start	end	text
0	6080	And then they're halfway into the first question before it actually connects.
7020	10180	There we go.
11240	12260	Nope.
16240	21680	Ella Punk, would you holler at our SpeakerUps channel saying we're going live?
22360	23520	Gotcha.
23520	24980	Thank you.
28200	30280	Gotta find the channel.
30320	31420	Yeah.
32800	36080	One of many, many, many, many, many channels.
38600	39420	Got it.
39620	42740	Hey, cool. We're live.
42780	47460	So, welcome everyone. I want to thank everybody for coming to join.
47480	52760	We're sitting here with Cooper. What's your last name, Cooper? I had it up here somewhere.
52760	53320	Quinton.
53320	54600	Cooper Quinton.
55080	55700	Yes.
55700	61960	All right. His presentation was Detecting Fake 4G Base Stations in Real Time.
62400	68140	So, thank you so much for taking the time and effort to put together this DEF CON Talk.
68300	74640	We're in this brave new world where we all get to do things virtually, so thank you very much.
75160	76800	Yeah, thanks for having me.
77000	78060	Absolutely.
78300	81960	So, we've had a few questions come in already.
82720	93620	We'll just get you started with this first one from RPTK2015, who has been watching, I think, all of the talks as we've been going through this.
93620	94520	Question.
94700	101300	If I can see that I'm connected to a fake cell ID, what can I do? Should I just stop using the internet?
102800	107280	Yeah, that's a great question, and I'll answer it in a couple of parts.
108380	113280	The first thing I'll answer is that if you think that you are connected to...
114940	121920	If you're in a situation where you might be worried about a cell site simulator, the best thing you can do is just put your phone on airplane mode.
122080	127860	And that's always a good idea if you're at a protest or if you're committing a crime.
127860	129280	This is not legal advice.
130220	137820	But if you're doing anything where you don't want to be tracked by your phone, the best thing you can do is just put it in airplane mode.
138540	146360	The question, though, of if you see that you're connected to a rogue cell ID, you're usually not going to see that.
146440	156680	The unfortunate thing about how phones work is that it's actually really hard to tell if you're connected to a cell site simulator.
156680	159640	And so you're usually not going to know.
160740	170040	And a lot of the things that cell site simulators do are similar to the things that cell networks do when they enter failure modes.
170040	175960	So like when an eNodeB crashes or when there's too many people connected to a cell.
176140	184180	So you're likely not going to know, but if you do have that concern, yeah, just put your phone in airplane mode.
184180	187780	And leave it in that until you need to send a text or something.
188480	195200	Airplane mode. All right. So there's been a lot of conversation in the past about airplane mode doesn't protect you from a lot of stuff.
195200	201820	Are we thinking that this is still going to be good enough? Or is this your situation if you don't bring your phone with you?
203520	210760	So, I mean, it depends. I think it depends on your risk model, right? It depends what you are concerned about.
211480	216960	I think airplane mode is going to be good enough for most cases and situations.
217800	223180	Because not bringing your phone with you means you can't take pictures of whatever's going on.
223180	226980	It means that you can't make calls. It means you can't call your friends.
226980	229620	It means you can't call anybody if you're about to get arrested.
230300	234660	I don't know, like, again, I don't know what situation you're planning on taking this out.
234940	238920	But I think airplane mode is good enough for most cases.
238920	248660	And yeah, if you really have high security needs, if you don't want to be displaying any weird patterns of travel,
248660	251780	like, yeah, leave your phone at home and leave it on, right?
252680	255500	Then it looks like you're just sitting around at home doing nothing.
255500	258480	So, again, not legal advice.
259960	263560	You know, we had a follow-up that I think a lot of people would find true.
263560	265820	So I'm interested in what you have to say.
265820	270560	Does a VPN offer any protection from a cell site simulator?
270560	272860	And also, what does it not protect against?
272860	276780	For example, GPS data or exploits in pre-authentication messages?
277820	279920	That's a really great question.
280300	285220	Yes, exactly. It does not protect against those two things.
285220	287480	It doesn't protect against GPS data.
287480	290980	It doesn't protect against exploits in pre-authentication messages,
290980	294420	which is where most cell site simulators happen in the first place.
294420	298940	And actually, there was a really... there was a great talk at Black Hat
298940	303700	and a really good paper that's out, and I can try to find the link and post it somewhere later,
304740	310400	about... so the attack is called... I think it's called ALTER.
310960	313200	Yeah, well, so there's... no, okay, so there's two attacks.
313200	315820	One is called A-L-T-E-R, ALTER.
315820	318780	And then the other attack is called...
319620	321260	Shit, I forgot the name.
321860	325320	And there's another attack, and these are two attacks that allow you in the...
325320	329580	that allow a malicious actor in the pre-authentication stage
329580	337800	to manipulate DNS queries being sent to the tower to send back fake...
339660	344740	or to send back fake answers, like to send back malicious DNS answers, right?
344920	347280	Responses. So there's...
348380	354280	Sorry, so to answer the question, like, a VPN might...
355040	359820	like, it might protect against some eavesdropping attacks,
359820	361680	but I don't think it's going to be good enough.
361680	366340	But the other thing is that it seems like, at least in the US,
366340	373140	the primary usage for cell-side simulators is to determine who is in a specific place,
373140	375540	or in other words, what phones are in a specific place,
375540	381540	or to locate a suspect, or to locate somebody, like,
381540	385980	down to what apartment they're in, or down to, you know, what building, right?
386080	394600	And neither of those attacks rely on looking at the person's or people's internet traffic.
394600	397500	They only rely on looking at signals being sent from the phone,
397500	399720	and a VPN won't do anything about that.
400640	403680	Interesting. That makes sense.
403680	407240	So there are some things that you can protect yourself with in this way.
407240	412180	There are some things that are outside the scope of your research in this case.
412700	413540	Yeah.
413780	419220	Well, the natural follow-up question from that is usually one I ask quite a bit further,
419220	422960	but then, what's next in this research space?
422960	429340	And if you had more time or money, what could you have done to expand this?
430020	432060	Yeah, that's a great question.
432060	443980	So the thing I would love to have is transmission data.
443980	447460	So I mentioned in my talk that, like, we can't actually connect to the tower,
447460	449820	and we can't actually transmit things.
449820	453980	We can't actually, like, send authentication messages to the tower
453980	455460	and see how it responds.
455540	457540	We can't look at paging messages, etc.
457540	466160	But if we were able to gain access to licensed hardware,
466160	469760	like a licensed 4G baseband and program it ourselves,
469760	472380	or gain access to lower-level messages,
472380	474720	then it's possible that we could do that.
474720	477940	And that would be an amazing thing to do.
477940	479840	I think the other thing I would like to do in the future
480540	485060	is get better heuristics involved in Crocodile Hunters.
485060	487420	So the heuristics that Crocodile Hunter uses right now
487420	490060	to determine what's a suspicious tower or not,
491640	493900	they're kind of my first pass at that.
493900	500740	And I think that once we know more about what malicious cell towers look like in the wild,
500740	506880	we'll be able to get better heuristics to have less false positives
507780	509740	in what's suspicious and what's not.
509740	513740	I don't want to stomp all over the wonderful people putting stuff in chat over here,
513740	516920	but that is my next follow-up question if it's right into there.
518300	521860	There are people out here with a lot of time and effort and energy
521860	524860	and want to get involved in projects.
524860	527880	If somebody wants to get involved in this project,
527880	532580	if they build your rig and are doing this,
532580	534240	do you want their data?
534240	536920	Is data from other people helpful?
536920	538600	How can people assist?
539480	543240	Yeah, data from other people is absolutely helpful.
543240	547660	And there's actually an API built into Crocodile Hunter
547660	550240	to allow you to send your data back to us.
550600	554240	And there's documentation on that in the GitHub repository.
555900	561080	But yeah, if you go do scans, even if you don't find anything,
561080	563280	having that data is super helpful.
565660	568460	Yeah, so please go ahead and send it to us.
568460	571980	And please go ahead and get involved on the GitHub
571980	574880	and file bugs and pull requests and stuff.
575120	578720	We'll probably eventually set up a chat server somewhere
578720	581220	if the project seems popular enough.
582500	585600	A specific question here, specific to an area,
585600	587040	so Latin America.
587040	592120	Can you talk about the fake antenna detection project?
593240	599540	Yeah, so I don't want to put words in their mouth too much.
599540	600720	They have a website.
601960	605960	I think it's fadeprojects.org.
605960	610160	Maybe one of you can confirm that real quick.
610620	612940	Or I'll post it later.
613160	614300	So they have a website.
614300	616220	I don't want to put too many words in their mouth,
616220	620120	but basically this is a group of technologists,
620200	624700	a group of hackers that are in various countries in Latin America.
624740	630060	And they had previously done fake antenna detection with Seaglass,
630060	632720	which is a similar project out of the University of Washington,
632720	634620	but focused on 2G towers.
634940	639080	And they found some really interesting results in Mexico City
639080	644980	and I think in Colombia, if I recall.
645220	647880	So they found some really interesting results in a few different places.
647880	651360	And they're just doing this to see what they can find
651360	655440	and to see how widespread the problem of CSS is in Latin America.
655520	659240	And they're planning on doing this with Crocodile Hunter,
659240	660960	doing the same research, but next with...
660960	662240	Great.
662420	668060	You get to see where it takes you when you're traveling in other countries.
668400	670960	Yeah, I'm really excited to see what they find.
671160	673740	Probably some interesting questions as well is
673740	678760	what's allowed on the Send-Receive if you are in non-US countries?
681420	684000	I am not an international lawyer.
684000	685580	I'm not even a national lawyer.
685580	687140	I'm not any type of lawyer.
687140	690100	So I cannot speak to that.
690100	694480	If you are curious about that, you should ask a lawyer in your country
695400	697920	as to what's allowed for Send-Receive.
697920	699800	Because it varies from country to country.
699800	700540	It does.
700580	705500	We were looking at doing this in some Middle Eastern countries
705500	710980	and the laws there wouldn't even allow us to receive packets from a cell tower.
713120	713640	So...
714700	718780	There's a bunch of questions that I saw here that I'd be interested to learn a little bit more.
718780	723400	You mentioned briefly in your talk that 5G handles pre-authentication.
723400	724460	I can't speak today.
724460	725740	Pre-authentication.
726460	727540	Thank you.
727540	728820	This never happened.
728880	731180	Messages similar to 4G.
731180	737320	Do you suspect nearly identical cell site simulator techniques will carry over from 4G to 5G?
737320	738260	Cut to it.
741080	743080	Awesome. Awesome.
743260	746240	Yeah, unfortunately I do.
746240	752740	A lot of the... almost all of the attacks that work against 4G still work against 5G.
752740	754180	There have been...
755240	759940	There have been some mitigations put in place in the standard.
759940	766600	But unfortunately a lot of those mitigations are marked as optional in the standard.
766600	772890	And anything marked as optional means that the phone companies are absolutely not going to do it.
773820	778060	Because they want to spend as little money as possible.
778140	779280	As little effort as possible.
779280	782100	Because phone companies are a giant pile of shit.
782700	783280	So...
786920	793500	So I don't expect that those mitigations will make their way into actual deployment.
793500	800260	And I think that a lot of the same techniques that you see in 4G are going to still work in 5G.
801040	802740	Alright, that's good to know.
802900	807580	I had another question that I think more just shows my ignorance in the subject.
808000	813500	So the kit that you've built in order to do the hardware on this one is...
814660	818220	What, $500 for the radio?
818220	821580	And you've got a Raspberry Pi, which is relatively inexpensive.
821580	824160	And you're carrying around a laptop and all this.
824580	828580	The question that comes to mind on this is...
830460	835900	We all carry around a cell phone that already talks to these devices.
836600	841580	Can cell phones themselves be modified to do any of this work?
842040	844280	Yeah, so that's a great question.
844280	846740	And I would love it if they could.
848120	850520	I have not found a good way to do that.
850520	855160	So we can't do this in a native app.
855200	857460	Because for two reasons.
857460	859760	A, we don't get enough low-level data.
859820	865400	And B, we're only going to see the cells that the phone is actually connecting to.
865440	868340	And the neighbor list of cells that the phone is actually connecting to.
868340	870720	And I want to see all of the cells.
870720	873600	I want to be war-driving 5G towers.
873800	878460	Not just looking at what the cell phone wants to connect to.
879320	881640	And then the other thing is, there's no way...
881640	886760	There's no API for the baseband, right?
886760	889560	And there's no...
890460	895240	I mean, the closest thing to an open-source baseband is in SRS LTE.
895580	900020	There's no open-source baseband, programmable baseband,
900020	903200	that runs on an actual licensed 4G chip.
903200	907820	And that's the open-source LTE library?
908540	911380	Yeah, sorry. So that's the open-source LTE.
911380	915540	SRS LTE is the open-source LTE library that we use in the backend of Crocodile Hunter
915540	920800	to actually emulate part of the user equipment,
920800	924940	to emulate part of the cell phone, and scan the frequencies
924940	928400	and get the information blocks that we need.
928660	929140	Gotcha.
929600	933260	So we are essentially emulating the cell phone,
933260	937080	doing part of what a cell phone does, but we're not doing it on cell phone hardware.
937080	939460	And it would be great if we could do that on cell phone hardware,
939460	944460	but I don't think that that currently exists.
946160	948180	But it's a good idea.
951900	954780	So Seaglass, the Seaglass project from the University of Washington
954780	957860	that I was talking about earlier, is doing that on a phone
957860	961700	using the Osmocom baseband for 2G or GSM.
962060	967060	So that does exist for GSM, it just doesn't exist for LTE.
967560	968280	Okay.
968460	971500	But it is a good idea, and if and when it does exist for LTE,
971500	977480	it would be great to rebuild Crocodile Hunter using that.
977840	980980	So you're barking up the right tree there, for sure.
983520	985460	What else do we have coming in, LL Bunk?
985460	988000	I can't believe I just used the phrase, barking up the right tree.
988000	988940	Yeah, you did.
990320	992660	This is a very laid-back Q&A.
992940	994520	Back to the alcohol.
995540	997800	And a coffee cup, well done.
998600	1000740	Alright, so next question.
1002380	1007220	You mentioned turning off 2G could help.
1007220	1011160	Do you know of any progress to create and enable this feature?
1017790	1020760	I think that there are people within these companies
1020760	1023060	that really want to see this happen.
1023060	1031340	But I think it's going to be an ongoing battle.
1031760	1042060	I think that the manufacturers, the OS manufacturers,
1042060	1046310	Samsung, Apple, will need to see that there is a consumer demand for it.
1047510	1053890	And they're still not likely to turn 2G off completely or even by default
1053890	1059930	because it is still used by so many people around the world, unfortunately.
1059930	1064350	But even getting a toggle to turn it off, if that's a concern, would be great.
1064350	1067570	But I think that even though there are people within the companies
1067570	1069130	that really want to see this happen,
1069130	1071970	I think the people at the top of those companies
1071970	1075010	need to see consumer demand for it to really make it a priority.
1076110	1078510	It's probably a deal all over the place.
1079690	1082690	The consumer needs to understand that this is the thing that they want
1082690	1084770	before they know how to ask for it.
1084890	1086430	Yeah, exactly.
1088150	1089950	Another follow-up is...
1092190	1095830	I lost my thing on here. I'm just doing horrible today, guys. Sorry.
1096490	1097090	Oh, no.
1097710	1098890	It's the day.
1099290	1103270	With disposable phones and burner phones being so readily available,
1103270	1106010	why not buy one of those and give it a try?
1109270	1113930	Yeah. I mean, again, I'd say it depends what your threat model is.
1115830	1119050	Burner phones are really hard to do properly.
1120250	1122650	There's a lot of things you've got to take into account.
1122650	1125750	If you want to actually use a burner phone,
1125750	1129070	you have to be able to actually buy it anonymously.
1129070	1131910	You have to call people that you normally call on it.
1131910	1134850	You have to stop using it afterwards.
1134850	1136310	There's a lot there.
1136430	1140370	Battery has to come out and in at the right place and time.
1140770	1141950	Yeah, exactly.
1144470	1148110	Even though it's cheap to buy cell phones these days,
1148110	1152350	it's still not actually, I don't think, trivial to set up a burner phone.
1154290	1157050	Again, it depends on what your threat model is.
1157050	1164550	If you just don't want the law enforcement agency in your country to know you're at a protest,
1164550	1166790	I would just put your phone in a lane.
1167410	1171150	If you really need to be making calls during that protest,
1171150	1174030	but you really don't want them to know you're there,
1174030	1176590	I mean, your chief worry should not be MC catchers.
1176590	1178210	It should be not getting arrested.
1179110	1180270	It's not...
1180270	1192870	I think that MC catchers should actually be fairly far down on your list of threats if you're going to a protest.
1192870	1198930	And at the top of that should be tear gas and cops beating the shit out of you.
1202130	1203090	It's not...
1205090	1207510	And then several other things,
1207510	1211510	like the police taking your phone and doing a forensic analysis of it after you get arrested,
1211510	1213310	and then MC catchers.
1213770	1215550	So, I don't know.
1216570	1220470	I think using a burner phone is over-engineering the solution there.
1220470	1223170	I think you should just put your phone in airplane mode.
1223530	1226110	Or if you really need to be doing a lot of comms,
1226110	1231690	but you need to be anonymous, then think about that.
1231690	1235330	But also think about facial recognition and also make sure tattoos are covered up.
1235330	1237290	Make sure you don't have hair.
1239090	1242370	Make sure that nobody can find your t-shirt on Etsy.
1242770	1243470	Exactly.
1243670	1246270	Make sure you're not wearing a custom mask.
1247530	1250010	I know we're kind of coming up to the end.
1250010	1251550	We still have more time.
1251550	1253390	But a great one is,
1253390	1258150	any suggestions on research avenues for others looking to build off this project on?
1258150	1262550	Most of this project in the past seems to be around 2G and 3G-based.
1262550	1266450	So, it would be great to see a project catching up to the latest protocols.
1266950	1268930	So, that is what we're doing.
1270630	1273090	That is, in fact, the whole point of the project,
1273090	1276970	is that all the past research has been focused on 2G and 3G,
1276970	1278990	and we're specifically focused on 4G
1278990	1284190	and what the latest iterations of cell-sizing motors like the Hailstorm and the Crossbow.
1284390	1287090	I think what they're asking specifically is how they can give back,
1287090	1288610	you know, research more on their own.
1288670	1292130	Sorry, I misunderstood.
1293250	1295390	Yep, that was the talk.
1296510	1298590	Yeah, so how you can give back.
1301150	1305290	Like, we would love people to get involved with the project, right?
1306910	1313410	We have theories about how these things work based on our research,
1313410	1315370	based on reading the academic papers, right?
1315370	1317670	And again, a big shout-out to Yamna.
1318830	1322950	Me and her spent two years reading all of the academic papers.
1322950	1325610	A lot.
1330270	1332410	You're probably back. We had some cutouts.
1332410	1334470	Okay. Oh, sorry.
1334470	1337850	Yeah, so me and Yamna spent a long time reading all...
1337850	1343730	Yamna wrote a really excellent paper detailing all that we know about the 4G.
1344670	1348970	And yeah, I mean, but, you know, further research, right?
1348970	1352270	And, you know, new theories about how they might work.
1352270	1354330	I mean, FOIA requests, right?
1354570	1360350	There was a really excellent set of manuals for the Stingray, right?
1360350	1368310	And if somebody did a similar FOIA request and got manuals for the Hailstorm hospital, like, yeah, that would be excellent.
1368830	1374730	Well, this is a fantastic time for us to put in here a couple of bits.
1374730	1376530	So you work for the EFF.
1377070	1386270	Everybody here should know what the EFF is, but if you are brand new to the InfoSec community, give us just a blurb on the EFF.
1386930	1396750	Sure. So EFF, or the Electronic Frontier Foundation, is an organization that defends civil liberties as they intersect with technology.
1396830	1400050	Or as we say, when you get online, your rights come with you.
1400050	1409490	You don't lose your rights, you don't lose your human rights, you don't lose your civil liberties, freedom of speech, the right to privacy, free expression, just because you're working with technology.
1409490	1421390	And so we defend that, and we defend that through a combination of legal strategy, grassroots activism, and technology, like what I work.
1422090	1429010	So we've been doing this for 30 years now. 30 years this year. We started in 1990.
1429250	1440650	And our first case was defending Steve Jackson Games when they had put out a pen and paper RPG called Cyberpunk, which the FBI decided was a manual for hacking.
1440650	1444530	And they raided Steve Jackson Games and took all of their copies of Cyberpunk.
1444530	1453090	We were teaching kids how to hack, and we defended them and got their books back because this is a clear freedom of speech issue.
1453450	1457170	And so that was our first case, and we've been taking on cases ever since then.
1457570	1467110	So I work specifically in EFF Threat Lab. Well, I guess you watched my talk where I talked pretty extensively about that, so I won't dig into the EFF Threat Lab.
1467110	1477550	But that's what EFF is. We're a non-profit. We're member-supported. Over half of our annual budget comes from individual donations from our members, members like you.
1478230	1484850	Well, Cooper, if I had a little bit of extra money and I wanted to give it to the EFF, how would I do that?
1485410	1499910	Yeah, so you can buy EFF swag here at DEF CON. In fact, we even have a special DEF CON Safe Mode EFF shirt that you can only buy during Safe Mode. You can buy it right now.
1500170	1512690	And that's at our website, EFF.org. And I think there's a donate link up there. There's a shop link up there. You can go find all of our branded swag and all of our DEF CON swag.
1512690	1524710	Or you can just donate us money directly from there if you like. We're also taking donations in Zcash, I think, during DEF CON. So if you want to donate truly anonymously, you can donate to us through that.
1524810	1533610	I have no idea how that works, but you can drop into the vendors channel and message the EFF account and set you up.
1534790	1544270	I also heard a little bit that you are involved in some other things at DEF CON here. So would you like to talk a little bit about what you have going on later on?
1544270	1564450	Yeah, I am. So at 5 o'clock tonight, 1700 Vegas time, we're running the EFF Tech Trivia event. So I will be the quiz master.
1565130	1585910	And we will be asking trivia questions. You can sign up for a team right now if you go to the Discord channel under Contests and Events. It's EFF Triv. And you can sign up for a team and we'll ask a bunch of questions and the winning teams will get some free EFF swag.
1585910	1605450	Great. Alright, so I'm sure that with all of the stuff that you've been talking about here, there are people who are interested in reaching out and doing more of this work with you. So we'll have you at the end here post whatever sort of contact information you would like for people to reach out to you with.
1605830	1608810	Yeah, do you want me to post that in the Talks channel?
1608810	1624250	Sure, we'll put that in the Talks channel. And yeah, if there's anybody who has one additional question that you'd like to hit or if... Ella Punk, did you find anything? Are you sitting on something? Maybe.
1624690	1633550	Maybe. I was having so much fun listening to that. So I did post links for the shirt and more information on EFF in the group chat.
1633910	1635450	Awesome. Thank you, Ella Punk.
1635450	1644530	So do you have a final call to action for the people who are listening here? Something you would like them to take away?
1645890	1664170	I do. My final call to action is just to get involved with what's going on in your local communities. As hackers, there's a lot we can do. There's a lot of problems that we can solve in our smart hackers way. And we don't always have to solve it through making a new app.
1664170	1684850	A lot of people working in your community just need help setting up a mailing list, right? Or just need help setting up a simple static website, right? But there's also more creative problems to solve. Like I think the thing about using leaf blowers to blow away tear gas is very much in the hacker spirit, right? It's such a great thing to see.
1684850	1694150	So I think that there's a lot of ways to get involved. You can also get involved with other EFF-minded people in your community by checking out the Electronic Frontier Alliance.
1694170	1710950	Which is a group of EFF-affiliated subchapters in the local region. This is sort of the way to act locally. And you can check that out at EFF.org slash EFA.
1711450	1720130	And the perfect question to end on here is, is all the project documentation on GitHub or any information about a paper being published?
1720130	1738470	Yeah, all the project documentation. I have not published a paper. I hate writing. So I may publish a paper eventually, but all of the documentation such as it is, which, boy, open source and documentation, it's always great, right?
1739010	1753030	But yeah, most of the documentation is in my head. The documentation that exists is on the GitHub, and I'm happy to answer questions. And I'm happy to take it upon myself to improve the documentation that people are actually using this.
1753250	1755850	That's where you're sharing all of your spreadsheets, huh?
1756590	1757310	Yes.
1757490	1758870	All right.
1758870	1760770	Yep. Hacking is just spreadsheets.
1760770	1782350	Thank you, everyone, for coming to join. This was a wonderful presentation. I appreciate your willingness to come spend your time with us. So if anyone has additional questions, we will make sure that the contact information is available here in the track one. Otherwise, have a great rest of your convention, and we hope to see more from you soon.
1783090	1784830	Thanks. Bye, everybody.
1784830	1785190	Bye.