1
00:00:00,000 --> 00:00:06,080
And then they're halfway into the first question before it actually connects.

2
00:00:07,020 --> 00:00:10,180
There we go.

3
00:00:11,240 --> 00:00:12,260
Nope.

4
00:00:16,240 --> 00:00:21,680
Ella Punk, would you holler at our SpeakerUps channel saying we're going live?

5
00:00:22,360 --> 00:00:23,520
Gotcha.

6
00:00:23,520 --> 00:00:24,980
Thank you.

7
00:00:28,200 --> 00:00:30,280
Gotta find the channel.

8
00:00:30,320 --> 00:00:31,420
Yeah.

9
00:00:32,800 --> 00:00:36,080
One of many, many, many, many, many channels.

10
00:00:38,600 --> 00:00:39,420
Got it.

11
00:00:39,620 --> 00:00:41,760
Hey, cool.

12
00:00:41,760 --> 00:00:42,740
We're live.

13
00:00:42,780 --> 00:00:45,140
So, welcome everyone.

14
00:00:45,140 --> 00:00:47,460
I want to thank everybody for coming to join.

15
00:00:47,480 --> 00:00:49,320
We're sitting here with Cooper.

16
00:00:50,220 --> 00:00:51,700
What's your last name, Cooper?

17
00:00:51,700 --> 00:00:52,760
I had it up here somewhere.

18
00:00:52,760 --> 00:00:53,320
Quinton.

19
00:00:53,320 --> 00:00:54,600
Cooper Quinton.

20
00:00:55,080 --> 00:00:55,700
Yes.

21
00:00:55,700 --> 00:00:56,600
All right.

22
00:00:56,620 --> 00:01:01,960
His presentation was Detecting Fake 4G Base Stations in Real Time.

23
00:01:02,400 --> 00:01:08,140
So, thank you so much for taking the time and effort to put together this DEF CON Talk.

24
00:01:08,300 --> 00:01:14,640
We're in this brave new world where we all get to do things virtually, so thank you very much.

25
00:01:15,160 --> 00:01:16,800
Yeah, thanks for having me.

26
00:01:17,000 --> 00:01:18,060
Absolutely.

27
00:01:18,300 --> 00:01:21,960
So, we've had a few questions come in already.

28
00:01:22,720 --> 00:01:33,620
We'll just get you started with this first one from RPTK2015, who has been watching, I think, all of the talks as we've been going through this.

29
00:01:33,620 --> 00:01:34,520
Question.

30
00:01:34,700 --> 00:01:39,180
If I can see that I'm connected to a fake cell ID, what can I do?

31
00:01:39,180 --> 00:01:41,300
Should I just stop using the internet?

32
00:01:42,800 --> 00:01:47,280
Yeah, that's a great question, and I'll answer it in a couple of parts.

33
00:01:48,380 --> 00:01:53,280
The first thing I'll answer is that if you think that you are connected to...

34
00:01:54,940 --> 00:02:01,920
If you're in a situation where you might be worried about a cell site simulator, the best thing you can do is just put your phone on airplane mode.

35
00:02:02,080 --> 00:02:07,860
And that's always a good idea if you're at a protest or if you're committing a crime.

36
00:02:07,860 --> 00:02:09,280
This is not legal advice.

37
00:02:10,220 --> 00:02:17,820
But if you're doing anything where you don't want to be tracked by your phone, the best thing you can do is just put it in airplane mode.

38
00:02:18,540 --> 00:02:26,360
The question, though, of if you see that you're connected to a rogue cell ID, you're usually not going to see that.

39
00:02:26,440 --> 00:02:36,680
The unfortunate thing about how phones work is that it's actually really hard to tell if you're connected to a cell site simulator.

40
00:02:36,680 --> 00:02:39,640
And so you're usually not going to know.

41
00:02:40,740 --> 00:02:50,040
And a lot of the things that cell site simulators do are similar to the things that cell networks do when they enter failure modes.

42
00:02:50,040 --> 00:02:55,960
So like when an eNodeB crashes or when there's too many people connected to a cell.

43
00:02:56,140 --> 00:03:04,180
So you're likely not going to know, but if you do have that concern, yeah, just put your phone in airplane mode.

44
00:03:04,180 --> 00:03:07,780
And leave it in that until you need to send a text or something.

45
00:03:08,480 --> 00:03:09,160
Airplane mode.

46
00:03:09,160 --> 00:03:09,420
All right.

47
00:03:09,420 --> 00:03:15,200
So there's been a lot of conversation in the past about airplane mode doesn't protect you from a lot of stuff.

48
00:03:15,200 --> 00:03:17,940
Are we thinking that this is still going to be good enough?

49
00:03:17,940 --> 00:03:21,820
Or is this your situation if you don't bring your phone with you?

50
00:03:23,520 --> 00:03:25,680
So, I mean, it depends.

51
00:03:25,680 --> 00:03:27,480
I think it depends on your risk model, right?

52
00:03:27,480 --> 00:03:30,760
It depends what you are concerned about.

53
00:03:31,480 --> 00:03:36,960
I think airplane mode is going to be good enough for most cases and situations.

54
00:03:37,800 --> 00:03:43,180
Because not bringing your phone with you means you can't take pictures of whatever's going on.

55
00:03:43,180 --> 00:03:45,500
It means that you can't make calls.

56
00:03:45,500 --> 00:03:46,980
It means you can't call your friends.

57
00:03:46,980 --> 00:03:49,620
It means you can't call anybody if you're about to get arrested.

58
00:03:50,300 --> 00:03:54,660
I don't know, like, again, I don't know what situation you're planning on taking this out.

59
00:03:54,940 --> 00:03:58,920
But I think airplane mode is good enough for most cases.

60
00:03:58,920 --> 00:04:11,780
And yeah, if you really have high security needs, if you don't want to be displaying any weird patterns of travel, like, yeah, leave your phone at home and leave it on, right?

61
00:04:12,680 --> 00:04:15,500
Then it looks like you're just sitting around at home doing nothing.

62
00:04:15,500 --> 00:04:18,480
So, again, not legal advice.

63
00:04:19,960 --> 00:04:23,560
You know, we had a follow-up that I think a lot of people would find true.

64
00:04:23,560 --> 00:04:25,820
So I'm interested in what you have to say.

65
00:04:25,820 --> 00:04:30,560
Does a VPN offer any protection from a cell site simulator?

66
00:04:30,560 --> 00:04:32,860
And also, what does it not protect against?

67
00:04:32,860 --> 00:04:36,780
For example, GPS data or exploits in pre-authentication messages?

68
00:04:37,820 --> 00:04:39,920
That's a really great question.

69
00:04:40,300 --> 00:04:41,760
Yes, exactly.

70
00:04:42,420 --> 00:04:45,220
It does not protect against those two things.

71
00:04:45,220 --> 00:04:47,480
It doesn't protect against GPS data.

72
00:04:47,480 --> 00:04:54,420
It doesn't protect against exploits in pre-authentication messages, which is where most cell site simulators happen in the first place.

73
00:04:54,420 --> 00:05:10,400
And actually, there was a really... there was a great talk at Black Hat and a really good paper that's out, and I can try to find the link and post it somewhere later, about... so the attack is called... I think it's called ALTER.

74
00:05:10,960 --> 00:05:13,200
Yeah, well, so there's... no, okay, so there's two attacks.

75
00:05:13,200 --> 00:05:15,820
One is called A-L-T-E-R, ALTER.

76
00:05:15,820 --> 00:05:18,780
And then the other attack is called...

77
00:05:19,620 --> 00:05:21,260
Shit, I forgot the name.

78
00:05:21,860 --> 00:05:25,320
And there's another attack, and these are two attacks that allow you in the...

79
00:05:25,320 --> 00:05:37,800
that allow a malicious actor in the pre-authentication stage to manipulate DNS queries being sent to the tower to send back fake...

80
00:05:39,660 --> 00:05:44,740
or to send back fake answers, like to send back malicious DNS answers, right?

81
00:05:44,920 --> 00:05:45,580
Responses.

82
00:05:45,580 --> 00:05:47,280
So there's...

83
00:05:48,380 --> 00:05:54,280
Sorry, so to answer the question, like, a VPN might...

84
00:05:55,040 --> 00:06:01,680
like, it might protect against some eavesdropping attacks, but I don't think it's going to be good enough.

85
00:06:01,680 --> 00:06:20,980
But the other thing is that it seems like, at least in the US, the primary usage for cell-side simulators is to determine who is in a specific place, or in other words, what phones are in a specific place, or to locate a suspect, or to locate somebody,

86
00:06:20,980 --> 00:06:25,980
like, down to what apartment they're in, or down to, you know, what building, right?

87
00:06:26,080 --> 00:06:34,600
And neither of those attacks rely on looking at the person's or people's internet traffic.

88
00:06:34,600 --> 00:06:39,720
They only rely on looking at signals being sent from the phone, and a VPN won't do anything about that.

89
00:06:40,640 --> 00:06:41,680
Interesting.

90
00:06:42,420 --> 00:06:43,680
That makes sense.

91
00:06:43,680 --> 00:06:47,240
So there are some things that you can protect yourself with in this way.

92
00:06:47,240 --> 00:06:52,180
There are some things that are outside the scope of your research in this case.

93
00:06:52,700 --> 00:06:53,540
Yeah.

94
00:06:53,780 --> 00:07:02,960
Well, the natural follow-up question from that is usually one I ask quite a bit further, but then, what's next in this research space?

95
00:07:02,960 --> 00:07:09,340
And if you had more time or money, what could you have done to expand this?

96
00:07:10,020 --> 00:07:12,060
Yeah, that's a great question.

97
00:07:12,060 --> 00:07:23,980
So the thing I would love to have is transmission data.

98
00:07:23,980 --> 00:07:29,820
So I mentioned in my talk that, like, we can't actually connect to the tower, and we can't actually transmit things.

99
00:07:29,820 --> 00:07:35,460
We can't actually, like, send authentication messages to the tower and see how it responds.

100
00:07:35,540 --> 00:07:37,540
We can't look at paging messages, etc.

101
00:07:37,540 --> 00:07:54,720
But if we were able to gain access to licensed hardware, like a licensed 4G baseband and program it ourselves, or gain access to lower-level messages, then it's possible that we could do that.

102
00:07:54,720 --> 00:07:57,940
And that would be an amazing thing to do.

103
00:07:57,940 --> 00:08:05,060
I think the other thing I would like to do in the future is get better heuristics involved in Crocodile Hunters.

104
00:08:05,060 --> 00:08:13,900
So the heuristics that Crocodile Hunter uses right now to determine what's a suspicious tower or not, they're kind of my first pass at that.

105
00:08:13,900 --> 00:08:29,740
And I think that once we know more about what malicious cell towers look like in the wild, we'll be able to get better heuristics to have less false positives in what's suspicious and what's not.

106
00:08:29,740 --> 00:08:36,920
I don't want to stomp all over the wonderful people putting stuff in chat over here, but that is my next follow-up question if it's right into there.

107
00:08:38,300 --> 00:08:44,860
There are people out here with a lot of time and effort and energy and want to get involved in projects.

108
00:08:44,860 --> 00:08:54,240
If somebody wants to get involved in this project, if they build your rig and are doing this, do you want their data?

109
00:08:54,240 --> 00:08:56,920
Is data from other people helpful?

110
00:08:56,920 --> 00:08:58,600
How can people assist?

111
00:08:59,480 --> 00:09:03,240
Yeah, data from other people is absolutely helpful.

112
00:09:03,240 --> 00:09:10,240
And there's actually an API built into Crocodile Hunter to allow you to send your data back to us.

113
00:09:10,600 --> 00:09:14,240
And there's documentation on that in the GitHub repository.

114
00:09:15,900 --> 00:09:23,280
But yeah, if you go do scans, even if you don't find anything, having that data is super helpful.

115
00:09:25,660 --> 00:09:28,460
Yeah, so please go ahead and send it to us.

116
00:09:28,460 --> 00:09:34,880
And please go ahead and get involved on the GitHub and file bugs and pull requests and stuff.

117
00:09:35,120 --> 00:09:41,220
We'll probably eventually set up a chat server somewhere if the project seems popular enough.

118
00:09:42,500 --> 00:09:47,040
A specific question here, specific to an area, so Latin America.

119
00:09:47,040 --> 00:09:52,120
Can you talk about the fake antenna detection project?

120
00:09:53,240 --> 00:09:59,540
Yeah, so I don't want to put words in their mouth too much.

121
00:09:59,540 --> 00:10:00,720
They have a website.

122
00:10:01,960 --> 00:10:05,960
I think it's fadeprojects.org.

123
00:10:05,960 --> 00:10:10,160
Maybe one of you can confirm that real quick.

124
00:10:10,620 --> 00:10:12,940
Or I'll post it later.

125
00:10:13,160 --> 00:10:14,300
So they have a website.

126
00:10:14,300 --> 00:10:24,700
I don't want to put too many words in their mouth, but basically this is a group of technologists, a group of hackers that are in various countries in Latin America.

127
00:10:24,740 --> 00:10:34,620
And they had previously done fake antenna detection with Seaglass, which is a similar project out of the University of Washington, but focused on 2G towers.

128
00:10:34,940 --> 00:10:44,980
And they found some really interesting results in Mexico City and I think in Colombia, if I recall.

129
00:10:45,220 --> 00:10:47,880
So they found some really interesting results in a few different places.

130
00:10:47,880 --> 00:10:55,440
And they're just doing this to see what they can find and to see how widespread the problem of CSS is in Latin America.

131
00:10:55,520 --> 00:11:00,960
And they're planning on doing this with Crocodile Hunter, doing the same research, but next with...

132
00:11:00,960 --> 00:11:02,240
Great.

133
00:11:02,420 --> 00:11:08,060
You get to see where it takes you when you're traveling in other countries.

134
00:11:08,400 --> 00:11:10,960
Yeah, I'm really excited to see what they find.

135
00:11:11,160 --> 00:11:18,760
Probably some interesting questions as well is what's allowed on the Send-Receive if you are in non-US countries?

136
00:11:21,420 --> 00:11:24,000
I am not an international lawyer.

137
00:11:24,000 --> 00:11:25,580
I'm not even a national lawyer.

138
00:11:25,580 --> 00:11:27,140
I'm not any type of lawyer.

139
00:11:27,140 --> 00:11:30,100
So I cannot speak to that.

140
00:11:30,100 --> 00:11:37,920
If you are curious about that, you should ask a lawyer in your country as to what's allowed for Send-Receive.

141
00:11:37,920 --> 00:11:39,800
Because it varies from country to country.

142
00:11:39,800 --> 00:11:40,540
It does.

143
00:11:40,580 --> 00:11:50,980
We were looking at doing this in some Middle Eastern countries and the laws there wouldn't even allow us to receive packets from a cell tower.

144
00:11:53,120 --> 00:11:53,640
So...

145
00:11:54,700 --> 00:11:58,780
There's a bunch of questions that I saw here that I'd be interested to learn a little bit more.

146
00:11:58,780 --> 00:12:03,400
You mentioned briefly in your talk that 5G handles pre-authentication.

147
00:12:03,400 --> 00:12:04,460
I can't speak today.

148
00:12:04,460 --> 00:12:05,740
Pre-authentication.

149
00:12:06,460 --> 00:12:07,540
Thank you.

150
00:12:07,540 --> 00:12:08,820
This never happened.

151
00:12:08,880 --> 00:12:11,180
Messages similar to 4G.

152
00:12:11,180 --> 00:12:17,320
Do you suspect nearly identical cell site simulator techniques will carry over from 4G to 5G?

153
00:12:17,320 --> 00:12:18,260
Cut to it.

154
00:12:21,080 --> 00:12:22,240
Awesome.

155
00:12:22,240 --> 00:12:23,080
Awesome.

156
00:12:23,260 --> 00:12:26,240
Yeah, unfortunately I do.

157
00:12:26,240 --> 00:12:32,740
A lot of the... almost all of the attacks that work against 4G still work against 5G.

158
00:12:32,740 --> 00:12:34,180
There have been...

159
00:12:35,240 --> 00:12:39,940
There have been some mitigations put in place in the standard.

160
00:12:39,940 --> 00:12:46,600
But unfortunately a lot of those mitigations are marked as optional in the standard.

161
00:12:46,600 --> 00:12:52,890
And anything marked as optional means that the phone companies are absolutely not going to do it.

162
00:12:53,820 --> 00:12:58,060
Because they want to spend as little money as possible.

163
00:12:58,140 --> 00:12:59,280
As little effort as possible.

164
00:12:59,280 --> 00:13:02,100
Because phone companies are a giant pile of shit.

165
00:13:02,700 --> 00:13:03,280
So...

166
00:13:06,920 --> 00:13:13,500
So I don't expect that those mitigations will make their way into actual deployment.

167
00:13:13,500 --> 00:13:20,260
And I think that a lot of the same techniques that you see in 4G are going to still work in 5G.

168
00:13:21,040 --> 00:13:22,740
Alright, that's good to know.

169
00:13:22,900 --> 00:13:27,580
I had another question that I think more just shows my ignorance in the subject.

170
00:13:28,000 --> 00:13:33,500
So the kit that you've built in order to do the hardware on this one is...

171
00:13:34,660 --> 00:13:38,220
What, $500 for the radio?

172
00:13:38,220 --> 00:13:41,580
And you've got a Raspberry Pi, which is relatively inexpensive.

173
00:13:41,580 --> 00:13:44,160
And you're carrying around a laptop and all this.

174
00:13:44,580 --> 00:13:48,580
The question that comes to mind on this is...

175
00:13:50,460 --> 00:13:55,900
We all carry around a cell phone that already talks to these devices.

176
00:13:56,600 --> 00:14:01,580
Can cell phones themselves be modified to do any of this work?

177
00:14:02,040 --> 00:14:04,280
Yeah, so that's a great question.

178
00:14:04,280 --> 00:14:06,740
And I would love it if they could.

179
00:14:08,120 --> 00:14:10,520
I have not found a good way to do that.

180
00:14:10,520 --> 00:14:15,160
So we can't do this in a native app.

181
00:14:15,200 --> 00:14:17,460
Because for two reasons.

182
00:14:17,460 --> 00:14:19,760
A, we don't get enough low-level data.

183
00:14:19,820 --> 00:14:25,400
And B, we're only going to see the cells that the phone is actually connecting to.

184
00:14:25,440 --> 00:14:28,340
And the neighbor list of cells that the phone is actually connecting to.

185
00:14:28,340 --> 00:14:30,720
And I want to see all of the cells.

186
00:14:30,720 --> 00:14:33,600
I want to be war-driving 5G towers.

187
00:14:33,800 --> 00:14:38,460
Not just looking at what the cell phone wants to connect to.

188
00:14:39,320 --> 00:14:41,640
And then the other thing is, there's no way...

189
00:14:41,640 --> 00:14:46,760
There's no API for the baseband, right?

190
00:14:46,760 --> 00:14:49,560
And there's no...

191
00:14:50,460 --> 00:14:55,240
I mean, the closest thing to an open-source baseband is in SRS LTE.

192
00:14:55,580 --> 00:15:03,200
There's no open-source baseband, programmable baseband, that runs on an actual licensed 4G chip.

193
00:15:03,200 --> 00:15:07,820
And that's the open-source LTE library?

194
00:15:08,540 --> 00:15:09,740
Yeah, sorry.

195
00:15:09,740 --> 00:15:11,380
So that's the open-source LTE.

196
00:15:11,380 --> 00:15:28,400
SRS LTE is the open-source LTE library that we use in the backend of Crocodile Hunter to actually emulate part of the user equipment, to emulate part of the cell phone, and scan the frequencies and get the information blocks that we need.

197
00:15:28,660 --> 00:15:29,140
Gotcha .

198
00:15:29,600 --> 00:15:37,080
So we are essentially emulating the cell phone, doing part of what a cell phone does, but we're not doing it on cell phone hardware.

199
00:15:37,080 --> 00:15:44,460
And it would be great if we could do that on cell phone hardware, but I don't think that that currently exists.

200
00:15:46,160 --> 00:15:48,180
But it's a good idea.

201
00:15:51,900 --> 00:16:01,700
So Seaglass, the Seaglass project from the University of Washington that I was talking about earlier, is doing that on a phone using the Osmocom baseband for 2G or GSM.

202
00:16:02,060 --> 00:16:07,060
So that does exist for GSM, it just doesn't exist for LTE.

203
00:16:07,560 --> 00:16:08,280
Okay.

204
00:16:08,460 --> 00:16:17,480
But it is a good idea, and if and when it does exist for LTE, it would be great to rebuild Crocodile Hunter using that.

205
00:16:17,840 --> 00:16:20,980
So you're barking up the right tree there, for sure.

206
00:16:23,520 --> 00:16:25,460
What else do we have coming in, LL Bunk?

207
00:16:25,460 --> 00:16:28,000
I can't believe I just used the phrase, barking up the right tree.

208
00:16:28,000 --> 00:16:28,940
Yeah, you did.

209
00:16:30,320 --> 00:16:32,660
This is a very laid-back Q&A.

210
00:16:32,940 --> 00:16:34,520
Back to the alcohol.

211
00:16:35,540 --> 00:16:37,800
And a coffee cup, well done.

212
00:16:38,600 --> 00:16:40,740
Alright, so next question.

213
00:16:42,380 --> 00:16:47,220
You mentioned turning off 2G could help.

214
00:16:47,220 --> 00:16:51,160
Do you know of any progress to create and enable this feature?

215
00:16:57,790 --> 00:17:03,060
I think that there are people within these companies that really want to see this happen.

216
00:17:03,060 --> 00:17:11,340
But I think it's going to be an ongoing battle.

217
00:17:11,760 --> 00:17:26,310
I think that the manufacturers, the OS manufacturers, Samsung, Apple, will need to see that there is a consumer demand for it.

218
00:17:27,510 --> 00:17:38,050
And they're still not likely to turn 2G off completely or even by default because it is still used by so many people around the world, unfortunately.

219
00:17:39,470 --> 00:17:44,270
But even getting a toggle to turn it off, if that's a concern, would be great.

220
00:17:44,270 --> 00:17:55,010
But I think that even though there are people within the companies that really want to see this happen, I think the people at the top of those companies need to see consumer demand for it to really make it a priority.

221
00:17:56,110 --> 00:17:58,510
It's probably a deal all over the place.

222
00:17:59,690 --> 00:18:04,770
The consumer needs to understand that this is the thing that they want before they know how to ask for it.

223
00:18:04,890 --> 00:18:06,430
Yeah, exactly.

224
00:18:08,150 --> 00:18:09,950
Another follow-up is...

225
00:18:12,190 --> 00:18:13,930
I lost my thing on here.

226
00:18:13,930 --> 00:18:15,230
I'm just doing horrible today, guys.

227
00:18:15,230 --> 00:18:15,830
Sorry.

228
00:18:16,490 --> 00:18:17,090
Oh, no.

229
00:18:17,710 --> 00:18:18,890
It's the day.

230
00:18:19,290 --> 00:18:26,010
With disposable phones and burner phones being so readily available, why not buy one of those and give it a try?

231
00:18:29,270 --> 00:18:29,850
Yeah.

232
00:18:29,850 --> 00:18:33,930
I mean, again, I'd say it depends what your threat model is.

233
00:18:35,830 --> 00:18:39,050
Burner phones are really hard to do properly.

234
00:18:40,250 --> 00:18:42,650
There's a lot of things you've got to take into account.

235
00:18:42,650 --> 00:18:49,070
If you want to actually use a burner phone, you have to be able to actually buy it anonymously.

236
00:18:49,070 --> 00:18:51,910
You have to call people that you normally call on it.

237
00:18:51,910 --> 00:18:54,850
You have to stop using it afterwards.

238
00:18:54,850 --> 00:18:56,310
There's a lot there.

239
00:18:56,430 --> 00:19:00,370
Battery has to come out and in at the right place and time.

240
00:19:00,770 --> 00:19:01,950
Yeah, exactly.

241
00:19:04,470 --> 00:19:12,350
Even though it's cheap to buy cell phones these days, it's still not actually, I don't think, trivial to set up a burner phone.

242
00:19:14,290 --> 00:19:17,050
Again, it depends on what your threat model is.

243
00:19:17,050 --> 00:19:26,790
If you just don't want the law enforcement agency in your country to know you're at a protest, I would just put your phone in a lane.

244
00:19:27,410 --> 00:19:36,590
If you really need to be making calls during that protest, but you really don't want them to know you're there, I mean, your chief worry should not be MC catchers.

245
00:19:36,590 --> 00:19:38,210
It should be not getting arrested.

246
00:19:39,110 --> 00:19:40,270
It's not...

247
00:19:40,270 --> 00:19:52,870
I think that MC catchers should actually be fairly far down on your list of threats if you're going to a protest.

248
00:19:52,870 --> 00:19:58,930
And at the top of that should be tear gas and cops beating the shit out of you.

249
00:20:02,130 --> 00:20:03,090
It's not...

250
00:20:05,090 --> 00:20:13,310
And then several other things, like the police taking your phone and doing a forensic analysis of it after you get arrested, and then MC catchers.

251
00:20:13,770 --> 00:20:15,550
So, I don't know.

252
00:20:16,570 --> 00:20:20,470
I think using a burner phone is over-engineering the solution there.

253
00:20:20,470 --> 00:20:23,170
I think you should just put your phone in airplane mode.

254
00:20:23,530 --> 00:20:31,690
Or if you really need to be doing a lot of comms, but you need to be anonymous, then think about that.

255
00:20:31,690 --> 00:20:35,330
But also think about facial recognition and also make sure tattoos are covered up.

256
00:20:35,330 --> 00:20:37,290
Make sure you don't have hair.

257
00:20:39,090 --> 00:20:42,370
Make sure that nobody can find your t-shirt on Etsy.

258
00:20:42,770 --> 00:20:43,470
Exactly.

259
00:20:43,670 --> 00:20:46,270
Make sure you're not wearing a custom mask.

260
00:20:47,530 --> 00:20:50,010
I know we're kind of coming up to the end.

261
00:20:50,010 --> 00:20:51,550
We still have more time.

262
00:20:51,550 --> 00:20:58,150
But a great one is, any suggestions on research avenues for others looking to build off this project on?

263
00:20:58,150 --> 00:21:02,550
Most of this project in the past seems to be around 2G and 3G-based.

264
00:21:02,550 --> 00:21:06,450
So, it would be great to see a project catching up to the latest protocols.

265
00:21:06,950 --> 00:21:08,930
So, that is what we're doing.

266
00:21:10,630 --> 00:21:24,190
That is, in fact, the whole point of the project, is that all the past research has been focused on 2G and 3G, and we're specifically focused on 4G and what the latest iterations of cell-sizing motors like the Hailstorm and the Crossbow.

267
00:21:24,390 --> 00:21:28,610
I think what they're asking specifically is how they can give back, you know, research more on their own.

268
00:21:28,670 --> 00:21:32,130
Sorry, I misunderstood.

269
00:21:33,250 --> 00:21:35,390
Yep, that was the talk.

270
00:21:36,510 --> 00:21:38,590
Yeah, so how you can give back.

271
00:21:41,150 --> 00:21:45,290
Like, we would love people to get involved with the project, right?

272
00:21:46,910 --> 00:21:55,370
We have theories about how these things work based on our research, based on reading the academic papers, right?

273
00:21:55,370 --> 00:21:57,670
And again, a big shout-out to Yamna.

274
00:21:58,830 --> 00:22:02,950
Me and her spent two years reading all of the academic papers.

275
00:22:02,950 --> 00:22:05,610
A lot.

276
00:22:10,270 --> 00:22:11,670
You're probably back.

277
00:22:11,670 --> 00:22:12,410
We had some cutouts.

278
00:22:12,410 --> 00:22:13,090
Okay.

279
00:22:13,490 --> 00:22:14,470
Oh, sorry.

280
00:22:14,470 --> 00:22:17,850
Yeah, so me and Yamna spent a long time reading all...

281
00:22:17,850 --> 00:22:23,730
Yamna wrote a really excellent paper detailing all that we know about the 4G.

282
00:22:24,670 --> 00:22:28,970
And yeah, I mean, but, you know, further research, right?

283
00:22:28,970 --> 00:22:32,270
And, you know, new theories about how they might work.

284
00:22:32,270 --> 00:22:34,330
I mean, FOIA requests, right?

285
00:22:34,570 --> 00:22:40,350
There was a really excellent set of manuals for the Stingray, right?

286
00:22:40,350 --> 00:22:48,310
And if somebody did a similar FOIA request and got manuals for the Hailstorm hospital, like, yeah, that would be excellent.

287
00:22:48,830 --> 00:22:54,730
Well, this is a fantastic time for us to put in here a couple of bits.

288
00:22:54,730 --> 00:22:56,530
So you work for the EFF.

289
00:22:57,070 --> 00:23:06,270
Everybody here should know what the EFF is, but if you are brand new to the InfoSec community, give us just a blurb on the EFF.

290
00:23:06,930 --> 00:23:07,890
Sure.

291
00:23:07,890 --> 00:23:16,750
So EFF, or the Electronic Frontier Foundation, is an organization that defends civil liberties as they intersect with technology.

292
00:23:16,830 --> 00:23:20,050
Or as we say, when you get online, your rights come with you.

293
00:23:20,050 --> 00:23:29,490
You don't lose your rights, you don't lose your human rights, you don't lose your civil liberties, freedom of speech, the right to privacy, free expression, just because you're working with technology.

294
00:23:29,490 --> 00:23:41,390
And so we defend that, and we defend that through a combination of legal strategy, grassroots activism, and technology, like what I work.

295
00:23:42,090 --> 00:23:46,250
So we've been doing this for 30 years now.

296
00:23:46,250 --> 00:23:47,370
30 years this year.

297
00:23:47,370 --> 00:23:49,010
We started in 1990.

298
00:23:49,250 --> 00:24:00,650
And our first case was defending Steve Jackson Games when they had put out a pen and paper RPG called Cyberpunk, which the FBI decided was a manual for hacking.

299
00:24:00,650 --> 00:24:04,530
And they raided Steve Jackson Games and took all of their copies of Cyberpunk.

300
00:24:04,530 --> 00:24:13,090
We were teaching kids how to hack, and we defended them and got their books back because this is a clear freedom of speech issue.

301
00:24:13,450 --> 00:24:17,170
And so that was our first case, and we've been taking on cases ever since then.

302
00:24:17,570 --> 00:24:21,710
So I work specifically in EFF Threat Lab.

303
00:24:21,910 --> 00:24:27,110
Well, I guess you watched my talk where I talked pretty extensively about that, so I won't dig into the EFF Threat Lab.

304
00:24:27,110 --> 00:24:28,350
But that's what EFF is.

305
00:24:28,350 --> 00:24:29,790
We're a non-profit.

306
00:24:29,790 --> 00:24:31,110
We're member-supported.

307
00:24:31,210 --> 00:24:37,550
Over half of our annual budget comes from individual donations from our members, members like you.

308
00:24:38,230 --> 00:24:44,850
Well, Cooper, if I had a little bit of extra money and I wanted to give it to the EFF, how would I do that?

309
00:24:45,410 --> 00:24:50,390
Yeah, so you can buy EFF swag here at DEF CON.

310
00:24:50,390 --> 00:24:58,690
In fact, we even have a special DEF CON Safe Mode EFF shirt that you can only buy during Safe Mode.

311
00:24:58,690 --> 00:24:59,910
You can buy it right now.

312
00:25:00,170 --> 00:25:02,970
And that's at our website, EFF.org.

313
00:25:03,970 --> 00:25:06,850
And I think there's a donate link up there.

314
00:25:06,850 --> 00:25:08,170
There's a shop link up there.

315
00:25:08,170 --> 00:25:12,690
You can go find all of our branded swag and all of our DEF CON swag.

316
00:25:12,690 --> 00:25:15,830
Or you can just donate us money directly from there if you like.

317
00:25:15,830 --> 00:25:21,090
We're also taking donations in Zcash, I think, during DEF CON.

318
00:25:21,090 --> 00:25:24,710
So if you want to donate truly anonymously, you can donate to us through that.

319
00:25:24,810 --> 00:25:33,610
I have no idea how that works, but you can drop into the vendors channel and message the EFF account and set you up.

320
00:25:34,790 --> 00:25:40,990
I also heard a little bit that you are involved in some other things at DEF CON here.

321
00:25:41,010 --> 00:25:44,270
So would you like to talk a little bit about what you have going on later on?

322
00:25:44,270 --> 00:25:45,970
Yeah, I am.

323
00:25:45,970 --> 00:26:01,770
So at 5 o'clock tonight, 1700 Vegas time, we're running the EFF Tech Trivia event.

324
00:26:01,770 --> 00:26:04,450
So I will be the quiz master.

325
00:26:05,130 --> 00:26:08,810
And we will be asking trivia questions.

326
00:26:08,810 --> 00:26:16,310
You can sign up for a team right now if you go to the Discord channel under Contests and Events.

327
00:26:16,310 --> 00:26:17,770
It's EFF Triv.

328
00:26:17,910 --> 00:26:25,910
And you can sign up for a team and we'll ask a bunch of questions and the winning teams will get some free EFF swag.

329
00:26:25,910 --> 00:26:26,850
Great.

330
00:26:26,850 --> 00:26:36,030
Alright, so I'm sure that with all of the stuff that you've been talking about here, there are people who are interested in reaching out and doing more of this work with you.

331
00:26:36,030 --> 00:26:45,450
So we'll have you at the end here post whatever sort of contact information you would like for people to reach out to you with.

332
00:26:45,830 --> 00:26:48,810
Yeah, do you want me to post that in the Talks channel?

333
00:26:48,810 --> 00:26:50,630
Sure, we'll put that in the Talks channel.

334
00:26:51,110 --> 00:26:59,450
And yeah, if there's anybody who has one additional question that you'd like to hit or if... Ella Punk, did you find anything?

335
00:26:59,450 --> 00:27:00,590
Are you sitting on something?

336
00:27:03,410 --> 00:27:04,250
Maybe.

337
00:27:04,690 --> 00:27:05,350
Maybe.

338
00:27:05,350 --> 00:27:07,450
I was having so much fun listening to that.

339
00:27:07,450 --> 00:27:13,550
So I did post links for the shirt and more information on EFF in the group chat.

340
00:27:13,910 --> 00:27:14,550
Awesome.

341
00:27:14,550 --> 00:27:15,450
Thank you, Ella Punk.

342
00:27:15,450 --> 00:27:21,530
So do you have a final call to action for the people who are listening here?

343
00:27:21,710 --> 00:27:24,530
Something you would like them to take away?

344
00:27:25,890 --> 00:27:27,210
I do.

345
00:27:27,510 --> 00:27:34,030
My final call to action is just to get involved with what's going on in your local communities.

346
00:27:34,330 --> 00:27:38,290
As hackers, there's a lot we can do.

347
00:27:38,290 --> 00:27:41,450
There's a lot of problems that we can solve in our smart hackers way.

348
00:27:41,450 --> 00:27:44,170
And we don't always have to solve it through making a new app.

349
00:27:44,170 --> 00:27:49,430
A lot of people working in your community just need help setting up a mailing list, right?

350
00:27:49,530 --> 00:27:53,330
Or just need help setting up a simple static website, right?

351
00:27:53,370 --> 00:27:56,230
But there's also more creative problems to solve.

352
00:27:56,230 --> 00:28:02,650
Like I think the thing about using leaf blowers to blow away tear gas is very much in the hacker spirit, right?

353
00:28:02,650 --> 00:28:04,850
It's such a great thing to see.

354
00:28:04,850 --> 00:28:07,850
So I think that there's a lot of ways to get involved.

355
00:28:08,110 --> 00:28:14,150
You can also get involved with other EFF-minded people in your community by checking out the Electronic Frontier Alliance.

356
00:28:14,170 --> 00:28:23,510
Which is a group of EFF-affiliated subchapters in the local region.

357
00:28:23,510 --> 00:28:26,010
This is sort of the way to act locally.

358
00:28:26,950 --> 00:28:30,950
And you can check that out at EFF.org slash EFA.

359
00:28:31,450 --> 00:28:40,130
And the perfect question to end on here is, is all the project documentation on GitHub or any information about a paper being published?

360
00:28:40,130 --> 00:28:43,310
Yeah, all the project documentation.

361
00:28:44,130 --> 00:28:46,290
I have not published a paper.

362
00:28:46,290 --> 00:28:47,170
I hate writing.

363
00:28:47,170 --> 00:28:58,470
So I may publish a paper eventually, but all of the documentation such as it is, which, boy, open source and documentation, it's always great, right?

364
00:28:59,010 --> 00:29:02,870
But yeah, most of the documentation is in my head.

365
00:29:03,330 --> 00:29:07,050
The documentation that exists is on the GitHub, and I'm happy to answer questions.

366
00:29:07,050 --> 00:29:13,030
And I'm happy to take it upon myself to improve the documentation that people are actually using this.

367
00:29:13,250 --> 00:29:15,850
That's where you're sharing all of your spreadsheets, huh?

368
00:29:16,590 --> 00:29:17,310
Yes.

369
00:29:17,490 --> 00:29:18,870
All right.

370
00:29:18,870 --> 00:29:19,170
Yep.

371
00:29:19,170 --> 00:29:20,770
Hacking is just spreadsheets.

372
00:29:20,770 --> 00:29:23,610
Thank you, everyone, for coming to join.

373
00:29:23,610 --> 00:29:25,510
This was a wonderful presentation.

374
00:29:25,510 --> 00:29:29,470
I appreciate your willingness to come spend your time with us.

375
00:29:29,470 --> 00:29:37,110
So if anyone has additional questions, we will make sure that the contact information is available here in the track one.

376
00:29:37,590 --> 00:29:42,350
Otherwise, have a great rest of your convention, and we hope to see more from you soon.

377
00:29:43,090 --> 00:29:43,950
Thanks.

378
00:29:43,950 --> 00:29:44,830
Bye, everybody.

379
00:29:44,830 --> 00:29:45,190
Bye.