1197
00:51:27,140 --> 00:51:28,820
don't mess with them

1198
00:51:29,860 --> 00:51:30,900
they're serious

1199
00:51:30,900 --> 00:51:32,460
okay so we found

1200
00:51:32,460 --> 00:51:34,820
basically what's going on we found basically

1201
00:51:34,820 --> 00:51:36,940
there are kind of three classes of

1202
00:51:38,000 --> 00:51:38,520
mistakes

1203
00:51:38,900 --> 00:51:40,860
going on here one is the kind of single

1204
00:51:40,860 --> 00:51:43,000
user error where the switch

1205
00:51:43,000 --> 00:51:44,980
is just in the wrong position for one user

1206
00:51:44,980 --> 00:51:47,020
in a group and invariably it's

1207
00:51:47,020 --> 00:51:48,300
the okay here's the plan guy

1208
00:51:49,100 --> 00:51:49,620
but

1209
00:51:51,680 --> 00:51:52,920
somebody is transmitting

1210
00:51:52,920 --> 00:51:55,060
part of the operation there's also

1211
00:51:55,060 --> 00:51:56,320
kind of a group error

1212
00:51:56,320 --> 00:51:57,900
where you have this

1213
00:51:59,080 --> 00:52:00,700
incorrect information about

1214
00:52:00,700 --> 00:52:02,560
what the encryption switch means

1215
00:52:03,080 --> 00:52:04,180
and what it doesn't

1216
00:52:05,380 --> 00:52:06,680
and you know

1217
00:52:06,680 --> 00:52:08,740
or nobody notices that they weren't

1218
00:52:08,740 --> 00:52:10,720
and then finally you have the keying

1219
00:52:10,720 --> 00:52:12,960
failure problem where a bunch of

1220
00:52:12,960 --> 00:52:14,760
users in a group have one key

1221
00:52:14,760 --> 00:52:16,820
a bunch have another key and the only

1222
00:52:16,820 --> 00:52:18,840
way they can all interoperate is to

1223
00:52:18,840 --> 00:52:20,880
switch to the clear because they're out

1224
00:52:20,880 --> 00:52:23,020
of sync on their key material

1225
00:52:23,020 --> 00:52:24,760
and we found that these

1226
00:52:24,760 --> 00:52:26,260
three categories of

1227
00:52:26,880 --> 00:52:28,800
when we would sample what was going on

1228
00:52:29,080 --> 00:52:30,480
it was roughly a third each

1229
00:52:30,940 --> 00:52:32,460
of these

1230
00:52:32,460 --> 00:52:35,980
of each of these things

1231
00:52:37,560 --> 00:52:38,840
and what's

1232
00:52:38,840 --> 00:52:40,440
interesting is that

1233
00:52:40,440 --> 00:52:42,980
if you go back to the standards

1234
00:52:42,980 --> 00:52:44,680
people and

1235
00:52:44,680 --> 00:52:46,840
say you know here's what we discovered about

1236
00:52:46,840 --> 00:52:48,720
this they'd say well great

1237
00:52:48,720 --> 00:52:50,820
it's all working properly right

1238
00:52:50,820 --> 00:52:52,900
because the standard

1239
00:52:53,720 --> 00:52:54,360
is

1240
00:52:55,080 --> 00:52:56,360
working according to spec

1241
00:52:56,840 --> 00:52:58,920
if you go to the radio vendor they say

1242
00:52:59,080 --> 00:53:00,960
we built radios according to the standard

1243
00:53:00,960 --> 00:53:02,660
and if you go

1244
00:53:02,660 --> 00:53:04,380
to the user community

1245
00:53:04,820 --> 00:53:06,640
you know they say well

1246
00:53:06,640 --> 00:53:08,860
these are the radios that we're able to buy

1247
00:53:08,860 --> 00:53:10,860
and if they have usability

1248
00:53:10,860 --> 00:53:12,940
problems you know this is what we're stuck

1249
00:53:12,940 --> 00:53:14,660
with we have no real control

1250
00:53:14,660 --> 00:53:16,960
over what the standard is

1251
00:53:16,960 --> 00:53:19,040
so this effectively ends

1252
00:53:19,040 --> 00:53:20,340
up being nobody's fault

1253
00:53:20,340 --> 00:53:22,380
which is familiar in

1254
00:53:22,820 --> 00:53:24,800
many security problems

1255
00:53:24,800 --> 00:53:26,460
okay so

1256
00:53:26,460 --> 00:53:26,900
um

1257
00:53:29,080 --> 00:53:30,560
the you know a couple of

1258
00:53:30,560 --> 00:53:31,860
you know kind of observation

1259
00:53:32,900 --> 00:53:34,700
this was a great

1260
00:53:34,700 --> 00:53:36,640
example of things

1261
00:53:36,640 --> 00:53:39,020
security being grafted on

1262
00:53:39,020 --> 00:53:41,340
later with compromises

1263
00:53:41,340 --> 00:53:42,840
from the beginning with

1264
00:53:42,840 --> 00:53:44,620
very predictable consequences

1265
00:53:44,620 --> 00:53:45,900
um

1266
00:53:45,900 --> 00:53:48,840
the um we're seeing

1267
00:53:48,840 --> 00:53:50,880
actually to this day our sensors are

1268
00:53:50,880 --> 00:53:53,000
still in most of our cities the sensors

1269
00:53:53,000 --> 00:53:54,900
are still running and what

1270
00:53:54,900 --> 00:53:56,640
we've seen is that I've gone

1271
00:53:56,640 --> 00:53:58,780
to every federal agency

1272
00:53:59,080 --> 00:54:01,260
that we're seeing sensitive

1273
00:54:01,260 --> 00:54:03,260
clear traffic to I've spoken

1274
00:54:03,260 --> 00:54:05,200
to some

1275
00:54:05,200 --> 00:54:06,980
senior person in charge of their

1276
00:54:06,980 --> 00:54:08,880
communication system which by the way

1277
00:54:08,880 --> 00:54:11,040
those are meetings which are really

1278
00:54:11,040 --> 00:54:12,380
fun to set up

1279
00:54:13,080 --> 00:54:14,700
you know when you call a

1280
00:54:14,700 --> 00:54:16,460
federal law enforcement agency

1281
00:54:17,040 --> 00:54:19,100
with lots of body armor and machine

1282
00:54:19,100 --> 00:54:21,060
guns and handcuffs and you try

1283
00:54:21,060 --> 00:54:23,040
to tell them that there's a mistake that they're making

1284
00:54:23,040 --> 00:54:25,000
it's helpful to have friends introduce

1285
00:54:25,000 --> 00:54:26,880
you um but

1286
00:54:26,880 --> 00:54:29,000
so you know I go to those meetings with some

1287
00:54:29,080 --> 00:54:30,360
trepidation but they're actually

1288
00:54:31,100 --> 00:54:33,120
very receptive to that

1289
00:54:33,120 --> 00:54:34,940
um but what I found

1290
00:54:34,940 --> 00:54:37,020
is that every time I you know when I

1291
00:54:37,020 --> 00:54:38,960
meet with an agency and discuss what

1292
00:54:38,960 --> 00:54:40,920
their real problems are and you know playing the

1293
00:54:40,920 --> 00:54:42,900
audio is very helpful in driving

1294
00:54:42,900 --> 00:54:44,940
home um some of

1295
00:54:44,940 --> 00:54:46,060
some of these things

1296
00:54:46,660 --> 00:54:48,960
um and in fact I remember one conversation

1297
00:54:48,960 --> 00:54:51,000
in which I was talking to an agent

1298
00:54:51,000 --> 00:54:53,080
and you know I was able to tell

1299
00:54:53,080 --> 00:54:54,780
her how she likes her coffee

1300
00:54:54,780 --> 00:54:56,320
um because

1301
00:54:56,980 --> 00:54:58,860
I've heard one of somebody getting coffee

1302
00:54:59,080 --> 00:55:00,540
for her during a surveillance operation

1303
00:55:01,060 --> 00:55:02,820
um the you know those

1304
00:55:02,820 --> 00:55:04,760
those you know that gets

1305
00:55:04,760 --> 00:55:06,940
driven home and what we found is that we

1306
00:55:06,940 --> 00:55:09,120
would see clear text go way down

1307
00:55:09,120 --> 00:55:11,040
for about two weeks

1308
00:55:11,040 --> 00:55:13,020
uh after um

1309
00:55:13,020 --> 00:55:15,000
we would talk to them and then interestingly

1310
00:55:15,000 --> 00:55:17,200
it would go up to a higher

1311
00:55:17,200 --> 00:55:18,420
level than we had seen

1312
00:55:18,940 --> 00:55:20,580
before why is that

1313
00:55:20,580 --> 00:55:22,800
well as far as I can tell it's that you know

1314
00:55:22,800 --> 00:55:24,560
the message goes out of exactly

1315
00:55:24,800 --> 00:55:27,040
what to do uh and

1316
00:55:27,040 --> 00:55:28,920
then um that

1317
00:55:29,080 --> 00:55:31,140
message gets a little bit garbled

1318
00:55:31,140 --> 00:55:32,960
over time and what people remember

1319
00:55:32,960 --> 00:55:35,060
is pay extra attention to

1320
00:55:35,060 --> 00:55:36,800
the position of that

1321
00:55:36,800 --> 00:55:38,020
mysterious switch

1322
00:55:38,020 --> 00:55:40,720
uh but they don't remember which position

1323
00:55:40,720 --> 00:55:42,800
it's supposed to be in um and

1324
00:55:42,800 --> 00:55:44,940
or they rekey more frequently

1325
00:55:44,940 --> 00:55:46,580
which has the effect of

1326
00:55:46,580 --> 00:55:49,000
taking making people go out of

1327
00:55:49,000 --> 00:55:50,820
sync more frequently um

1328
00:55:50,820 --> 00:55:52,780
and so um you know

1329
00:55:52,780 --> 00:55:55,040
these are really fundamental problems that

1330
00:55:55,040 --> 00:55:57,240
are easy to blame on the user

1331
00:55:57,240 --> 00:55:58,860
but um

1332
00:55:59,080 --> 00:56:00,760
aren't actually

1333
00:56:00,760 --> 00:56:02,660
you know but that would be a terrible mistake

1334
00:56:02,660 --> 00:56:04,980
um you know that would be a cop

1335
00:56:04,980 --> 00:56:06,860
out on the part of the

1336
00:56:06,860 --> 00:56:08,880
technology design uh

1337
00:56:08,880 --> 00:56:11,120
of these that they've made a system that's so much

1338
00:56:11,120 --> 00:56:12,860
easier to use or to

1339
00:56:12,860 --> 00:56:15,180
misuse than to uh than to use

1340
00:56:15,180 --> 00:56:17,120
um so you know

1341
00:56:17,120 --> 00:56:19,140
we've developed some mitigation strategies

1342
00:56:19,140 --> 00:56:21,080
uh for them you know

1343
00:56:21,080 --> 00:56:22,780
which which you know a kind of some

1344
00:56:22,780 --> 00:56:24,720
set of better practices

1345
00:56:24,720 --> 00:56:26,860
if not best practices but really

1346
00:56:26,860 --> 00:56:27,900
the protocol itself

1347
00:56:29,080 --> 00:56:30,240
needs to be and the usability

1348
00:56:30,800 --> 00:56:32,660
needs to be redesigned from scratch

1349
00:56:32,660 --> 00:56:34,260
so I also

1350
00:56:34,900 --> 00:56:36,620
spent some time working

1351
00:56:36,620 --> 00:56:38,900
with the P25 standards people

1352
00:56:38,900 --> 00:56:40,660
and you know as

1353
00:56:40,660 --> 00:56:42,060
receptive as

1354
00:56:42,060 --> 00:56:44,380
the federal agencies were

1355
00:56:44,780 --> 00:56:46,640
um this was a remarkably

1356
00:56:46,640 --> 00:56:49,020
different experience so I

1357
00:56:49,020 --> 00:56:50,840
had you know I had gone to a number of

1358
00:56:50,840 --> 00:56:52,960
federal law enforcement agencies spoke to them

1359
00:56:52,960 --> 00:56:54,860
about you know what some of our findings were

1360
00:56:54,860 --> 00:56:56,800
um and you know

1361
00:56:56,800 --> 00:56:58,920
everybody was very interested and you know

1362
00:56:59,080 --> 00:57:00,900
at least trying to fix the problem

1363
00:57:00,900 --> 00:57:02,720
and then I took a trip down to

1364
00:57:02,720 --> 00:57:04,760
uh uh to

1365
00:57:04,760 --> 00:57:06,980
uh Charleston

1366
00:57:06,980 --> 00:57:09,020
to the meeting of

1367
00:57:09,020 --> 00:57:10,640
the P25 security

1368
00:57:10,640 --> 00:57:12,860
working group um which

1369
00:57:12,860 --> 00:57:14,680
consisted basically of vendors

1370
00:57:14,680 --> 00:57:17,080
and a few assorted

1371
00:57:17,080 --> 00:57:18,740
others and

1372
00:57:18,740 --> 00:57:21,100
um the um first thing

1373
00:57:21,100 --> 00:57:23,100
is I spoke to some of the federal representatives

1374
00:57:23,100 --> 00:57:24,820
and I said you know these

1375
00:57:24,820 --> 00:57:26,340
protocols when I looked at them

1376
00:57:26,340 --> 00:57:28,740
it kinda looked as if there was

1377
00:57:29,080 --> 00:57:30,900
somebody from the NSA in the room

1378
00:57:30,900 --> 00:57:32,600
for the first two meetings

1379
00:57:32,600 --> 00:57:34,520
and then they stopped showing up

1380
00:57:34,800 --> 00:57:37,020
because all of the language of the standard

1381
00:57:37,020 --> 00:57:39,220
has words that kind of

1382
00:57:39,220 --> 00:57:39,940
look like

1383
00:57:39,940 --> 00:57:42,760
um good crypto speak

1384
00:57:42,760 --> 00:57:45,100
they talk about key material and they talk about

1385
00:57:45,100 --> 00:57:46,660
initialization vectors and it's all

1386
00:57:46,660 --> 00:57:48,800
it's got all the right Greek letters and

1387
00:57:48,800 --> 00:57:50,900
everything is um looks pretty good

1388
00:57:50,900 --> 00:57:52,240
but then everything is

1389
00:57:52,940 --> 00:57:54,920
just being used a little bit

1390
00:57:54,920 --> 00:57:56,340
wrong and they said oh yeah

1391
00:57:56,820 --> 00:57:59,000
that's actually exactly what happened he died

1392
00:57:59,080 --> 00:58:00,980
um and

1393
00:58:00,980 --> 00:58:03,020
um you know I mean that's very

1394
00:58:03,020 --> 00:58:05,120
sad um but it's

1395
00:58:05,120 --> 00:58:06,780
also very sad for the uh

1396
00:58:06,780 --> 00:58:08,920
design of the protocol itself

1397
00:58:08,920 --> 00:58:10,820
um and basically

1398
00:58:10,820 --> 00:58:13,100
was never replaced so they were kinda left

1399
00:58:13,100 --> 00:58:14,260
going on their own

1400
00:58:14,260 --> 00:58:16,560
the standards group itself consists

1401
00:58:16,880 --> 00:58:17,900
chiefly of vendors

1402
00:58:17,900 --> 00:58:20,220
and mostly

1403
00:58:20,220 --> 00:58:23,040
uh the meeting that I had with

1404
00:58:23,040 --> 00:58:25,000
them consisted of the first hour

1405
00:58:25,000 --> 00:58:27,120
and a half of them taking turns

1406
00:58:27,120 --> 00:58:28,180
introducing themselves

1407
00:58:29,080 --> 00:58:30,640
and telling me how utterly stupid

1408
00:58:30,640 --> 00:58:33,060
and off base I was and how none of this

1409
00:58:33,060 --> 00:58:34,940
is a problem and by the way you don't

1410
00:58:34,940 --> 00:58:35,960
understand decibels

1411
00:58:35,960 --> 00:58:39,000
um and um it was

1412
00:58:39,000 --> 00:58:40,880
incredibly so they would go one

1413
00:58:40,880 --> 00:58:43,020
after the other and just tell me

1414
00:58:43,020 --> 00:58:44,820
how utterly terrible it was

1415
00:58:44,820 --> 00:58:47,120
and how awful it was and oh and by the way

1416
00:58:47,120 --> 00:58:48,960
you know you're immoral because you're

1417
00:58:48,960 --> 00:58:50,180
making us look stupid

1418
00:58:50,180 --> 00:58:52,880
um and uh and so on

1419
00:58:52,880 --> 00:58:54,640
so it was a very very unproductive start

1420
00:58:54,640 --> 00:58:57,000
and then of course we retreat

1421
00:58:57,000 --> 00:58:58,740
to the bar and

1422
00:58:59,080 --> 00:59:00,460
that's where all the kind of interesting

1423
00:59:00,460 --> 00:59:02,840
uh work got done and so there's

1424
00:59:02,840 --> 00:59:04,740
there's some hope of

1425
00:59:04,740 --> 00:59:06,340
maybe the next generation

1426
00:59:06,340 --> 00:59:08,840
it won't be called P26 because they

1427
00:59:08,840 --> 00:59:10,380
apparently don't go by ones

1428
00:59:10,380 --> 00:59:13,020
so you know when they come up with P45

1429
00:59:13,780 --> 00:59:14,920
there's a chance that

1430
00:59:14,920 --> 00:59:16,320
there'll be a clean slate

1431
00:59:16,320 --> 00:59:19,020
but it looks as if this particular standard

1432
00:59:19,020 --> 00:59:20,980
is kind of set in stone

1433
00:59:20,980 --> 00:59:22,880
okay so what are the overall lessons

1434
00:59:22,880 --> 00:59:24,260
learned the first is

1435
00:59:24,260 --> 00:59:26,540
Bob Morris' first

1436
00:59:26,840 --> 00:59:28,920
look for clear text which

1437
00:59:29,080 --> 00:59:30,720
I thought was this trite joke

1438
00:59:30,720 --> 00:59:32,480
turns out to work

1439
00:59:32,480 --> 00:59:34,420
really well right

1440
00:59:34,680 --> 00:59:36,180
looking for clear text

1441
00:59:36,180 --> 00:59:38,060
in a sea of cipher text

1442
00:59:38,060 --> 00:59:40,860
with the practical things that exist

1443
00:59:40,860 --> 00:59:43,120
right now is a remarkably

1444
00:59:43,120 --> 00:59:44,580
productive strategy

1445
00:59:44,580 --> 00:59:46,720
um and in fact from the

1446
00:59:46,720 --> 00:59:48,400
standpoint of

1447
00:59:48,400 --> 00:59:50,080
the interceptor

1448
00:59:50,080 --> 00:59:52,900
um in the old days

1449
00:59:52,900 --> 00:59:55,000
when encryption wasn't

1450
00:59:55,000 --> 00:59:55,440
available

1451
00:59:55,440 --> 00:59:58,780
users of these

1452
00:59:59,080 --> 01:00:00,240
things doing sensitive stuff

1453
01:00:00,240 --> 01:00:02,500
had to be pretty circumspect

1454
01:00:02,500 --> 01:00:04,240
in what they would say over the radio

1455
01:00:04,240 --> 01:00:06,640
um because they knew that anybody

1456
01:00:06,640 --> 01:00:07,260
could listen

1457
01:00:07,260 --> 01:00:09,800
um now they have

1458
01:00:09,800 --> 01:00:12,320
what they believe to be reliably

1459
01:00:12,320 --> 01:00:13,600
secure communication

1460
01:00:13,600 --> 01:00:16,320
and are much much more open

1461
01:00:16,320 --> 01:00:18,560
in what they talk about

1462
01:00:18,900 --> 01:00:20,240
at the same time

1463
01:00:21,020 --> 01:00:22,380
intercept technology

1464
01:00:23,080 --> 01:00:24,740
um you know an SDR

1465
01:00:24,740 --> 01:00:26,980
you know an under a thousand dollar

1466
01:00:26,980 --> 01:00:28,060
SDR setup

1467
01:00:29,080 --> 01:00:30,180
is sufficient to

1468
01:00:30,860 --> 01:00:33,100
capture um in real time

1469
01:00:33,100 --> 01:00:35,020
all of the I and Q

1470
01:00:35,020 --> 01:00:36,880
from all of the raw

1471
01:00:36,880 --> 01:00:38,580
spectrum in the entire federal

1472
01:00:38,580 --> 01:00:40,200
um frequency band

1473
01:00:40,740 --> 01:00:42,440
and can um

1474
01:00:42,440 --> 01:00:45,040
then offline pick out all the

1475
01:00:45,040 --> 01:00:46,960
clear sensitive traffic

1476
01:00:46,960 --> 01:00:49,120
um at your leisure

1477
01:00:49,120 --> 01:00:50,880
or in real time depending

1478
01:00:50,880 --> 01:00:52,600
on what your application is

1479
01:00:52,600 --> 01:00:54,880
this is pretty much the you know

1480
01:00:54,880 --> 01:00:56,800
a budget equivalent of

1481
01:00:56,800 --> 01:00:58,780
precisely the sort of package

1482
01:00:59,080 --> 01:01:01,020
NSA is installing in agencies

1483
01:01:01,020 --> 01:01:03,000
around the world and the FSB

1484
01:01:03,000 --> 01:01:04,540
is installing in uh

1485
01:01:04,770 --> 01:01:06,740
in uh embassies in the US

1486
01:01:06,740 --> 01:01:08,680
except that you can do it on kind of a

1487
01:01:08,680 --> 01:01:10,480
hacker budget and

1488
01:01:10,480 --> 01:01:12,860
um so now we have people

1489
01:01:12,860 --> 01:01:14,660
who are very confident in

1490
01:01:14,660 --> 01:01:16,880
the security of their communication

1491
01:01:16,880 --> 01:01:18,560
and an intercept environment

1492
01:01:18,810 --> 01:01:20,920
that allows uh passive

1493
01:01:20,920 --> 01:01:22,860
intercept uh to

1494
01:01:22,860 --> 01:01:24,360
to happen very cheaply

1495
01:01:24,360 --> 01:01:27,120
and really quite comprehensively

1496
01:01:27,120 --> 01:01:28,240
um and so

1497
01:01:29,080 --> 01:01:30,400
um you know arguably

1498
01:01:30,400 --> 01:01:32,620
the situation is actually far worse

1499
01:01:32,620 --> 01:01:34,780
than it was back in the days when

1500
01:01:34,780 --> 01:01:36,080
when uh encryption

1501
01:01:36,080 --> 01:01:38,480
uh wasn't available um

1502
01:01:38,480 --> 01:01:39,780
you know the um

1503
01:01:39,780 --> 01:01:42,440
uh you know I joke that

1504
01:01:42,440 --> 01:01:44,740
you know this I'm looking into whether

1505
01:01:44,740 --> 01:01:46,520
you know bank robbery is more lucrative

1506
01:01:46,520 --> 01:01:48,140
than being a professor because this

1507
01:01:48,140 --> 01:01:50,500
could really kind of give you a leg up

1508
01:01:50,820 --> 01:01:52,880
um I don't make that joke in

1509
01:01:52,880 --> 01:01:54,560
any talks with the federal agencies

1510
01:01:54,560 --> 01:01:56,760
um the uh

1511
01:01:57,560 --> 01:01:58,760
uh so that's

1512
01:01:59,080 --> 01:02:00,720
kind of the first lesson look for clear text

1513
01:02:00,720 --> 01:02:02,660
works and it's a lot cheaper

1514
01:02:02,660 --> 01:02:04,480
to look for clear text

1515
01:02:04,740 --> 01:02:06,840
the second is the sort of crypto lesson

1516
01:02:06,840 --> 01:02:08,540
which is that grafting

1517
01:02:08,980 --> 01:02:10,960
um encryption and security

1518
01:02:10,960 --> 01:02:12,880
standards onto a legacy

1519
01:02:12,880 --> 01:02:14,900
system has a long

1520
01:02:14,900 --> 01:02:17,040
and distinguished history of failure

1521
01:02:17,040 --> 01:02:19,020
that is unbroken by

1522
01:02:19,020 --> 01:02:20,940
our experience with uh

1523
01:02:20,940 --> 01:02:22,760
uh P25 this

1524
01:02:22,760 --> 01:02:24,500
um this really doesn't work

1525
01:02:24,720 --> 01:02:27,020
and right now I'm just upgrading our sensor

1526
01:02:27,020 --> 01:02:28,380
network to capture

1527
01:02:29,080 --> 01:02:30,840
all of the uh traffic

1528
01:02:30,840 --> 01:02:32,340
for offline uh

1529
01:02:32,940 --> 01:02:34,940
analysis later and that seems to be

1530
01:02:34,940 --> 01:02:36,960
working um fairly

1531
01:02:36,960 --> 01:02:38,940
um straightforwardly

1532
01:02:38,940 --> 01:02:41,100
so we've got plenty of time if you want to ask

1533
01:02:41,100 --> 01:02:42,820
any questions or throw anything or

1534
01:02:42,820 --> 01:02:44,960
tell me why I don't understand decibels

1535
01:02:44,960 --> 01:02:47,000
I'm happy to but try to use the mic

1536
01:02:47,000 --> 01:02:48,000
or they'll yell at us

1537
01:02:54,580 --> 01:02:56,820
yeah just come to the mic cause it's just

1538
01:02:56,820 --> 01:02:58,940
is there any audio feedback

1539
01:02:59,080 --> 01:03:00,360
if the uh received

1540
01:03:00,360 --> 01:03:02,400
voice frames are not encrypted so

1541
01:03:02,400 --> 01:03:04,960
you can configure the radio so that

1542
01:03:04,960 --> 01:03:07,140
it'll beep on encrypted

1543
01:03:07,140 --> 01:03:08,480
received or

1544
01:03:08,480 --> 01:03:10,260
beep on encrypted

1545
01:03:10,780 --> 01:03:12,900
on unencrypted received and

1546
01:03:12,900 --> 01:03:14,780
there's disagreement about what the beep means

1547
01:03:14,780 --> 01:03:16,920
unfortunately the same

1548
01:03:16,920 --> 01:03:18,660
beep on the Motorola radios

1549
01:03:18,660 --> 01:03:20,600
exactly the same beep

1550
01:03:20,600 --> 01:03:22,920
is used to indicate low battery

1551
01:03:22,920 --> 01:03:24,840
um so

1552
01:03:24,840 --> 01:03:26,380
um it

1553
01:03:26,380 --> 01:03:28,880
you can't win um and uh

1554
01:03:29,080 --> 01:03:30,140
the other question is um

1555
01:03:30,140 --> 01:03:32,900
can you have multiple keys inside the radio

1556
01:03:32,900 --> 01:03:34,640
or is it one key for one group

1557
01:03:34,640 --> 01:03:37,180
um you uh depending on how the radio is optioned

1558
01:03:37,180 --> 01:03:38,220
you can um

1559
01:03:38,220 --> 01:03:40,940
you can load I think up to 64 keys

1560
01:03:40,940 --> 01:03:41,660
on the radio

1561
01:03:41,660 --> 01:03:46,940
very cool um in a in a case

1562
01:03:46,940 --> 01:03:47,780
of using AES

1563
01:03:48,580 --> 01:03:50,800
if we wanted to mitigate like constant

1564
01:03:50,800 --> 01:03:52,340
re-keying and all the crap that goes with that

1565
01:03:52,340 --> 01:03:53,840
what sort of interval

1566
01:03:54,640 --> 01:03:55,680
might you recommend

1567
01:03:55,680 --> 01:03:57,400
you know so I mean I think the

1568
01:04:00,040 --> 01:04:01,080
federal guidelines

1569
01:04:01,080 --> 01:04:03,280
basically have them re-keying about once a month

1570
01:04:03,280 --> 01:04:04,580
for most agencies

1571
01:04:04,580 --> 01:04:07,200
and the model appears to be kind of

1572
01:04:07,200 --> 01:04:08,760
based on this military model

1573
01:04:08,760 --> 01:04:11,020
in which you know some of your

1574
01:04:11,020 --> 01:04:13,120
agents are being captured by

1575
01:04:13,120 --> 01:04:15,060
the enemy right um which

1576
01:04:15,060 --> 01:04:17,260
you know mostly doesn't happen to FBI

1577
01:04:17,260 --> 01:04:18,600
agents um

1578
01:04:18,600 --> 01:04:21,100
you know as far as we know they do lose

1579
01:04:21,100 --> 01:04:22,960
radios uh from time to time

1580
01:04:22,960 --> 01:04:25,160
but you know you know it's about as

1581
01:04:25,160 --> 01:04:27,060
frequent as losing guns you know it

1582
01:04:27,060 --> 01:04:29,000
happens but just not that often um

1583
01:04:29,080 --> 01:04:30,720
you know and

1584
01:04:30,720 --> 01:04:32,660
the problem is that if you re-key

1585
01:04:32,660 --> 01:04:35,040
you're guaranteeing that lots of stuff

1586
01:04:35,040 --> 01:04:36,840
is going to go out in the clear because the

1587
01:04:36,840 --> 01:04:38,680
re-keying protocol isn't atomic

1588
01:04:38,680 --> 01:04:40,420
across everybody um

1589
01:04:40,420 --> 01:04:42,400
if you don't re-key

1590
01:04:42,400 --> 01:04:45,140
you're guaranteed that any of your lost radios

1591
01:04:45,140 --> 01:04:46,400
will be able to uh

1592
01:04:47,080 --> 01:04:48,700
receive stuff you know

1593
01:04:48,700 --> 01:04:51,300
that's less bad than guaranteeing

1594
01:04:51,300 --> 01:04:53,060
that everybody is going to be able to

1595
01:04:53,060 --> 01:04:54,580
receive stuff so you know I advocate

1596
01:04:54,580 --> 01:04:56,300
very long lived keys

1597
01:04:57,060 --> 01:04:58,940
and um but getting

1598
01:04:59,080 --> 01:05:01,060
that practice out in the

1599
01:05:01,060 --> 01:05:02,920
in the field is an uphill

1600
01:05:02,920 --> 01:05:04,280
battle changing federal

1601
01:05:04,280 --> 01:05:06,960
security standards is a

1602
01:05:06,960 --> 01:05:08,560
non-trivial process

1603
01:05:09,070 --> 01:05:09,400
yeah

1604
01:05:11,440 --> 01:05:12,860
so uh is the

1605
01:05:12,860 --> 01:05:15,000
over the air re-keying protocol secure

1606
01:05:15,000 --> 01:05:17,180
as far as you can tell like not subject to replays

1607
01:05:17,180 --> 01:05:18,780
no it's horrible um

1608
01:05:18,780 --> 01:05:20,760
the uh so

1609
01:05:20,760 --> 01:05:22,840
it's um it is vulnerable to

1610
01:05:22,840 --> 01:05:25,140
a large number of active

1611
01:05:25,140 --> 01:05:26,800
attacks and manipulations

1612
01:05:26,800 --> 01:05:29,060
um it does not appear to be

1613
01:05:29,080 --> 01:05:30,480
possible to load

1614
01:05:31,080 --> 01:05:33,020
selected selected chosen

1615
01:05:33,020 --> 01:05:34,900
key material but you

1616
01:05:34,900 --> 01:05:37,000
can do other kinds of mischief

1617
01:05:37,000 --> 01:05:38,800
that are just as effective in practice

1618
01:05:38,800 --> 01:05:39,400
in practice

1619
01:05:41,240 --> 01:05:42,880
yeah okay so

1620
01:05:42,880 --> 01:05:45,060
thanks I'll uh see you

1621
01:05:45,060 --> 01:05:45,380
next time

1622
01:05:46,860 --> 01:05:48,980
oh and I should I would be remiss

1623
01:05:48,980 --> 01:05:51,040
in saying come to the voting village