start	end	text
5750	10610	Hello, welcome to DEFCON 28 Demo Labs.
10610	15490	Today I'm going to show you a tool called Circo, version 2.
16030	20270	Hello, virtual friend. My name is Emilio.
20410	25770	I'm from Argentina, I'm currently located in Japan,
25770	33190	and I have a background of hacking, networks, firewall, packets, electronics,
33190	36350	and a bit of 3D printing as well.
36350	45430	I present tools in various conferences around Asia, US, Europe, a bit of here and there,
45430	51490	and I'm actually 16 hours ahead DEFCON, so I'm in the future.
51850	58870	As you can see, my English is very Argentinian, and I'm definitely not a native programmer.
58870	61530	So, let's move on to Circo.
65420	71280	All right, before I actually move on, let's talk about the legal disclaimer.
71780	76420	This tool is provided for educational, research, or testing purposes.
76420	81740	Using this tool against network systems without permission is illegal.
82100	87200	Radio waves are per country regulated, so you must check your own country
87200	92540	to see if that you're doing within compliant regulations, etc.
93260	98620	I'm not responsible for any good or bad things you do with it, blah, blah, blah.
98620	100080	Okay, great.
100220	103680	Wait, what is Circo version 1 if this is version 2?
104080	112320	All right, so Circo version 1 is actually based on Python 2.
112320	117020	It was a network implant using cheap hardware like Raspberry Pi,
117020	124160	and the idea is to exploit the zero trust that network automation tools have these days.
124260	129160	The whole concept of the network automation tool is to auto-discover things,
129160	130980	like Cisco switches, for example.
131000	132980	So, what about if I am a Cisco switch?
132980	136920	That means that they will try to connect to me to grab my configurations?
137220	138020	Exactly.
138020	144160	So, the whole concept of that was, okay, I build with cheap hardware in Cisco switch,
144160	147200	behavior as a Cisco switch, as a honeypot, basically,
147200	151260	and then I wait for automation tools to connect to me.
151320	155340	So, once they connect to me and they give me the credentials, thank you very much,
155340	160160	I will actually exfiltrate it to the Internet, to my own Internet server.
160420	164160	For that, I come up with a few different techniques for exfiltration,
164820	171200	and also some additions of encryptions and anti-forensics, etc.
171960	177020	Over the past year, well, actually over 2019,
177020	184460	most of the features and techniques used here were actually feedback
184460	188540	from when I was presenting this tool in various conferences and friends
188540	190840	and people suggesting things.
190840	194540	So, it improved over the time.
194540	199580	So, just to show you how it looks actually version 1.
200880	202720	Let me turn off the camera.
202720	209620	So, version 1 used to be like a network outlet that you have these things on top of your desk
209620	212480	or under your desk where you put the network ports here,
212480	215400	and inside was actually things like this, right?
215420	219700	Raspberry Pi and some electronics, buttons, etc.
221960	225480	Also, there's a bigger box of it, similar concept,
225480	228260	the network ports here, right?
228380	233800	And you actually, inside of this, let me see if I can open it like that,
233800	239060	you will have a Raspberry Pi and electronics and PoE, etc, etc.
240200	244280	So, that's pretty much what was done with version 1, right?
247490	250110	Okay, great. Good to know.
251470	254850	So, what's version 2 about it?
254850	261590	Well, basically, Python 2 wasn't supposed to be allegedly end of life, blah, blah, blah,
261590	263290	so it needed to be Python 3.
263390	267630	So, I dedicated time and migrated everything to Python 3,
267630	272290	which is not that simple as replacing Python with Python 3 on the top.
272290	274090	Nope, doesn't work like that.
274090	276990	So, most of the stuff was recoded.
276990	280390	Probably 70-80% of the code was recoded.
280390	283210	So, I took the opportunity and make it modular code.
283270	291530	So, that will allow me to easily add all the features and exfiltration techniques using modular code, right?
291710	296150	Also, I have a couple of features that people suggest over the past.
296150	300710	For example, MAC IP addresses spoofing when you do exfiltration.
300710	309730	Also, I've been suggested to actually, because I'm tapping, I'm man-in-the-middle between a phone and a network,
309730	314810	I also record calls, like getting audio files. I do.
314930	327790	I add support for a tool called netcreds, which actually captures unencrypted credentials or hashes of NTLM, HTTP, SMTP, IMAP, etc.
327790	330950	Kerberos as well, right? FTP, etc.
330950	333570	Yeah, various ones.
333770	339390	I add as well, before I used to use either magnet or push buttons to detect if someone opened the alarm.
339390	343470	And now I'm using LDR, which is a light sensor, basically.
344530	350310	And I add an extra exfiltration method using FM.
350630	356330	Because the phone itself will authenticate, I also collect in that zip authentication hash.
356330	363070	And I add a new camouflage hardware, which will be something very familiar to you.
364850	374350	If you recall, this is a power injector from Cisco, used for phones, also for APs as well.
374590	378570	So I'm actually going to use this as a new camouflage hardware.
378570	384650	Instead of using these boxes, network outlets, I'm going to use one of these.
384650	385650	Why not?
386330	391510	For that, I add also the TCP exfiltration.
391790	397030	Before it used to be HTTP, HTTPS, now it's any TCP port you would like to use.
397030	399270	80, 40, 25, whatever.
399830	405370	Because I'm using a new method for exfiltration, FM, so you will probably need one of these.
405370	408930	Which is actually an SDR dongle, right?
408930	412950	To be able to capture those radio waves.
412950	419070	And also improve a lot of the Cisco IOS and Honeypot.
419070	428750	So the Telnet, when I recode it, I improve the Telnet, the SSH, the CDP and LLDP demos, right?
429390	436900	OK, so let's go back to here, right?
436900	441200	These are all the things that have been added in version 2.
441200	444900	Which will go today, just to recap.
445160	449580	We have what Honeypot will provide as a Cisco services.
449580	455760	Remember, we are trying to emulate the Cisco switch, so we do provide CDP and LLDP advertisements.
456100	460080	As a Cisco switch, or actually phone, if you want to run in single mode.
460080	463780	We also provide an SNMP agent, so you can actually pull.
463780	470880	That's the idea of the automation system, to pull the SNMP communities, SNMP MIPS from the Cisco switch.
470880	479720	So we have one of those, we provide CLI via Telnet and SSH, with quite a few commands.
479840	488100	And also a TCP stack, so when we get fingerprinting, we can actually reply saying that we are a Cisco switch indeed.
489100	500740	For exfiltration, when we exfiltrate data, we actually send it, the Honeypot will send the credentials via Telnet or SSH or SNMP.
500740	503640	So we have different various formats, right?
503640	508760	The T for Telnet, the Telnet enable, the SSH, SSH enable, SNMP.
508760	516960	And also because now we are sniffing credentials, that the actual phone could be cascaded to a PC behind it.
516960	520640	So we are using netcreds, so that will be the end.
520640	527420	And also the zip, which is the voice hashes that we actually capture.
527900	533800	So I didn't want to make this longer, so now demo labs, demo time, right?
536220	543980	Okay, so behind me, you will see I set up a lab, actually.
543980	546800	I will explain you what the lab consists of.
546800	556860	The lab actually has, on this side, this case you see here, this is actually the whole network infrastructure.
557120	561120	I have the blue box on the top, it's actually my internet server.
561120	566680	The yellow box is actually my network automation, so network administration server inside the network.
566680	574100	The Cisco switch, real one, called TK, it's called SH-TKY01.
574100	583800	I also have a black box, which is my file, my proxy, DNS, DHCP, pack file, server, etc.
584400	591640	On this side, I have connected an IP phone, cascaded to a PC, right?
591640	596640	And in the middle, you will see this box, right?
596640	601940	This, which contains one cable going to the phone, the white cable, right?
601940	605660	And the other cable going to the infrastructure, right?
605860	612560	And of course, power, because this is using a magic power cable, right?
613140	615320	Are we good? Yes, okay.
615480	620000	So, let's move on.
622820	628660	Okay, on the right side, I got access to my yellow box, which is my network automation.
628660	635460	On the bottom, I have access to my blue box, which is my internet server, which will be receiving, called CARPA, right?
635460	638120	Will be receiving the credentials from the internet.
638120	644240	And on the top, I have access to the circo, which is actually out of band.
644240	647540	So, first of all, let's start CARPA.
655760	662540	And before I start circo, I want to connect to the real switch.
663220	665980	This is the real circo switch on my infrastructure.
666460	669640	Switch Tokyo 01, show CDP neighbors.
669640	673800	Okay, I have a CDP, which is the phone, actually, that you saw on the back.
675360	676640	LDP.
677740	680880	Nothing, because that phone only speaks CDP.
681040	690120	Right, so, I'm going to start circo on the reverse mode, bridge mode, and actually, maybe, ping, right?
690860	692540	That's an exfiltration.
695020	697860	So, I will explain you before.
698680	707260	Before this happened, what I do is actually collect CDP details and LDP from the actual PR switch, just to get the names.
707260	712240	I'm going to derivate the name, so if... similar name to what already exists.
712580	719120	Okay, I change my MAC address, get an IP address from the server.
722280	737080	I start a few as a sniffer, create a template, and bring all the honeypots, which is all of this, CDP, LDP, IOS, Telnet, SSH, SNMP, and also the name of OS Fuller to the TCP fingerprint.
737660	739720	Service is actually fingerprinted, right?
739720	741780	An exfiltration, I select ping, right?
741780	748100	Okay, so now if I do show CDP neighbor from the real switch, I can see there is another switch here.
748100	751740	Okay, so CDP neighbor details.
751780	762340	I can see the switch is called SWTKY03, has a 10.10.10.152, and is 2960 ATC.
762500	764540	So, what about LLDP?
765500	767140	DP neighbors.
767140	772100	Okay, LLDP as well, I can see the same switch connected via CDP and LLDP.
772100	784840	If I do the details, I can see the chassis, which match the MAC address I'm setting up, the interface, the name, the software version running, and the capabilities from the switch itself.
784840	786940	And the VLAN ID also, right?
786940	790060	Standard LLDP information you get.
791660	794370	Alright, so I'm in my automation tool.
794680	799320	Let's see if I can ping that 152, 10.10.10.152.
799380	801040	Yes, I can ping it.
802240	809600	Alright, so let's try 10.10.10.152.
810420	812420	Okay, I connect.
812500	814080	So let me type.
816320	818600	Username and a password.
818600	820820	Okay, I got access to the Cisco switch.
820820	823000	Show version.
823600	826000	Give me a version of the Cisco switch.
826000	830820	If you see on the circuit itself, it starts to say, sending credentials via ping.
830820	832580	That means that he got credentials.
832580	836440	So those credentials will appear on the bottom screen on Carpa, right?
836440	838140	Because they're coming via ping.
838140	842100	Carpa is on the internet, and Cisco is on the internal network, right?
844460	845900	Show inventory.
846760	848600	Show IP route.
848780	850460	Show interface description.
850460	851540	Behave like a Cisco.
851540	854340	Show IP app.
854340	856220	Show MAC address.
856240	858680	Show status.
860580	861380	Alright?
861380	867360	As you can see on the bottom of the screen, you see that credentials coming from protocolternet.
867360	870320	Username hola, password descon.
870740	871600	You see?
871660	873420	What about if I do enable now?
874160	876060	I can enable as well.
876060	881460	I can do some commands, like show run.
883880	886000	And give me a configuration.
886060	887640	But I cannot do some commands.
887980	893380	I'm not authorizing, because I didn't code the whole iOS honeypot.
893380	896500	Just enough for automation tool to find out.
897480	900220	Similar should work by SSH.
900800	902300	You can see in Carpa.
902300	906200	Now Carpa received a credential via Ternet.
906340	908660	And the credential was secret.
909220	910720	Elite mode, right?
911880	915840	So I can also, I should be able to SSH as well.
921480	924160	Yep, I got this via SSH.
924160	925240	Same thing.
925240	928000	Same commands via SSH and Ternet are provided.
928540	929280	Right?
929600	930800	Inventory.
931360	933500	Also I can put enable.
936760	939320	Again, I get the same commands, right?
943410	945370	So what else we can do?
945370	948070	Well, we can do an SNMP walk, right?
949770	951830	Version 2, community.
951830	953330	Here's a trick, right?
953370	958690	Automation tool will try first their own community, the internal community they use in all devices.
958690	962950	If that fails, they will switch to public, right?
962950	968700	So let's try community.
969100	973140	10.10.10.152, right?
973600	976380	I should escape that.
977460	979060	Wrong key.
982840	990220	So what happened here, you can see on the Carpa in the meantime, that credentials start to arrive.
990640	994780	My pass, SSH, user admin, my pass, right?
994780	1000940	When I do an SNMP walk for this community, I don't get any answer.
1001140	1003260	However, I did capture it.
1004160	1009420	So automation tools will try public if they will fail back to public, right?
1009420	1011620	And if I do that, let me cut it.
1012760	1020220	When I do public, it actually replies as a Cisco switch with the name SWTKY03, right?
1020220	1022320	So it behaves as a Cisco switch.
1023940	1027000	Okay, what else we can try?
1027140	1035960	Oh, by the way, let me show you all those credentials that Carpa is storing in a text file.
1036020	1038380	There you go, the enable password.
1038980	1044100	All those credentials are being stored in a text file, of course, but they're also being pushed to Faraday.
1045280	1052980	So if I log to my Faraday dashboard,
1052980	1060820	if I go to manage, hosts, it will create automatically a host and you also add credentials to it.
1060820	1065380	So you see that host, it has a telnet, the username and the password.
1065840	1068220	The E stands for enable, of course, right?
1069240	1073600	So those are being pushed automatically from Carpa into Faraday, right?
1075480	1076520	Oops.
1078280	1079240	All right.
1080080	1082760	The SNMP did not arrive yet.
1083980	1085880	It should arrive soon.
1086320	1091100	I think I'm cycling the credentials every 60 seconds, 30 seconds, I can't remember.
1091200	1094160	So what about now? Let's try nmap.
1096740	1099920	sv for 10.10.152.
1100220	1103340	And this is funny, you will see some...
1103340	1112840	When I run npm for service enumeration, you may see paramicos and errors here, but there's nothing wrong with it.
1112840	1118880	It's just because this debug mode is showing that, but nothing crashed on Cisco, still running.
1120180	1130840	So once I do the nmap, let's see what nmap say I have running on that 10.10.10.152, which is my fake Cisco switch, right?
1132720	1142020	Okay, so it has recognized I have an SSH and a telnet, which is a Cisco daemons, and also they connect the device as a Cisco IOS router.
1142400	1152560	Not bad. Here you go. I got the community as well here, the SNMP community, and that should be also pushed here.
1152560	1154220	Let me refresh this.
1155080	1157640	No, not pushed yet.
1157640	1161480	It should be coming up.
1165730	1168010	Maybe I need to refresh that.
1171650	1176570	Or maybe I'm excluding, actually, SNMP. Yeah, most likely.
1176890	1180870	I need to add it. Alright, no big deal.
1182470	1184350	Okay, what else?
1185770	1188330	Let's stop this for a second.
1188830	1193010	So those are pretty much all the features that we've been running in the past.
1193010	1197330	So now I'm going to show you the new features we've been working on.
1198030	1204910	First of all, let's bring up Circo with DNS.
1208050	1212290	And I'm going to connect to my PC on the back.
1213190	1215530	I'm going to connect remotely.
1217790	1221010	And I'm going to...
1221010	1228110	So I'm going to generate, this is a PC running on the back, and I'm going to generate some FTP and Kerberos traffic.
1228470	1232330	I'm going to replay some traffic, some pickups, basically.
1232790	1238990	So when I start Cisco, I'm thinking this is minus D, DNS, right? If iteration DNS, for example.
1239290	1243870	And here, it's a starting net cred sniffer, right?
1244230	1250210	So the PC now is using FTP and Kerberos, etc. from the PC, right?
1250210	1255710	So because I'm sniffing the traffic that comes from the PC, I'm also going to exfiltrate that traffic too.
1256950	1260810	That's just running until all the packets run, right?
1262730	1268110	So it clearly finds some credentials, and it gets exfiltrated by DNS.
1268610	1279050	There you go. The end for net creds, username and a password, and the actual FTP and port destination that those credentials work.
1279050	1285870	That's important because here is the source port of the automation tool or whoever connected it, right?
1285870	1289830	But in net creds, I care about the destination.
1292790	1294990	What else I have to show you?
1295850	1297830	I actually should have some...
1299470	1303630	Let's move on into something else, right?
1303630	1306010	Let me cut this. You get the sense.
1307910	1309370	Stop this.
1310750	1311550	Okay.
1311890	1316490	So I'm going to show you the spoofing feature, right?
1319690	1324590	TCP 25 for exfiltration and minus minus spoof, right?
1325550	1328490	For that, I'm going to connect into...
1329270	1330950	I need to specify...
1331550	1339190	I'm going to connect into the gateway, which is a black box on the lab, which is my firewall, right?
1339190	1342370	So I'm filtering for port 25, right?
1342370	1346990	So originally my MAC address is this one, right?
1346990	1350470	And my IP was 152, 10.10.152.
1350470	1354630	But because I specify minus minus spoof, right?
1355050	1358590	I'm actually starting the spoof discovery.
1358590	1367030	What it does is look in the other interface for packets and MAC address combination and use those when I do exfiltration, right?
1368930	1370130	Okay.
1375060	1381200	So for that, I probably... let's see if I can finish one.
1382280	1387160	Okay, I found a MAC address, which is 100 and this MAC address.
1387580	1390040	So I'm 25. So what I'm going to do is...
1390620	1395660	I can ping this, so I'm going to connect again just to generate some credentials.
1401190	1402550	All right.
1402550	1406470	So that should trigger some credentials.
1406470	1410680	And if I check the actual packet captures...
1413530	1416630	Did I hit enter here? No.
1418810	1421930	So I'm capturing packets. There you go.
1421930	1423800	I start to see packets coming in.
1424170	1428350	And as you can see, the source IP is 100.
1428350	1431590	And the actual MAC address is matching.
1431590	1435450	This is actually the PC, the PC behind me, probably.
1438340	1439480	Okay.
1439780	1443220	Something went wrong here.
1443240	1446120	Probably some characters.
1446320	1448340	Let me run it again.
1449320	1450540	Okay.
1450580	1452960	So that is done there.
1452960	1455100	So now I'm going to do is...
1455960	1459520	I'm going to show you the void features, right?
1460460	1461500	Yes.
1461620	1462900	Cancel, cancel.
1463420	1464320	All right.
1464320	1469580	For that, we use DNS and voice.
1469980	1472140	Voip? Voip. I think it's Voip.
1472140	1472900	Yes.
1475500	1478600	For this, I will need the...
1478600	1480360	I will need to make a phone call, actually.
1481420	1482180	Right.
1483280	1486220	Is this phone actually logging?
1491600	1493040	Yep, it is actually.
1493720	1496040	So what I'm going to do...
1505650	1507110	Start Carpa.
1507190	1508910	Exfiltration is DNS.
1509050	1511370	And zip hash collector, right?
1511370	1513610	And RTP captures, okay?
1513610	1515370	So I'm going to make a phone call.
1529610	1530890	Hello?
1530910	1532230	Pick it up.
1533050	1534010	Hello?
1538430	1539930	All right.
1540150	1541490	I make a call.
1541510	1542310	Great.
1542310	1545630	As you can see now, it says sending credentials via DNS.
1545630	1548810	This is because that phone probably sent a zip request.
1548910	1551570	So that means that it's going to get a zip hash, right?
1553190	1553670	So...
1556390	1557310	Here you go.
1557310	1557690	Yeah.
1557690	1558950	Zip credentials, right?
1559410	1561750	So those should be arriving in Carpa.
1561750	1563950	And they should have the format with a V.
1563950	1564950	There you go.
1565290	1567670	This is a zip hash, actually, right?
1567670	1569750	These two pieces.
1569750	1575470	And this is actually the registered zip, the username, and the type of phone system.
1577070	1577670	So...
1578990	1586950	Because we actually keep the captures of the RTP stream and the zip for control,
1586950	1589270	so what we can do...
1589270	1592330	We cannot actually trade these because they are big files,
1592330	1596430	but what we can do is once we pick up Cisco after the assessment,
1596430	1598670	we can actually grab the pickups.
1598670	1599930	And...
1601490	1602850	Pickup to WAP.
1602850	1604690	Pickup to WAP.
1604990	1607890	I'm going to use the RTP stream.
1610010	1611670	And I'm going to use...
1612550	1613990	I can't remember the...
1615190	1616130	Pickup to WAP.
1616130	1617210	Pickup to WAP.
1617210	1618050	What was it?
1618050	1619570	P. Okay.
1621230	1622230	RTP.
1622230	1623070	RTP.
1623070	1623970	RTP.
1623970	1624710	P.
1624950	1625630	And...
1625630	1626490	Mix.
1631200	1632140	Okay.
1632140	1634700	So this will generate the WAP file.
1637400	1641840	I should be able to play it back.
1642320	1645640	Of course I need to extract it, right?
1647260	1647620	So...
1647980	1651920	Let's copy this to my actually...
1651920	1654760	10.10.117...
1659150	1660590	Username as well.
1667140	1668420	It's not.
1669520	1671560	20.10. There you go.
1677360	1678220	Okay.
1678980	1680260	There you go.
1680460	1684340	So if I do play of that file...
1686660	1687680	Hello? Hello?
1689320	1691440	As you can see, there you go.
1691520	1692980	You get your WAP file.
1693440	1694380	Great!
1696160	1696640	So...
1697140	1699500	I got one more feature to show you,
1699500	1700200	which is...
1700200	1704000	Let's bring up Circo, this time with FM and wireless...
1705200	1706400	Exfiltration.
1706820	1708900	But for here...
1708900	1710500	I need to show you...
1712020	1712740	Howla.
1713160	1714740	Howla is actually my...
1716760	1718700	Different computer.
1718700	1721840	Different laptop running a wireless and the SDR dongle.
1722040	1724600	So here I will run this...
1724600	1725240	Verbose.
1725240	1727040	I will specify the frequency.
1727040	1729980	10.7. The wireless interface.
1730300	1732140	And a log file.
1736010	1737130	Alright?
1737610	1741850	So, before I run that, I want you to understand that I'm going to be...
1743070	1745750	Using FM, so I bring up a...
1746950	1749210	Screen so you can see it.
1749490	1750990	Let me bring this up.
1750990	1754130	Channel 10 for wireless and frequency for FM.
1755090	1757030	This is the decoder.
1758470	1760390	And for RDS.
1760390	1762770	Let me do that.
1762950	1764170	Ok.
1768280	1769680	Maybe there.
1769680	1770820	Right.
1771360	1775020	So, now I'm going to...
1776060	1778800	Go back to my screen.
1778860	1782220	And actually start Circo.
1791680	1797120	I'm starting with the wireless and the FM modules on.
1805080	1808260	Let me see if I can do something else here.
1819120	1820060	Alright.
1820060	1821320	This is started.
1821320	1823540	So I'm going to telnet again.
1823940	1826700	And I'm going to put some credentials.
1832560	1833840	Alright.
1834940	1835580	So...
1836160	1837500	Starting exfiltration.
1837500	1840460	So I'm going to switch to my Jaula.
1842160	1844140	You see the silence now?
1845040	1848780	You can see that there is a new station called Circo.
1848780	1851820	With different program types and different PI.
1851820	1855480	This is the RDS type of the FM protocol.
1855480	1858520	Well, not the FM protocol but the RDS protocol.
1858620	1861320	On the bottom you can see I already start to...
1862800	1867160	To actually exfiltrate credentials here.
1869770	1871550	The WiFi one.
1871550	1872350	The telnet.
1872350	1873330	The username.
1873330	1874570	Mundoi.
1874570	1876650	Clearly I typed it wrongly.
1877090	1878810	And also from FM.
1879650	1883570	So you can see both credentials getting from FM and actually...
1884590	1888630	Let me cut it so we are not all deaf.
1888690	1893030	So we get the credentials by FM and actually by wireless as well.
1897970	1899330	Alright.
1899490	1902490	That is pretty much.
1903730	1904410	So...
1904410	1907410	Before we move on I want to explain you about...
1908190	1909700	One more thing.
1911970	1913290	Let me...
1914230	1914890	Go...
1915400	1916390	Here.
1916690	1917570	Ok.
1918110	1919670	Close this.
1921150	1923550	And let's start Circo one more time.
1923550	1924330	Bridge.
1924330	1925350	Spin.
1927980	1932090	There is one more feature which is actually the light sensor, right?
1932090	1935050	So for this I probably will...
1935050	1936810	Need to go to switch.
1936810	1939530	Let me see once Circo start.
1940030	1942090	Carpa is already on.
1943010	1943730	Ok.
1943730	1946710	So I will need to move to...
1946710	1948430	Back camera probably.
1948930	1951410	Once this stuff is up.
1952650	1954390	Yep, it's up.
1955250	1956530	Alright.
1958430	1959530	Ok.
1961090	1961730	So...
1961730	1963450	This is what I'm going to do.
1964930	1967430	I'm going to open this box, right?
1979570	1980530	Ok.
1993830	1995470	Let me see if I can get it...
2001500	2002680	There you go.
2007290	2009390	Ok, what do we have inside?
2010290	2011270	Let me see if...
2011270	2013550	Maybe I do a bit like that.
2014290	2015210	There you go.
2015630	2017690	So we have a Raspberry Pi.
2017990	2019630	Power components.
2020890	2021370	And...
2021370	2024750	On the bottom here we have a light sensor, right?
2031070	2033750	So if I switch back...
2033750	2034430	You will see...
2036010	2038070	Carpa is receiving an alarm.
2038390	2039290	And it actually...
2042570	2043250	Circo...
2043250	2045750	Recognize the case has been opened.
2045750	2046170	Right.
2046170	2047270	Circo.
2048510	2050830	So that's pretty much.
2050830	2053570	So one thing I want to show you guys.
2053590	2055110	It's a magic cable.
2061300	2063500	So the magic cable I told you was...
2064540	2066660	It looked like a cable like that.
2066680	2067360	You know.
2068000	2071180	In Japan they come like that. This is for earth, right?
2073240	2073720	This...
2074280	2076200	This is not a magic cable.
2076200	2077600	There's no magic here.
2078760	2080760	You also can get magic here.
2080760	2082520	This type of cables, right?
2082580	2083560	This is earth.
2083560	2085400	Or the British cables.
2085400	2086860	Which is this one, right?
2086980	2088940	So where the magic come from?
2089060	2090620	Well, the magic is like...
2090620	2092080	I'm using the GPO.
2092080	2094760	A pin in the Raspberry to modulate the FM frequency.
2094760	2096400	And I need basically an antenna.
2096560	2098320	So one way to get an antenna.
2098400	2099600	Is actually...
2099600	2102700	There's an earth cable inside the power cable.
2102840	2104880	So if you look into the...
2104880	2108440	Where that earth cable connect into the...
2108440	2109800	Circo.
2109800	2112260	You will see there's a white cable coming out.
2115950	2117590	This white cable.
2118610	2120970	It come out from earth.
2122330	2125290	And it goes to the GPO of the Raspberry.
2126370	2128550	And that is my earth, right?
2128550	2129970	So that basically...
2134900	2138980	That give me actually a 2-3 meters FM antenna.
2138980	2139440	Which great...
2140940	2142980	Great distance reach.
2143220	2143820	So...
2143820	2146180	This is another method for exfiltrating.
2146180	2152140	When wireless is not an option due to 50-80 meters length, right?
2152140	2154580	You can go longer with FM.
2155340	2156620	All right.
2157820	2159540	That's all, guys.
2161000	2161640	So...
2161640	2164180	I hope you actually enjoy it.
2164180	2166140	And let me know if anything...
2167760	2170560	Questions, just shout out, right?
2172020	2174020	Okay, thanks.
2174460	2175520	See ya.