1
00:00:00,000 --> 00:00:03,720
Welcome back to the Wireless Village, like most of you ever left.

2
00:00:05,820 --> 00:00:10,400
Contestants, I'm sure you remember by now, but please be quiet.

3
00:00:11,420 --> 00:00:16,720
We're all very glad you're here, and quiet, really quiet.

4
00:00:17,680 --> 00:00:23,260
Because I don't want to have to take points away, or drop this mic.

5
00:00:24,760 --> 00:00:34,360
So, it is my distinct pleasure to introduce two people that, well, if you were playing the dog collar game, you already know.

6
00:00:36,140 --> 00:00:40,100
These are two of our newer friends of the village.

7
00:00:40,520 --> 00:00:43,740
They've managed to ingratiate themselves in a short time.

8
00:00:44,140 --> 00:00:50,280
Tim was one of very few people who said, dog collar challenge, that sounds like fun.

9
00:00:51,280 --> 00:00:53,180
When Russ first introduced it.

10
00:00:53,260 --> 00:00:54,520
No one else would play.

11
00:00:54,760 --> 00:01:00,240
And then after Tim played for about 45 minutes, nobody wanted to play against Tim.

12
00:01:02,420 --> 00:01:04,960
So, yeah, that's been a lot of fun.

13
00:01:05,040 --> 00:01:08,780
He had no idea how software-defined radios worked right up until then.

14
00:01:08,900 --> 00:01:12,260
And then he's been ruined ever since.

15
00:01:12,440 --> 00:01:15,040
I'm sure he does nothing else from the look of it.

16
00:01:15,500 --> 00:01:23,240
And Woody sent me, I cannot even imagine, the most entertaining email I have ever read for the CFL.

17
00:01:23,820 --> 00:01:24,220
So, I'm going to go ahead and read it.

18
00:01:24,220 --> 00:01:28,800
Something to the effect of, I'd like to give this talk, but I need to bring my dog.

19
00:01:29,020 --> 00:01:29,540
Is that okay?

20
00:01:30,200 --> 00:01:33,540
I'm like, just bringing your dog?

21
00:01:33,660 --> 00:01:34,560
Is there any particular reason?

22
00:01:34,640 --> 00:01:35,960
Well, it's a hearing ear dog.

23
00:01:37,060 --> 00:01:37,460
Okay.

24
00:01:37,860 --> 00:01:38,260
Sure.

25
00:01:38,960 --> 00:01:40,480
So, it's actually a service animal.

26
00:01:40,560 --> 00:01:41,480
It's not like a service pony.

27
00:01:41,660 --> 00:01:42,200
It's a dog.

28
00:01:42,500 --> 00:01:42,900
Yeah.

29
00:01:42,960 --> 00:01:43,200
Yeah.

30
00:01:43,260 --> 00:01:43,520
Okay.

31
00:01:43,600 --> 00:01:43,740
Yeah.

32
00:01:43,760 --> 00:01:44,340
You can bring your dog.

33
00:01:44,380 --> 00:01:44,840
No problem.

34
00:01:46,360 --> 00:01:48,980
So, these are some of our newest friends.

35
00:01:49,120 --> 00:01:53,240
And they have done something that the entire Wireless Village team wanted to do.

36
00:01:53,240 --> 00:01:56,340
Which is reverse engineer the bloody GoTenna.

37
00:01:56,580 --> 00:02:01,300
So, I present GoTenna reverse engineering with our new friends, Woody and Tim.

38
00:02:01,740 --> 00:02:02,180
Woo!

39
00:02:08,940 --> 00:02:10,620
So, we're glad to be here.

40
00:02:11,940 --> 00:02:14,240
Actually, we want to thank Wireless Village.

41
00:02:14,460 --> 00:02:16,460
They also gave us a chance last year at DEF CON.

42
00:02:16,620 --> 00:02:22,720
We presented Iris for any of you that have heard of infrared and how that might be a way to track cell phones.

43
00:02:22,920 --> 00:02:23,220
We did.

44
00:02:23,240 --> 00:02:24,480
We did that.

45
00:02:24,480 --> 00:02:25,660
They gave us a chance to do that.

46
00:02:25,720 --> 00:02:26,640
And they brought us back again.

47
00:02:26,880 --> 00:02:30,540
So, pretty happy to be here.

48
00:02:31,380 --> 00:02:32,700
A little bit about me.

49
00:02:32,980 --> 00:02:33,960
I go by Woody.

50
00:02:34,280 --> 00:02:37,120
And I play with Software Defined Radios and RF.

51
00:02:37,500 --> 00:02:38,320
And now, Tim.

52
00:02:39,540 --> 00:02:39,920
Yeah.

53
00:02:40,020 --> 00:02:40,380
I'm Tim.

54
00:02:40,940 --> 00:02:44,280
I came here to the DEF CON for the first time about three years back.

55
00:02:44,460 --> 00:02:47,600
And got really excited when Russ was, like, playing with dog collars.

56
00:02:47,680 --> 00:02:49,540
It's like, man, this is going to be fun.

57
00:02:49,720 --> 00:02:52,560
Not only can we shock people with dog collars.

58
00:02:52,620 --> 00:02:53,220
Like, we can set them up.

59
00:02:53,220 --> 00:02:54,020
We can set this thing up on the Internet.

60
00:02:54,240 --> 00:02:56,040
Like, Japan's going to get really excited about it.

61
00:02:56,220 --> 00:02:56,760
It was...

62
00:02:57,340 --> 00:02:57,700
Anyways.

63
00:02:57,940 --> 00:03:01,620
So, we're going to be working on the Gotenna here.

64
00:03:02,140 --> 00:03:08,060
This is something that came out a couple of years back out of Hurricane Sandy in New Jersey.

65
00:03:08,240 --> 00:03:11,500
There's two people, Daniela and Jorge Perdomo.

66
00:03:11,540 --> 00:03:11,960
They're siblings.

67
00:03:12,540 --> 00:03:17,160
They thought, you know, it would be kind of neat if we could have some way of communicating when cell networks go down.

68
00:03:17,340 --> 00:03:18,320
And so, they made these things.

69
00:03:18,840 --> 00:03:19,920
Do you got one on hand, Woody?

70
00:03:20,020 --> 00:03:22,820
They're about the size of a pack of six pencils.

71
00:03:22,820 --> 00:03:23,600
It's kind of taped together.

72
00:03:23,700 --> 00:03:24,260
They're really small.

73
00:03:24,840 --> 00:03:27,180
And you pair your phone to it over Bluetooth.

74
00:03:27,740 --> 00:03:30,020
And so, once you've got your Bluetooth link up...

75
00:03:31,020 --> 00:03:32,200
Got one over there.

76
00:03:32,660 --> 00:03:33,260
Pretty sick.

77
00:03:33,960 --> 00:03:35,220
Anybody else in the audience got one?

78
00:03:35,440 --> 00:03:36,040
Anybody else?

79
00:03:36,280 --> 00:03:36,680
All right.

80
00:03:36,720 --> 00:03:39,360
Well, we actually have a discount code from them at the end.

81
00:03:39,620 --> 00:03:40,960
We don't work for them.

82
00:03:41,380 --> 00:03:44,540
But we ended up having to contact them about something, which we'll talk about later.

83
00:03:45,380 --> 00:03:47,180
So, anyways, you pair it with your phone or Bluetooth.

84
00:03:47,460 --> 00:03:48,940
You send a little text message to your buddy.

85
00:03:49,220 --> 00:03:50,740
And it goes out over MERS.

86
00:03:51,200 --> 00:03:52,680
Which is sort of similar.

87
00:03:52,820 --> 00:03:56,720
It's similar to push-to-talk radio networks for, like, family radio service, things like that.

88
00:03:56,920 --> 00:03:59,220
And so, some expectation management for the talk.

89
00:03:59,900 --> 00:04:01,280
We're not doing anything with Bluetooth.

90
00:04:01,560 --> 00:04:03,520
We're not doing anything with mobile applications.

91
00:04:04,340 --> 00:04:05,500
It's just not our skill set.

92
00:04:06,440 --> 00:04:10,180
We're going to be focusing on the MERS link and how it communicates.

93
00:04:10,920 --> 00:04:12,760
Also, Goten is coming out with new hardware.

94
00:04:13,060 --> 00:04:15,460
This is not the new hardware that we're studying.

95
00:04:15,620 --> 00:04:19,580
We're studying the older classic hardware, if you will.

96
00:04:19,760 --> 00:04:20,140
So.

97
00:04:22,200 --> 00:04:22,620
Now.

98
00:04:22,820 --> 00:04:23,940
We have ordered the new hardware.

99
00:04:24,340 --> 00:04:27,000
And hopefully it will be arriving within the next few weeks.

100
00:04:27,140 --> 00:04:29,480
But Goten is a fund-me thing.

101
00:04:29,680 --> 00:04:31,520
So we're waiting for the new stuff to come out.

102
00:04:31,860 --> 00:04:33,360
So a couple of things we're going to talk about.

103
00:04:33,960 --> 00:04:35,760
We've all heard of this OSI model.

104
00:04:36,760 --> 00:04:41,580
What became interesting as we did this, a lot of things we do with software-defined radios.

105
00:04:42,780 --> 00:04:50,060
Key fobs, entering vehicles, bypassing your home alarm system, being able to open your garage door.

106
00:04:50,620 --> 00:04:52,800
I don't need to worry about the OSI model as much.

107
00:04:52,800 --> 00:04:57,860
Pretty much, I have the hardware, I'm able to collect some stuff, I can replay, make a couple of changes, make things happen.

108
00:04:58,040 --> 00:05:00,600
That wasn't the way that this worked.

109
00:05:01,360 --> 00:05:07,600
This actually has networking, this actually has the physical model, this actually has presentations, sessions, and applications.

110
00:05:09,000 --> 00:05:10,740
So, I had to read.

111
00:05:11,640 --> 00:05:14,140
But fortunately I had Tim and he reads much better than I do.

112
00:05:18,720 --> 00:05:19,300
Screen's blank.

113
00:05:20,120 --> 00:05:20,520
Okay.

114
00:05:21,380 --> 00:05:22,700
So here's how we got started.

115
00:05:22,800 --> 00:05:23,780
As he pulls up the presentation.

116
00:05:25,960 --> 00:05:28,320
So, this is what we did as we first started out.

117
00:05:28,900 --> 00:05:33,240
I got excited because I'm a big fan of using software-defined radios.

118
00:05:33,500 --> 00:05:41,620
And let me caveat with saying that if you broadcast on the MERS network without permission, that is an FCC violation.

119
00:05:42,040 --> 00:05:44,000
So I'm making sure to tell you, don't ever do it.

120
00:05:45,420 --> 00:05:48,860
And if you do it, only do it in the casino with a yogi.

121
00:05:48,980 --> 00:05:49,380
But.

122
00:05:51,520 --> 00:05:51,920
But.

123
00:05:51,920 --> 00:06:05,040
But, with that being said, in my own home, on my own large piece of property, inside of a RF-free Faraday environment, I might have played with this.

124
00:06:05,300 --> 00:06:17,120
So, as I did that, one thing I noticed is I could replay a message from a GoTenant device hours later and have another GoTenant device still accept the message.

125
00:06:17,220 --> 00:06:19,640
So I was like, oh, that's kind of interesting.

126
00:06:20,260 --> 00:06:21,900
That would be something.

127
00:06:21,920 --> 00:06:24,480
That would be something that could be of use if I had done that.

128
00:06:26,480 --> 00:06:30,700
In a perfectly Faraday cage with no RF environment or anything else.

129
00:06:30,920 --> 00:06:31,220
Yeah.

130
00:06:31,260 --> 00:06:32,740
My Faraday cage was good to go.

131
00:06:32,840 --> 00:06:33,340
So I was fine.

132
00:06:34,820 --> 00:06:38,260
So the first thing I did was I started looking at a spectrum analyzer.

133
00:06:38,340 --> 00:06:38,860
Because I called Tim.

134
00:06:38,940 --> 00:06:40,740
I said, hey, this is pretty cool.

135
00:06:41,040 --> 00:06:45,220
We need some really high-end, expensive equipment to be able to move further with this.

136
00:06:45,420 --> 00:06:47,720
So we used Osmocon FFT.

137
00:06:48,640 --> 00:06:51,900
You're going to find out throughout this talk, we want to promote you to the next level.

138
00:06:51,920 --> 00:06:57,280
We want you to use basic tools and be able to use simple tools to do complex tasks.

139
00:06:58,220 --> 00:06:59,080
Osmocon FFT.

140
00:06:59,440 --> 00:07:04,980
So I invite Tim over, and I'm like, hey, I know that you can do some rebroadcasting with this.

141
00:07:05,080 --> 00:07:07,340
So let's figure out how this thing works.

142
00:07:07,540 --> 00:07:12,740
And Tim is really good at software-defined radios, and he can write some really cool code.

143
00:07:13,380 --> 00:07:15,060
So he said, okay, well, let's start playing.

144
00:07:15,240 --> 00:07:16,660
And then, boom, things start hitting.

145
00:07:17,240 --> 00:07:19,620
So can anyone tell me what's happening right here?

146
00:07:19,620 --> 00:07:21,500
The biggest thing you take out of seeing here?

147
00:07:23,320 --> 00:07:23,640
Exactly.

148
00:07:23,920 --> 00:07:25,540
There's a command channel, obviously.

149
00:07:27,300 --> 00:07:29,220
So you see where it spikes right here?

150
00:07:29,420 --> 00:07:29,860
No, hold on.

151
00:07:29,860 --> 00:07:31,740
How long did someone, did someone say command channel?

152
00:07:32,420 --> 00:07:34,200
That took me like 20 minutes to figure out.

153
00:07:34,300 --> 00:07:34,920
I didn't believe him.

154
00:07:35,120 --> 00:07:36,220
Yeah, so here's what happens.

155
00:07:36,600 --> 00:07:39,740
We sent about that many packs, and I go, hey, Tim, look, they got a command channel.

156
00:07:40,220 --> 00:07:43,640
And he's like, no, what is, we're going to have to do some more tests.

157
00:07:43,740 --> 00:07:45,040
I said, no, no, that's a command channel.

158
00:07:45,200 --> 00:07:49,600
So Tim can write really well, and I can kind of look at weird things and say, hey, this is really cool.

159
00:07:49,620 --> 00:07:50,340
And sometimes they pick up.

160
00:07:50,460 --> 00:07:53,420
So I was like, I think there's a command channel at the highest end.

161
00:07:53,520 --> 00:07:54,760
Because we knew there were five channels.

162
00:07:55,100 --> 00:07:55,460
Why?

163
00:07:55,600 --> 00:07:59,020
Because FCC is our friend, and we knew there were five channels in the MERS band.

164
00:07:59,860 --> 00:08:01,420
You're going to find more out about that later.

165
00:08:01,900 --> 00:08:03,300
So Tim doesn't believe me.

166
00:08:03,360 --> 00:08:06,080
You'll find out if you talk, if you were here for our Iris talk.

167
00:08:06,900 --> 00:08:09,200
Tim's a firm believer that I hunt unicorns.

168
00:08:09,860 --> 00:08:10,440
He does.

169
00:08:10,520 --> 00:08:11,960
I will tell you, unicorns are real.

170
00:08:12,920 --> 00:08:15,700
So what happened after we started testing this out?

171
00:08:15,760 --> 00:08:17,000
We realized that they're bouncing around.

172
00:08:17,640 --> 00:08:19,180
But one thing stayed consistent.

173
00:08:20,940 --> 00:08:28,840
So being a little bit more of a scientific man, I thought, hey, how can we test this and actually prove somehow that there's a command channel?

174
00:08:29,580 --> 00:08:32,680
So if there's a command channel, what would that mean?

175
00:08:32,780 --> 00:08:35,120
That means there's some sort of trunked radio network.

176
00:08:35,320 --> 00:08:40,560
And I said, well, let's do something that I think will help Woody and I understand this problem.

177
00:08:40,680 --> 00:08:42,680
So I said, Woody, let's start role playing.

178
00:08:43,140 --> 00:08:46,600
And so I put on my robe and wizard hat.

179
00:08:47,260 --> 00:08:47,800
All right.

180
00:08:49,620 --> 00:08:52,440
I'm going to be, yeah, he's really into this, by the way.

181
00:08:52,620 --> 00:08:56,000
He made a character, maxed out the stern in, and I maxed out my wiz.

182
00:08:56,120 --> 00:08:58,560
So it's just kind of, yeah, there you go.

183
00:08:59,540 --> 00:09:00,140
Lightning bolt.

184
00:09:00,240 --> 00:09:03,260
Anyways, so I'm going to pretend like I'm trying to talk to Woody.

185
00:09:03,340 --> 00:09:04,040
I'm one Gotenna.

186
00:09:04,060 --> 00:09:04,540
I'm the other.

187
00:09:04,640 --> 00:09:05,960
I'm going to start on channel four.

188
00:09:06,020 --> 00:09:06,880
That's the control channel.

189
00:09:07,240 --> 00:09:10,000
I'm going to say, hey, Woody, I want to talk to you.

190
00:09:10,140 --> 00:09:11,520
Let's meet on channel two.

191
00:09:14,060 --> 00:09:17,460
Now, Tim didn't do this to try to make it prove that I was right.

192
00:09:18,180 --> 00:09:19,600
Tim was like, well, I'm going to show you how to do this.

193
00:09:19,600 --> 00:09:21,000
I'm going to show you why this doesn't work.

194
00:09:21,440 --> 00:09:23,180
So Tim said, we're going to do this.

195
00:09:23,300 --> 00:09:26,320
And you'll find out, if it still bounces around, Woody, you're wrong.

196
00:09:26,580 --> 00:09:28,880
Because it's FreeCop, and I don't think there's a command channel.

197
00:09:29,200 --> 00:09:31,480
I was fortunate enough to be able to say, well, I think there is.

198
00:09:33,200 --> 00:09:34,360
So we did it.

199
00:09:34,800 --> 00:09:36,240
What happens if you're on channel two?

200
00:09:36,480 --> 00:09:36,740
Yeah.

201
00:09:36,820 --> 00:09:43,240
So what happens if we start sending it to where one channel, one radio is off, and we send, and that radio doesn't authenticate?

202
00:09:43,440 --> 00:09:47,840
If there's truly a command channel, it should only send from one channel over and over and over.

203
00:09:48,080 --> 00:09:49,580
So let's reset our control channel.

204
00:09:49,600 --> 00:09:55,100
And we're going to shut down all other radios, except the one we want to, except the one who's sending.

205
00:09:55,580 --> 00:10:00,960
And if what we're sending, oh, by the way, we're doing this live demo, because if we're not willing to go live, should we really be here?

206
00:10:03,760 --> 00:10:07,360
We have backups, but I think there should be some principles.

207
00:10:08,280 --> 00:10:08,800
All right.

208
00:10:08,820 --> 00:10:11,120
So we're totally, we're all the way off.

209
00:10:11,260 --> 00:10:12,620
We've only got, I've got my phone on.

210
00:10:12,740 --> 00:10:14,080
And I've got my Gotenna on.

211
00:10:14,160 --> 00:10:17,360
And I'm going to try and transmit to a Gotenna that's currently turned off.

212
00:10:17,640 --> 00:10:19,580
If Woody was right, and I was wrong.

213
00:10:19,600 --> 00:10:21,720
What we should see is on channel four.

214
00:10:21,800 --> 00:10:22,940
That's the one all the way on the right.

215
00:10:23,000 --> 00:10:25,780
We should see it talking and never hopping over to channel two.

216
00:10:25,880 --> 00:10:30,040
To finish off the conversation, what was supposed to happen is, hey, Woody, let's meet on channel two.

217
00:10:30,240 --> 00:10:33,520
And Woody was supposed to go, okay, Tim, I'm ready to receive a message.

218
00:10:33,680 --> 00:10:34,340
But he never did that.

219
00:10:35,420 --> 00:10:39,580
So if it doesn't have a command channel on channel four, it will bounce all over the screen.

220
00:10:41,760 --> 00:10:45,740
So, huh, huh, huh.

221
00:10:46,860 --> 00:10:47,760
God dang it.

222
00:10:47,880 --> 00:10:48,620
I'm sorry, Tim.

223
00:10:49,600 --> 00:10:50,060
I'm right.

224
00:10:50,260 --> 00:10:53,500
So now I might be right, but he can script.

225
00:10:53,660 --> 00:10:54,420
So he wins.

226
00:10:54,660 --> 00:10:55,400
But still.

227
00:10:56,720 --> 00:11:00,920
So as we started to look at this, we were like, dang it.

228
00:11:01,260 --> 00:11:04,060
This could be something to look at.

229
00:11:04,120 --> 00:11:09,660
Because remember, if I know where you start, what are you probably going to tell me when you start?

230
00:11:09,920 --> 00:11:13,840
Who you want to talk to and where we're going.

231
00:11:14,520 --> 00:11:14,980
Woohoo.

232
00:11:15,760 --> 00:11:16,920
So we start working.

233
00:11:18,660 --> 00:11:19,580
So let's go.

234
00:11:19,600 --> 00:11:22,080
Let's go ahead and tell us why the FCC is our good friend.

235
00:11:22,940 --> 00:11:26,040
We were able to find the actual board on the FCC.

236
00:11:26,780 --> 00:11:27,220
Why?

237
00:11:27,380 --> 00:11:29,020
Because they have to be there.

238
00:11:30,540 --> 00:11:36,100
Now as we look at this, remember I told, Tim told you we're not doing Bluetooth exploit.

239
00:11:36,400 --> 00:11:37,320
Not even going to attempt it.

240
00:11:37,500 --> 00:11:40,760
However, in the lower left-hand corner, that is the Wi-Fi antenna.

241
00:11:41,880 --> 00:11:43,040
I'm sorry, Bluetooth.

242
00:11:43,340 --> 00:11:44,300
We're not using Wi-Fi.

243
00:11:44,480 --> 00:11:45,160
Please, okay.

244
00:11:45,160 --> 00:11:46,820
Got it.

245
00:11:46,860 --> 00:11:47,220
Understood.

246
00:11:47,760 --> 00:11:55,320
Now, as we move up on that whole side, we look at the protocol and we realize that we move over all the way to the right.

247
00:11:55,580 --> 00:11:58,020
That is going to be the MERS antenna.

248
00:11:58,700 --> 00:12:05,640
And if we come just between everything else, that is the actual radio antenna for the Gotenna.

249
00:12:05,660 --> 00:12:12,260
Now, this is the antenna, which for MERS is fairly small, but it's one of those things they're working on.

250
00:12:12,820 --> 00:12:16,380
So, at this point, we're like, okay, we're looking at this board, we're able to find some information.

251
00:12:17,560 --> 00:12:20,160
So, what kind of modulation do you think we're going to use, Tim?

252
00:12:22,100 --> 00:12:24,160
So, this is going to be on the MERS channel.

253
00:12:24,300 --> 00:12:31,520
So, if you're familiar with push-to-talk radios and that whole plethora of frequencies that the FCC allocated for unlicensed people to use,

254
00:12:32,260 --> 00:12:34,500
everyone's using frequency modulations.

255
00:12:34,640 --> 00:12:36,100
So, pretty sure about that.

256
00:12:36,140 --> 00:12:37,000
It's frequency modulation.

257
00:12:37,420 --> 00:12:41,520
And also, on top of that, it's probably going to be within a 12.5 kilohertz channel,

258
00:12:41,620 --> 00:12:42,240
because if you're using a 12.5 kilohertz channel,

259
00:12:42,260 --> 00:12:43,860
each of the little push-to-talk radios,

260
00:12:43,920 --> 00:12:45,240
every time you go to the next channel,

261
00:12:45,380 --> 00:12:46,580
12.5 kilohertz.

262
00:12:46,800 --> 00:12:48,080
So, I'll show you the modulation.

263
00:12:49,300 --> 00:12:51,260
We should probably go to a live demo at this point.

264
00:12:57,100 --> 00:12:57,420
So,

265
00:12:58,020 --> 00:12:59,460
while we talk about this a little bit,

266
00:12:59,520 --> 00:13:00,620
and we wait for this to pop up,

267
00:13:00,780 --> 00:13:02,000
which, oh, there we go.

268
00:13:02,180 --> 00:13:02,620
Weight's over.

269
00:13:04,880 --> 00:13:06,920
We looked at this, and we're like, okay, it's probably,

270
00:13:07,180 --> 00:13:09,620
well, Tim's like, hey, you know what, I bet they're using FM.

271
00:13:09,880 --> 00:13:11,860
We'd seen a few things that made us feel that way.

272
00:13:12,260 --> 00:13:13,380
And then we looked at the FCC stuff,

273
00:13:13,620 --> 00:13:15,520
and he said, hey, let's really sketch this out

274
00:13:15,520 --> 00:13:16,420
and see how it works.

275
00:13:17,380 --> 00:13:18,700
So, let's go ahead and send something

276
00:13:18,700 --> 00:13:19,560
and see what it looks like.

277
00:13:21,440 --> 00:13:21,760
Now,

278
00:13:24,260 --> 00:13:25,100
there we are.

279
00:13:27,060 --> 00:13:28,820
So, we have a good amount of data here.

280
00:13:28,960 --> 00:13:30,360
For those of you that are familiar with

281
00:13:31,040 --> 00:13:32,060
FM, or, you know,

282
00:13:32,080 --> 00:13:33,400
frequency modulation stuff,

283
00:13:33,560 --> 00:13:35,720
you realize it's a little different than on-off keying,

284
00:13:35,840 --> 00:13:38,120
and it can be a little more difficult to demodulate

285
00:13:38,120 --> 00:13:39,040
and see what's going on.

286
00:13:39,660 --> 00:13:40,080
So,

287
00:13:40,740 --> 00:13:42,760
we need to figure out where all the packets start.

288
00:13:46,320 --> 00:13:48,380
There's questions coming at the end, sir,

289
00:13:48,460 --> 00:13:49,720
but I appreciate your enthusiasm.

290
00:13:50,360 --> 00:13:51,660
That is a great question,

291
00:13:51,820 --> 00:13:53,800
and please remember at the end

292
00:13:53,800 --> 00:13:54,920
that we're willing to answer those.

293
00:13:55,760 --> 00:13:56,320
It's okay.

294
00:13:57,160 --> 00:13:57,580
Yep.

295
00:13:58,920 --> 00:14:02,900
One of the interesting things about this one

296
00:14:02,900 --> 00:14:04,780
is if you look at these bits

297
00:14:04,780 --> 00:14:05,700
that are being transmitted,

298
00:14:06,180 --> 00:14:07,020
they're not square.

299
00:14:09,040 --> 00:14:10,600
If you're looking at a wireless fan remote,

300
00:14:10,760 --> 00:14:12,580
they're going to be square because they're pure FM.

301
00:14:12,720 --> 00:14:14,380
They're hopping right between two frequencies.

302
00:14:14,740 --> 00:14:16,060
As soon as that bit changes,

303
00:14:16,180 --> 00:14:17,760
boom, just hops right over the other bit.

304
00:14:18,080 --> 00:14:19,860
The problem with that is it makes your

305
00:14:22,760 --> 00:14:24,380
frequency content really wide,

306
00:14:24,500 --> 00:14:26,540
and if you were here for Balint's excellent talk,

307
00:14:27,100 --> 00:14:29,120
when you start increasing your bit rate,

308
00:14:29,220 --> 00:14:30,660
you start increasing your bandwidth,

309
00:14:30,820 --> 00:14:32,540
and this is something that we're under a constraint

310
00:14:32,540 --> 00:14:33,080
from the FCC.

311
00:14:33,780 --> 00:14:36,880
So, what you do is instead of hopping instantaneously

312
00:14:36,880 --> 00:14:37,720
between frequencies,

313
00:14:39,040 --> 00:14:40,020
you slide between frequencies.

314
00:14:40,140 --> 00:14:41,400
That lowers your spectral content.

315
00:14:41,600 --> 00:14:42,480
As you can see in the bottom,

316
00:14:42,540 --> 00:14:44,100
that's only about nine kilohertz wide.

317
00:14:44,280 --> 00:14:46,820
Easily fits within 12 kilohertz.

318
00:14:47,460 --> 00:14:48,820
So as you look at this,

319
00:14:48,980 --> 00:14:51,000
and remember Tim's the person who taught me

320
00:14:51,000 --> 00:14:52,040
software-defined radios,

321
00:14:52,080 --> 00:14:53,860
so anything I say incorrectly falls on him,

322
00:14:53,960 --> 00:14:57,480
but Guzman modulation is what we're looking at,

323
00:14:57,600 --> 00:14:58,860
and we're, oh wait, is that,

324
00:14:59,020 --> 00:15:00,320
oh, I'm sorry, Gaussian.

325
00:15:00,600 --> 00:15:03,400
But the way this works is it helps us know

326
00:15:03,400 --> 00:15:05,420
that it's something else that we need.

327
00:15:05,420 --> 00:15:07,860
We need that because we need clock recovery.

328
00:15:09,540 --> 00:15:11,660
We need to be able to figure out the timing,

329
00:15:11,820 --> 00:15:12,880
the sequence of these bits,

330
00:15:12,940 --> 00:15:14,720
to be able to turn them into ones and zeros,

331
00:15:14,980 --> 00:15:16,480
and then from those ones and zeros,

332
00:15:16,540 --> 00:15:17,940
we need to be able to make real information.

333
00:15:18,680 --> 00:15:21,800
This part of the packet's called the preamble,

334
00:15:21,900 --> 00:15:23,880
and it's something that most radios

335
00:15:23,880 --> 00:15:24,800
like to do to start out.

336
00:15:24,900 --> 00:15:25,560
It's kind of like, ahem,

337
00:15:25,640 --> 00:15:26,860
it kind of gets everybody's attention,

338
00:15:27,340 --> 00:15:29,460
but it also lets the clock recovery algorithm

339
00:15:29,980 --> 00:15:31,220
sync to each bit.

340
00:15:31,420 --> 00:15:32,600
So what you're looking at here,

341
00:15:35,420 --> 00:15:36,860
let's see if this is going to break everything,

342
00:15:37,060 --> 00:15:37,440
stem plot.

343
00:15:37,700 --> 00:15:39,460
Alright, those are the actual samples,

344
00:15:39,560 --> 00:15:42,160
so if you had an array inside your programming language,

345
00:15:42,360 --> 00:15:43,320
each of those would be a sample.

346
00:15:43,600 --> 00:15:44,920
The problem is we've got to figure out

347
00:15:44,920 --> 00:15:46,580
which one is the one, which one's the zero.

348
00:15:46,820 --> 00:15:49,500
So this is where something that really handy

349
00:15:49,500 --> 00:15:50,500
came in from Andy Walls.

350
00:15:52,140 --> 00:15:54,520
Andy Walls, the stuff that he did,

351
00:15:54,720 --> 00:15:57,120
oh, by the way, this is all GNU radio based,

352
00:15:57,320 --> 00:15:59,520
which means everybody has a chance to play with this.

353
00:15:59,580 --> 00:16:01,440
You don't have to be high end or anything else.

354
00:16:01,600 --> 00:16:02,700
You don't have to be some guru.

355
00:16:03,200 --> 00:16:05,260
Everybody has an opportunity to play with every piece

356
00:16:05,420 --> 00:16:07,440
of this and it will be released so everyone will be able

357
00:16:07,440 --> 00:16:09,180
to do exactly what we do up here.

358
00:16:10,160 --> 00:16:10,960
Even noobs.

359
00:16:13,200 --> 00:16:14,900
Now, we got bad clock recovery.

360
00:16:15,540 --> 00:16:17,220
So Tim, tell us what that means.

361
00:16:18,040 --> 00:16:19,760
So if we have bad clock recovery,

362
00:16:19,900 --> 00:16:21,300
it means we're not going to know what bits

363
00:16:21,300 --> 00:16:22,420
are correct inside our packet.

364
00:16:22,620 --> 00:16:25,680
So you can see here we had 10101010

365
00:16:25,680 --> 00:16:26,480
in the preamble.

366
00:16:26,680 --> 00:16:28,520
We shouldn't see that sloping.

367
00:16:28,560 --> 00:16:31,840
This was the stock clock recovery block

368
00:16:31,840 --> 00:16:32,560
in GNU radio.

369
00:16:33,600 --> 00:16:34,620
Don't make me say that again.

370
00:16:35,660 --> 00:16:37,400
So it didn't do a very good job.

371
00:16:37,960 --> 00:16:39,040
The one that Andy, no.

372
00:16:39,260 --> 00:16:41,700
The one that Andy Walls wrote was much better.

373
00:16:41,800 --> 00:16:43,340
You see how each of those points are

374
00:16:43,340 --> 00:16:45,420
pretty much perfectly on plus or minus one?

375
00:16:45,960 --> 00:16:47,260
That's great clock recovery.

376
00:16:47,500 --> 00:16:49,720
And for these longer packets, these variable length packets,

377
00:16:49,860 --> 00:16:51,500
we really needed to have something

378
00:16:51,500 --> 00:16:52,200
that would be good on that.

379
00:16:52,320 --> 00:16:54,080
So thank you to Andy Walls if you're hearing this.

380
00:16:56,700 --> 00:16:58,880
Now one of the other things that needed to be done

381
00:16:58,880 --> 00:17:00,320
was a way to actually look at this

382
00:17:00,320 --> 00:17:02,380
and spit it out into something that was readable

383
00:17:02,900 --> 00:17:04,780
where you could actually start and stop

384
00:17:04,780 --> 00:17:05,760
where you wanted to.

385
00:17:06,140 --> 00:17:08,480
So Tim came up with this

386
00:17:08,480 --> 00:17:10,600
really cool module for GNU radio

387
00:17:10,600 --> 00:17:12,440
called GR Revenge.

388
00:17:12,580 --> 00:17:14,540
Now let me give you a caveat.

389
00:17:14,740 --> 00:17:16,100
You're going to have to use that

390
00:17:16,620 --> 00:17:17,560
when we release this.

391
00:17:17,600 --> 00:17:19,460
You're going to have to add that to your repositories

392
00:17:19,460 --> 00:17:20,260
and everything from GitHub.

393
00:17:21,240 --> 00:17:23,840
When you look up GR Revenge, what's going to pop up

394
00:17:23,840 --> 00:17:26,040
is girlfriend revenge over and over

395
00:17:26,040 --> 00:17:28,200
because that's apparently the number one search

396
00:17:28,200 --> 00:17:30,080
for Google under GR.

397
00:17:30,380 --> 00:17:32,180
That is not what he wrote.

398
00:17:32,420 --> 00:17:34,480
It is GR Revenge

399
00:17:34,780 --> 00:17:35,200
without an E.

400
00:17:35,340 --> 00:17:36,860
So please find that on GitHub.

401
00:17:38,420 --> 00:17:39,780
It will be an issue.

402
00:17:39,920 --> 00:17:42,060
I promise you when you search it that's what's going to pop up.

403
00:17:42,240 --> 00:17:44,160
Now what we're able to do here

404
00:17:45,640 --> 00:17:46,900
is take the information,

405
00:17:47,280 --> 00:17:48,220
start with a radio,

406
00:17:48,600 --> 00:17:49,360
move it over,

407
00:17:50,100 --> 00:17:51,240
and as we set it up,

408
00:17:51,260 --> 00:17:53,240
because we know there's five channels in the MERS, right?

409
00:17:53,580 --> 00:17:55,480
We break it into five channels.

410
00:17:55,640 --> 00:17:57,180
Not we, him.

411
00:17:58,060 --> 00:18:00,600
Now we break it into that and we make virtual syncs.

412
00:18:00,660 --> 00:18:02,080
The virtual syncs give us the ability

413
00:18:02,080 --> 00:18:03,720
to now continue working our progresses

414
00:18:04,780 --> 00:18:06,640
that each channel does individually.

415
00:18:07,500 --> 00:18:08,640
So if we can look at

416
00:18:08,640 --> 00:18:09,980
all five channels individually,

417
00:18:10,280 --> 00:18:12,140
we can start figuring out

418
00:18:12,140 --> 00:18:13,940
how they work together.

419
00:18:14,300 --> 00:18:16,640
And because we've already started to figure out

420
00:18:16,640 --> 00:18:17,540
there's a command channel,

421
00:18:17,660 --> 00:18:19,800
the command channels tell me where the next place

422
00:18:19,800 --> 00:18:20,720
I need to look at anyway.

423
00:18:21,040 --> 00:18:21,960
And once that happens,

424
00:18:22,000 --> 00:18:23,620
I can ignore the other channels altogether.

425
00:18:25,500 --> 00:18:27,000
So just to run through the

426
00:18:28,300 --> 00:18:29,660
this really quickly.

427
00:18:29,860 --> 00:18:31,820
It looks really complicated

428
00:18:31,820 --> 00:18:33,900
until you start doing FMD modulation enough.

429
00:18:34,780 --> 00:18:35,380
And once you do it enough,

430
00:18:35,460 --> 00:18:37,180
this becomes like this design pattern

431
00:18:37,180 --> 00:18:38,440
that you do over and over and over again.

432
00:18:38,920 --> 00:18:39,840
On the far left,

433
00:18:40,400 --> 00:18:42,100
demodulate it from a radio signal

434
00:18:42,100 --> 00:18:44,380
into something that you can plot out on an oscilloscope.

435
00:18:44,880 --> 00:18:45,600
After that,

436
00:18:45,680 --> 00:18:47,700
you do a low pass filter on it

437
00:18:47,700 --> 00:18:48,980
to make sure there's less noise.

438
00:18:49,600 --> 00:18:50,300
Clock recovery.

439
00:18:51,220 --> 00:18:52,940
Turn it into a bit, one or zero.

440
00:18:53,100 --> 00:18:54,040
And then after that,

441
00:18:54,160 --> 00:18:55,120
look for the packet.

442
00:18:55,360 --> 00:18:58,140
So we had to figure out what the sync word is.

443
00:18:59,200 --> 00:19:01,600
This is a stream of information coming through.

444
00:19:06,560 --> 00:19:06,960
It's a bit of information.

445
00:19:06,960 --> 00:19:08,240
So as far as radios are concerned,

446
00:19:08,320 --> 00:19:09,580
they have to know when a packet begins.

447
00:19:09,760 --> 00:19:11,020
So what they do is they shift

448
00:19:11,460 --> 00:19:13,200
every bit they think they're receiving

449
00:19:13,200 --> 00:19:14,460
into a shift register.

450
00:19:14,900 --> 00:19:17,260
And they look to see when the shift register

451
00:19:17,260 --> 00:19:18,560
equals a magic value.

452
00:19:18,740 --> 00:19:20,160
In this case, it was 2DD4.

453
00:19:21,180 --> 00:19:22,540
And when we found that,

454
00:19:22,620 --> 00:19:24,460
we weren't actually sure if we found that correctly.

455
00:19:24,660 --> 00:19:26,640
So we googled it and we found the data sheet

456
00:19:26,640 --> 00:19:27,900
for the Silicon Labs radio,

457
00:19:28,080 --> 00:19:28,960
which turned out to be really good.

458
00:19:31,480 --> 00:19:32,360
Now one thing,

459
00:19:32,380 --> 00:19:33,640
as you look at this and realize,

460
00:19:34,080 --> 00:19:35,920
spitting the data out and being able to see it,

461
00:19:35,980 --> 00:19:38,140
one of the interesting things that really came out

462
00:19:38,140 --> 00:19:38,800
that Tim found,

463
00:19:39,600 --> 00:19:41,460
which should really go on his counter,

464
00:19:41,560 --> 00:19:42,580
but he didn't put it on here,

465
00:19:42,760 --> 00:19:44,480
is the fact that as he comes through

466
00:19:44,480 --> 00:19:46,000
and he's able to spit this data out

467
00:19:46,000 --> 00:19:47,540
and be able to see what's going on,

468
00:19:47,660 --> 00:19:50,740
he does a great job because initially

469
00:19:51,700 --> 00:19:53,520
we didn't know the full length.

470
00:19:54,080 --> 00:19:55,840
Remember, we've got a lot of information.

471
00:19:55,880 --> 00:19:57,600
We've got back and forth, back and forth

472
00:19:58,960 --> 00:19:59,080
and back and forth.

473
00:20:00,060 --> 00:20:01,340
Initially we didn't realize

474
00:20:02,280 --> 00:20:04,400
we actually have to be able to segregate

475
00:20:04,400 --> 00:20:05,860
the length of the packets

476
00:20:05,860 --> 00:20:08,920
for every step of that communication.

477
00:20:10,800 --> 00:20:13,220
So now, we start looking at this.

478
00:20:14,140 --> 00:20:15,240
And initially we're like,

479
00:20:15,340 --> 00:20:16,840
oh, 11, we're good to go.

480
00:20:16,920 --> 00:20:18,220
We know how long this packet is, right?

481
00:20:18,340 --> 00:20:20,820
Yeah, so we had some issues with that.

482
00:20:20,860 --> 00:20:22,040
That may not have been correct.

483
00:20:23,280 --> 00:20:24,580
So then we come down here like,

484
00:20:24,720 --> 00:20:26,480
oh, well, things are looking a little bit better.

485
00:20:26,640 --> 00:20:27,000
Now,

486
00:20:28,960 --> 00:20:30,080
I want to start figuring something out.

487
00:20:30,180 --> 00:20:31,920
I know that I have a protocol that uses encryption,

488
00:20:32,520 --> 00:20:34,400
but I also know that the same protocol

489
00:20:34,400 --> 00:20:36,240
can be used without using encryption.

490
00:20:36,660 --> 00:20:38,220
What's the first thing we do

491
00:20:38,220 --> 00:20:39,140
to start checking ourselves?

492
00:20:40,180 --> 00:20:42,300
We send information unencrypted

493
00:20:42,300 --> 00:20:44,180
and can we find it inside the packet?

494
00:20:45,000 --> 00:20:45,480
Oh,

495
00:20:47,380 --> 00:20:48,920
so there's 41,

496
00:20:49,220 --> 00:20:50,620
which would be a capital A,

497
00:20:50,700 --> 00:20:53,040
62, which is actually a lower case b,

498
00:20:53,180 --> 00:20:54,440
and then 63, which is c.

499
00:20:54,520 --> 00:20:56,680
And we had just sent that exact same message.

500
00:20:56,880 --> 00:20:58,700
And right next to it in red

501
00:20:58,960 --> 00:21:00,560
it actually gave us the length

502
00:21:00,560 --> 00:21:02,020
of the message.

503
00:21:02,780 --> 00:21:05,220
So if we can transfer this over to the encrypted side,

504
00:21:05,340 --> 00:21:06,620
we can start developing how long

505
00:21:06,620 --> 00:21:08,020
the packets they're sending are.

506
00:21:08,340 --> 00:21:09,980
Now we start looking at everything else

507
00:21:09,980 --> 00:21:12,120
and we start realizing we can count how far it goes

508
00:21:12,120 --> 00:21:14,680
to start figuring out a little bit more information.

509
00:21:16,220 --> 00:21:16,660
Yep.

510
00:21:17,180 --> 00:21:19,440
Eat the elephant one bite at a time.

511
00:21:19,700 --> 00:21:20,140
Now,

512
00:21:20,740 --> 00:21:22,320
you see the one e up there?

513
00:21:22,680 --> 00:21:24,080
So as we looked at one e,

514
00:21:24,720 --> 00:21:26,740
what we realized when we

515
00:21:26,740 --> 00:21:28,880
upped the size of the packet by one

516
00:21:28,960 --> 00:21:30,460
it now became one f.

517
00:21:30,980 --> 00:21:32,660
And Tim informed me that means

518
00:21:32,660 --> 00:21:33,860
it went up by one size.

519
00:21:34,200 --> 00:21:35,420
So I was pretty happy.

520
00:21:35,780 --> 00:21:38,660
Because we had now done a, b, c, and d.

521
00:21:38,900 --> 00:21:41,240
I also watch Sesame Street a lot

522
00:21:41,240 --> 00:21:42,540
so I was like this is probably the

523
00:21:43,080 --> 00:21:44,460
system we should use

524
00:21:44,460 --> 00:21:46,260
because that's what I watch every day.

525
00:21:47,800 --> 00:21:48,240
Alright.

526
00:21:49,200 --> 00:21:50,180
So, um,

527
00:21:50,940 --> 00:21:52,300
I had to tell Woody though that

528
00:21:52,300 --> 00:21:54,560
the next thing after one f was not one g.

529
00:21:54,680 --> 00:21:55,560
It was actually 20.

530
00:21:56,340 --> 00:21:56,780
Alright.

531
00:21:59,440 --> 00:22:00,240
Um, alright.

532
00:22:00,320 --> 00:22:01,540
This is another one of Woody's wins.

533
00:22:02,120 --> 00:22:04,080
I'll have him run the slides for a little bit here.

534
00:22:04,480 --> 00:22:04,880
Um,

535
00:22:06,020 --> 00:22:07,880
so one of the things he called me up on the phone

536
00:22:07,880 --> 00:22:09,060
he was really saying, Tim, Tim,

537
00:22:09,160 --> 00:22:11,100
I just found the next channel they're transmitting on.

538
00:22:11,200 --> 00:22:12,620
It's this bit right here.

539
00:22:12,740 --> 00:22:13,380
It says two.

540
00:22:13,620 --> 00:22:15,680
And then the next channel it transmits on is two.

541
00:22:15,880 --> 00:22:19,200
And I'm like, they could have put those bits anywhere.

542
00:22:19,360 --> 00:22:20,780
This could have been anywhere inside the packet.

543
00:22:21,000 --> 00:22:22,980
And he was just so dang sort of,

544
00:22:23,080 --> 00:22:25,980
and I'm starting to try and learn from my mistakes

545
00:22:25,980 --> 00:22:28,200
of telling Woody he's wrong every time he's actually right.

546
00:22:30,680 --> 00:22:31,900
That's how I remember it going.

547
00:22:32,180 --> 00:22:32,540
Anyways,

548
00:22:32,700 --> 00:22:34,940
if you look at that one that's highlighted right there

549
00:22:34,940 --> 00:22:36,820
in green, the two tells you

550
00:22:36,820 --> 00:22:38,740
that the next packet is going to go on channel two.

551
00:22:39,140 --> 00:22:40,960
And on the second one down here

552
00:22:40,960 --> 00:22:42,620
the three says it's going to be on channel three.

553
00:22:42,740 --> 00:22:44,680
We turned out, turns out we didn't need to know that.

554
00:22:44,940 --> 00:22:46,740
Um, in a single receiver system

555
00:22:46,740 --> 00:22:48,760
that can only look at one channel at a time

556
00:22:48,760 --> 00:22:51,160
it's really important for it to tell the next radio

557
00:22:51,160 --> 00:22:53,060
hey, I'm going to be talking to you over here

558
00:22:53,060 --> 00:22:53,740
you need to go there.

559
00:22:54,120 --> 00:22:56,120
But we're looking at all five channels simultaneously.

560
00:22:56,500 --> 00:22:58,160
So although we found that,

561
00:23:00,080 --> 00:23:01,500
it's just a, you know,

562
00:23:01,540 --> 00:23:03,080
interesting thing to know.

563
00:23:04,500 --> 00:23:06,260
So yeah, I'll give Woody another point for that one.

564
00:23:07,080 --> 00:23:08,380
And so once we've,

565
00:23:08,380 --> 00:23:09,680
so we found the length of the packet,

566
00:23:09,880 --> 00:23:12,980
this is starting to tread into like layer two territory.

567
00:23:13,300 --> 00:23:15,040
So an Ethernet frame,

568
00:23:15,280 --> 00:23:17,080
a lot of times it has this is who it's going to,

569
00:23:17,220 --> 00:23:18,680
it's got a length, it's got a payload,

570
00:23:18,900 --> 00:23:19,640
and then the checksum.

571
00:23:19,900 --> 00:23:21,700
So we're starting to step into layer two territory.

572
00:23:21,900 --> 00:23:24,920
We found, pardon me, we found the synchronization,

573
00:23:25,200 --> 00:23:26,660
we found the length byte

574
00:23:26,660 --> 00:23:27,780
where it's located in the packet,

575
00:23:28,960 --> 00:23:29,320
and then we found out,

576
00:23:31,100 --> 00:23:33,420
just about enough to start trying to find checksums.

577
00:23:33,960 --> 00:23:34,940
This was really hard.

578
00:23:35,080 --> 00:23:36,600
And without a checksum,

579
00:23:36,600 --> 00:23:39,220
we're just going to be looking at a bunch of bits on the screen.

580
00:23:39,380 --> 00:23:41,040
And this is really hard to look at

581
00:23:41,040 --> 00:23:42,720
and figure out who's talking to who.

582
00:23:42,860 --> 00:23:44,740
I don't even know which radio it is,

583
00:23:44,860 --> 00:23:46,540
we have no checksum, if there's any noise,

584
00:23:47,200 --> 00:23:47,840
we're screwed.

585
00:23:48,080 --> 00:23:50,260
So that was kind of me.

586
00:23:50,640 --> 00:23:53,440
And I came in one day

587
00:23:53,440 --> 00:23:56,000
and I found Woody just sitting there with a screen

588
00:23:56,000 --> 00:23:57,520
with packets scrolling across them.

589
00:23:57,600 --> 00:23:58,260
And I'm like, oh hey,

590
00:23:58,960 --> 00:23:59,880
did you dremel the thing apart

591
00:23:59,880 --> 00:24:02,520
and solder down onto the debug wires

592
00:24:02,520 --> 00:24:05,400
and write some thing to analyze the packets?

593
00:24:05,600 --> 00:24:06,020
And he's like,

594
00:24:06,480 --> 00:24:08,840
no, I just plugged into the USB port

595
00:24:08,840 --> 00:24:10,500
and it showed up as TTYUSB.

596
00:24:12,280 --> 00:24:12,860
I mean,

597
00:24:12,880 --> 00:24:15,040
I don't even know why I wrote this whole radio thing.

598
00:24:15,300 --> 00:24:15,660
It's...

599
00:24:16,620 --> 00:24:19,300
Yeah, so he also introduced me to Dumb and Dumber.

600
00:24:19,400 --> 00:24:20,480
I'm a nerd, I don't get out,

601
00:24:20,500 --> 00:24:21,440
I don't watch movies a lot,

602
00:24:21,540 --> 00:24:23,480
so this movie's actually really funny.

603
00:24:25,760 --> 00:24:26,160
Yeah.

604
00:24:27,180 --> 00:24:28,400
So one point for Woody.

605
00:24:28,960 --> 00:24:30,560
We actually got full packets here coming through,

606
00:24:30,720 --> 00:24:33,000
which meant we didn't have to worry about the checksum yet.

607
00:24:33,420 --> 00:24:34,860
That was just something we pushed off

608
00:24:34,860 --> 00:24:36,800
into the back burner while we worked on it later.

609
00:24:37,400 --> 00:24:38,860
I'm gonna pass this off and let you talk.

610
00:24:39,040 --> 00:24:39,440
Okay.

611
00:24:40,040 --> 00:24:41,900
So what was interesting about that is

612
00:24:41,900 --> 00:24:43,940
Tim had been working this clock recovery piece

613
00:24:43,940 --> 00:24:46,640
and he's like, man, I think I really got this,

614
00:24:46,720 --> 00:24:48,000
but I can't confirm it.

615
00:24:48,120 --> 00:24:49,640
Well, now we were able to actually

616
00:24:50,540 --> 00:24:52,740
from the radio see what it said

617
00:24:52,740 --> 00:24:54,480
and then compare his radio to it.

618
00:24:54,560 --> 00:24:56,120
And he's pretty good at writing.

619
00:24:56,360 --> 00:24:58,180
Tim was right.

620
00:24:58,960 --> 00:25:00,200
We're gonna keep that low though

621
00:25:00,200 --> 00:25:01,700
because then he'll put it on his column.

622
00:25:02,920 --> 00:25:04,660
So as we start looking at this,

623
00:25:04,680 --> 00:25:05,980
we start figuring more things out

624
00:25:07,000 --> 00:25:09,380
and we keep getting this Gotenna ID

625
00:25:09,380 --> 00:25:11,280
when we start getting into the serial port.

626
00:25:11,520 --> 00:25:12,640
They call it a GID,

627
00:25:13,400 --> 00:25:14,980
which would basically be the equivalent

628
00:25:14,980 --> 00:25:16,340
of a unique identifier.

629
00:25:16,720 --> 00:25:17,540
Think of anything else.

630
00:25:17,760 --> 00:25:19,900
So as we start looking at unique identifiers,

631
00:25:20,000 --> 00:25:21,600
we keep having these numbers pop up.

632
00:25:22,460 --> 00:25:24,280
Now, as we look at these numbers,

633
00:25:24,920 --> 00:25:26,380
up here where it says TRX

634
00:25:26,380 --> 00:25:28,520
and you see ODB9,

635
00:25:28,960 --> 00:25:30,420
we kept seeing that and we're like,

636
00:25:30,560 --> 00:25:32,900
hey, every time I send to somebody,

637
00:25:33,380 --> 00:25:35,300
it says that first where it says,

638
00:25:35,400 --> 00:25:36,880
hey, you on this channel,

639
00:25:37,460 --> 00:25:38,840
I wanna talk to you.

640
00:25:39,780 --> 00:25:40,160
Okay.

641
00:25:40,840 --> 00:25:41,660
Well, that works.

642
00:25:41,800 --> 00:25:43,920
And we start realizing that we start seeing these packets.

643
00:25:45,120 --> 00:25:46,760
Oh, and now let me tell you,

644
00:25:46,800 --> 00:25:48,000
you know how you start figuring this out

645
00:25:48,000 --> 00:25:49,240
when you just have a whole bunch of numbers

646
00:25:49,240 --> 00:25:50,320
and letters on the screen?

647
00:25:51,640 --> 00:25:54,000
Anyone in here ever heard of a little program called Vim?

648
00:25:54,780 --> 00:25:56,200
Yeah, well, I don't know how to use it.

649
00:25:56,200 --> 00:25:57,360
So we use Get It.

650
00:25:59,400 --> 00:25:59,760
So,

651
00:26:00,520 --> 00:26:01,940
Get It, control F.

652
00:26:02,320 --> 00:26:04,340
So if you're reverse engineering something

653
00:26:04,340 --> 00:26:05,680
and you really wanna have a quick,

654
00:26:05,800 --> 00:26:08,240
easy way to do it, and I'm not insulting anyone on Vim

655
00:26:08,240 --> 00:26:09,520
because I can't spell Vim.

656
00:26:10,000 --> 00:26:11,700
What I use is Get It.

657
00:26:11,980 --> 00:26:13,880
I take Get It, I use control F,

658
00:26:13,940 --> 00:26:15,200
I highlight what I'm looking for

659
00:26:15,640 --> 00:26:17,760
because part of this talk is we wanna help you

660
00:26:17,760 --> 00:26:19,840
learn how to use the basic tools to be able to do this

661
00:26:19,840 --> 00:26:21,920
for the basic person to be able to do it

662
00:26:21,920 --> 00:26:24,100
and for the advanced person then be able to add it

663
00:26:24,100 --> 00:26:25,100
to their advanced systems.

664
00:26:26,200 --> 00:26:28,060
By doing that, we start searching

665
00:26:28,060 --> 00:26:30,140
and seeing where this pops up in all the packets

666
00:26:30,140 --> 00:26:32,040
and man, we keep seeing this

667
00:26:33,780 --> 00:26:34,220
58570D

668
00:26:35,020 --> 00:26:36,080
fecdb, we keep

669
00:26:36,080 --> 00:26:38,000
seeing the hash 16

670
00:26:38,000 --> 00:26:40,000
equals db9

671
00:26:40,000 --> 00:26:41,500
and I keep looking at that and I'm like,

672
00:26:41,560 --> 00:26:43,180
damn, I think I know what that is.

673
00:26:46,120 --> 00:26:47,680
So we found some other stuff.

674
00:26:47,940 --> 00:26:49,320
There's cryptography, so

675
00:26:49,320 --> 00:26:50,820
it's public key cryptography

676
00:26:50,820 --> 00:26:53,280
public key cryptography as well.

677
00:26:53,420 --> 00:26:55,760
So at some point I'm gonna have to exchange my key

678
00:26:56,300 --> 00:26:58,800
So I found this in a message, public key

679
00:26:58,800 --> 00:26:59,960
and it told me what it is

680
00:26:59,960 --> 00:27:01,840
and then I control F for it

681
00:27:01,840 --> 00:27:04,140
and lo and behold it's sitting somewhere down here

682
00:27:04,140 --> 00:27:05,100
in a transmission message.

683
00:27:05,260 --> 00:27:07,560
So we know they're transmitting the Gotenna ID

684
00:27:07,560 --> 00:27:09,480
we know they're transmitting public keys

685
00:27:09,480 --> 00:27:13,220
and that actually helped us even understand

686
00:27:13,220 --> 00:27:14,420
the format of the protocol

687
00:27:14,420 --> 00:27:17,380
because this is 49 byte long

688
00:27:18,020 --> 00:27:19,340
public key, this is a 49

689
00:27:19,980 --> 00:27:20,240
anyways

690
00:27:20,240 --> 00:27:22,720
if you turn 49 into hexadecimal

691
00:27:22,720 --> 00:27:23,620
it turns into 31.

692
00:27:23,620 --> 00:27:25,660
And so we're understanding

693
00:27:25,660 --> 00:27:26,460
even more of this.

694
00:27:26,600 --> 00:27:29,380
A pretty common paradigm for sending

695
00:27:29,380 --> 00:27:31,020
variable length packets is you say

696
00:27:31,020 --> 00:27:32,580
this is what it is, that's the first byte

697
00:27:32,580 --> 00:27:34,940
the next byte's the length, then you have your data

698
00:27:34,940 --> 00:27:35,860
and maybe a checksum.

699
00:27:36,060 --> 00:27:37,760
If you go back to this previous slide

700
00:27:38,280 --> 00:27:41,140
you see where it says 0109

701
00:27:41,140 --> 00:27:42,880
and then the Gotenna ID

702
00:27:43,320 --> 00:27:45,560
01 means Gotenna, there's 9 bytes to it

703
00:27:45,560 --> 00:27:47,820
and you keep going on to find the end of the packet there.

704
00:27:47,920 --> 00:27:49,500
So this helped us really understand

705
00:27:49,500 --> 00:27:50,680
having this debug port

706
00:27:50,680 --> 00:27:53,000
like the, what's it called?

707
00:27:53,620 --> 00:27:54,520
The clock that they found in the desert

708
00:27:54,520 --> 00:27:55,760
that helped them understand Greek.

709
00:27:55,860 --> 00:27:56,960
Thank you.

710
00:27:57,100 --> 00:27:58,400
So I'm also bad with history.

711
00:28:01,040 --> 00:28:02,900
So I wrote a script that would

712
00:28:02,900 --> 00:28:04,800
let you plug two Gotennas in

713
00:28:04,800 --> 00:28:05,680
to the same computer

714
00:28:05,680 --> 00:28:07,840
and it would interleave the serial port streams

715
00:28:07,840 --> 00:28:09,020
and what this meant is

716
00:28:09,020 --> 00:28:11,140
beforehand in the wireless domain

717
00:28:11,140 --> 00:28:13,420
I didn't know which radio was transmitting what

718
00:28:13,420 --> 00:28:14,740
I just got all these packets

719
00:28:14,740 --> 00:28:16,040
I didn't know who was talking

720
00:28:16,040 --> 00:28:19,120
but now I know this radio started the transmission

721
00:28:19,120 --> 00:28:21,020
and the next radio responded to it.

722
00:28:23,620 --> 00:28:24,780
That's Woody's 2.

723
00:28:25,020 --> 00:28:26,600
He's really excited about that.

724
00:28:27,580 --> 00:28:28,020
And

725
00:28:29,560 --> 00:28:31,020
this is kind of

726
00:28:31,020 --> 00:28:32,720
a little obtuse to look at.

727
00:28:32,800 --> 00:28:33,940
So I translated it into English.

728
00:28:34,820 --> 00:28:37,000
So it starts out, the first radio is transmitting

729
00:28:37,000 --> 00:28:38,880
it says, hey I'm looking to talk to a guy

730
00:28:39,420 --> 00:28:41,140
odb9, that's like the short name

731
00:28:41,140 --> 00:28:43,240
for the whole Gotenna ID.

732
00:28:43,440 --> 00:28:45,400
It lets them get away with not transmitting so much

733
00:28:45,400 --> 00:28:46,120
on the control channel.

734
00:28:47,060 --> 00:28:49,160
The next thing that happens, just like Woody and I

735
00:28:49,160 --> 00:28:50,700
sort of hypothesized in the beginning

736
00:28:50,700 --> 00:28:53,140
it meets over on the message channel

737
00:28:53,620 --> 00:28:55,040
this is me, what do you want to say?

738
00:28:55,960 --> 00:28:57,500
Well, here's the problem, if I say

739
00:28:57,500 --> 00:28:59,680
I'm looking to talk to W, how many people in this room

740
00:28:59,680 --> 00:29:00,940
have a name that starts with W?

741
00:29:01,600 --> 00:29:02,780
Alright, we got a couple people.

742
00:29:03,460 --> 00:29:04,120
Woody included.

743
00:29:05,160 --> 00:29:07,420
Everyone's got to meet, I actually have to disambiguate that

744
00:29:07,420 --> 00:29:09,300
and say, okay I actually wanted to talk

745
00:29:09,300 --> 00:29:11,220
to this guy, is that you?

746
00:29:11,340 --> 00:29:13,140
And also, I might need your public key.

747
00:29:13,800 --> 00:29:15,620
Further, the radio goes and responds

748
00:29:16,140 --> 00:29:16,840
here's your key

749
00:29:17,660 --> 00:29:19,480
and then you end up transmitting the data

750
00:29:19,480 --> 00:29:21,560
which, here's the data from this

751
00:29:21,560 --> 00:29:23,460
user and then finally an acknowledgement

752
00:29:23,620 --> 00:29:25,500
so this is a pretty stereotypical

753
00:29:26,720 --> 00:29:28,020
paradigm for transmitting

754
00:29:28,020 --> 00:29:29,360
stuff over a lossy medium

755
00:29:29,360 --> 00:29:30,780
where you're going to lose a packet somewhere

756
00:29:30,780 --> 00:29:32,660
or get a byte corrupted and it's like

757
00:29:32,660 --> 00:29:33,900
I need you to send this again.

758
00:29:34,080 --> 00:29:35,760
Fortunately we're working really close to each other

759
00:29:35,760 --> 00:29:36,820
we didn't have to worry about that.

760
00:29:41,360 --> 00:29:43,040
So now we start looking at this

761
00:29:43,040 --> 00:29:43,920
and we start going wow

762
00:29:45,040 --> 00:29:46,380
so we can see

763
00:29:47,120 --> 00:29:48,260
using the serial port

764
00:29:49,900 --> 00:29:51,260
when each person talks

765
00:29:51,260 --> 00:29:52,260
when they want to send something

766
00:29:53,620 --> 00:29:54,860
it's almost like a golden egg

767
00:29:54,860 --> 00:29:56,400
given by the person that designed the protocol

768
00:29:56,400 --> 00:29:59,720
that it goes 1, 0, hold on a second

769
00:29:59,720 --> 00:30:01,220
even I can figure this one out

770
00:30:01,220 --> 00:30:02,120
remember Sesame Street?

771
00:30:02,700 --> 00:30:05,560
2, 3, 4, 5

772
00:30:06,080 --> 00:30:07,520
4, 5, 6, 7

773
00:30:07,520 --> 00:30:09,220
they start following it into a

774
00:30:09,220 --> 00:30:11,760
sequential order as they start working the packets out

775
00:30:11,760 --> 00:30:13,620
and that was pretty nice to be able to figure out

776
00:30:13,620 --> 00:30:14,280
what's going on.

777
00:30:14,620 --> 00:30:16,260
And as we move to the end of it

778
00:30:16,260 --> 00:30:17,880
we're actually able to see

779
00:30:19,980 --> 00:30:21,620
they start designing out

780
00:30:21,620 --> 00:30:23,480
the packets they're going to use

781
00:30:23,620 --> 00:30:24,880
how big they're going to be

782
00:30:24,880 --> 00:30:26,520
and what sequence they're going to fall into

783
00:30:26,520 --> 00:30:29,660
and yeah header versus payload

784
00:30:30,260 --> 00:30:31,400
so we're like wow

785
00:30:31,400 --> 00:30:32,740
we can work with that

786
00:30:32,740 --> 00:30:34,280
and then we come up

787
00:30:35,240 --> 00:30:37,700
to one of the funner nights of the entire project

788
00:30:38,920 --> 00:30:40,120
this is called

789
00:30:40,120 --> 00:30:41,320
the GID

790
00:30:41,320 --> 00:30:42,460
which we've already said is

791
00:30:42,460 --> 00:30:43,580
the Gotenna identifier

792
00:30:44,420 --> 00:30:46,280
who in this room has ever used a Gotenna?

793
00:30:46,500 --> 00:30:46,940
Anybody?

794
00:30:48,020 --> 00:30:50,220
Can anyone tell me what the default protocol is

795
00:30:50,220 --> 00:30:51,140
for using a Gotenna?

796
00:30:53,620 --> 00:30:55,260
B for your unique identifier

797
00:30:55,260 --> 00:30:57,740
it starts with phone ends with number

798
00:30:57,740 --> 00:30:58,380
that's right

799
00:30:59,540 --> 00:31:00,020
so

800
00:31:01,540 --> 00:31:02,780
so here's the thing

801
00:31:02,780 --> 00:31:04,260
but Tim and I aren't those guys

802
00:31:04,260 --> 00:31:06,120
like we don't use our phone numbers for stuff

803
00:31:06,120 --> 00:31:07,900
because we both have high levels of paranoia

804
00:31:09,320 --> 00:31:11,100
so we always use randomized

805
00:31:11,100 --> 00:31:13,300
so this actually was a setback

806
00:31:13,300 --> 00:31:14,140
for us at first

807
00:31:14,140 --> 00:31:15,820
so we start looking at this and we're like man

808
00:31:16,420 --> 00:31:19,620
we're never finding this 972210

809
00:31:19,620 --> 00:31:21,040
in any of the data

810
00:31:21,040 --> 00:31:22,880
I don't know how they're sending it

811
00:31:23,620 --> 00:31:23,800
wait a minute

812
00:31:23,800 --> 00:31:25,420
maybe we look into the hex

813
00:31:25,420 --> 00:31:27,480
maybe it's some kind of MAC address formula

814
00:31:27,480 --> 00:31:29,520
because obviously whoever wrote this

815
00:31:29,520 --> 00:31:30,740
is going to make sure it's very secure

816
00:31:30,740 --> 00:31:31,920
and a very high end protocol

817
00:31:33,200 --> 00:31:34,460
nah that ain't working

818
00:31:35,080 --> 00:31:36,360
well let's look at it again

819
00:31:36,900 --> 00:31:39,280
maybe there's some kind of sequential ordering

820
00:31:39,280 --> 00:31:40,340
that goes back and forth

821
00:31:40,340 --> 00:31:43,680
and we start kind of pulling our hair out a little bit

822
00:31:43,680 --> 00:31:45,340
and we start going hey what is that

823
00:31:46,440 --> 00:31:47,980
anyone here ever use a thing called

824
00:31:47,980 --> 00:31:48,800
gnome calculator

825
00:31:50,060 --> 00:31:51,880
well hold on before we get to that

826
00:31:53,620 --> 00:31:55,580
so let's just talk about gnome calculator

827
00:31:56,800 --> 00:31:58,060
so gnome calculator

828
00:31:58,060 --> 00:31:58,940
which is in

829
00:31:58,940 --> 00:32:00,880
most Linux systems

830
00:32:00,880 --> 00:32:03,340
it allows you to take like hexadecimal

831
00:32:03,340 --> 00:32:05,560
and transfer it into

832
00:32:05,560 --> 00:32:06,280
other protocols

833
00:32:07,160 --> 00:32:09,700
but we figured there had to be some high end

834
00:32:09,700 --> 00:32:10,940
things being used

835
00:32:10,940 --> 00:32:12,700
so this is what we did

836
00:32:12,700 --> 00:32:15,380
we just jumped out of presentation mode

837
00:32:15,380 --> 00:32:16,700
and said let's just get it on

838
00:32:16,700 --> 00:32:18,180
and just throw things on the screen

839
00:32:21,260 --> 00:32:21,740
yep

840
00:32:22,440 --> 00:32:22,920
oh

841
00:32:23,620 --> 00:32:23,940
yeah

842
00:32:23,940 --> 00:32:26,000
so what Tim was just saying

843
00:32:26,000 --> 00:32:28,560
because again remember he's the guy that helps teach me

844
00:32:28,560 --> 00:32:30,700
so any mistakes I make are his

845
00:32:30,700 --> 00:32:33,540
so we started noticing

846
00:32:33,540 --> 00:32:35,980
you know that whole 9597 sequence

847
00:32:35,980 --> 00:32:37,480
that's a fairly high number

848
00:32:38,940 --> 00:32:39,720
but then

849
00:32:39,720 --> 00:32:41,160
we decided

850
00:32:41,160 --> 00:32:42,300
you know what we're going to do

851
00:32:42,300 --> 00:32:44,560
we're going to use one of the cell phone numbers

852
00:32:44,560 --> 00:32:47,020
just like the default protocol is in Gotenna

853
00:32:47,020 --> 00:32:48,220
and when we did that we were like wow

854
00:32:48,220 --> 00:32:49,580
that's a really little number

855
00:32:49,580 --> 00:32:50,900
that's a little odd

856
00:32:53,620 --> 00:32:54,240
gnome calculator

857
00:32:54,240 --> 00:32:57,360
again please always use basic tools first

858
00:32:57,360 --> 00:32:59,620
because then you can talk to me

859
00:32:59,620 --> 00:33:00,460
and I can understand it

860
00:33:00,460 --> 00:33:04,460
so we throw the information in there

861
00:33:04,460 --> 00:33:05,440
zero one

862
00:33:05,440 --> 00:33:06,720
zero zero zero one

863
00:33:06,720 --> 00:33:08,220
c three eight nine

864
00:33:08,220 --> 00:33:10,880
wait a minute

865
00:33:10,880 --> 00:33:13,000
own shites a biscuit

866
00:33:13,000 --> 00:33:14,100
that's a phone number

867
00:33:15,740 --> 00:33:17,320
your to and from blocks

868
00:33:17,320 --> 00:33:18,700
we know have been identified

869
00:33:18,700 --> 00:33:20,900
and what we realize is they broadcast

870
00:33:20,900 --> 00:33:23,500
if you use your phone number for Gotenna

871
00:33:24,300 --> 00:33:25,680
your phone number

872
00:33:27,120 --> 00:33:28,760
so if any of you do

873
00:33:28,760 --> 00:33:31,420
open source information or technologies

874
00:33:31,420 --> 00:33:32,780
we can talk on the side

875
00:33:32,780 --> 00:33:34,940
but I'm pretty good with phone numbers and Facebook

876
00:33:34,940 --> 00:33:36,420
to be able to figure out who you are

877
00:33:36,420 --> 00:33:37,840
but that's another conversation

878
00:33:38,360 --> 00:33:39,780
how dangerous could it be

879
00:33:42,220 --> 00:33:42,700
oh

880
00:33:43,220 --> 00:33:45,080
well and then we're sitting there

881
00:33:45,080 --> 00:33:46,700
and I was like man

882
00:33:46,700 --> 00:33:48,900
I'm bored and Tim was working on the presentation

883
00:33:48,900 --> 00:33:51,200
and he's an engineer so he like works on things

884
00:33:51,200 --> 00:33:52,620
like really intensely

885
00:33:53,620 --> 00:33:54,780
and I get bored really easy

886
00:33:54,780 --> 00:33:56,300
and I got tired of shaking my keys

887
00:33:56,300 --> 00:33:57,740
because they weren't shiny enough

888
00:33:57,740 --> 00:33:58,340
so I said huh

889
00:33:58,340 --> 00:34:00,780
I took a couple phones and I just started saying

890
00:34:00,780 --> 00:34:03,160
well if I now there is a fix for this

891
00:34:03,160 --> 00:34:06,200
if you use the Gotenna GID random identifier

892
00:34:06,200 --> 00:34:07,200
you know what's going to happen

893
00:34:07,200 --> 00:34:08,240
you get a random identifier

894
00:34:08,240 --> 00:34:10,160
and you don't have to compromise your phone

895
00:34:10,160 --> 00:34:12,180
so Gotenna has put this in there

896
00:34:12,180 --> 00:34:14,400
I want to add this is not a slam on Gotenna

897
00:34:14,400 --> 00:34:16,860
this whole talk I still like Gotenna

898
00:34:16,860 --> 00:34:20,200
I will use Gotenna and I think for what it's designed to do

899
00:34:20,200 --> 00:34:22,540
I think it's great and I want to make sure I add that in there

900
00:34:23,620 --> 00:34:24,020
and I was like man

901
00:34:24,620 --> 00:34:27,320
hey Tim do you think I could make two Gotenna IDs

902
00:34:27,320 --> 00:34:28,620
that are exactly the same

903
00:34:28,620 --> 00:34:31,720
if they're random at some point they'll cross contaminate

904
00:34:31,720 --> 00:34:32,860
and they'd have to be identical

905
00:34:33,620 --> 00:34:34,440
and he's like what are you

906
00:34:34,440 --> 00:34:35,760
stuff doesn't happen like that

907
00:34:37,000 --> 00:34:37,860
so I said

908
00:34:39,320 --> 00:34:40,600
Tim's poking me again

909
00:34:40,600 --> 00:34:42,920
remember he beats me all the time

910
00:34:42,920 --> 00:34:44,980
so what I did was I took two phones

911
00:34:44,980 --> 00:34:46,660
and at the exact same time

912
00:34:46,660 --> 00:34:49,340
I pressed new random identifier

913
00:34:49,340 --> 00:34:50,700
on both of them

914
00:34:51,480 --> 00:34:53,340
and we realized this is a time sequence

915
00:34:55,680 --> 00:34:56,040
now

916
00:34:56,040 --> 00:34:57,640
and then I was like

917
00:34:57,640 --> 00:34:59,180
well what if we go back to what

918
00:34:59,180 --> 00:34:59,880
nineteen

919
00:35:01,320 --> 00:35:02,900
I don't know maybe 1970

920
00:35:03,480 --> 00:35:05,820
a certain month a certain day a certain time

921
00:35:05,820 --> 00:35:06,720
and see what happens

922
00:35:07,260 --> 00:35:07,960
couldn't do it

923
00:35:09,380 --> 00:35:11,040
we could go back to a certain date

924
00:35:11,040 --> 00:35:12,440
and that's the furthest it led to go back

925
00:35:13,000 --> 00:35:14,800
so we could go back to a certain date

926
00:35:14,800 --> 00:35:16,700
and try to set it at the exact same time

927
00:35:16,700 --> 00:35:18,220
but it actually goes all the way to the milliseconds

928
00:35:18,220 --> 00:35:20,160
so we couldn't get the same one

929
00:35:20,580 --> 00:35:22,220
I was a little bummed but that's okay

930
00:35:23,620 --> 00:35:24,100
what I realized is

931
00:35:24,100 --> 00:35:25,780
the year doesn't matter

932
00:35:25,780 --> 00:35:26,740
that's what the nine does

933
00:35:26,740 --> 00:35:29,600
it stops you from having the year important

934
00:35:29,600 --> 00:35:32,320
but the month the day

935
00:35:32,320 --> 00:35:34,900
the time all the way down to the millisecond

936
00:35:35,440 --> 00:35:37,240
that's how you set these identifiers

937
00:35:37,240 --> 00:35:39,040
so you can from someone's identifier

938
00:35:39,040 --> 00:35:41,100
at least know some rough information

939
00:35:41,620 --> 00:35:43,300
so even if I don't have your phone number

940
00:35:43,300 --> 00:35:45,420
I can still pull some rough information out of this

941
00:35:46,240 --> 00:35:47,440
and I can still do

942
00:35:47,440 --> 00:35:48,040
link analysis

943
00:35:49,940 --> 00:35:51,500
Tim those are your words

944
00:35:51,500 --> 00:35:52,000
not mine

945
00:35:55,780 --> 00:35:57,440
so if you've ever seen a movie

946
00:35:57,440 --> 00:35:59,260
where there's like some guy sitting up

947
00:35:59,260 --> 00:36:00,880
with like this wall with all this stuff

948
00:36:00,880 --> 00:36:02,440
and little red lines going there

949
00:36:02,440 --> 00:36:03,420
it's called a crazy wall

950
00:36:03,920 --> 00:36:06,140
and we made our own crazy wall

951
00:36:07,000 --> 00:36:09,620
sorry if you just give me a second to get it open

952
00:36:10,620 --> 00:36:12,040
pulling open my favorite tool here

953
00:36:12,040 --> 00:36:13,600
I'm going to actually need to move this to my monitor

954
00:36:13,600 --> 00:36:14,420
so I can see what I'm doing

955
00:36:14,420 --> 00:36:15,900
so what we ended up doing is

956
00:36:15,900 --> 00:36:18,740
one of our primary tools like we mentioned earlier

957
00:36:18,740 --> 00:36:21,060
sorry about the disjointedness of this presentation

958
00:36:22,440 --> 00:36:23,540
that's kind of the way we work

959
00:36:23,620 --> 00:36:25,960
you don't find things in a linear manner

960
00:36:25,960 --> 00:36:26,960
that would be really nice

961
00:36:26,960 --> 00:36:28,500
but we didn't

962
00:36:32,180 --> 00:36:34,040
so this is our crazy wall

963
00:36:35,420 --> 00:36:37,120
and I'll just show you a couple of things

964
00:36:37,120 --> 00:36:38,500
this is a lot to process

965
00:36:38,500 --> 00:36:40,700
and I don't want to spend a lot of time here

966
00:36:41,940 --> 00:36:43,320
but what we did first is

967
00:36:43,320 --> 00:36:45,400
we started by organizing our packets

968
00:36:45,400 --> 00:36:47,060
by the way they happen

969
00:36:47,060 --> 00:36:48,980
so each one of these little blocks of text

970
00:36:48,980 --> 00:36:49,520
is a communication

971
00:36:50,000 --> 00:36:51,620
and what we started doing is we just started

972
00:36:53,620 --> 00:36:54,400
to make sure that it made sense to us

973
00:36:54,400 --> 00:36:57,200
so remember we had that 0db9

974
00:36:57,680 --> 00:36:59,320
this is what Woody was talking about

975
00:36:59,320 --> 00:37:01,520
we control F for it

976
00:37:01,520 --> 00:37:03,200
and we found it in another part of the packet

977
00:37:03,200 --> 00:37:05,540
and so we used that to create divisions

978
00:37:05,540 --> 00:37:06,740
within the packet structure

979
00:37:06,740 --> 00:37:08,980
and that helped us break the fields out

980
00:37:08,980 --> 00:37:09,760
outside the packet

981
00:37:11,120 --> 00:37:12,320
moving on down

982
00:37:12,320 --> 00:37:13,440
so these are communications

983
00:37:13,440 --> 00:37:16,580
so again 10 was the hello I'd like to talk to you

984
00:37:16,580 --> 00:37:17,880
62 was I'm there

985
00:37:17,880 --> 00:37:21,300
23 was this is the person I actually wanted to talk to

986
00:37:22,100 --> 00:37:23,600
remember this was the gif

987
00:37:23,620 --> 00:37:24,920
this is the ID coming along here

988
00:37:25,660 --> 00:37:27,340
followed by yup that's me

989
00:37:27,760 --> 00:37:29,420
here's the packet and I got it

990
00:37:29,420 --> 00:37:30,060
thank you very much

991
00:37:30,540 --> 00:37:32,020
when you have it in this structure

992
00:37:32,020 --> 00:37:33,480
you can see some interesting things

993
00:37:33,480 --> 00:37:34,280
but not everything

994
00:37:35,440 --> 00:37:37,760
one of the neat ones if I can find it

995
00:37:37,760 --> 00:37:38,400
yeah here it is

996
00:37:39,660 --> 00:37:41,920
this was a long message that got sent

997
00:37:41,920 --> 00:37:44,420
and so if you have a very long message

998
00:37:44,420 --> 00:37:46,460
it gives you a high probability of a bit error

999
00:37:46,460 --> 00:37:49,080
which means your packet is going to get dropped

1000
00:37:49,080 --> 00:37:51,200
so you chop your messages up to smaller packets

1001
00:37:51,200 --> 00:37:52,860
so that you have a better chance of getting through

1002
00:37:53,620 --> 00:37:54,480
so this is part one

1003
00:37:54,480 --> 00:37:56,820
and this was part two of the passage

1004
00:37:57,740 --> 00:37:59,480
but what really helped

1005
00:37:59,480 --> 00:38:02,080
was when we looked at it from a different perspective

1006
00:38:02,080 --> 00:38:03,860
let's gather all the

1007
00:38:05,640 --> 00:38:06,680
transmit announcements

1008
00:38:06,680 --> 00:38:08,080
on the control channel

1009
00:38:08,080 --> 00:38:09,180
let's gather all those together

1010
00:38:09,180 --> 00:38:10,040
and look at them again

1011
00:38:10,040 --> 00:38:12,480
and that helped us see more things

1012
00:38:14,000 --> 00:38:15,940
down here in the packet

1013
00:38:16,520 --> 00:38:17,040
haha

1014
00:38:17,620 --> 00:38:18,060
alright

1015
00:38:19,280 --> 00:38:20,900
so once we started finding that

1016
00:38:20,900 --> 00:38:22,260
type length

1017
00:38:23,660 --> 00:38:24,180
data

1018
00:38:25,580 --> 00:38:26,620
paradigm again

1019
00:38:26,620 --> 00:38:29,300
we saw FBOF

1020
00:38:29,300 --> 00:38:30,520
oh hey look

1021
00:38:30,520 --> 00:38:32,200
there's the Gotenna ID that we found

1022
00:38:32,200 --> 00:38:33,880
we control left and that popped out

1023
00:38:33,880 --> 00:38:36,600
so within the message FB

1024
00:38:36,600 --> 00:38:38,820
that means this is the Gotenna ID

1025
00:38:38,820 --> 00:38:40,240
there's lots of little other things

1026
00:38:40,240 --> 00:38:41,420
that we didn't particularly understand

1027
00:38:41,420 --> 00:38:44,380
here's your message 416263

1028
00:38:44,380 --> 00:38:44,860
that's ABC

1029
00:38:44,860 --> 00:38:48,060
and then at the beginning this one here

1030
00:38:48,060 --> 00:38:49,680
the type 3 wraps the entirety

1031
00:38:49,680 --> 00:38:51,000
of the packet

1032
00:38:53,620 --> 00:38:53,960
this is my crazy wall

1033
00:38:55,860 --> 00:38:57,640
you gotta be careful with crazy walls

1034
00:38:59,120 --> 00:38:59,740
enough said

1035
00:39:01,800 --> 00:39:03,280
so to break the packet apart

1036
00:39:03,280 --> 00:39:05,260
we showed you like all these bytes

1037
00:39:05,260 --> 00:39:06,320
and your eyes are probably blurry

1038
00:39:06,320 --> 00:39:07,060
so were ours

1039
00:39:07,060 --> 00:39:08,340
so to make it simple

1040
00:39:09,000 --> 00:39:10,060
you've got a packet header

1041
00:39:10,060 --> 00:39:11,500
at the start of every packet

1042
00:39:12,320 --> 00:39:13,600
optionally there's a frame

1043
00:39:13,600 --> 00:39:15,340
that shows up at the end of the packet

1044
00:39:15,340 --> 00:39:16,920
which is again the type, length

1045
00:39:16,920 --> 00:39:18,960
and then some checksum at the end of it

1046
00:39:23,620 --> 00:39:25,460
and the message has the type, length, whatever

1047
00:39:25,460 --> 00:39:27,420
so if I type a message to you

1048
00:39:27,420 --> 00:39:29,380
there's several frames that build together

1049
00:39:29,380 --> 00:39:30,580
to form some sort of message

1050
00:39:32,480 --> 00:39:33,540
which brings us

1051
00:39:33,540 --> 00:39:34,140
to this part here

1052
00:39:36,160 --> 00:39:37,580
so as we look at this

1053
00:39:37,580 --> 00:39:39,640
what we would like to see

1054
00:39:39,640 --> 00:39:40,840
versus what we did see

1055
00:39:40,840 --> 00:39:43,360
versus how things work

1056
00:39:44,200 --> 00:39:45,480
your broadcast messages

1057
00:39:45,480 --> 00:39:46,360
are meant for everyone

1058
00:39:46,360 --> 00:39:47,200
let's say there's an emergency

1059
00:39:47,200 --> 00:39:48,420
you want someone to know where you are

1060
00:39:48,420 --> 00:39:51,000
you just send it out, it's not encrypted, everyone can see it

1061
00:39:53,620 --> 00:39:53,640
there's a protocol

1062
00:39:53,640 --> 00:39:55,400
again, I'm not slamming Goten

1063
00:39:55,400 --> 00:39:56,320
I think it's a great thing

1064
00:39:56,320 --> 00:39:58,180
and I don't discourage anyone from using them

1065
00:39:58,180 --> 00:39:59,780
I just want you to understand the difference

1066
00:39:59,780 --> 00:40:02,080
between anonymity and privacy

1067
00:40:02,080 --> 00:40:03,440
and security

1068
00:40:04,440 --> 00:40:05,480
they're different elements

1069
00:40:07,560 --> 00:40:08,960
now, in the broadcast

1070
00:40:08,960 --> 00:40:10,120
you can see everything

1071
00:40:10,120 --> 00:40:11,300
from who's sending it

1072
00:40:11,300 --> 00:40:13,300
to it goes out to everyone

1073
00:40:13,820 --> 00:40:16,680
you can see the initials of who's sending the message

1074
00:40:16,680 --> 00:40:17,940
you can see GPS coordinates

1075
00:40:17,940 --> 00:40:18,860
messages, all that

1076
00:40:23,640 --> 00:40:25,820
but there's actually a little bit more I can see too

1077
00:40:25,820 --> 00:40:27,860
not just the sender

1078
00:40:27,860 --> 00:40:29,600
but I can also see who it's going to

1079
00:40:31,580 --> 00:40:32,960
so early in the conversation

1080
00:40:32,960 --> 00:40:34,680
I can see who it's going to

1081
00:40:35,260 --> 00:40:36,380
and who it's from

1082
00:40:37,760 --> 00:40:39,400
how does this bother us?

1083
00:40:39,660 --> 00:40:41,560
well, because maybe some of that

1084
00:40:41,560 --> 00:40:43,580
could be protected a little bit better

1085
00:40:43,580 --> 00:40:45,180
you don't have to necessarily

1086
00:40:45,180 --> 00:40:47,000
give away both ends of the conversation

1087
00:40:47,520 --> 00:40:48,720
I want you to think a tour

1088
00:40:50,380 --> 00:40:51,960
do we want everyone to know

1089
00:40:51,960 --> 00:40:53,580
where we're starting and where we're going?

1090
00:40:53,620 --> 00:40:55,020
could be dangerous

1091
00:40:55,500 --> 00:40:57,640
so as we move forward and we start looking at this

1092
00:40:57,640 --> 00:40:59,700
we start thinking what would our goals be

1093
00:40:59,700 --> 00:41:00,720
what would we like to see

1094
00:41:00,720 --> 00:41:03,560
we'd like to see a little less information come out of that

1095
00:41:03,560 --> 00:41:04,440
and with that

1096
00:41:05,460 --> 00:41:07,400
initially the name of the program was called

1097
00:41:09,220 --> 00:41:09,660
GoDump

1098
00:41:09,660 --> 00:41:10,960
kind of like arrow dump

1099
00:41:11,520 --> 00:41:13,040
but then we started realizing

1100
00:41:13,040 --> 00:41:15,280
wow, this is a little bit overseeing

1101
00:41:15,280 --> 00:41:17,020
it sees everything going on

1102
00:41:17,020 --> 00:41:18,460
who's sending something

1103
00:41:19,180 --> 00:41:20,540
who's receiving something

1104
00:41:21,080 --> 00:41:22,920
what channel they're going to go to next

1105
00:41:23,620 --> 00:41:24,600
it lets us know

1106
00:41:25,140 --> 00:41:27,060
how big the packet is

1107
00:41:28,440 --> 00:41:29,380
so if I know

1108
00:41:29,380 --> 00:41:30,700
how much information you sent

1109
00:41:31,520 --> 00:41:33,780
where it started from and where it's going to

1110
00:41:33,780 --> 00:41:35,480
would that be of any value

1111
00:41:35,480 --> 00:41:36,040
to anybody?

1112
00:41:37,620 --> 00:41:38,800
if it is, it is

1113
00:41:38,800 --> 00:41:39,640
if it isn't, it isn't

1114
00:41:39,640 --> 00:41:40,520
I'm going to leave it at that

1115
00:41:42,960 --> 00:41:43,720
so now

1116
00:41:44,700 --> 00:41:46,340
what we're going to show you is a little bit about

1117
00:41:46,340 --> 00:41:47,880
how some of the SCAPI plays into this

1118
00:41:47,880 --> 00:41:49,340
so you can see what does it look like

1119
00:41:49,340 --> 00:41:52,920
so what we're going to release

1120
00:41:53,860 --> 00:41:55,680
we want to kind of show you a little bit

1121
00:41:55,680 --> 00:41:56,880
about what it looks like

1122
00:41:56,880 --> 00:41:58,040
and how we put this into place

1123
00:41:58,040 --> 00:42:00,600
going from what we're initially using to SCAPI

1124
00:42:02,720 --> 00:42:03,800
so I'm sure

1125
00:42:03,800 --> 00:42:05,960
all of you guys in here are familiar with SCAPI

1126
00:42:05,960 --> 00:42:08,140
but to explain it a little bit better

1127
00:42:08,140 --> 00:42:09,460
just in case anyone doesn't know

1128
00:42:09,460 --> 00:42:11,720
it's a python framework for understanding packets

1129
00:42:11,720 --> 00:42:12,920
so you give it

1130
00:42:12,920 --> 00:42:15,320
you give it a block of data

1131
00:42:15,320 --> 00:42:16,960
so I've got this here

1132
00:42:16,960 --> 00:42:18,100
I called this variable m

1133
00:42:19,200 --> 00:42:22,300
and you feed that into an object

1134
00:42:22,300 --> 00:42:23,500
and SCAPI

1135
00:42:23,620 --> 00:42:24,840
will pull apart the fields

1136
00:42:24,840 --> 00:42:26,100
as you've told it

1137
00:42:26,100 --> 00:42:29,920
and it will let you access them in a really easy programmatic way

1138
00:42:29,920 --> 00:42:30,560
so

1139
00:42:30,560 --> 00:42:33,120
one of the things you can do here is packet.show

1140
00:42:33,120 --> 00:42:34,940
and so what you're looking at

1141
00:42:34,940 --> 00:42:37,860
it was type 45 packet

1142
00:42:37,860 --> 00:42:39,080
which if you guys remember

1143
00:42:39,760 --> 00:42:41,560
here's the data I'm sending to you

1144
00:42:41,560 --> 00:42:43,740
so it automatically understands that

1145
00:42:43,740 --> 00:42:44,640
it's a message fragment

1146
00:42:45,380 --> 00:42:47,320
it pulled apart the

1147
00:42:47,320 --> 00:42:50,760
the payload down here

1148
00:42:51,640 --> 00:42:53,600
and it separated that

1149
00:42:53,620 --> 00:42:54,100
out for us

1150
00:42:54,560 --> 00:42:55,720
however the payload remember

1151
00:42:55,720 --> 00:42:57,000
it's a multiple step thing

1152
00:42:57,000 --> 00:42:58,980
and so you might need more sequences

1153
00:42:58,980 --> 00:43:01,380
or more fragments to make the complete payload

1154
00:43:01,380 --> 00:43:03,380
I know for a fact that this one was short

1155
00:43:03,380 --> 00:43:04,620
so I'm going to pull it out really quickly

1156
00:43:05,280 --> 00:43:10,020
I'm going to do packet.fragmenter

1157
00:43:10,020 --> 00:43:11,000
you know what

1158
00:43:11,000 --> 00:43:11,720
I can't even remember

1159
00:43:12,540 --> 00:43:13,240
my own code

1160
00:43:13,760 --> 00:43:14,880
so we're not going to do this

1161
00:43:15,800 --> 00:43:17,180
we're just going to show you Sauron

1162
00:43:18,760 --> 00:43:19,120
whatever

1163
00:43:19,120 --> 00:43:21,100
so we're moving to Sauron

1164
00:43:23,560 --> 00:43:24,000
alright

1165
00:43:25,460 --> 00:43:26,740
so you're going to see

1166
00:43:26,740 --> 00:43:27,960
something similar to this in

1167
00:43:27,960 --> 00:43:29,080
because what happened was

1168
00:43:30,540 --> 00:43:33,060
in the beautiful mind he put all this together

1169
00:43:33,060 --> 00:43:34,340
and he actually has it spit it out

1170
00:43:34,340 --> 00:43:35,760
so you have to do zero work

1171
00:43:35,760 --> 00:43:38,320
so do you see where it says press enter to quit

1172
00:43:38,320 --> 00:43:40,200
that's because right now we're live

1173
00:43:40,200 --> 00:43:42,060
and we're going to go ahead and just go live with this

1174
00:43:42,920 --> 00:43:44,480
okay because again

1175
00:43:44,960 --> 00:43:46,260
you probably want to see it

1176
00:43:46,900 --> 00:43:47,540
what's that?

1177
00:43:49,120 --> 00:43:49,900
alright let's just go live

1178
00:43:50,760 --> 00:43:52,140
then we don't have to remember the code

1179
00:43:52,140 --> 00:43:52,500
so

1180
00:43:54,680 --> 00:43:56,280
oh wait a minute what is that

1181
00:43:57,020 --> 00:43:59,320
so Tim just sent a broadcast message

1182
00:44:00,500 --> 00:44:01,300
over Gotenna

1183
00:44:01,300 --> 00:44:02,980
so this would go out to anyone

1184
00:44:02,980 --> 00:44:05,140
so if you had a Gotenna you'd be able to read

1185
00:44:05,140 --> 00:44:05,940
and decrypt this too

1186
00:44:06,460 --> 00:44:08,660
but the simple fact is we now have a listener

1187
00:44:08,660 --> 00:44:09,640
a packet sniffer

1188
00:44:10,340 --> 00:44:12,940
that can listen to all of this and make it happen

1189
00:44:12,940 --> 00:44:14,500
now on top of that

1190
00:44:17,000 --> 00:44:17,820
can't see it?

1191
00:44:19,120 --> 00:44:20,560
I'm going to send another broadcast message

1192
00:44:20,560 --> 00:44:22,480
they can't see it there's nothing up there

1193
00:44:22,480 --> 00:44:22,960
yeah I know

1194
00:44:22,960 --> 00:44:23,800
okay

1195
00:44:26,720 --> 00:44:27,480
Uncheit's a biscuit

1196
00:44:29,020 --> 00:44:29,520
okay

1197
00:44:32,500 --> 00:44:33,000
alright

1198
00:44:33,000 --> 00:44:34,060
sorry I can't

1199
00:44:34,880 --> 00:44:35,560
good enough

1200
00:44:35,560 --> 00:44:37,260
spelling errors are okay

1201
00:44:38,660 --> 00:44:40,880
yeah you're not in any of it

1202
00:44:40,880 --> 00:44:42,060
oh come on Gotenna

1203
00:44:42,060 --> 00:44:42,640
you're not there

1204
00:44:44,220 --> 00:44:45,580
first the demo guy's right

1205
00:44:46,440 --> 00:44:48,040
okay so why he's

1206
00:44:49,340 --> 00:44:50,400
putting that back up

1207
00:44:50,400 --> 00:44:51,960
does anyone in here have a Gotenna

1208
00:44:51,960 --> 00:44:53,660
if you do send a message

1209
00:44:54,340 --> 00:44:56,480
go ahead what's the worst that happens

1210
00:44:56,480 --> 00:44:57,080
let's go live

1211
00:44:57,080 --> 00:44:59,840
everyone with a Gotenna launch as fast as you can

1212
00:44:59,840 --> 00:45:00,240
let's go

1213
00:45:01,520 --> 00:45:03,980
Tim does not want this to happen but I do

1214
00:45:03,980 --> 00:45:04,880
let's see it

1215
00:45:06,000 --> 00:45:08,360
oh if you're using your phone number don't do it

1216
00:45:08,360 --> 00:45:10,140
unless you really want some things to happen

1217
00:45:10,140 --> 00:45:11,100
so Tim

1218
00:45:14,000 --> 00:45:15,600
Tim you're not paired with anything

1219
00:45:15,600 --> 00:45:17,300
no I sent a message out

1220
00:45:21,200 --> 00:45:22,040
I told you

1221
00:45:22,040 --> 00:45:22,920
one more time

1222
00:45:23,540 --> 00:45:23,880
sorry

1223
00:45:26,700 --> 00:45:27,040
sometimes

1224
00:45:27,780 --> 00:45:28,440
things crash

1225
00:45:29,960 --> 00:45:30,740
kids these days

1226
00:45:30,740 --> 00:45:32,920
so hold on

1227
00:45:32,920 --> 00:45:34,040
let me get my Gotenna up

1228
00:45:34,040 --> 00:45:37,400
alright so here's what we're going to do

1229
00:45:37,400 --> 00:45:38,740
we're going to go ahead and look at a couple things

1230
00:45:38,740 --> 00:45:40,320
we're going to launch some Gotennas

1231
00:45:40,320 --> 00:45:41,280
we're going to make some things talk

1232
00:45:41,960 --> 00:45:43,040
and go live with it

1233
00:45:44,780 --> 00:45:45,120
okay

1234
00:45:46,860 --> 00:45:47,960
there we go now

1235
00:45:49,120 --> 00:45:50,780
so again if you have a Gotenna

1236
00:45:50,780 --> 00:45:51,720
please feel free to

1237
00:45:52,360 --> 00:45:54,060
send whatever messages you want

1238
00:45:54,060 --> 00:45:56,240
and we'll just see what happens randomly

1239
00:46:05,800 --> 00:46:07,100
oh you're paired

1240
00:46:07,100 --> 00:46:08,100
that one right there

1241
00:46:10,180 --> 00:46:10,660
okay

1242
00:46:10,660 --> 00:46:11,500
we'll send it

1243
00:46:15,400 --> 00:46:17,380
alright so now he's going to send a message

1244
00:46:17,380 --> 00:46:18,340
Jared is yours up?

1245
00:46:19,900 --> 00:46:20,380
alright

1246
00:46:21,000 --> 00:46:22,540
so we got Jay Boone in the room

1247
00:46:22,540 --> 00:46:23,260
which by the way

1248
00:46:23,260 --> 00:46:25,280
if any of you do software defined radio

1249
00:46:25,280 --> 00:46:27,240
like just amazing work

1250
00:46:27,240 --> 00:46:29,000
he's just incredible

1251
00:46:29,680 --> 00:46:30,160
so

1252
00:46:33,060 --> 00:46:34,100
oh my goodness

1253
00:46:34,100 --> 00:46:35,520
scientific progress going

1254
00:46:35,520 --> 00:46:37,280
maybe too many antennas open

1255
00:46:39,620 --> 00:46:40,520
one more shot

1256
00:46:40,520 --> 00:46:41,440
and then we're going to move on

1257
00:46:42,120 --> 00:46:42,600
yeah

1258
00:46:44,600 --> 00:46:45,280
say again

1259
00:46:46,120 --> 00:46:48,200
what radio are you using? that one

1260
00:46:49,120 --> 00:46:49,460
one more shot

1261
00:46:59,100 --> 00:46:59,820
no it's

1262
00:47:00,340 --> 00:47:01,060
that's not it

1263
00:47:03,380 --> 00:47:05,060
is anyone jamming any of the

1264
00:47:05,060 --> 00:47:05,640
MERS channels?

1265
00:47:11,900 --> 00:47:13,020
alright one more shot

1266
00:47:13,020 --> 00:47:14,480
and then we're going to move on with the talk

1267
00:47:19,940 --> 00:47:21,740
alright so he got the message

1268
00:47:23,460 --> 00:47:24,860
use the old card

1269
00:47:24,860 --> 00:47:26,020
this one's not working

1270
00:47:26,020 --> 00:47:26,620
use the old card

1271
00:47:28,340 --> 00:47:29,380
we're getting the packets

1272
00:47:29,380 --> 00:47:30,380
it's just not working

1273
00:47:30,920 --> 00:47:32,400
alright scientific progress

1274
00:47:32,400 --> 00:47:37,440
we got more time

1275
00:47:37,440 --> 00:47:37,920
go again

1276
00:47:37,920 --> 00:47:38,540
we don't

1277
00:47:39,020 --> 00:47:39,980
no go

1278
00:47:40,940 --> 00:47:41,780
try it again

1279
00:47:41,780 --> 00:47:44,300
okay so what winds up happening is

1280
00:47:45,660 --> 00:47:46,660
wish we had HDMI

1281
00:47:48,080 --> 00:47:49,080
go ahead push it

1282
00:47:54,760 --> 00:47:55,800
here we go

1283
00:47:55,800 --> 00:47:57,600
so we're going to run off the other radio

1284
00:47:57,600 --> 00:47:58,960
so when this is working

1285
00:47:58,960 --> 00:48:01,400
which typically it was up until earlier

1286
00:48:01,400 --> 00:48:02,540
that's why if anyone is

1287
00:48:02,540 --> 00:48:03,320
jamming MERS

1288
00:48:03,320 --> 00:48:04,520
please don't

1289
00:48:06,140 --> 00:48:07,500
so what'll happen is

1290
00:48:07,500 --> 00:48:08,820
it'll actually spit out your message

1291
00:48:08,820 --> 00:48:10,380
so let me tell you what you're going to be able to see

1292
00:48:10,960 --> 00:48:12,240
who sent the message

1293
00:48:12,900 --> 00:48:14,220
who's the message going to

1294
00:48:14,220 --> 00:48:15,940
and how large is the message

1295
00:48:18,660 --> 00:48:19,100
so

1296
00:48:19,100 --> 00:48:20,180
oh wait a minute

1297
00:48:20,180 --> 00:48:22,200
oh shoot what is

1298
00:48:22,200 --> 00:48:24,120
can you go ahead and pull that up a little bit

1299
00:48:25,160 --> 00:48:26,460
it pulled up

1300
00:48:26,960 --> 00:48:28,460
there we go so now we're up again

1301
00:48:28,960 --> 00:48:30,720
so wait what is

1302
00:48:32,340 --> 00:48:32,820
757512

1303
00:48:32,820 --> 00:48:34,720
oh a phone number

1304
00:48:34,720 --> 00:48:37,000
so we're using a burner phone up here

1305
00:48:37,000 --> 00:48:38,840
and the burner phone's phone number is

1306
00:48:38,840 --> 00:48:41,320
although it's not quad zeros at the end

1307
00:48:41,320 --> 00:48:42,900
which we've modified that out

1308
00:48:42,900 --> 00:48:44,040
you get to see

1309
00:48:44,040 --> 00:48:45,840
where it came from

1310
00:48:46,340 --> 00:48:48,960
who it's going to and what it means

1311
00:48:49,100 --> 00:48:50,280
and you see where it says DEFCON

1312
00:48:50,280 --> 00:48:52,780
that's the individual name of the individual

1313
00:48:53,840 --> 00:48:55,680
who has listed that as their name

1314
00:48:55,680 --> 00:48:56,880
so if you said Jeff Wilson

1315
00:48:56,880 --> 00:48:58,140
it would say

1316
00:48:58,880 --> 00:48:59,320
JW

1317
00:48:59,840 --> 00:49:01,740
what we did is made a very long name

1318
00:49:01,740 --> 00:49:04,760
that the first initial of each name spelled out DEFCON

1319
00:49:06,220 --> 00:49:06,660
but

1320
00:49:08,000 --> 00:49:09,020
that's a live demo

1321
00:49:09,020 --> 00:49:09,740
right there

1322
00:49:09,740 --> 00:49:11,280
you're actually able to see it

1323
00:49:12,260 --> 00:49:12,700
so

1324
00:49:15,880 --> 00:49:16,320
so

1325
00:49:16,320 --> 00:49:18,200
sorry that didn't quite work out the way

1326
00:49:19,160 --> 00:49:20,660
but it's a live environment

1327
00:49:20,660 --> 00:49:22,240
so the metadata circle

1328
00:49:22,240 --> 00:49:24,020
this is like a lame thing that I came up with

1329
00:49:24,020 --> 00:49:24,920
to try and explain metadata

1330
00:49:24,920 --> 00:49:26,880
so there's like five different things

1331
00:49:26,880 --> 00:49:29,900
that are being sent out whenever you transmit packets

1332
00:49:29,900 --> 00:49:32,540
who, when, where, how much

1333
00:49:32,540 --> 00:49:33,780
and then the actual content

1334
00:49:36,040 --> 00:49:36,920
with cryptography

1335
00:49:36,920 --> 00:49:38,260
you can kind of get rid of the content

1336
00:49:38,260 --> 00:49:41,020
you can hide that and make it so that people can't see what you're saying

1337
00:49:41,020 --> 00:49:41,940
the who

1338
00:49:41,940 --> 00:49:43,800
that's a little tricky to hide

1339
00:49:43,800 --> 00:49:47,260
because at some point my Gotenna has to say to someone else's Gotenna

1340
00:49:47,260 --> 00:49:48,340
I'm talking to you

1341
00:49:49,180 --> 00:49:50,640
the cryptographic protocols

1342
00:49:50,640 --> 00:49:52,860
can compensate for that

1343
00:49:52,860 --> 00:49:55,380
but it makes it really tough to program

1344
00:49:55,380 --> 00:49:56,000
and it makes

1345
00:49:57,000 --> 00:49:58,480
what's supposed to be simple

1346
00:49:59,060 --> 00:50:00,200
device really complicated

1347
00:50:02,240 --> 00:50:03,680
but that being said

1348
00:50:05,040 --> 00:50:06,380
who it's going to

1349
00:50:06,380 --> 00:50:08,160
we understand why they have that

1350
00:50:08,160 --> 00:50:10,480
who it's coming from we definitely think

1351
00:50:10,480 --> 00:50:11,400
that should be encrypted

1352
00:50:12,060 --> 00:50:14,480
as far as when, where, and how much

1353
00:50:14,480 --> 00:50:16,620
you're not going to get away from transmitting energy

1354
00:50:16,620 --> 00:50:18,400
you have to use energy to send a signal

1355
00:50:19,520 --> 00:50:20,680
there's no getting out of it

1356
00:50:20,680 --> 00:50:23,480
and especially since we're constrained in frequency

1357
00:50:23,480 --> 00:50:24,520
we've only got a particular

1358
00:50:25,020 --> 00:50:25,820
yeah we got it

1359
00:50:25,820 --> 00:50:27,520
we've only got a particular bandwidth

1360
00:50:27,520 --> 00:50:30,820
we have to put all of our energy in that tiny narrow channel

1361
00:50:30,820 --> 00:50:32,620
so we can get a long range

1362
00:50:32,620 --> 00:50:34,460
and that just shows up like a thumb tack

1363
00:50:34,460 --> 00:50:35,740
on the waterfall

1364
00:50:35,740 --> 00:50:38,160
so everyone's going to know when you transmitted

1365
00:50:38,160 --> 00:50:40,000
they're going to know where you transmitted

1366
00:50:40,000 --> 00:50:42,700
because they were with you when they caught that waveform

1367
00:50:43,300 --> 00:50:44,400
and they're also going to know

1368
00:50:44,400 --> 00:50:46,680
how much got transmitted just by the length

1369
00:50:46,680 --> 00:50:49,080
so it's understandable that you can't get away from that

1370
00:50:49,100 --> 00:50:49,680
you can't get away from those things there

1371
00:50:50,920 --> 00:50:52,640
also it's on a mobile device

1372
00:50:52,640 --> 00:50:54,960
I'm not particularly sure that mobile devices

1373
00:50:54,960 --> 00:50:56,080
are the most secure things ever

1374
00:50:56,080 --> 00:50:57,600
I'm not convinced but that's just me

1375
00:50:58,040 --> 00:51:00,060
so we did contact Gotenna and we said

1376
00:51:00,060 --> 00:51:01,880
hey look we'd like to talk to you guys about

1377
00:51:02,340 --> 00:51:05,160
this we think this was maybe perhaps a mistake

1378
00:51:05,160 --> 00:51:05,740
in your design

1379
00:51:06,340 --> 00:51:07,760
and they did come back very

1380
00:51:07,760 --> 00:51:09,140
they were very responsive to us

1381
00:51:09,140 --> 00:51:11,620
they were very welcoming of our analysis

1382
00:51:11,620 --> 00:51:13,520
and our report and they were thankful for it

1383
00:51:13,520 --> 00:51:16,280
and they said right now what we're promising our users

1384
00:51:16,280 --> 00:51:16,880
is encryption

1385
00:51:19,300 --> 00:51:19,700
anonymity

1386
00:51:19,700 --> 00:51:22,740
so they said it's kind of like an envelope

1387
00:51:22,740 --> 00:51:24,360
you can look at the inside of the envelope

1388
00:51:24,360 --> 00:51:26,020
or you can look at the outside of the envelope

1389
00:51:26,020 --> 00:51:27,900
and get to and from but the inside is encrypted

1390
00:51:27,900 --> 00:51:30,660
we didn't really study their cryptography protocol very much

1391
00:51:30,660 --> 00:51:31,780
because we're not cryptographers

1392
00:51:32,740 --> 00:51:35,100
but as far as we can tell they are encrypting it

1393
00:51:35,780 --> 00:51:36,880
just to wrap up

1394
00:51:39,000 --> 00:51:39,400
so

1395
00:51:49,100 --> 00:51:50,680
as we wrap this up we're going to go ahead

1396
00:51:50,680 --> 00:51:52,880
and just talk a little bit more about this

1397
00:51:52,880 --> 00:51:54,860
and we're only going to have a couple questions

1398
00:51:55,660 --> 00:51:56,060
haha

1399
00:51:56,700 --> 00:51:58,600
nice I love seeing the Gotenna traffic

1400
00:51:58,600 --> 00:51:59,920
that's kicking through here right now

1401
00:51:59,920 --> 00:52:01,820
so what we want to be able to tell people is hey

1402
00:52:02,320 --> 00:52:04,960
as you go through and do this there's a couple key features

1403
00:52:04,960 --> 00:52:06,880
that are going to be safe that we want you to think about

1404
00:52:06,880 --> 00:52:09,560
do not use your phone number

1405
00:52:09,560 --> 00:52:09,820
why?

1406
00:52:10,160 --> 00:52:13,320
well that is just going to be a bad day

1407
00:52:14,020 --> 00:52:14,820
there we go

1408
00:52:14,820 --> 00:52:16,240
now we got it kicking up

1409
00:52:16,240 --> 00:52:17,500
so see to and from

1410
00:52:19,100 --> 00:52:20,240
a couple of things that I want you to realize

1411
00:52:21,340 --> 00:52:23,320
Gotenna I think is still a great product

1412
00:52:23,320 --> 00:52:25,940
if I send an encrypted message to somebody

1413
00:52:25,940 --> 00:52:28,720
a couple of things that are going to wind up happening is

1414
00:52:29,580 --> 00:52:30,920
that you're going to have issues

1415
00:52:30,920 --> 00:52:32,380
those issues are

1416
00:52:33,700 --> 00:52:34,980
if you use your phone number

1417
00:52:34,980 --> 00:52:36,200
I'm going to see your phone number

1418
00:52:36,200 --> 00:52:37,200
if you send

1419
00:52:37,200 --> 00:52:37,980
hold on

1420
00:52:37,980 --> 00:52:38,760
pull down

1421
00:52:38,760 --> 00:52:39,760
do you see what that's

1422
00:52:41,320 --> 00:52:43,740
do you see right there where it says location

1423
00:52:45,060 --> 00:52:46,500
what's that that just came across

1424
00:52:46,960 --> 00:52:49,080
somebody just broadcast their actual Latin line

1425
00:52:49,100 --> 00:52:51,360
we can see that if they're using broadcast

1426
00:52:52,540 --> 00:52:54,120
even if they're using encrypted

1427
00:52:54,120 --> 00:52:55,920
we can see who it came from

1428
00:52:55,920 --> 00:52:56,840
who it's going to

1429
00:52:56,840 --> 00:52:57,800
and the size of the packet

1430
00:52:57,800 --> 00:52:59,820
anyone in here that does targeting

1431
00:52:59,820 --> 00:53:01,500
I think you understand what that means

1432
00:53:02,140 --> 00:53:03,600
they were very receptive

1433
00:53:03,600 --> 00:53:05,880
they gave us a code that we can use

1434
00:53:05,880 --> 00:53:07,640
if anyone wants to buy Gotennas

1435
00:53:07,640 --> 00:53:09,740
they gave us a discount for Defcon

1436
00:53:09,740 --> 00:53:11,960
we do not work for Gotenna

1437
00:53:11,960 --> 00:53:13,920
we are not salesmen for anything else

1438
00:53:13,920 --> 00:53:16,260
but part of the responsible disclosure was to tell them

1439
00:53:16,260 --> 00:53:17,560
so they said hey

1440
00:53:19,100 --> 00:53:19,200
thank you

1441
00:53:19,200 --> 00:53:21,020
if anyone wants 15% off

1442
00:53:21,020 --> 00:53:23,320
use this code and you can buy their product

1443
00:53:23,320 --> 00:53:24,860
I'm a big fan of it

1444
00:53:24,860 --> 00:53:27,580
but as you can see

1445
00:53:27,580 --> 00:53:29,020
and we did go live

1446
00:53:29,020 --> 00:53:30,040
we had some recorded video

1447
00:53:30,040 --> 00:53:31,220
but we figured live was better

1448
00:53:31,220 --> 00:53:32,580
because you guys are a pretty impressive crew

1449
00:53:34,820 --> 00:53:37,540
any time if you're a person that designs a protocol

1450
00:53:38,080 --> 00:53:39,840
and you're using command channels

1451
00:53:39,840 --> 00:53:41,580
be careful with exposing

1452
00:53:42,140 --> 00:53:43,440
where you're going to be next

1453
00:53:43,440 --> 00:53:44,460
who you're talking to

1454
00:53:44,460 --> 00:53:46,020
who you are and where it's going to go

1455
00:53:49,100 --> 00:53:49,500
if you're a protestor

1456
00:53:49,500 --> 00:53:50,840
if you're a government person

1457
00:53:50,840 --> 00:53:52,800
if you're anyone that uses this

1458
00:53:52,800 --> 00:53:54,640
realize if I'm a celebrity

1459
00:53:54,640 --> 00:53:56,700
and I walk down the street with a protective detail

1460
00:53:57,900 --> 00:53:59,820
I have security

1461
00:54:00,460 --> 00:54:02,040
if I'm that same celebrity

1462
00:54:02,040 --> 00:54:03,300
and I disguise myself

1463
00:54:03,300 --> 00:54:04,700
and I sit on the corner of the street

1464
00:54:04,700 --> 00:54:06,460
like a homeless person that no one looks at

1465
00:54:06,460 --> 00:54:08,320
I now have anonymity

1466
00:54:08,980 --> 00:54:10,680
but I no longer have security

1467
00:54:11,220 --> 00:54:14,060
just like the celebrity surrounded by a bodyguard detail

1468
00:54:14,060 --> 00:54:15,480
doesn't have anonymity

1469
00:54:15,480 --> 00:54:17,900
the two are not always the same

1470
00:54:20,820 --> 00:54:22,680
security is not anonymity

1471
00:54:22,680 --> 00:54:24,460
and anonymity is not security

1472
00:54:24,460 --> 00:54:26,700
but each can be used to protect

1473
00:54:26,700 --> 00:54:28,440
in certain and individual ways

1474
00:54:30,900 --> 00:54:32,300
yeah further work

1475
00:54:33,460 --> 00:54:34,980
so we have a lot of work

1476
00:54:34,980 --> 00:54:35,680
that's still not done

1477
00:54:35,680 --> 00:54:37,720
we haven't found the checksum yet

1478
00:54:37,720 --> 00:54:38,740
it's kind of embarrassing

1479
00:54:38,740 --> 00:54:40,380
we don't know how the cryptography works

1480
00:54:40,380 --> 00:54:41,360
if you're a cryptographer

1481
00:54:41,360 --> 00:54:42,460
we're going to be putting this online

1482
00:54:42,460 --> 00:54:43,160
in a couple days

1483
00:54:43,160 --> 00:54:45,060
so we'd love your input

1484
00:54:45,660 --> 00:54:48,800
we haven't done anything with group chat or emergency broadcasts

1485
00:54:49,100 --> 00:54:50,880
any of these millions of unknown fields

1486
00:54:50,880 --> 00:54:53,160
so we've got a lot of work to do still

1487
00:54:53,960 --> 00:54:54,860
so I guess

1488
00:54:54,860 --> 00:54:56,800
we've got about five minutes left

1489
00:54:56,800 --> 00:54:58,940
some things that we wanted to talk about

1490
00:54:58,940 --> 00:55:00,480
is just what worked in this project

1491
00:55:00,480 --> 00:55:02,760
if you're new to the security research field

1492
00:55:02,760 --> 00:55:03,620
you're coming into this

1493
00:55:03,620 --> 00:55:05,840
there's some basic skills that are helpful

1494
00:55:06,580 --> 00:55:08,120
the first is know your tools

1495
00:55:08,120 --> 00:55:09,480
cut, grep, sort

1496
00:55:10,540 --> 00:55:12,540
unique, gnome calculator, gedit

1497
00:55:12,920 --> 00:55:14,160
we can have the fancy tools

1498
00:55:14,160 --> 00:55:15,680
with the hundred dollar equipment

1499
00:55:15,680 --> 00:55:17,940
but if you can't use these basic tools

1500
00:55:19,100 --> 00:55:20,240
what uses your equipment

1501
00:55:20,240 --> 00:55:22,320
just like Zero was saying earlier on

1502
00:55:22,920 --> 00:55:23,900
also know your formats

1503
00:55:23,900 --> 00:55:25,880
integers, chars, shorts, floats

1504
00:55:27,020 --> 00:55:28,260
hexadecimal, binary, strings

1505
00:55:28,260 --> 00:55:29,940
know how to convert between the other

1506
00:55:29,940 --> 00:55:31,120
move it around

1507
00:55:31,120 --> 00:55:32,840
we're finishing up, we're nearly done

1508
00:55:33,380 --> 00:55:33,860
automation

1509
00:55:33,860 --> 00:55:36,640
you can do this with some of the tools

1510
00:55:38,020 --> 00:55:38,980
D-Spectrum

1511
00:55:39,980 --> 00:55:41,800
but it's not going to get you too far

1512
00:55:41,800 --> 00:55:42,740
you need automation

1513
00:55:43,820 --> 00:55:45,620
so again, in conclusion

1514
00:55:46,140 --> 00:55:47,580
we appreciate all your time

1515
00:55:49,100 --> 00:55:49,260
if you want to communicate

1516
00:55:49,260 --> 00:55:50,340
no human patterns

1517
00:55:50,840 --> 00:55:52,060
try before you pry

1518
00:55:52,060 --> 00:55:54,020
sometimes you might get that serial port

1519
00:55:54,020 --> 00:55:55,440
before you have to solder into something

1520
00:55:55,440 --> 00:55:57,120
change one thing at a time

1521
00:55:57,120 --> 00:55:58,420
and if nothing else

1522
00:55:58,420 --> 00:56:00,000
if you're a new person out there

1523
00:56:00,000 --> 00:56:01,460
who's never had a chance to speak

1524
00:56:01,460 --> 00:56:03,440
or be in front of a crowd

1525
00:56:04,040 --> 00:56:05,460
submit to the Wireless Village

1526
00:56:05,460 --> 00:56:07,000
because these guys are amazing

1527
00:56:07,000 --> 00:56:08,520
they'll put you out there

1528
00:56:08,520 --> 00:56:09,680
and they'll let you do it

1529
00:56:09,680 --> 00:56:11,460
and they're just good people

1530
00:56:19,100 --> 00:56:20,320
thank you