1
00:00:00,000 --> 00:00:06,980
My name is Cooper Quinton, and thank you for coming to my talk, Detecting 4G Base Stations in Real Time.

2
00:00:07,800 --> 00:00:09,340
First, a little about me.

3
00:00:09,340 --> 00:00:13,680
I am a senior security researcher at the EFF Threat Lab.

4
00:00:14,060 --> 00:00:19,680
I have a toddler, so you'll have to forgive the dad jokes and possible baby noises in the background.

5
00:00:19,680 --> 00:00:21,620
I'm also a former teenage phone freak.

6
00:00:21,620 --> 00:00:28,480
I may have built some boxes to do some nefarious things back in the day, which might explain why I got into the work that I do now.

7
00:00:30,000 --> 00:00:34,440
If you're not familiar with EFF, we are a member-supported non-profit.

8
00:00:34,440 --> 00:00:43,440
Over half of our annual funding comes from small donations from our members, individual donations, and we defend civil liberties online.

9
00:00:43,440 --> 00:00:51,160
So we think that when you get online, your rights come with you, and that when you're using technology, you still have rights, such as freedom of speech and the right to privacy.

10
00:00:51,160 --> 00:00:53,480
And we've been doing this work for 30 years this year.

11
00:00:53,480 --> 00:00:55,080
We started in 1990.

12
00:00:55,460 --> 00:00:58,780
So we have a lot of experience under our belt.

13
00:00:58,780 --> 00:01:02,220
We've been defending the internet and defending hackers for a long time.

14
00:01:02,820 --> 00:01:07,280
I work in the EFF Threat Lab, and I'll talk a little bit more about that in a second.

15
00:01:07,360 --> 00:01:11,080
But I want to first introduce my colleague Yamna.

16
00:01:11,500 --> 00:01:18,500
She can't be here with me on the DEF CON stage today, but none of this research would have been possible without her hard work.

17
00:01:18,500 --> 00:01:24,160
This is as much her project as it is mine, and she is an incredibly smart, incredibly talented person.

18
00:01:24,160 --> 00:01:31,000
So if you see her in the virtual halls of DEF CON safe mode, please buy her a virtual beer, or follow her on Twitter.

19
00:01:31,000 --> 00:01:37,540
Her name is at RivalElf, and she is a giant, sentient, very excitable radish, so don't be scared when you meet her.

20
00:01:37,700 --> 00:01:39,600
This is an actual photo of her.

21
00:01:40,720 --> 00:01:42,180
A bit about Threat Lab.

22
00:01:42,180 --> 00:01:45,800
We look at technology that targets at-risk people.

23
00:01:45,900 --> 00:01:53,660
So by at-risk, I mean people who are at risk of harm just for being who they are, having the beliefs that they do.

24
00:01:53,660 --> 00:02:04,560
And this includes activists, human rights defenders, journalists, domestic abuse victims, immigrants, sex workers, minority groups, political dissidents, and so on.

25
00:02:04,620 --> 00:02:07,460
Basically anybody who is at risk.

26
00:02:07,460 --> 00:02:12,740
So this is the sort of technology that we research and try to get a handle on.

27
00:02:12,740 --> 00:02:26,460
And we do this work because even though cybersecurity teams and antivirus companies are doing a good job of what they do, they mostly care about the types of malware that affect their customers, which are usually enterprise customers.

28
00:02:26,460 --> 00:02:35,840
And this is things like ransomware, banking Trojans, things that steal sensitive corporate data, things that affect bigger businesses.

29
00:02:35,840 --> 00:02:42,240
And we get to care about the types of technology that infringe on civil liberties and human rights of at-risk people.

30
00:02:42,580 --> 00:02:48,300
Because these people don't necessarily have the budget to pay a security team.

31
00:02:48,720 --> 00:02:55,240
But we also, by virtue of working for a nonprofit , don't have to worry about meeting a bottom line at the end of the day.

32
00:02:55,240 --> 00:03:00,840
So we like to think of ourselves as the security team for people who need it most and yet can afford it the least .

33
00:03:02,220 --> 00:03:05,360
Our goals in this work are, of course, first and foremost, to protect people.

34
00:03:05,360 --> 00:03:15,620
We want to make sure that the people in the communities that we work with are safe and able to express themselves and able to exercise their human rights.

35
00:03:15,900 --> 00:03:24,820
We want to broaden the community's understanding of the sorts of threats they face, who the threat actors are, what their capabilities are, and what sorts of technologies they might be facing.

36
00:03:25,980 --> 00:03:34,360
And we want them to better understand their defenses as well, how they can protect themselves, in what ways and what sort of measures they might need to take.

37
00:03:34,380 --> 00:03:47,620
We want to expose bad actors, such as nation states or companies or cyber mercenaries, that are going after people that are building technology to spy on civilians and violate human rights.

38
00:03:47,620 --> 00:03:51,200
And we want to make better laws, because we're a legal nonprofit at the end of the day.

39
00:03:51,200 --> 00:03:59,900
We want to make better norms and better laws and better norms in civil society so that these sorts of things don't keep happening again and again.

40
00:04:00,280 --> 00:04:06,680
What I want to talk to you about today is cell site simulators, also known as stingrays or MC catchers.

41
00:04:07,060 --> 00:04:17,260
I want to talk about how they work, some previous efforts to detect them, and why I think that those efforts aren't so great, and a new method that we've come up with to detect them here at EFF.

42
00:04:17,580 --> 00:04:21,540
And also how to fix the problem of cell site simulators once and for all.

43
00:04:23,280 --> 00:04:25,140
First, a little bit of terminology.

44
00:04:25,720 --> 00:04:27,880
The UE is the phone.

45
00:04:27,880 --> 00:04:28,680
It's just the phone.

46
00:04:28,680 --> 00:04:32,560
It stands for user equipment, but it's just the phone, the thing you're making the calls on.

47
00:04:32,960 --> 00:04:36,120
The MC is the International Mobile Subscriber ID.

48
00:04:36,120 --> 00:04:40,860
This is the ID that is burned into the sim card and unique for each sim card.

49
00:04:41,020 --> 00:04:49,020
The IMEI is the International Mobile Equipment ID, and this is the unique ID for the hardware that's burned into the hardware and can't be changed.

50
00:04:49,300 --> 00:04:57,880
The eNodeB, or the base station, this is what the UE, or user equipment, again, the phone, this is what the UE is actually communicating with.

51
00:04:57,880 --> 00:05:02,280
This is the thing that's at the end of the antennas that you're talking to.

52
00:05:03,460 --> 00:05:11,520
The EARFCN, or E-A-R-F-C-N, this is the frequency that the UE and eNodeB are communicating on.

53
00:05:12,000 --> 00:05:25,080
The sector is a specific antenna that is attached to the base station or eNodeB, and eNodeB can have multiple sectors, and each sector basically is an antenna pointing in a specific direction.

54
00:05:25,760 --> 00:05:44,520
The MIM, or master information block, is broadcast by the eNodeB and tells phones where to find the SIB, or system information block, which contains more details about the eNodeB, such as the cell ID, the MCC, MNC, and TAC, which are the mobile country code,

55
00:05:44,520 --> 00:05:47,620
the mobile network code, and the tracking area code, respectively.

56
00:05:47,620 --> 00:05:56,120
So, finally, I'm going to use the terms MCCatcher, Stingray, Hailstorm, fake base station, and cell site simulator, all kind of interchangeably.

57
00:05:56,680 --> 00:05:59,820
These don't mean exactly the same thing.

58
00:05:59,840 --> 00:06:04,320
A cell site simulator and a fake base station are fake cell towers.

59
00:06:05,000 --> 00:06:20,500
A Stingray and a Hailstorm are two brands of cell site simulator, and MCCatcher is sort of a common term for one of the things that cell site simulators do, although not all MCCatchers are cell sites that fully emulate a cell site.

60
00:06:20,820 --> 00:06:26,420
Some MCCatchers can run passively and not actually transmit anything, thus not emulating a cell site.

61
00:06:26,420 --> 00:06:31,480
But for our purposes, we're going to use them interchangeably, and that's okay for the purposes of this talk.

62
00:06:34,010 --> 00:06:38,690
So, here we have a diagram of the 4G network.

63
00:06:38,690 --> 00:06:47,670
This is a pretty high-level diagram, but you can see here that the user equipment, the phone, connects to the eNodeB using the LTVU protocol.

64
00:06:47,790 --> 00:06:55,450
Through the uplink, the eNodeBs can talk to each other through another protocol, and the eNodeBs exist in the network called the EUTRAN.

65
00:06:55,730 --> 00:07:13,750
And then you have a network called the Enhanced Packet Core, which is behind the eNodeBs, and this contains the MME, or Mobility Management Engine, serving gateway, and the PDN gateway, which connect to the public data network, which connect back to the phone network,

66
00:07:13,750 --> 00:07:18,930
and the EPC is also responsible for authenticating user billing, etc.

67
00:07:18,970 --> 00:07:21,550
We're not going to focus on the EPC today.

68
00:07:21,550 --> 00:07:27,450
There are issues there that we could talk about, but it's out of scope for this talk.

69
00:07:27,450 --> 00:07:35,910
We're instead going to focus specifically on the communication between the user equipment and the eNodeB, and that is sort of the area inside of this red circle.

70
00:07:38,590 --> 00:07:45,870
So, we started this project because we already knew a lot about the Stingray.

71
00:07:46,710 --> 00:07:49,710
Some law enforcement agencies had had the Stingray.

72
00:07:49,710 --> 00:07:55,310
The Stingray had been around for a while, and it was pretty well understood how it worked.

73
00:07:55,310 --> 00:08:05,350
Kristen Paget did a really great talk at DEF CON several years ago, where she demonstrated building her own homemade Stingray, and it's pretty well understood the vulnerabilities.

74
00:08:05,790 --> 00:08:20,190
But what we were noticing was that law enforcement was starting to upgrade their cell-site simulator devices to newer devices, such as the Hailstorm, which purported to be able to operate natively in 4G.

75
00:08:20,610 --> 00:08:32,450
And we started wondering, well, we have a pretty good idea of how the Stingray works, but we have no idea of how the Hailstorm and these newer devices operating in 4G, how they might work.

76
00:08:32,450 --> 00:08:37,830
So, let's dig into this, and let's start by figuring out how they could possibly work.

77
00:08:37,890 --> 00:08:42,650
And the first thing we want to look at is what changed between 2G and 4G.

78
00:08:42,650 --> 00:08:49,710
And there are three significant changes that affect the way that a cell-site simulator might work.

79
00:08:49,930 --> 00:08:57,750
The first, and most important, is that the eNodeB and the UE in 4G mutually authenticate each other.

80
00:08:59,330 --> 00:09:11,890
In 2G, the user equipment or the phone had to authenticate itself to the eNodeB or the base station, but the base station never had to prove that it was a real base station.

81
00:09:12,210 --> 00:09:18,870
And this was the source of a lot of fake base station attacks, such as the ones that the Stingray used in 2G.

82
00:09:18,870 --> 00:09:21,690
With 4G, this is no longer a problem.

83
00:09:21,970 --> 00:09:25,590
Also, in 2G, you had terrible encryption.

84
00:09:26,370 --> 00:09:34,810
The base station would dictate to the user equipment what cipher to use, and it could even dictate that the user equipment use a null cipher.

85
00:09:35,770 --> 00:09:52,290
What's more, the ciphers that were used by 2G were actually quite weak and could be broken in real-time or near real-time by anybody recording the packets between the base station and the phone, without even having to transmit anything.

86
00:09:52,290 --> 00:10:01,830
This is no longer the case in 4G, now that eNodeB and UE mutually agree on what encryption to use, and the ciphers are much, much better.

87
00:10:02,490 --> 00:10:20,110
Also, in 2G, the phone would always just connect to the strongest tower that it could see, and in 2G, you could even dictate how strong your signal was, telling the phone to ignore the actual signal strength and just trust what you were saying the signal strength was.

88
00:10:20,350 --> 00:10:23,130
Neither of these are the case anymore in 4G.

89
00:10:23,130 --> 00:10:25,450
The phone no longer naively connects to the strongest tower.

90
00:10:25,450 --> 00:10:29,730
Instead, there are a set of cell selection criteria that it follows.

91
00:10:30,610 --> 00:10:33,090
So, great, we've solved all the problems, right?

92
00:10:33,090 --> 00:10:38,270
Well, clearly not, because there are still cell site simulators that are operating natively in 4G.

93
00:10:38,910 --> 00:10:53,410
So, me and Yamna, set to work reading all of the academic literature that we could about vulnerabilities in 4G, and what could possibly be making cell sites and next generation cell sites and simulators work.

94
00:10:54,190 --> 00:11:13,690
And after several months of reading, over a year of reading really, Yamna wrote a really amazing paper called Gotta Catch Em All, which summarizes all of our findings, everything that we learned, about what vulnerabilities next gen CSSs might be taking advantage of.

95
00:11:13,930 --> 00:11:21,250
And we really figured out that there's one specific area where 4G is extremely vulnerable.

96
00:11:22,590 --> 00:11:25,150
So, 4G has a bit of a glass jaw.

97
00:11:25,150 --> 00:11:39,830
Even though the UE authenticates with the tower, or authenticates the tower now, there are still several messages that get sent, received, and trusted, before that authentication ever happens, or without authentication ever happening in the first place.

98
00:11:39,930 --> 00:11:44,410
And this is the weak spot in which the vast majority of 4G attacks happen.

99
00:11:44,770 --> 00:11:53,690
I'm not going to get into those attacks here today, because Yamna has already done a really excellent job of summarizing those in that paper, and I highly suggest that you go read it.

100
00:11:53,690 --> 00:11:55,110
It's an excellent paper.

101
00:11:56,510 --> 00:12:05,070
But to give a high level summary, this is the handshake protocol between the user equipment, the phone, again, and the base station.

102
00:12:05,930 --> 00:12:13,950
And it starts with the user equipment looking on each ERF SIN, or frequency, for a frame synchronization signal from a base station.

103
00:12:13,950 --> 00:12:30,890
Once it finds synchronization signals, it is able to find the MIB, master information block, and decode that, which lets it find the SIN and decode that, which gives it enough information about the mobile country code, the mobile network code, to decide whether it wants to connect,

104
00:12:30,890 --> 00:12:36,070
and then send an RRC, radio resource control, RRC connection request.

105
00:12:36,190 --> 00:12:40,530
It does that handshake, and then it begins the attach request.

106
00:12:40,590 --> 00:12:45,990
And here, in step 7, is where the authentication finally starts.

107
00:12:45,990 --> 00:12:50,670
All of the messages before that are never authenticated.

108
00:12:50,670 --> 00:13:07,050
And some of the messages that get sent in that area can contain things like the IMSI of the phone, allowing you to uniquely identify it, it can contain even the GPS coordinates of the phone, allowing you to locate it, and a bunch of other things.

109
00:13:07,050 --> 00:13:12,490
Attacks that allow you to downgrade it to TeamG, or allow you to kick it off the mobile network entirely.

110
00:13:13,310 --> 00:13:20,490
So this is where the heart of all of the vulnerabilities lie at 4G, and this is the part that we find really interesting.

111
00:13:21,210 --> 00:13:34,510
So now that we had a pretty good handle on how 4G cell-site simulators are probably being used, we wanted to get an idea of how often they're being used.

112
00:13:35,510 --> 00:13:38,530
And if we want to learn how often they're being used by U.S.

113
00:13:38,530 --> 00:13:43,130
law enforcement, the best way to do this is to file FOIA requests.

114
00:13:44,590 --> 00:13:55,890
ACLU filed a really excellent FOIA request, which came back, which just got published this year, in 2020, about ICE and DHS's use of cell-site simulators.

115
00:13:55,890 --> 00:13:58,850
And in it, they discovered that ICE, or U.S.

116
00:13:58,850 --> 00:14:09,770
Immigration and Customs Enforcement, used cell-site simulators between 2017 and 2019 a total of 466 times, hundreds of times per year.

117
00:14:10,050 --> 00:14:18,490
DHS, on the other hand, used their cell-site simulator 1,885 times between 2013 and 2017.

118
00:14:18,590 --> 00:14:25,770
We also found out that Customs and Border Patrol, or CBP, owns 33 cell-site simulators, which is a ton.

119
00:14:25,770 --> 00:14:32,390
And we don't know how often they're being used, but we can assume that it's probably on par with ICE and DHS.

120
00:14:33,850 --> 00:14:47,470
Oakland, on the other hand, the Oakland PD, Oakland's local police department in California, they used their cell-site simulator, which is a hailstorm, three times in 2017.

121
00:14:47,510 --> 00:14:52,730
In 2018, it was used four times, and in 2019, it was used only once.

122
00:14:53,530 --> 00:15:08,590
But on the other hand, Santa Barbara PD, the local police department for Santa Barbara, California, used their cell-site simulator 231 times in 2017, roughly matching up with the numbers from ICE and DHS.

123
00:15:08,990 --> 00:15:11,730
So, what makes Oakland so much different in this case?

124
00:15:11,730 --> 00:15:16,470
Well, we think that it's because Oakland has stronger privacy laws.

125
00:15:16,690 --> 00:15:28,570
Oakland has pretty strong regulations about when and where the cell-site simulator can be used, how it can be used, and what sort of reporting, public reporting, needs to happen afterwards.

126
00:15:28,570 --> 00:15:36,370
And we think that that has really kept Oakland PD on a leash as far as their use of cell-site simulators is concerned.

127
00:15:37,390 --> 00:15:44,770
So, we encourage other communities to come up with similar rules and regulations about how these can be used.

128
00:15:45,010 --> 00:15:54,010
But of course, not everybody using a cell-site simulator is going to follow rules and regulations, nor can they be FOIAed.

129
00:15:54,030 --> 00:15:58,770
We have pretty good evidence that foreign spies are using cell-site simulators.

130
00:15:58,770 --> 00:16:15,370
The Department of Homeland Security put out a report last year where they demonstrated that they found several cell-site simulators around the White House and around Washington, D.C., which almost certainly belong to foreign spies trying to spy on the political class in Washington,

131
00:16:15,370 --> 00:16:16,050
D.C.

132
00:16:16,930 --> 00:16:23,110
We also have reason to believe that cyber mercenaries such as NSO Group have access to cell-site simulators.

133
00:16:23,110 --> 00:16:41,550
A report from Amnesty International that was put out this year in 2020 detailed a campaign against a Moroccan journalist to spy on a Moroccan journalist by NSO Group, where they also use cell-site simulators to intercept his calls.

134
00:16:41,870 --> 00:16:45,330
And finally, we think that just straight-up criminals have access to these.

135
00:16:45,330 --> 00:16:51,550
There's rumors that drug cartels have access to a cell-site simulator, and it makes sense.

136
00:16:51,550 --> 00:16:55,930
Cell-site simulators are pretty easy and pretty cheap to build at this point.

137
00:16:55,930 --> 00:17:02,230
And if you don't want to build one, you can acquire them from companies in Israel, companies in Saudi Arabia.

138
00:17:02,510 --> 00:17:07,050
They're really pretty ubiquitous and pretty easy to acquire.

139
00:17:07,370 --> 00:17:09,830
And of course, these people can't be FOIA.

140
00:17:09,830 --> 00:17:15,770
We can't ask them how often they're being used, so we have no idea how often these groups are using these.

141
00:17:16,530 --> 00:17:24,950
So that being the case, our next step is we start to think about, okay, how can we detect cell-site simulators?

142
00:17:25,430 --> 00:17:33,840
And there are two schools of thought for how to detect cell-site simulators.

143
00:17:35,300 --> 00:17:45,360
One is app-based, and this is applications like Aim60 or Android MCCatcher Detector, Snoop Snitch, or Darshark.

144
00:17:45,860 --> 00:17:48,800
The strengths of these are that they're cheap.

145
00:17:48,800 --> 00:17:53,100
It's an app, you install it on your Android phone, and they're easy to use.

146
00:17:53,100 --> 00:17:59,420
You start the app, you let it run, it lets you know if it finds something that's suspicious.

147
00:17:59,440 --> 00:18:01,560
All you need is an Android phone.

148
00:18:01,660 --> 00:18:10,620
And it might need to be rooted, it might need to be a specific type of phone, but you don't really, as long as you have that phone already, you don't have to spend any further money.

149
00:18:11,560 --> 00:18:15,940
The weaknesses of these are that you're going to get very limited data.

150
00:18:16,000 --> 00:18:26,020
Aim60 only gives you, on an unrooted phone at least, only gives you the MCC, MNC, and the location and the location area.

151
00:18:27,200 --> 00:18:29,860
And some information about the signal strength.

152
00:18:29,900 --> 00:18:42,120
Snoop Snitch and Darshark get more info because they're able to read baseband messages on the phones that they support, but still you're only getting the info about cells that your phone is connected to.

153
00:18:42,220 --> 00:19:03,780
And you're getting a lot of information about weird things happening, but a lot of those end up being false positives, because many of the things that could be indicators of cell-site simulators are also just weird, these sorts of weird things that happen in the cell network quite often.

154
00:19:04,140 --> 00:19:16,520
And because of that, you get a lot of false positives, and it's hard to tell what is actually a cell-site simulator and what is maybe just the cell network being the cell network.

155
00:19:17,860 --> 00:19:34,620
The other school of thought is radio-based, and this is basically things where you have a software-defined radio or a cellular modem, and you're getting information about all of the towers around you, and you're putting that in a database and running some heuristics to determine what's suspicious.

156
00:19:35,460 --> 00:19:43,380
Projects that are examples of this are Seaglass from the University of Washington, Sitch from Ashwilson, and Overwatch, which is a commercial product.

157
00:19:43,820 --> 00:19:46,160
The strengths of these are that you can get better data.

158
00:19:46,160 --> 00:19:50,880
You can get data from all of the towers in an area, not just the ones that you're connecting to.

159
00:19:50,940 --> 00:19:53,820
You can also get lower-level information.

160
00:19:53,820 --> 00:20:01,440
You can get as low-level information as you want based on what you can program with your radio, right?

161
00:20:02,060 --> 00:20:06,600
The weaknesses of these are that they're harder to set up.

162
00:20:06,900 --> 00:20:16,720
They can be harder to use and interpret because you maybe have to run Linux and set up a server, and you have to put together some hardware, and maybe even have to know a little bit of programming.

163
00:20:16,900 --> 00:20:21,160
Also, the weaknesses that you have to buy that hardware, and hardware can be expensive.

164
00:20:21,280 --> 00:20:25,900
You might have to spend a couple hundred dollars to get running, whereas the app is free.

165
00:20:25,900 --> 00:20:29,300
So there are strengths and weaknesses to both of these.

166
00:20:30,040 --> 00:20:47,740
But armed with this knowledge, we started hearing rumors about cell-site simulators being used at the Standing Rock protest, or at the Dakota Access Pipeline protest in Standing Rock, North Dakota.

167
00:20:48,400 --> 00:21:00,160
And given that we had some ideas about how maybe one could detect cell-site simulators, and we wanted to know if they were being used at protests, we decided to go down to Standing Rock and see what we could find.

168
00:21:00,180 --> 00:21:12,640
So I armed my phone with Snoop Snitch and AimSickD, and I brought along a couple of RTL-SDRs, which I figured I could do some spectrum analysis with, and made my way down to Standing Rock.

169
00:21:12,960 --> 00:21:19,500
And what I figured out was that I had no idea what I was doing.

170
00:21:19,900 --> 00:21:24,620
And by the way, this dog is, I don't know, our patronus is canceled now?

171
00:21:24,840 --> 00:21:26,940
If not, this dog is my patronus.

172
00:21:26,940 --> 00:21:30,160
I very much identify with this dog.

173
00:21:30,360 --> 00:21:33,580
But we had no idea what we were doing.

174
00:21:33,580 --> 00:21:44,120
When we got there, what we realized was there were no 2G towers anywhere to be found, whether they be legitimate or illegitimate.

175
00:21:44,120 --> 00:21:49,680
And all of our detection methods were focused on detecting 2G towers.

176
00:21:49,720 --> 00:21:55,760
If a 2G cell had shown up all of a sudden, that would have been a pretty strong indicator.

177
00:21:55,760 --> 00:22:01,760
But we weren't able to find any evidence of 2G cells while we were at Standing Rock.

178
00:22:02,120 --> 00:22:16,260
And the conclusion that we came to is that if cell site simulators were being used at Standing Rock, they must be next generation cell site simulators that were operating natively on 4G.

179
00:22:16,260 --> 00:22:22,480
Which leaves us with the question, how can we detect 4G-based cell site simulators?

180
00:22:22,560 --> 00:22:27,960
And how can we improve on previous attempts to detect cell site simulators?

181
00:22:28,720 --> 00:22:34,420
Well, first off, I think that the radio-based method is solid.

182
00:22:34,460 --> 00:22:37,760
SeaGlass had already put up some pretty interesting results.

183
00:22:37,760 --> 00:22:50,320
And the idea of getting information about all of the cells in an area, everything that's broadcasting, not just the ones that your phone's connecting to, and comparing that data over time, I think are really interesting.

184
00:22:50,320 --> 00:23:06,320
So let's add on top of that, looking specifically at 4G transmissions, having heuristics based on what we've learned from mine and Yamna's research, and let's verify the results.

185
00:23:06,320 --> 00:23:12,320
When we find a suspicious tower, let's go track it down and see what it actually is.

186
00:23:12,380 --> 00:23:14,720
Is it on top of a cell tower?

187
00:23:14,720 --> 00:23:15,300
Yeah, great.

188
00:23:15,300 --> 00:23:16,440
It's probably fine.

189
00:23:16,440 --> 00:23:18,680
Is it on top of a building?

190
00:23:18,680 --> 00:23:19,380
Yeah, that's fine.

191
00:23:19,380 --> 00:23:20,820
It's probably a small cell.

192
00:23:20,820 --> 00:23:22,660
Is that building an embassy?

193
00:23:22,660 --> 00:23:25,060
Well, that's a lot more suspicious.

194
00:23:25,460 --> 00:23:31,000
And finally, is it in an unmarked van or in a van surrounded by police officers?

195
00:23:31,000 --> 00:23:32,840
Well, that's very suspicious.

196
00:23:33,720 --> 00:23:37,770
So without further ado, I introduce to you Crocodile Hunter.

197
00:23:38,880 --> 00:23:49,780
Crocodile Hunter is an open source project that we've been working on at EFF for the last couple of years and are releasing here at Virtual Black Hat and DEF CON this week.

198
00:23:50,380 --> 00:23:53,480
Crocodile Hunter is a hardware and software based.

199
00:23:53,480 --> 00:24:13,880
It uses an SDR and the software, the backend is based on SRS-LTE, which is an open source LTE software stack that's able to emulate both the Enhanced Packet Core, the eNodeB, and also the user equipment, which we use to measure the cell network in the area.

200
00:24:13,880 --> 00:24:24,340
It's written in C++ and we wrote a program in the SRS-LTE API to scan the cell network for us.

201
00:24:24,340 --> 00:24:31,360
The frontend, which it communicates with over a local socket, is written in Python 3.

202
00:24:32,020 --> 00:24:42,940
The frontend is responsible for getting data from the socket from SRS-LTE, adding it to the database, running heuristics, and displaying tower locations.

203
00:24:42,940 --> 00:24:52,440
And we also have an API so that if you want to gather data from multiple sensors or if you want to share data between multiple researchers, you can.

204
00:24:53,600 --> 00:24:56,640
Here's an example of what the user interface looks like.

205
00:24:56,640 --> 00:25:04,340
This is from a scan that me and my colleague Dave Moss did in downtown San Francisco during the Dreamforce conference last year.

206
00:25:05,740 --> 00:25:14,360
Each of these points on this map is, we think, probable location of a cell in downtown San Francisco on that day.

207
00:25:14,360 --> 00:25:21,740
The orange points are cells that we didn't find to be suspicious, and the black skulls are cells that we did think were suspicious.

208
00:25:21,860 --> 00:25:29,020
And I should note here that certainly there's no way that each of these black skulls is a cell site simulator.

209
00:25:29,020 --> 00:25:32,920
In fact, probably none of them are cell site simulators.

210
00:25:32,920 --> 00:25:36,560
But we think they're suspicious and require further checking.

211
00:25:38,260 --> 00:25:40,860
And I'll go into more depth about that later.

212
00:25:40,860 --> 00:25:55,540
On the hardware side, the hardware stack is a laptop or a Raspberry Pi running Ubuntu, and you need a battery for the Pi if you want it to be mobile , a USB GPS dongle, and an SDR with some LTE antennas.

213
00:25:55,660 --> 00:26:00,080
For the SDRs, we've tested it with BladeRF and an Edis B200.

214
00:26:00,280 --> 00:26:03,820
It should support all models of Edis and BladeRF.

215
00:26:04,160 --> 00:26:08,920
It also theoretically could support a Lime SDR, which is significantly cheaper.

216
00:26:09,160 --> 00:26:14,000
I think the BladeRF will run you about $500, whereas a Lime SDR will run you about $250.

217
00:26:14,260 --> 00:26:16,400
But we have not tested it with that.

218
00:26:16,400 --> 00:26:20,600
But that is on the roadmap because we would like for this hardware stack to be cheaper.

219
00:26:22,100 --> 00:26:24,960
Here's what the hardware looks like sitting on my kitchen counter.

220
00:26:25,020 --> 00:26:34,220
As you can see, it's actually pretty compact, and you can easily put it into a backpack or load it into your car and go for a drive around your city.

221
00:26:35,120 --> 00:26:38,440
And it's pretty... and you can do it pretty discreetly.

222
00:26:39,920 --> 00:26:47,860
So the general workflow is we start by scanning all of the frequencies that we know about and decoding each MIB and SIB that we find.

223
00:26:47,860 --> 00:26:58,020
We record those into a database, we map the probable location of those cells, we look for any anomalies in the readings, and then we locate suspicious cells and confirm the results.

224
00:26:58,120 --> 00:27:00,320
And I'll go into each one of those in more depth.

225
00:27:01,000 --> 00:27:05,440
So we start by scanning a list of ERFsens, again, frequencies.

226
00:27:05,440 --> 00:27:10,520
We start by scanning a list of ERFsens that we get from an open source database called Wiggle.

227
00:27:10,520 --> 00:27:17,500
Wiggle is an open source database of war driving readings of Wi-Fi networks and also of cell networks.

228
00:27:17,500 --> 00:27:23,780
So we get all of the ERFsens for the given geographical region we are in, and then we scan each of those.

229
00:27:23,780 --> 00:27:35,340
And our theory behind this is that we think that a cell-site simulator is going to have to operate on the same frequencies that real cells are, so that phones will be more inclined to connect to them.

230
00:27:35,920 --> 00:27:44,400
So we scan each of these frequencies, and if we find a MIB, we decode the MIB and the SIB, and we send it to the front end over our socket.

231
00:27:45,060 --> 00:28:02,300
The front end stores the information in a database, and it stores in that database the mobile country code, the network code, the tracking area code, physical ID and ERFsens, the latitude and longitude of where the reading was made, the timestamp, the signal strength,

232
00:28:02,300 --> 00:28:08,400
the e-node BID, the sector ID, and a few other IDs, and finally the raw data from the SIB1.

233
00:28:11,540 --> 00:28:15,980
And then the next step is that we try to map out the antennas in real time.

234
00:28:16,480 --> 00:28:29,500
And we map them out using a process called trilateration, which is a process where we have distance estimates that we're able to get from a combination of the frequency of the transmission and the signal strength.

235
00:28:29,500 --> 00:28:34,800
We can estimate the distance and then with multiple readings, figure out where the towers are.

236
00:28:35,000 --> 00:28:47,440
And then we can compare this to a ground truth such as wiggle or open cell ID or the FCC database to see if other people have seen a cell with those identifiers in that area historically.

237
00:28:48,240 --> 00:28:51,940
A quick explanation of trilateration versus triangulation.

238
00:28:52,120 --> 00:29:02,240
So trilateration is where you have a measurement of the distance away from a transmitter that you are, but not what direction the transmitter is in.

239
00:29:02,240 --> 00:29:11,800
So you draw a circle around the point where you're at, and somewhere on the edge of that circle is where the transmitter is going to be.

240
00:29:11,800 --> 00:29:22,670
Once you've made three measurements, you can draw three circles, and the place where those three circles intersect is the place where the transmitter is going to be located.

241
00:29:23,540 --> 00:29:32,860
Triangulation, on the other hand, is where you have a bearing, that is to say a direction of the signal, but you don't know how far away the signal is.

242
00:29:32,940 --> 00:29:50,040
With triangulation, you get two readings with a bearing, with a direction, and then you can make a triangle with one line between the two readings and the other two sides with the direction of the readings.

243
00:29:50,040 --> 00:29:57,720
And where those two directions intersect is where the location of the tower will be.

244
00:29:58,040 --> 00:30:06,160
So triangulation is good if you have direction, direction but not distance, and trilateration is good if you have distance but not direction.

245
00:30:06,160 --> 00:30:09,760
For trilateration, you only need one omni-directional antenna.

246
00:30:09,760 --> 00:30:32,320
But for triangulation, you either need three omni-directional antennas with all of their clocks synced, so that you can actually measure the angle that the signal is coming from, or you need a directional antenna that's constantly spinning so that you can figure out which direction it points has the strongest signal and thus figure out the bearing.

247
00:30:34,100 --> 00:30:46,720
Given that we figured most people running this would only have one omni-directional antenna and not a spinning antenna or three clock-synced antennas and thus three clock-synced radios, we figured that trilateration was our best bet.

248
00:30:47,400 --> 00:30:49,880
So finally, we look for anomalies.

249
00:30:49,880 --> 00:30:52,320
And what are we looking for in terms of anomalies?

250
00:30:52,520 --> 00:31:08,320
We're, well, looking for things like cells that move over time, cells where the signal strength changes, cells that aren't where they should be, in other words, cells that are here and also across the city, cells that change parameters.

251
00:31:08,320 --> 00:31:18,840
Suddenly this node BID is broadcasting a different country code or a different network code or suddenly it's broadcasting a different bandwidth or something like that.

252
00:31:18,840 --> 00:31:25,380
We're also looking for cells that are missing some of the more obscure parameters in the SID or higher SIDs.

253
00:31:25,380 --> 00:31:28,020
And we're looking for new cells that are showing up.

254
00:31:28,060 --> 00:31:34,160
And again, it's important to mention here that just because we find an anomaly doesn't mean we've found a cell-site simulator.

255
00:31:34,160 --> 00:31:36,580
We actually need to go verify it.

256
00:31:38,820 --> 00:31:50,480
So if you know anything about 4G attacks and know how they work, you might be thinking at this point, but there's a lot of heuristics that you could have if you could actually connect to the tower.

257
00:31:50,580 --> 00:31:51,940
And that is true.

258
00:31:52,000 --> 00:31:56,580
There are a lot of really cool heuristics that we could get if we could connect to a cell.

259
00:31:56,580 --> 00:32:00,220
We could see if we got a reject message or we could see if it accepted us.

260
00:32:00,220 --> 00:32:01,980
Either one of those might be interesting.

261
00:32:02,200 --> 00:32:08,360
We could see if it was missing some of the higher level or more esoteric parts of the LTE stack.

262
00:32:08,360 --> 00:32:11,380
Or there's all sorts of things we could measure.

263
00:32:11,380 --> 00:32:16,840
We could see how many paging messages it's sending out or how many other UEs are connected to the cell.

264
00:32:16,840 --> 00:32:20,000
But all of those would require connecting to the cell.

265
00:32:20,000 --> 00:32:23,580
And connecting to the cell requires transmitting.

266
00:32:23,960 --> 00:32:29,240
We thought it'd be a great idea until the EFF lawyers pointed out that that's illegal.

267
00:32:29,240 --> 00:32:39,660
Because we're using a software-defined radio, it's not actually licensed to communicate to transmit on the cellular bandwidths.

268
00:32:39,660 --> 00:32:44,400
Whereas your cellular modem in your phone is licensed to transmit on those bands.

269
00:32:44,400 --> 00:32:51,520
So we can't transmit on those bandwidths without violating on those bands on those frequencies without violating the law.

270
00:32:51,520 --> 00:32:53,140
And we don't want to go to jail.

271
00:32:53,140 --> 00:32:55,100
So we decided not to transmit.

272
00:32:55,700 --> 00:33:00,040
But despite that, we still got some results.

273
00:33:00,040 --> 00:33:02,240
So what we've found so far.

274
00:33:02,240 --> 00:33:08,260
Our first test was at the Dreamforce conference, which I mentioned previously, with my colleague Dave Moss.

275
00:33:08,560 --> 00:33:11,820
Me and Dave spent all day running around downtown San Francisco.

276
00:33:11,820 --> 00:33:15,320
And for those of you who aren't familiar with Dreamforce, lucky you.

277
00:33:15,920 --> 00:33:18,480
Dreamforce takes over all of downtown San Francisco.

278
00:33:18,480 --> 00:33:23,220
And there's sales people running around everywhere.

279
00:33:23,540 --> 00:33:26,800
We wandered around the main park where Dreamforce was happening.

280
00:33:26,800 --> 00:33:36,500
And we noticed this little cluster of suspicious cells here on the park near the where the event was taking place.

281
00:33:36,540 --> 00:33:43,360
So we started walking down Third Street and getting to the point where we thought the suspicious cells were.

282
00:33:43,360 --> 00:33:46,440
And we're thinking, hey, yeah, I think it's probably right about here.

283
00:33:46,460 --> 00:33:51,880
When we looked up and saw this giant black truck with a satellite dish on top of it.

284
00:33:51,880 --> 00:33:58,860
The satellite dish was pointing at a building about a block away that had a couple of cell antennas on top of it that we had noted previously.

285
00:34:00,740 --> 00:34:11,980
After looking at the truck, looking up the company that was listed on the side of the truck and talking to the guys in the truck, we determined that this is in fact a cell on wheels and not a cell-side simulator.

286
00:34:12,340 --> 00:34:24,840
A cell on wheels is a portable cell tower that people bring out, companies bring out, to expand the cellular capacity in a given area, usually for large events.

287
00:34:24,840 --> 00:34:26,960
In fact, there was even one at Stading Rock.

288
00:34:29,000 --> 00:34:31,460
We don't think that this was a cell-side simulator.

289
00:34:31,460 --> 00:34:33,860
And in fact, cells on wheels are pretty common.

290
00:34:34,120 --> 00:34:38,220
But they have some interesting similarities to cell-side simulators.

291
00:34:41,880 --> 00:34:49,360
Namely, in that they are a portable cell that shows up that isn't usually there, is suddenly there, and then leaves.

292
00:34:50,360 --> 00:34:56,580
And that they are acting like legitimate cells.

293
00:34:56,580 --> 00:35:10,080
The main differences are that they're not actually trying to exploit any of the characteristics of the 4G network, and the people operating them are probably not using them to spy on you.

294
00:35:10,440 --> 00:35:14,120
But we still think that this is a successful test.

295
00:35:14,120 --> 00:35:23,900
We were able to use our heuristics to find a new cell that had just showed up, and we were able to use our map to actually track that down and see what it was.

296
00:35:24,160 --> 00:35:28,860
If we had just been using an app, maybe that app would have called this out, maybe it wouldn't have.

297
00:35:28,860 --> 00:35:34,420
And even if it had called it out, we wouldn't have known what to go look for or what it might have been.

298
00:35:34,780 --> 00:35:37,300
So, we considered this a success.

299
00:35:38,640 --> 00:35:44,940
Earlier this year, we did a second test at ShmooCon in Washington, D.C.

300
00:35:45,960 --> 00:35:55,460
So, I loaded up Crocodile Hunter on a Raspberry Pi running around ShmooCon with it in my backpack for the entire time.

301
00:35:55,460 --> 00:36:16,480
And what we discovered at ShmooCon was two really interesting sets of two different ENOBs that would occasionally broadcast, instead of the country code and network code of 310410, which maps to USA and AT&T, would broadcast a completely different country code and a completely different network code.

302
00:36:16,680 --> 00:36:31,760
Looking into it further, the first one was broadcasting on the same ERCIN as what we think is the legitimate tower, but would broadcast a different MCC and MNC of 350 and 490.

303
00:36:32,080 --> 00:36:41,100
350 is the country code for Bermuda, and the MNC 490 is not used by any network in Bermuda.

304
00:36:41,100 --> 00:36:46,740
In the U.S., it's used by Sprint and T-Mobile, but again, this is an AT&T network.

305
00:36:46,740 --> 00:36:54,920
It was also broadcasting the same physical ID, but a different sector ID and a different tracking area code.

306
00:36:54,920 --> 00:36:56,980
So we find this really interesting.

307
00:36:58,400 --> 00:37:10,680
In another instance, there was another ENOB broadcasting on the same ERCIN as what we think is a legitimate ENOB, this time broadcasting a country code of 308 for St.

308
00:37:10,680 --> 00:37:16,820
Pierre and Miquelon, which, if you need a point of reference, these are a couple of small islands off the coast of Nova Scotia.

309
00:37:16,880 --> 00:37:20,040
I was also not aware of them until I looked them up for this talk.

310
00:37:20,360 --> 00:37:28,220
And the network code 451 is not used by any network for anything ever anywhere in the world.

311
00:37:28,640 --> 00:37:39,260
This network was also broadcasting the same physical ID, and in this case was broadcasting the same sector ID as the legitimate tower and the same tracking area code as the legitimate tower.

312
00:37:39,260 --> 00:37:41,300
So these were really interesting.

313
00:37:41,560 --> 00:37:52,480
Unfortunately, I, as I said, was running around with the Crocodile Hunter in my backpack and didn't notice these results until after the fact, so I didn't get a chance to go track them down.

314
00:37:52,900 --> 00:37:57,280
So hopefully in the future, we'll find something like this and actually get to go physically look at them.

315
00:37:59,280 --> 00:38:01,440
We do have ongoing tests, though.

316
00:38:01,440 --> 00:38:18,100
Our partners in Latin America with the Fake Intended Detection Project have previously run around Mexico City and other places with SeaGlass and have gotten some really interesting results there, and are planning next to run around there with Crocodile Hunter and see what they can find.

317
00:38:18,100 --> 00:38:20,340
And I'm really excited for what they will find.

318
00:38:20,560 --> 00:38:25,780
We also have partners running Crocodile Hunter in Washington, D.C.

319
00:38:25,880 --> 00:38:32,100
and in New York City, and we hope now that the project is open source that you'll want to run this in your hometown as well.

320
00:38:35,480 --> 00:38:39,960
In the future, we hope to get better heuristics for Crocodile Hunter.

321
00:38:40,320 --> 00:38:46,920
Some of the heuristics I have right now aren't great, and I think that there are other ones that we could do.

322
00:38:46,920 --> 00:38:48,300
We have a lot of ideas.

323
00:38:48,660 --> 00:38:56,240
We also can improve these once we get a better sense of how ABC catchers and cell site simulators are operating in the wild.

324
00:38:56,700 --> 00:39:13,020
Speaking of heuristics, once we get a lot of readings, we think that we can start to do some machine learning to build a classifier for what towers are behaving normally and giving normal characteristics and what towers are suspicious, maybe in ways that a human wouldn't notice.

325
00:39:13,280 --> 00:39:15,480
I also want to get better location finding.

326
00:39:15,480 --> 00:39:21,340
Right now, my location finding can sometimes be about 50 meters off, and that's not great.

327
00:39:21,340 --> 00:39:23,380
It's still pretty close, and I'm okay with it.

328
00:39:23,380 --> 00:39:24,640
I think it's good enough.

329
00:39:25,140 --> 00:39:36,480
But I would like to get it much better, and that means we need better distance estimates, which is beyond my math and physics knowledge, unfortunately.

330
00:39:37,500 --> 00:39:40,600
And the other thing we need is we want to port it to cheaper hardware.

331
00:39:40,600 --> 00:39:44,420
Like I said, the Blade RF will ring you about $500.

332
00:39:44,500 --> 00:39:49,040
We think that it can work on the Lime SDR, which is cheaper at $250.

333
00:39:49,800 --> 00:40:06,260
My dream is that it would work on the RTL SDR, which would cost like $20, but I'm not convinced that the RTL SDR and Raspberry Pi are actually powerful enough or have the bandwidth to do what we need them to do, so that's still up in the air.

334
00:40:07,760 --> 00:40:09,700
And finally, what's with the name?

335
00:40:09,820 --> 00:40:16,980
Well, you may remember that one of the brand names for a cell-site simulator is the StingRam.

336
00:40:17,000 --> 00:40:24,040
You may also remember that the StingRam is the animal that finally killed Steve Irwin, the crocodile hunter.

337
00:40:24,320 --> 00:40:28,360
So, we named it Crocodile Hunter to press F for Steve.

338
00:40:30,320 --> 00:40:33,780
Finally, what can we do to stop cell-site simulators?

339
00:40:34,140 --> 00:40:41,980
Well, we can start by having a toggle on iOS and Android to turn off 2G support.

340
00:40:41,980 --> 00:40:51,480
One of the main attacks for native 4G cell-site simulators is to use that pre-authentication area to downgrade your connection to 2G.

341
00:40:51,480 --> 00:41:05,480
And once your phone is downgraded to a 2G connection, they can do things like inspect content or do passive attacks to decrypt the messages between you and the cell tower, or they can emulate a 2G base station.

342
00:41:05,500 --> 00:41:11,180
So, your phone still supports 2G, and the reason for that, there's a good reason for that.

343
00:41:11,180 --> 00:41:19,800
It's because many people in the world still use 2G cells as their primary form of communication, and lots of 2G networks are still up.

344
00:41:20,040 --> 00:41:32,960
So, iOS and Android can't just disable 2G by default, but what they could do is build in a toggle for users who are concerned about this to be able to turn off their 2G radios if they wish.

345
00:41:33,160 --> 00:41:37,060
And we've written a blog post that encourages them to do so.

346
00:41:38,020 --> 00:41:41,680
The main thing we need to fix, though, is these pre-authentication messages.

347
00:41:41,680 --> 00:41:48,900
All of the messages that happen after your phone connects to the tower, but before the authentication starts.

348
00:41:48,900 --> 00:41:54,020
And that's a problem not in 4G, but not just in 4G, but in 5G as well.

349
00:41:54,020 --> 00:42:07,520
There's a pretty interesting proposal for covering all of the messages, or authenticating all of the messages between the tower and the user equipment with TLS.

350
00:42:07,640 --> 00:42:21,900
There's a pretty good paper about this, and it'll be linked here in the notes for this presentation, that proposes a way, and it's still in its infancy, and it's going to take some more work, but we really think that long-term, that's the solution.

351
00:42:22,480 --> 00:42:27,700
But that's going to have to be implemented by a standards body, such as the 3GPP.

352
00:42:28,060 --> 00:42:33,040
And the 3GPP is the standards body that makes all of the standards for cell networks.

353
00:42:33,040 --> 00:42:45,440
It's also going to have to be implemented by carriers, manufacturers, and OEMs, and we need more incentives for the standards, or as the carriers and the OEMs, to care about user privacy.

354
00:42:45,440 --> 00:42:55,780
Right now, it often feels as though user privacy is an afterthought, and connectivity is really the most important, the primary goal of these organizations.

355
00:42:55,860 --> 00:42:58,700
And we need to change that.

356
00:42:58,700 --> 00:43:11,000
The 3GPP costs several tens of thousands of dollars to get a seat on, and as such, there are no representations from civil society, from privacy organizations, from non-profits, and that needs to change.

357
00:43:11,440 --> 00:43:22,860
None of these solutions are going to be tool-proof, of course, and our detection, and Carcine Hunter is tool-proof, but we're not even doing the bare minimum yet, and I think that we should be doing at least that.

358
00:43:24,840 --> 00:43:27,340
So what do I want you to take away from this?

359
00:43:27,520 --> 00:43:34,040
Well, we have a pretty good understanding of the vulnerabilities in 4G, which commercial cell site simulators might exploit.

360
00:43:34,040 --> 00:43:39,100
And if you want to read more about those, I really highly suggest you read Yama's paper, Gotta Catch Em All.

361
00:43:39,160 --> 00:43:43,520
None of the previous MCCatcher detector apps really do the job anymore.

362
00:43:43,520 --> 00:43:50,860
CGLASS could certainly still detect older MCCatchers, but none of them are able to detect newer MCCatchers.

363
00:43:50,860 --> 00:43:56,520
But we've come up with a method similar to established methods, but targeting 4G natively.

364
00:43:56,520 --> 00:44:04,040
And we think that the worst problems of CSS abuse can be solved with a little bit of elbow grease and a lot of politics.

365
00:44:05,740 --> 00:44:07,880
Finally, thanks to the following people.

366
00:44:07,880 --> 00:44:08,980
Yamna, of course.

367
00:44:08,980 --> 00:44:12,240
I couldn't have done this project without her, and she did so much amazing work.

368
00:44:12,240 --> 00:44:20,080
Thanks so much to Yamna, and please buy her a virtual beer, or just challenge her to a game of Dance Dance Revolution if you see her.

369
00:44:20,180 --> 00:44:25,800
And of course, thanks to the whole EFF crew, and especially Threat Lab, who have been a huge support through all of this.

370
00:44:25,860 --> 00:44:32,240
Huge thanks to Andy and Bob at Wiggle for a lot of programming help and a lot of... for giving me unfettered access to their API.

371
00:44:32,480 --> 00:44:38,060
Thanks to Roger Piqueros-Jover, who is one of the smartest people in the world about cell networks.

372
00:44:38,060 --> 00:44:42,360
He really knows his stuff, and he gave a lot of advice and a lot of encouragement.

373
00:44:42,580 --> 00:44:48,440
Thanks to my test crew, Neema Fatemi with CanDo, and Surya, Matthew, and Simon from the Markup.

374
00:44:48,880 --> 00:44:51,160
Simon Fondry-Tiedler, thank you.

375
00:44:51,780 --> 00:44:59,220
Carlos with the Fade Project, and everybody else involved in the Fade Project, thanks for running Practical Hunter in South America.

376
00:44:59,440 --> 00:45:10,600
Carl Kosher and Peter Ney and others at the University of Washington, who authored Seagloss, as well as giving me tons of advice, tons of support, coming out to Standing Rock with me.

377
00:45:10,600 --> 00:45:12,320
Really fantastic people.

378
00:45:13,000 --> 00:45:19,860
And of course, thanks to Ash Wilson, the author of Siege, and Eric Escobar, Defcon Justice Beaver, who also gave me a lot of inspiration and advice.

379
00:45:19,920 --> 00:45:27,420
And last but not least, thanks to Kristen Padgett for doing all the research on suicide simulators and really paving the way for hackers to start looking at these.

380
00:45:27,420 --> 00:45:29,920
And also, thanks for the Geophones, Kristen.

381
00:45:30,440 --> 00:45:32,640
And finally, thank you for coming to the talk.