WEBVTT 00:00.000 --> 00:06.080 And then they're halfway into the first question before it actually connects. 00:07.020 --> 00:10.180 There we go. 00:11.240 --> 00:12.260 Nope. 00:16.240 --> 00:21.680 Ella Punk, would you holler at our SpeakerUps channel saying we're going live? 00:22.360 --> 00:23.520 Gotcha. 00:23.520 --> 00:24.980 Thank you. 00:28.200 --> 00:30.280 Gotta find the channel. 00:30.320 --> 00:31.420 Yeah. 00:32.800 --> 00:36.080 One of many, many, many, many, many channels. 00:38.600 --> 00:39.420 Got it. 00:39.620 --> 00:41.760 Hey, cool. 00:41.760 --> 00:42.740 We're live. 00:42.780 --> 00:45.140 So, welcome everyone. 00:45.140 --> 00:47.460 I want to thank everybody for coming to join. 00:47.480 --> 00:49.320 We're sitting here with Cooper. 00:50.220 --> 00:51.700 What's your last name, Cooper? 00:51.700 --> 00:52.760 I had it up here somewhere. 00:52.760 --> 00:53.320 Quinton. 00:53.320 --> 00:54.600 Cooper Quinton. 00:55.080 --> 00:55.700 Yes. 00:55.700 --> 00:56.600 All right. 00:56.620 --> 01:01.960 His presentation was Detecting Fake 4G Base Stations in Real Time. 01:02.400 --> 01:08.140 So, thank you so much for taking the time and effort to put together this DEF CON Talk. 01:08.300 --> 01:14.640 We're in this brave new world where we all get to do things virtually, so thank you very much. 01:15.160 --> 01:16.800 Yeah, thanks for having me. 01:17.000 --> 01:18.060 Absolutely. 01:18.300 --> 01:21.960 So, we've had a few questions come in already. 01:22.720 --> 01:33.620 We'll just get you started with this first one from RPTK2015, who has been watching, I think, all of the talks as we've been going through this. 01:33.620 --> 01:34.520 Question. 01:34.700 --> 01:39.180 If I can see that I'm connected to a fake cell ID, what can I do? 01:39.180 --> 01:41.300 Should I just stop using the internet? 01:42.800 --> 01:47.280 Yeah, that's a great question, and I'll answer it in a couple of parts. 01:48.380 --> 01:53.280 The first thing I'll answer is that if you think that you are connected to... 01:54.940 --> 02:01.920 If you're in a situation where you might be worried about a cell site simulator, the best thing you can do is just put your phone on airplane mode. 02:02.080 --> 02:07.860 And that's always a good idea if you're at a protest or if you're committing a crime. 02:07.860 --> 02:09.280 This is not legal advice. 02:10.220 --> 02:17.820 But if you're doing anything where you don't want to be tracked by your phone, the best thing you can do is just put it in airplane mode. 02:18.540 --> 02:26.360 The question, though, of if you see that you're connected to a rogue cell ID, you're usually not going to see that. 02:26.440 --> 02:36.680 The unfortunate thing about how phones work is that it's actually really hard to tell if you're connected to a cell site simulator. 02:36.680 --> 02:39.640 And so you're usually not going to know. 02:40.740 --> 02:50.040 And a lot of the things that cell site simulators do are similar to the things that cell networks do when they enter failure modes. 02:50.040 --> 02:55.960 So like when an eNodeB crashes or when there's too many people connected to a cell. 02:56.140 --> 03:04.180 So you're likely not going to know, but if you do have that concern, yeah, just put your phone in airplane mode. 03:04.180 --> 03:07.780 And leave it in that until you need to send a text or something. 03:08.480 --> 03:09.160 Airplane mode. 03:09.160 --> 03:09.420 All right. 03:09.420 --> 03:15.200 So there's been a lot of conversation in the past about airplane mode doesn't protect you from a lot of stuff. 03:15.200 --> 03:17.940 Are we thinking that this is still going to be good enough? 03:17.940 --> 03:21.820 Or is this your situation if you don't bring your phone with you? 03:23.520 --> 03:25.680 So, I mean, it depends. 03:25.680 --> 03:27.480 I think it depends on your risk model, right? 03:27.480 --> 03:30.760 It depends what you are concerned about. 03:31.480 --> 03:36.960 I think airplane mode is going to be good enough for most cases and situations. 03:37.800 --> 03:43.180 Because not bringing your phone with you means you can't take pictures of whatever's going on. 03:43.180 --> 03:45.500 It means that you can't make calls. 03:45.500 --> 03:46.980 It means you can't call your friends. 03:46.980 --> 03:49.620 It means you can't call anybody if you're about to get arrested. 03:50.300 --> 03:54.660 I don't know, like, again, I don't know what situation you're planning on taking this out. 03:54.940 --> 03:58.920 But I think airplane mode is good enough for most cases. 03:58.920 --> 04:11.780 And yeah, if you really have high security needs, if you don't want to be displaying any weird patterns of travel, like, yeah, leave your phone at home and leave it on, right? 04:12.680 --> 04:15.500 Then it looks like you're just sitting around at home doing nothing. 04:15.500 --> 04:18.480 So, again, not legal advice. 04:19.960 --> 04:23.560 You know, we had a follow-up that I think a lot of people would find true. 04:23.560 --> 04:25.820 So I'm interested in what you have to say. 04:25.820 --> 04:30.560 Does a VPN offer any protection from a cell site simulator? 04:30.560 --> 04:32.860 And also, what does it not protect against? 04:32.860 --> 04:36.780 For example, GPS data or exploits in pre-authentication messages? 04:37.820 --> 04:39.920 That's a really great question. 04:40.300 --> 04:41.760 Yes, exactly. 04:42.420 --> 04:45.220 It does not protect against those two things. 04:45.220 --> 04:47.480 It doesn't protect against GPS data. 04:47.480 --> 04:54.420 It doesn't protect against exploits in pre-authentication messages, which is where most cell site simulators happen in the first place. 04:54.420 --> 05:10.400 And actually, there was a really... there was a great talk at Black Hat and a really good paper that's out, and I can try to find the link and post it somewhere later, about... so the attack is called... I think it's called ALTER. 05:10.960 --> 05:13.200 Yeah, well, so there's... no, okay, so there's two attacks. 05:13.200 --> 05:15.820 One is called A-L-T-E-R, ALTER. 05:15.820 --> 05:18.780 And then the other attack is called... 05:19.620 --> 05:21.260 Shit, I forgot the name. 05:21.860 --> 05:25.320 And there's another attack, and these are two attacks that allow you in the... 05:25.320 --> 05:37.800 that allow a malicious actor in the pre-authentication stage to manipulate DNS queries being sent to the tower to send back fake... 05:39.660 --> 05:44.740 or to send back fake answers, like to send back malicious DNS answers, right? 05:44.920 --> 05:45.580 Responses. 05:45.580 --> 05:47.280 So there's... 05:48.380 --> 05:54.280 Sorry, so to answer the question, like, a VPN might... 05:55.040 --> 06:01.680 like, it might protect against some eavesdropping attacks, but I don't think it's going to be good enough. 06:01.680 --> 06:20.980 But the other thing is that it seems like, at least in the US, the primary usage for cell-side simulators is to determine who is in a specific place, or in other words, what phones are in a specific place, or to locate a suspect, or to locate somebody, 06:20.980 --> 06:25.980 like, down to what apartment they're in, or down to, you know, what building, right? 06:26.080 --> 06:34.600 And neither of those attacks rely on looking at the person's or people's internet traffic. 06:34.600 --> 06:39.720 They only rely on looking at signals being sent from the phone, and a VPN won't do anything about that. 06:40.640 --> 06:41.680 Interesting. 06:42.420 --> 06:43.680 That makes sense. 06:43.680 --> 06:47.240 So there are some things that you can protect yourself with in this way. 06:47.240 --> 06:52.180 There are some things that are outside the scope of your research in this case. 06:52.700 --> 06:53.540 Yeah. 06:53.780 --> 07:02.960 Well, the natural follow-up question from that is usually one I ask quite a bit further, but then, what's next in this research space? 07:02.960 --> 07:09.340 And if you had more time or money, what could you have done to expand this? 07:10.020 --> 07:12.060 Yeah, that's a great question. 07:12.060 --> 07:23.980 So the thing I would love to have is transmission data. 07:23.980 --> 07:29.820 So I mentioned in my talk that, like, we can't actually connect to the tower, and we can't actually transmit things. 07:29.820 --> 07:35.460 We can't actually, like, send authentication messages to the tower and see how it responds. 07:35.540 --> 07:37.540 We can't look at paging messages, etc. 07:37.540 --> 07:54.720 But if we were able to gain access to licensed hardware, like a licensed 4G baseband and program it ourselves, or gain access to lower-level messages, then it's possible that we could do that. 07:54.720 --> 07:57.940 And that would be an amazing thing to do. 07:57.940 --> 08:05.060 I think the other thing I would like to do in the future is get better heuristics involved in Crocodile Hunters. 08:05.060 --> 08:13.900 So the heuristics that Crocodile Hunter uses right now to determine what's a suspicious tower or not, they're kind of my first pass at that. 08:13.900 --> 08:29.740 And I think that once we know more about what malicious cell towers look like in the wild, we'll be able to get better heuristics to have less false positives in what's suspicious and what's not. 08:29.740 --> 08:36.920 I don't want to stomp all over the wonderful people putting stuff in chat over here, but that is my next follow-up question if it's right into there. 08:38.300 --> 08:44.860 There are people out here with a lot of time and effort and energy and want to get involved in projects. 08:44.860 --> 08:54.240 If somebody wants to get involved in this project, if they build your rig and are doing this, do you want their data? 08:54.240 --> 08:56.920 Is data from other people helpful? 08:56.920 --> 08:58.600 How can people assist? 08:59.480 --> 09:03.240 Yeah, data from other people is absolutely helpful. 09:03.240 --> 09:10.240 And there's actually an API built into Crocodile Hunter to allow you to send your data back to us. 09:10.600 --> 09:14.240 And there's documentation on that in the GitHub repository. 09:15.900 --> 09:23.280 But yeah, if you go do scans, even if you don't find anything, having that data is super helpful. 09:25.660 --> 09:28.460 Yeah, so please go ahead and send it to us. 09:28.460 --> 09:34.880 And please go ahead and get involved on the GitHub and file bugs and pull requests and stuff. 09:35.120 --> 09:41.220 We'll probably eventually set up a chat server somewhere if the project seems popular enough. 09:42.500 --> 09:47.040 A specific question here, specific to an area, so Latin America. 09:47.040 --> 09:52.120 Can you talk about the fake antenna detection project? 09:53.240 --> 09:59.540 Yeah, so I don't want to put words in their mouth too much. 09:59.540 --> 10:00.720 They have a website. 10:01.960 --> 10:05.960 I think it's fadeprojects.org. 10:05.960 --> 10:10.160 Maybe one of you can confirm that real quick. 10:10.620 --> 10:12.940 Or I'll post it later. 10:13.160 --> 10:14.300 So they have a website. 10:14.300 --> 10:24.700 I don't want to put too many words in their mouth, but basically this is a group of technologists, a group of hackers that are in various countries in Latin America. 10:24.740 --> 10:34.620 And they had previously done fake antenna detection with Seaglass, which is a similar project out of the University of Washington, but focused on 2G towers. 10:34.940 --> 10:44.980 And they found some really interesting results in Mexico City and I think in Colombia, if I recall. 10:45.220 --> 10:47.880 So they found some really interesting results in a few different places. 10:47.880 --> 10:55.440 And they're just doing this to see what they can find and to see how widespread the problem of CSS is in Latin America. 10:55.520 --> 11:00.960 And they're planning on doing this with Crocodile Hunter, doing the same research, but next with... 11:00.960 --> 11:02.240 Great. 11:02.420 --> 11:08.060 You get to see where it takes you when you're traveling in other countries. 11:08.400 --> 11:10.960 Yeah, I'm really excited to see what they find. 11:11.160 --> 11:18.760 Probably some interesting questions as well is what's allowed on the Send-Receive if you are in non-US countries? 11:21.420 --> 11:24.000 I am not an international lawyer. 11:24.000 --> 11:25.580 I'm not even a national lawyer. 11:25.580 --> 11:27.140 I'm not any type of lawyer. 11:27.140 --> 11:30.100 So I cannot speak to that. 11:30.100 --> 11:37.920 If you are curious about that, you should ask a lawyer in your country as to what's allowed for Send-Receive. 11:37.920 --> 11:39.800 Because it varies from country to country. 11:39.800 --> 11:40.540 It does. 11:40.580 --> 11:50.980 We were looking at doing this in some Middle Eastern countries and the laws there wouldn't even allow us to receive packets from a cell tower. 11:53.120 --> 11:53.640 So... 11:54.700 --> 11:58.780 There's a bunch of questions that I saw here that I'd be interested to learn a little bit more. 11:58.780 --> 12:03.400 You mentioned briefly in your talk that 5G handles pre-authentication. 12:03.400 --> 12:04.460 I can't speak today. 12:04.460 --> 12:05.740 Pre-authentication. 12:06.460 --> 12:07.540 Thank you. 12:07.540 --> 12:08.820 This never happened. 12:08.880 --> 12:11.180 Messages similar to 4G. 12:11.180 --> 12:17.320 Do you suspect nearly identical cell site simulator techniques will carry over from 4G to 5G? 12:17.320 --> 12:18.260 Cut to it. 12:21.080 --> 12:22.240 Awesome. 12:22.240 --> 12:23.080 Awesome. 12:23.260 --> 12:26.240 Yeah, unfortunately I do. 12:26.240 --> 12:32.740 A lot of the... almost all of the attacks that work against 4G still work against 5G. 12:32.740 --> 12:34.180 There have been... 12:35.240 --> 12:39.940 There have been some mitigations put in place in the standard. 12:39.940 --> 12:46.600 But unfortunately a lot of those mitigations are marked as optional in the standard. 12:46.600 --> 12:52.890 And anything marked as optional means that the phone companies are absolutely not going to do it. 12:53.820 --> 12:58.060 Because they want to spend as little money as possible. 12:58.140 --> 12:59.280 As little effort as possible. 12:59.280 --> 13:02.100 Because phone companies are a giant pile of shit. 13:02.700 --> 13:03.280 So... 13:06.920 --> 13:13.500 So I don't expect that those mitigations will make their way into actual deployment. 13:13.500 --> 13:20.260 And I think that a lot of the same techniques that you see in 4G are going to still work in 5G. 13:21.040 --> 13:22.740 Alright, that's good to know. 13:22.900 --> 13:27.580 I had another question that I think more just shows my ignorance in the subject. 13:28.000 --> 13:33.500 So the kit that you've built in order to do the hardware on this one is... 13:34.660 --> 13:38.220 What, $500 for the radio? 13:38.220 --> 13:41.580 And you've got a Raspberry Pi, which is relatively inexpensive. 13:41.580 --> 13:44.160 And you're carrying around a laptop and all this. 13:44.580 --> 13:48.580 The question that comes to mind on this is... 13:50.460 --> 13:55.900 We all carry around a cell phone that already talks to these devices. 13:56.600 --> 14:01.580 Can cell phones themselves be modified to do any of this work? 14:02.040 --> 14:04.280 Yeah, so that's a great question. 14:04.280 --> 14:06.740 And I would love it if they could. 14:08.120 --> 14:10.520 I have not found a good way to do that. 14:10.520 --> 14:15.160 So we can't do this in a native app. 14:15.200 --> 14:17.460 Because for two reasons. 14:17.460 --> 14:19.760 A, we don't get enough low-level data. 14:19.820 --> 14:25.400 And B, we're only going to see the cells that the phone is actually connecting to. 14:25.440 --> 14:28.340 And the neighbor list of cells that the phone is actually connecting to. 14:28.340 --> 14:30.720 And I want to see all of the cells. 14:30.720 --> 14:33.600 I want to be war-driving 5G towers. 14:33.800 --> 14:38.460 Not just looking at what the cell phone wants to connect to. 14:39.320 --> 14:41.640 And then the other thing is, there's no way... 14:41.640 --> 14:46.760 There's no API for the baseband, right? 14:46.760 --> 14:49.560 And there's no... 14:50.460 --> 14:55.240 I mean, the closest thing to an open-source baseband is in SRS LTE. 14:55.580 --> 15:03.200 There's no open-source baseband, programmable baseband, that runs on an actual licensed 4G chip. 15:03.200 --> 15:07.820 And that's the open-source LTE library? 15:08.540 --> 15:09.740 Yeah, sorry. 15:09.740 --> 15:11.380 So that's the open-source LTE. 15:11.380 --> 15:28.400 SRS LTE is the open-source LTE library that we use in the backend of Crocodile Hunter to actually emulate part of the user equipment, to emulate part of the cell phone, and scan the frequencies and get the information blocks that we need. 15:28.660 --> 15:29.140 Gotcha . 15:29.600 --> 15:37.080 So we are essentially emulating the cell phone, doing part of what a cell phone does, but we're not doing it on cell phone hardware. 15:37.080 --> 15:44.460 And it would be great if we could do that on cell phone hardware, but I don't think that that currently exists. 15:46.160 --> 15:48.180 But it's a good idea. 15:51.900 --> 16:01.700 So Seaglass, the Seaglass project from the University of Washington that I was talking about earlier, is doing that on a phone using the Osmocom baseband for 2G or GSM. 16:02.060 --> 16:07.060 So that does exist for GSM, it just doesn't exist for LTE. 16:07.560 --> 16:08.280 Okay. 16:08.460 --> 16:17.480 But it is a good idea, and if and when it does exist for LTE, it would be great to rebuild Crocodile Hunter using that. 16:17.840 --> 16:20.980 So you're barking up the right tree there, for sure. 16:23.520 --> 16:25.460 What else do we have coming in, LL Bunk? 16:25.460 --> 16:28.000 I can't believe I just used the phrase, barking up the right tree. 16:28.000 --> 16:28.940 Yeah, you did. 16:30.320 --> 16:32.660 This is a very laid-back Q&A. 16:32.940 --> 16:34.520 Back to the alcohol. 16:35.540 --> 16:37.800 And a coffee cup, well done. 16:38.600 --> 16:40.740 Alright, so next question. 16:42.380 --> 16:47.220 You mentioned turning off 2G could help. 16:47.220 --> 16:51.160 Do you know of any progress to create and enable this feature? 16:57.790 --> 17:03.060 I think that there are people within these companies that really want to see this happen. 17:03.060 --> 17:11.340 But I think it's going to be an ongoing battle. 17:11.760 --> 17:26.310 I think that the manufacturers, the OS manufacturers, Samsung, Apple, will need to see that there is a consumer demand for it. 17:27.510 --> 17:38.050 And they're still not likely to turn 2G off completely or even by default because it is still used by so many people around the world, unfortunately. 17:39.470 --> 17:44.270 But even getting a toggle to turn it off, if that's a concern, would be great. 17:44.270 --> 17:55.010 But I think that even though there are people within the companies that really want to see this happen, I think the people at the top of those companies need to see consumer demand for it to really make it a priority. 17:56.110 --> 17:58.510 It's probably a deal all over the place. 17:59.690 --> 18:04.770 The consumer needs to understand that this is the thing that they want before they know how to ask for it. 18:04.890 --> 18:06.430 Yeah, exactly. 18:08.150 --> 18:09.950 Another follow-up is... 18:12.190 --> 18:13.930 I lost my thing on here. 18:13.930 --> 18:15.230 I'm just doing horrible today, guys. 18:15.230 --> 18:15.830 Sorry. 18:16.490 --> 18:17.090 Oh, no. 18:17.710 --> 18:18.890 It's the day. 18:19.290 --> 18:26.010 With disposable phones and burner phones being so readily available, why not buy one of those and give it a try? 18:29.270 --> 18:29.850 Yeah. 18:29.850 --> 18:33.930 I mean, again, I'd say it depends what your threat model is. 18:35.830 --> 18:39.050 Burner phones are really hard to do properly. 18:40.250 --> 18:42.650 There's a lot of things you've got to take into account. 18:42.650 --> 18:49.070 If you want to actually use a burner phone, you have to be able to actually buy it anonymously. 18:49.070 --> 18:51.910 You have to call people that you normally call on it. 18:51.910 --> 18:54.850 You have to stop using it afterwards. 18:54.850 --> 18:56.310 There's a lot there. 18:56.430 --> 19:00.370 Battery has to come out and in at the right place and time. 19:00.770 --> 19:01.950 Yeah, exactly. 19:04.470 --> 19:12.350 Even though it's cheap to buy cell phones these days, it's still not actually, I don't think, trivial to set up a burner phone. 19:14.290 --> 19:17.050 Again, it depends on what your threat model is. 19:17.050 --> 19:26.790 If you just don't want the law enforcement agency in your country to know you're at a protest, I would just put your phone in a lane. 19:27.410 --> 19:36.590 If you really need to be making calls during that protest, but you really don't want them to know you're there, I mean, your chief worry should not be MC catchers. 19:36.590 --> 19:38.210 It should be not getting arrested. 19:39.110 --> 19:40.270 It's not... 19:40.270 --> 19:52.870 I think that MC catchers should actually be fairly far down on your list of threats if you're going to a protest. 19:52.870 --> 19:58.930 And at the top of that should be tear gas and cops beating the shit out of you. 20:02.130 --> 20:03.090 It's not... 20:05.090 --> 20:13.310 And then several other things, like the police taking your phone and doing a forensic analysis of it after you get arrested, and then MC catchers. 20:13.770 --> 20:15.550 So, I don't know. 20:16.570 --> 20:20.470 I think using a burner phone is over-engineering the solution there. 20:20.470 --> 20:23.170 I think you should just put your phone in airplane mode. 20:23.530 --> 20:31.690 Or if you really need to be doing a lot of comms, but you need to be anonymous, then think about that. 20:31.690 --> 20:35.330 But also think about facial recognition and also make sure tattoos are covered up. 20:35.330 --> 20:37.290 Make sure you don't have hair. 20:39.090 --> 20:42.370 Make sure that nobody can find your t-shirt on Etsy. 20:42.770 --> 20:43.470 Exactly. 20:43.670 --> 20:46.270 Make sure you're not wearing a custom mask. 20:47.530 --> 20:50.010 I know we're kind of coming up to the end. 20:50.010 --> 20:51.550 We still have more time. 20:51.550 --> 20:58.150 But a great one is, any suggestions on research avenues for others looking to build off this project on? 20:58.150 --> 21:02.550 Most of this project in the past seems to be around 2G and 3G-based. 21:02.550 --> 21:06.450 So, it would be great to see a project catching up to the latest protocols. 21:06.950 --> 21:08.930 So, that is what we're doing. 21:10.630 --> 21:24.190 That is, in fact, the whole point of the project, is that all the past research has been focused on 2G and 3G, and we're specifically focused on 4G and what the latest iterations of cell-sizing motors like the Hailstorm and the Crossbow. 21:24.390 --> 21:28.610 I think what they're asking specifically is how they can give back, you know, research more on their own. 21:28.670 --> 21:32.130 Sorry, I misunderstood. 21:33.250 --> 21:35.390 Yep, that was the talk. 21:36.510 --> 21:38.590 Yeah, so how you can give back. 21:41.150 --> 21:45.290 Like, we would love people to get involved with the project, right? 21:46.910 --> 21:55.370 We have theories about how these things work based on our research, based on reading the academic papers, right? 21:55.370 --> 21:57.670 And again, a big shout-out to Yamna. 21:58.830 --> 22:02.950 Me and her spent two years reading all of the academic papers. 22:02.950 --> 22:05.610 A lot. 22:10.270 --> 22:11.670 You're probably back. 22:11.670 --> 22:12.410 We had some cutouts. 22:12.410 --> 22:13.090 Okay. 22:13.490 --> 22:14.470 Oh, sorry. 22:14.470 --> 22:17.850 Yeah, so me and Yamna spent a long time reading all... 22:17.850 --> 22:23.730 Yamna wrote a really excellent paper detailing all that we know about the 4G. 22:24.670 --> 22:28.970 And yeah, I mean, but, you know, further research, right? 22:28.970 --> 22:32.270 And, you know, new theories about how they might work. 22:32.270 --> 22:34.330 I mean, FOIA requests, right? 22:34.570 --> 22:40.350 There was a really excellent set of manuals for the Stingray, right? 22:40.350 --> 22:48.310 And if somebody did a similar FOIA request and got manuals for the Hailstorm hospital, like, yeah, that would be excellent. 22:48.830 --> 22:54.730 Well, this is a fantastic time for us to put in here a couple of bits. 22:54.730 --> 22:56.530 So you work for the EFF. 22:57.070 --> 23:06.270 Everybody here should know what the EFF is, but if you are brand new to the InfoSec community, give us just a blurb on the EFF. 23:06.930 --> 23:07.890 Sure. 23:07.890 --> 23:16.750 So EFF, or the Electronic Frontier Foundation, is an organization that defends civil liberties as they intersect with technology. 23:16.830 --> 23:20.050 Or as we say, when you get online, your rights come with you. 23:20.050 --> 23:29.490 You don't lose your rights, you don't lose your human rights, you don't lose your civil liberties, freedom of speech, the right to privacy, free expression, just because you're working with technology. 23:29.490 --> 23:41.390 And so we defend that, and we defend that through a combination of legal strategy, grassroots activism, and technology, like what I work. 23:42.090 --> 23:46.250 So we've been doing this for 30 years now. 23:46.250 --> 23:47.370 30 years this year. 23:47.370 --> 23:49.010 We started in 1990. 23:49.250 --> 24:00.650 And our first case was defending Steve Jackson Games when they had put out a pen and paper RPG called Cyberpunk, which the FBI decided was a manual for hacking. 24:00.650 --> 24:04.530 And they raided Steve Jackson Games and took all of their copies of Cyberpunk. 24:04.530 --> 24:13.090 We were teaching kids how to hack, and we defended them and got their books back because this is a clear freedom of speech issue. 24:13.450 --> 24:17.170 And so that was our first case, and we've been taking on cases ever since then. 24:17.570 --> 24:21.710 So I work specifically in EFF Threat Lab. 24:21.910 --> 24:27.110 Well, I guess you watched my talk where I talked pretty extensively about that, so I won't dig into the EFF Threat Lab. 24:27.110 --> 24:28.350 But that's what EFF is. 24:28.350 --> 24:29.790 We're a non-profit. 24:29.790 --> 24:31.110 We're member-supported. 24:31.210 --> 24:37.550 Over half of our annual budget comes from individual donations from our members, members like you. 24:38.230 --> 24:44.850 Well, Cooper, if I had a little bit of extra money and I wanted to give it to the EFF, how would I do that? 24:45.410 --> 24:50.390 Yeah, so you can buy EFF swag here at DEF CON. 24:50.390 --> 24:58.690 In fact, we even have a special DEF CON Safe Mode EFF shirt that you can only buy during Safe Mode. 24:58.690 --> 24:59.910 You can buy it right now. 25:00.170 --> 25:02.970 And that's at our website, EFF.org. 25:03.970 --> 25:06.850 And I think there's a donate link up there. 25:06.850 --> 25:08.170 There's a shop link up there. 25:08.170 --> 25:12.690 You can go find all of our branded swag and all of our DEF CON swag. 25:12.690 --> 25:15.830 Or you can just donate us money directly from there if you like. 25:15.830 --> 25:21.090 We're also taking donations in Zcash, I think, during DEF CON. 25:21.090 --> 25:24.710 So if you want to donate truly anonymously, you can donate to us through that. 25:24.810 --> 25:33.610 I have no idea how that works, but you can drop into the vendors channel and message the EFF account and set you up. 25:34.790 --> 25:40.990 I also heard a little bit that you are involved in some other things at DEF CON here. 25:41.010 --> 25:44.270 So would you like to talk a little bit about what you have going on later on? 25:44.270 --> 25:45.970 Yeah, I am. 25:45.970 --> 26:01.770 So at 5 o'clock tonight, 1700 Vegas time, we're running the EFF Tech Trivia event. 26:01.770 --> 26:04.450 So I will be the quiz master. 26:05.130 --> 26:08.810 And we will be asking trivia questions. 26:08.810 --> 26:16.310 You can sign up for a team right now if you go to the Discord channel under Contests and Events. 26:16.310 --> 26:17.770 It's EFF Triv. 26:17.910 --> 26:25.910 And you can sign up for a team and we'll ask a bunch of questions and the winning teams will get some free EFF swag. 26:25.910 --> 26:26.850 Great. 26:26.850 --> 26:36.030 Alright, so I'm sure that with all of the stuff that you've been talking about here, there are people who are interested in reaching out and doing more of this work with you. 26:36.030 --> 26:45.450 So we'll have you at the end here post whatever sort of contact information you would like for people to reach out to you with. 26:45.830 --> 26:48.810 Yeah, do you want me to post that in the Talks channel? 26:48.810 --> 26:50.630 Sure, we'll put that in the Talks channel. 26:51.110 --> 26:59.450 And yeah, if there's anybody who has one additional question that you'd like to hit or if... Ella Punk, did you find anything? 26:59.450 --> 27:00.590 Are you sitting on something? 27:03.410 --> 27:04.250 Maybe. 27:04.690 --> 27:05.350 Maybe. 27:05.350 --> 27:07.450 I was having so much fun listening to that. 27:07.450 --> 27:13.550 So I did post links for the shirt and more information on EFF in the group chat. 27:13.910 --> 27:14.550 Awesome. 27:14.550 --> 27:15.450 Thank you, Ella Punk. 27:15.450 --> 27:21.530 So do you have a final call to action for the people who are listening here? 27:21.710 --> 27:24.530 Something you would like them to take away? 27:25.890 --> 27:27.210 I do. 27:27.510 --> 27:34.030 My final call to action is just to get involved with what's going on in your local communities. 27:34.330 --> 27:38.290 As hackers, there's a lot we can do. 27:38.290 --> 27:41.450 There's a lot of problems that we can solve in our smart hackers way. 27:41.450 --> 27:44.170 And we don't always have to solve it through making a new app. 27:44.170 --> 27:49.430 A lot of people working in your community just need help setting up a mailing list, right? 27:49.530 --> 27:53.330 Or just need help setting up a simple static website, right? 27:53.370 --> 27:56.230 But there's also more creative problems to solve. 27:56.230 --> 28:02.650 Like I think the thing about using leaf blowers to blow away tear gas is very much in the hacker spirit, right? 28:02.650 --> 28:04.850 It's such a great thing to see. 28:04.850 --> 28:07.850 So I think that there's a lot of ways to get involved. 28:08.110 --> 28:14.150 You can also get involved with other EFF-minded people in your community by checking out the Electronic Frontier Alliance. 28:14.170 --> 28:23.510 Which is a group of EFF-affiliated subchapters in the local region. 28:23.510 --> 28:26.010 This is sort of the way to act locally. 28:26.950 --> 28:30.950 And you can check that out at EFF.org slash EFA. 28:31.450 --> 28:40.130 And the perfect question to end on here is, is all the project documentation on GitHub or any information about a paper being published? 28:40.130 --> 28:43.310 Yeah, all the project documentation. 28:44.130 --> 28:46.290 I have not published a paper. 28:46.290 --> 28:47.170 I hate writing. 28:47.170 --> 28:58.470 So I may publish a paper eventually, but all of the documentation such as it is, which, boy, open source and documentation, it's always great, right? 28:59.010 --> 29:02.870 But yeah, most of the documentation is in my head. 29:03.330 --> 29:07.050 The documentation that exists is on the GitHub, and I'm happy to answer questions. 29:07.050 --> 29:13.030 And I'm happy to take it upon myself to improve the documentation that people are actually using this. 29:13.250 --> 29:15.850 That's where you're sharing all of your spreadsheets, huh? 29:16.590 --> 29:17.310 Yes. 29:17.490 --> 29:18.870 All right. 29:18.870 --> 29:19.170 Yep. 29:19.170 --> 29:20.770 Hacking is just spreadsheets. 29:20.770 --> 29:23.610 Thank you, everyone, for coming to join. 29:23.610 --> 29:25.510 This was a wonderful presentation. 29:25.510 --> 29:29.470 I appreciate your willingness to come spend your time with us. 29:29.470 --> 29:37.110 So if anyone has additional questions, we will make sure that the contact information is available here in the track one. 29:37.590 --> 29:42.350 Otherwise, have a great rest of your convention, and we hope to see more from you soon. 29:43.090 --> 29:43.950 Thanks. 29:43.950 --> 29:44.830 Bye, everybody. 29:44.830 --> 29:45.190 Bye.