1
00:00:00,000 --> 00:00:07,420
Let me share my screen here and I'm going to start to go again.

2
00:00:11,660 --> 00:00:14,460
Just in case, I'm going to share the whole screen.

3
00:00:14,800 --> 00:00:16,960
I never know where I'm going to end up.

4
00:00:24,700 --> 00:00:26,120
Let me go there.

5
00:00:32,610 --> 00:00:34,190
And that's showing here again.

6
00:00:34,190 --> 00:00:35,390
Oh, well, of course it is.

7
00:00:35,390 --> 00:00:35,990
Okay.

8
00:00:35,990 --> 00:00:38,850
So, first of all, welcome to this session.

9
00:00:39,070 --> 00:00:45,930
I'd like to talk about Global Navigation Satellite Systems and Automatic ID Systems Spoofing.

10
00:00:46,610 --> 00:00:49,970
A lot of this has been in the news, certainly for a couple of years.

11
00:00:49,970 --> 00:00:51,770
I mean, none of this that I'm going to talk about...

12
00:00:51,770 --> 00:00:53,850
well, most of it is not brand new.

13
00:00:53,850 --> 00:00:59,890
But I want to talk a little bit about GPS spoofing and then evolve that into AIS spoofing as well.

14
00:01:00,250 --> 00:01:15,030
So, on an integrated nav system on a boat, and I've been fortunate enough to be able to walk through some really big boats, although I spend most of my time on pretty small boats.

15
00:01:15,870 --> 00:01:29,290
The key issue that I want to say, and this is not going to come as a surprise to any of you, is that GPS plays a big role in situational awareness for a boat.

16
00:01:29,750 --> 00:01:37,210
On their chart display, on their chart radar, them just knowing where they are relative to other things.

17
00:01:37,210 --> 00:01:48,310
Of course, AIS is huge in understanding, not only just seeing that there's a target out there, but knowing something about the target, which is information that radar, of course, won't give you, can't give you.

18
00:01:48,730 --> 00:02:04,750
And then AIS itself, of course, and everything in the integrated nav system, pulling together all of your chart downloads, your chart updates, by the way, these are hacking vectors, all of the sensors on a boat so that you can be producing your own messages,

19
00:02:04,750 --> 00:02:06,370
giving situational awareness.

20
00:02:06,370 --> 00:02:11,550
Anyway, the whole point is that GPS and AIS are highly intertwingled.

21
00:02:12,350 --> 00:02:25,070
Now, again, I'm going to assume that most of you are familiar with at least part of this, but just in case, there are four major global navigation satellite systems.

22
00:02:25,070 --> 00:02:31,870
There's BeiDou in China, Galileo is the European Union, GLONASS in Russia, and, of course, our GPS.

23
00:02:31,870 --> 00:02:33,610
There are a couple of regional systems.

24
00:02:33,610 --> 00:02:35,050
India has something called NAVIC.

25
00:02:35,050 --> 00:02:37,450
Japan has something called QZSS.

26
00:02:37,990 --> 00:02:48,430
All of these systems use medium Earth orbit satellites, and they're all using different constellations.

27
00:02:48,810 --> 00:03:06,230
And, you know, as this chart is trying to show, or at least give you an idea, you can see that the four GNSS satellites are at different altitudes, you know, from the Earth, and then, of course, their orbital circumference as well.

28
00:03:06,510 --> 00:03:14,510
The periods range for the different satellite networks from, you know, 11 to 14 hours for one cycle.

29
00:03:14,510 --> 00:03:18,310
But one of the keys is also, look how far away they are.

30
00:03:18,310 --> 00:03:21,250
I mean, you're talking 12 to 15,000 miles.

31
00:03:21,370 --> 00:03:34,370
Now, the only comment I want to make about that is sort of obvious, but I'll make it later, is the signal strength that is coming from a satellite 15,000 miles away is not terribly strong once it gets to the Earth.

32
00:03:34,370 --> 00:03:38,090
That will be an important part when we think about jamming.

33
00:03:39,330 --> 00:03:47,230
So when we talk about GNSS systems, we always talk about the space segment, control segment, and the user segment.

34
00:03:47,310 --> 00:03:50,590
The space segment is, of course, the satellites themselves.

35
00:03:50,590 --> 00:03:53,250
The user segment is the user equipment.

36
00:03:53,250 --> 00:04:01,510
So here we've got, you know, this happens to be a GPS antenna, but any GNSS system would work.

37
00:04:01,670 --> 00:04:06,190
So I've got a GNSS antenna connected to my GNSS receiver and display.

38
00:04:06,190 --> 00:04:12,790
The GNSS information might be now connected to other devices in that integrated nav system, and we'll talk about that.

39
00:04:13,730 --> 00:04:16,030
And then we've got the control segment.

40
00:04:16,050 --> 00:04:22,250
And the control segment, of course, this is stuff that we as users don't really have much to do with.

41
00:04:22,250 --> 00:04:24,830
But here's where you have the master control stations.

42
00:04:24,830 --> 00:04:29,710
You have a variety of ground antennas, a whole bunch of monitoring and tracking stations.

43
00:04:29,710 --> 00:04:36,790
But this is what is managed by, well, currently, if it's GPS, is managed by U.S.

44
00:04:36,790 --> 00:04:37,790
Space Force.

45
00:04:40,400 --> 00:04:45,240
So what this slide is talking about is this.

46
00:04:45,960 --> 00:05:03,060
And most of you, if you've played around with GPS, and particularly with any GPS app that tells you how many satellites you're seeing and all those kind of things, the GPS constellation, for example, requires, I believe, 24 satellites to be operational.

47
00:05:03,220 --> 00:05:04,820
We have 30.

48
00:05:05,040 --> 00:05:08,880
The extra six are basically backup in case one of the other ones fails.

49
00:05:09,220 --> 00:05:13,100
For you to get a fix, you need to be able to see at least four of them.

50
00:05:15,140 --> 00:05:19,800
So global nav systems all work by using trilateral rating.

51
00:05:19,820 --> 00:05:27,700
So I have my receiver, and I can figure out how far am I from three of the satellites.

52
00:05:27,880 --> 00:05:35,680
And if I can figure out how far and at what angle I am from the three satellites, I can, you know, trilateral rate.

53
00:05:35,680 --> 00:05:36,840
That's probably not really a word.

54
00:05:36,840 --> 00:05:40,260
I can triangulate my position based on that.

55
00:05:40,260 --> 00:05:43,060
So it's basically passive range funding.

56
00:05:43,060 --> 00:05:46,340
And so here's the next point that I just made earlier.

57
00:05:46,380 --> 00:05:49,640
These signals are being sent down at 50 watts.

58
00:05:49,640 --> 00:05:53,700
They are minuscule, hardly measurable when they hit the earth.

59
00:05:54,240 --> 00:06:00,080
This is why GPS jamming is very simple to accomplish.

60
00:06:00,200 --> 00:06:03,000
All I need is a signal on the right frequency.

61
00:06:03,000 --> 00:06:07,020
It's even a few watts, and I can blast out the GPS signal.

62
00:06:07,020 --> 00:06:12,460
It's also trivial to detect when GPS jamming is being used.

63
00:06:12,460 --> 00:06:17,000
So if you want to do surreptitious GPS jamming, you have a slightly harder problem.

64
00:06:17,520 --> 00:06:20,720
And, well, that's not why I'm here.

65
00:06:20,720 --> 00:06:29,160
But in any case, GPS transmits in the ultra high frequency band.

66
00:06:29,420 --> 00:06:34,780
GPS in particular, and actually GLONASS as well, use the L band.

67
00:06:35,440 --> 00:06:40,140
And all of the satellites are sharing the same frequency.

68
00:06:40,240 --> 00:06:43,100
They're doing it with co-division multiple access.

69
00:06:43,140 --> 00:06:45,980
We'll talk about CDMA in just a second.

70
00:06:45,980 --> 00:06:57,180
And the way in which you can differentiate the different satellite transmissions is because each satellite is assigned what's called a pseudorandom noise sequence.

71
00:06:57,180 --> 00:07:01,780
It's just a pseudorandom set of zeros and ones.

72
00:07:01,780 --> 00:07:06,420
Each satellite has its own PRN code.

73
00:07:06,420 --> 00:07:09,040
We know what the PRN codes are.

74
00:07:09,040 --> 00:07:15,740
So when you're receiving a signal, you can detect the PRN code and you know what satellite is communicating to you.

75
00:07:15,880 --> 00:07:21,680
Now, as a side note of history, I would like to point out that CDMA actually is an old idea.

76
00:07:21,740 --> 00:07:28,480
It was invented in the early 1940s by a musician named George Antheil and the actress Hedy Lamarr.

77
00:07:28,480 --> 00:07:33,220
Hedy Lamarr was responsible for a bunch of interesting inventions.

78
00:07:33,700 --> 00:07:45,060
But they developed this for the Navy because you may or may not know if you read some early World War II history, US Navy torpedoes mostly missed their target.

79
00:07:45,120 --> 00:07:48,560
And even a large number of them that hit the target didn't explode.

80
00:07:49,020 --> 00:07:51,840
In any case, they offered this up for free to the Navy.

81
00:07:51,840 --> 00:07:56,040
The Navy did not take them up on it for a couple of decades.

82
00:07:56,040 --> 00:08:01,300
But in any case, today we see CDMA used in Bluetooth, mobile phones, and GPS.

83
00:08:03,000 --> 00:08:07,800
Anyway, I said before that for us to get a position, we need four satellites.

84
00:08:07,800 --> 00:08:16,060
So one of the problems with global nav systems is that all of the satellites have on board a cesium clock.

85
00:08:16,060 --> 00:08:18,680
Your GPS receiver does not.

86
00:08:18,680 --> 00:08:20,800
So there is some clock bias.

87
00:08:20,800 --> 00:08:28,360
So if you want to trilaterate with just three satellites, which is really all you need, you're going to have an error of about a mile.

88
00:08:28,620 --> 00:08:41,020
By reducing or eliminating the clock bias, which is why you need the fourth satellite to be able to correct that drift, you can get your error down to about three feet.

89
00:08:41,480 --> 00:08:47,320
Which is why we get some very, very precise measurements with GPS.

90
00:08:48,780 --> 00:08:52,840
So I mentioned GPS was now managed by U.S.

91
00:08:52,840 --> 00:08:53,500
Space Force.

92
00:08:53,500 --> 00:08:57,440
It started as a Navy and Air Force project in the late 60s.

93
00:08:57,440 --> 00:08:59,540
It was managed by the Air Force until the U.S.

94
00:08:59,540 --> 00:09:02,740
Space Force took it over, I believe, last year.

95
00:09:03,360 --> 00:09:06,260
The first satellite wasn't launched until 78.

96
00:09:06,260 --> 00:09:11,700
We didn't have operational GPS in the civilian community until sometime in the 90s.

97
00:09:13,500 --> 00:09:17,580
And originally, civilian GPS was degraded.

98
00:09:17,580 --> 00:09:25,860
And it was degraded in accuracy compared to military because what they would do is they would introduce timing errors.

99
00:09:26,560 --> 00:09:31,020
So remember back here, I said, if you don't correct your timing bias, you can have some big errors.

100
00:09:31,020 --> 00:09:32,620
Well, that's exactly what they did.

101
00:09:32,620 --> 00:09:46,320
In 2000, which still would have been the Clinton administration, there was an executive order that basically said this so-called selective availability is no longer going to be in civilian GPS.

102
00:09:46,380 --> 00:09:50,460
And even though the military wanted it, the president said no.

103
00:09:50,740 --> 00:09:54,640
But there are basically today still two services.

104
00:09:54,640 --> 00:09:59,340
There's the standard positioning service and there's precise positioning service for military.

105
00:09:59,340 --> 00:10:00,960
GPS is for civilians.

106
00:10:02,160 --> 00:10:11,360
We still have pretty good granularity, but selective availability could make the SPS service degrade.

107
00:10:11,360 --> 00:10:20,160
But since we have no selective availability anymore, the SPS and PPS pretty much are equal in terms of service.

108
00:10:20,300 --> 00:10:26,960
The difference between the two today is that PPS is encrypted and SPS is not.

109
00:10:26,960 --> 00:10:29,220
So we'll come back to that later on.

110
00:10:29,220 --> 00:10:32,580
Anyway, I already mentioned with GPS, we've got 31 satellites.

111
00:10:32,580 --> 00:10:34,940
We need 24 at 95% uptime.

112
00:10:34,940 --> 00:10:39,260
And each of the satellites has an orbital period of like 11 hours and 59 minutes.

113
00:10:39,260 --> 00:10:41,640
So we get about two orbits per day.

114
00:10:43,320 --> 00:10:49,360
Now, a GPS transmission, and this I'm really just giving you for a little bit of interest.

115
00:10:49,920 --> 00:10:54,860
A GPS satellite is transmitting what's called a navigation message.

116
00:10:54,860 --> 00:10:59,820
A navigation message has, as it says here, 37 and a half thousand bits.

117
00:10:59,820 --> 00:11:02,340
We're transmitting at 50 bits per second.

118
00:11:02,380 --> 00:11:07,780
It takes about 12 and a half minutes for the entire message to hit the ground receiver.

119
00:11:08,060 --> 00:11:14,920
Now, in the message, we have the date and time, GPS date and time.

120
00:11:14,920 --> 00:11:24,180
We have information about this particular transmitting satellite, namely its status and health and all that kind of stuff, as well as what's called ephemeral information.

121
00:11:24,180 --> 00:11:39,660
So the position and velocity of the satellite, because if I'm going to measure my distance from me to the satellite, I need to know exactly where the satellite is, oh, by the way, and how fast it's moving, because that's going to impact how quickly I'm seeing the signal.

122
00:11:39,660 --> 00:11:41,460
A little error, but it's in there.

123
00:11:42,120 --> 00:11:44,460
And then there's something called the almanac.

124
00:11:44,460 --> 00:11:50,720
The almanac has gross ephemeris data for all of the GPS satellites.

125
00:11:50,920 --> 00:11:53,540
Now, the usefulness for that is this.

126
00:11:53,540 --> 00:12:00,360
When you flip on your GPS receiver, it takes a couple seconds to figure out where you are.

127
00:12:00,360 --> 00:12:07,820
Well, that's because it took a couple seconds to find and interpret the data from the first satellite.

128
00:12:07,920 --> 00:12:15,300
But as it sees the almanac, it can figure out where all the other, at least visible, satellites are going to be.

129
00:12:15,300 --> 00:12:22,460
And it's getting enough information from enough satellites that it can quickly find other satellites to ping off of.

130
00:12:22,460 --> 00:12:33,100
This is also why sometimes you'll get a satellite, a fix that'll show you someplace, and a couple seconds later, all of a sudden, it changes.

131
00:12:33,260 --> 00:12:39,240
Because, again, you were sort of getting a gross idea of where you were, but there may have been some error.

132
00:12:39,240 --> 00:12:44,540
And then as it, you know, gets all of the communication, all the satellites, it gets in a slightly better position.

133
00:12:45,780 --> 00:12:50,000
Just for FYI, GLONASS does a similar thing.

134
00:12:50,000 --> 00:12:54,380
Their messages are only 7,500 bits, also at 50 bits per second.

135
00:12:54,380 --> 00:12:57,520
They carry pretty much the same kind of information.

136
00:12:57,920 --> 00:13:02,100
The data for the sending satellite is, you know, very specific.

137
00:13:02,100 --> 00:13:05,320
And then it has what it calls non-immediate data.

138
00:13:05,320 --> 00:13:07,680
Basically, that's the almanac for everything else.

139
00:13:09,580 --> 00:13:11,520
I've already mentioned the L band.

140
00:13:12,420 --> 00:13:16,420
So you're a techie group, so I'll say a couple of techie things to you.

141
00:13:17,260 --> 00:13:24,540
If I am a satellite that's transmitting, I'm going to be transmitting on whatever carrier frequency I have.

142
00:13:24,540 --> 00:13:31,600
So the L1 band, I actually didn't include the frequencies, I'm not sure why, but the L1 band is whatever frequency it is.

143
00:13:31,600 --> 00:13:44,720
So what I'm going to do is I'm going to modulate my transmission on that carrier frequency by combining the nav message and exclusively ORing it with my PRN code.

144
00:13:44,720 --> 00:13:57,040
Now, since the PRN code is unique to a satellite, I can extract the PRN code because the format for the nav message, I know that.

145
00:13:57,040 --> 00:14:02,020
So now it's merely a matter of, like I said, I can extract the PRN information.

146
00:14:02,480 --> 00:14:05,860
Now, I already mentioned before that there were the two services.

147
00:14:05,860 --> 00:14:13,480
There was the standard service, unencrypted for civilians, and the precision service for military that was encrypted.

148
00:14:13,480 --> 00:14:18,240
Well, one satellite is sending both signals at the same time.

149
00:14:18,240 --> 00:14:28,180
And what they do is they send the precise position service, the encrypted military service, 90 degrees out of phase with the civilian service.

150
00:14:28,180 --> 00:14:31,720
So again, all of that is happening on the same channel.

151
00:14:32,700 --> 00:14:38,220
And there are some additional things you need for the PPS, this precision code that I mentioned here.

152
00:14:38,360 --> 00:14:42,840
It just provides some better interference protection and spoofing resistance.

153
00:14:42,840 --> 00:14:48,820
I mean, it's very, very hard to spoof on military GPS because you have to spoof an encrypted message.

154
00:14:48,820 --> 00:14:51,240
And that is unlikely that you're going to do that.

155
00:14:51,340 --> 00:14:53,440
Anyway, there's also the L2 band.

156
00:14:53,440 --> 00:14:57,760
It was originally designed for military use only and encrypted applications.

157
00:14:58,040 --> 00:15:01,900
It's now being opened up for civilian use.

158
00:15:01,900 --> 00:15:08,660
They're also starting to use an L5 band, which is now going to be a third channel for civilian use on GPS.

159
00:15:11,230 --> 00:15:14,430
I don't think I need to tell you why GPS is important.

160
00:15:15,050 --> 00:15:18,610
Obviously, we need it for ships, all sorts of things on ships.

161
00:15:18,610 --> 00:15:20,450
We need it for aids navigation.

162
00:15:20,650 --> 00:15:22,130
We need it for ports.

163
00:15:22,130 --> 00:15:24,230
We need it for vessel traffic management.

164
00:15:25,350 --> 00:15:30,230
So, like I said, I'm not going to beat you up too much on the importance of GPS.

165
00:15:31,850 --> 00:15:46,750
I will observe, however, that when we talk about GPS spoofing, GPS jamming and all that kind of stuff, one of the things that doesn't get talked about, in my view, enough is the importance of GPS to timing.

166
00:15:47,050 --> 00:15:52,410
There are a lot of devices on Earth that get their timing from GPS satellites.

167
00:15:52,950 --> 00:16:02,730
For example, all digital telecommunications networks, including North American mobile phones and digital telecom carriers, are basically working off of the same clock.

168
00:16:02,850 --> 00:16:05,470
Power grids need timing.

169
00:16:05,470 --> 00:16:08,470
Some of the network time protocol servers on the Internet...

170
00:16:09,090 --> 00:16:22,130
Anyway, the point is that if I can disrupt timing signals coming from GPS, then that also is another attack vector on the entire GNSS system.

171
00:16:22,130 --> 00:16:30,150
Even though I might be getting what I believe are accurate records of where I am, I can still be screwing up the timing.

172
00:16:30,330 --> 00:16:33,950
The second bullet item actually has a lot here.

173
00:16:33,950 --> 00:16:39,470
A one nanosecond timing error can cause a one foot positioning error.

174
00:16:39,930 --> 00:16:47,870
Now, as a mere aside to this, many of you may know who Grace Murray Hopper was.

175
00:16:49,130 --> 00:16:57,030
Grace Murray Hopper, when she was still on active duty as an admiral in the late 1970s, I had the joy to see one of her talks.

176
00:16:57,030 --> 00:16:58,710
I got to drive her around Vermont for a day.

177
00:16:58,710 --> 00:16:59,870
That was really cool.

178
00:16:59,870 --> 00:17:05,450
She would always go to her lectures and say, you know, back in the day...

179
00:17:05,450 --> 00:17:12,550
Well, she didn't use that expression, but back in the 50s, programmers were always trying to save nanoseconds.

180
00:17:12,550 --> 00:17:17,290
One day I went to one of the engineers and I said, what is a nanosecond?

181
00:17:17,630 --> 00:17:21,010
And he looked at me, then he pulled out a piece of wire.

182
00:17:21,010 --> 00:17:28,610
He cut off 11.8 inches and handed me the wire and says, that's how far light travels in a nanosecond.

183
00:17:28,610 --> 00:17:32,970
So she would go to all of her lectures carrying around a whole crapload of nanoseconds.

184
00:17:32,970 --> 00:17:35,150
And she'd hand out, you know, pieces of wire to people.

185
00:17:35,310 --> 00:17:39,390
In any case, I remember that lecture from, you know, 40 years ago.

186
00:17:39,650 --> 00:17:41,850
I think it was only 40 years ago.

187
00:17:41,890 --> 00:17:46,170
In any case, but that tells a lot.

188
00:17:46,170 --> 00:17:48,590
A nanosecond puts me off by a foot.

189
00:17:48,710 --> 00:17:59,210
If I can cause there to be, you know, a hundred nanosecond error or a microsecond error, we can cause people to be, you know, way far off from where they want to be.

190
00:17:59,630 --> 00:18:03,390
In any case, GPS jamming has been around for a while.

191
00:18:03,490 --> 00:18:09,070
We started to hear about this publicly, really, probably about four or five years ago.

192
00:18:09,070 --> 00:18:16,650
There was one really famous case where, well, the Newark airport was testing its automatic landing system.

193
00:18:16,750 --> 00:18:23,950
They had a plane coming in on automatic landing and they lost their GPS signal.

194
00:18:23,950 --> 00:18:31,950
So it happened because there was a truck driver who was taking a break, didn't want his bosses to know where he was.

195
00:18:31,950 --> 00:18:36,410
So he bought a GPS jammer so that his truck wouldn't broadcast the GPS signal.

196
00:18:36,650 --> 00:18:38,530
Anyway, they eventually found him.

197
00:18:38,530 --> 00:18:42,170
But the fact is, GPS jamming is relatively easy to do.

198
00:18:42,170 --> 00:18:46,910
It is totally illegal, but you can still buy GPS jammers.

199
00:18:49,430 --> 00:19:00,670
And in any case, the advice from the Coast Guard, you know, the trust, but verify if you don't have your GPS data, know how to read your chart, use your binoculars, all that kind of stuff.

200
00:19:01,410 --> 00:19:05,150
But really what I want to talk about is GPS spoofing.

201
00:19:05,590 --> 00:19:12,790
The first real public story about GPS spoofing came out also about six years ago.

202
00:19:13,310 --> 00:19:22,050
A group from the University of Texas at Austin spoofed the GPS signals on a yacht called the White Rose of Drox in the Mediterranean Sea.

203
00:19:22,810 --> 00:19:25,750
And I'm going to show you a one and a half minute video.

204
00:19:25,750 --> 00:19:32,790
But basically what happened was using totally COTS equipment, they built themselves a GPS transmitter.

205
00:19:32,790 --> 00:19:35,190
They put the attacker on the boat.

206
00:19:35,190 --> 00:19:37,510
The boat crew knew that something was going to happen.

207
00:19:37,510 --> 00:19:39,070
They just didn't know what.

208
00:19:39,810 --> 00:19:50,810
And the attacker slowly started sending increasingly powerful GPS signals until it overwhelmed the boat's GPS receiver.

209
00:19:50,810 --> 00:19:53,610
And then they drove the boat off course.

210
00:19:53,610 --> 00:20:00,050
And then the crew dutifully put the boat back on course, which of course drove it off course.

211
00:20:00,050 --> 00:20:05,050
So with that teaser, let me give you a one minute and 37 second video.

212
00:20:05,050 --> 00:20:08,510
I'll try to make my volume loud enough so that you can hear it.

213
00:20:16,680 --> 00:20:35,700
Southern coast of Italy in June 2013, a 65 meter super yacht and her crew were part of an unprecedented experiment led by the University of Texas at Austin that successfully coerced the vessel off course using a custom made GPS spoofing device.

214
00:20:35,700 --> 00:20:45,440
30 miles from land, the crew's sense of the ship's location is based entirely on simple GPS signals broadcast from orbiting satellites.

215
00:20:45,700 --> 00:20:54,500
The student, serving as the attacker, commands the spoofing device to transmit faint, counterfeit signals towards the ship's antennas.

216
00:20:54,500 --> 00:21:03,320
The attacker increases the power of the spoofing signals until they are stronger than the satellite signals, gaining control of the ship's navigation system.

217
00:21:03,320 --> 00:21:05,240
The takeover is stealthy.

218
00:21:05,300 --> 00:21:07,160
No alarms are triggered.

219
00:21:07,180 --> 00:21:12,700
Once in control, the attacker initiates a three degree change to the ship's course.

220
00:21:12,700 --> 00:21:17,660
The ship's navigation system reports that the vessel is drifting slowly to the left.

221
00:21:17,660 --> 00:21:21,860
The false location is represented here by the ghost ship.

222
00:21:21,860 --> 00:21:27,160
The crew applies a course correction to bring the ghost ship back onto the intended path.

223
00:21:27,160 --> 00:21:30,600
In reality, the ship is now on the attacker's course.

224
00:21:37,500 --> 00:21:39,380
So, pretty cool, huh?

225
00:21:40,360 --> 00:21:45,860
So, armed with that, I'm going to show you some other case studies.

226
00:21:46,560 --> 00:21:55,660
I'm not going to tell you every case study that I know about, but what I'm trying to do is show you the escalation in GPS spoofing that's occurred over the years.

227
00:21:55,860 --> 00:22:03,000
So, in the University of Texas case, what they did is they spoofed one vessel to go off course.

228
00:22:04,260 --> 00:22:09,020
In 2017, there was a mass GPS spoofing event in the Black Sea.

229
00:22:09,420 --> 00:22:13,400
And what happened was, this was reported by the master of a vessel called the Atria.

230
00:22:14,680 --> 00:22:19,600
And Atria was parked off the coast of Russia.

231
00:22:19,840 --> 00:22:27,020
And all of a sudden, his GPS and AIS told him that he was in the middle of an airport.

232
00:22:28,420 --> 00:22:45,300
And, oh, by the way, his closest point of alarm notification on his AIS devices were going crazy, because he was now also being told by his AIS equipment that you're less than 100 meters from 19 other ships.

233
00:22:45,680 --> 00:22:47,900
Now, the captain's no fool.

234
00:22:47,900 --> 00:22:53,140
He goes out to his bridge, looks around, and says, yeah, I'm in the water, and there's no other ships in sight.

235
00:22:53,140 --> 00:22:58,620
But here is showing where he was.

236
00:22:58,620 --> 00:23:01,000
That's the ship's position on the bottom.

237
00:23:01,120 --> 00:23:09,780
And up above is showing the GPS coordinates of where, well, his GPS device was telling him where he was, again, in the middle of an airport.

238
00:23:09,900 --> 00:23:20,340
Now, one of the interesting things that's worth noting on this is on this GPS display, over on the right, you can see it's identifying all these satellites.

239
00:23:20,340 --> 00:23:28,000
And they're all coming in with the same power, which is unusual, because you've got six GPS satellites.

240
00:23:28,000 --> 00:23:30,080
They're not all the same distance from you.

241
00:23:30,080 --> 00:23:32,100
All the power shouldn't be the same.

242
00:23:32,780 --> 00:23:45,300
In any case, in 2018, we start to get a report, constant GPS issues in the eastern Med and some in the Red Sea.

243
00:23:45,300 --> 00:23:47,660
This continues into 2019.

244
00:23:47,660 --> 00:23:51,120
Throughout the Med, people are finding GPS issues.

245
00:23:51,120 --> 00:23:53,220
GPS is going out.

246
00:23:54,400 --> 00:23:58,440
Ships are finding themselves being told they're in entirely different locations.

247
00:23:58,900 --> 00:24:08,380
And so last year, about a year and a quarter ago, a place called the Center for Advanced Defense Studies put out a report called Above Us Only Stars.

248
00:24:08,380 --> 00:24:10,960
It is really, really an interesting report.

249
00:24:11,000 --> 00:24:18,860
And it basically talks about how Russia has been manipulating GNSS signals for at least the last four years.

250
00:24:18,980 --> 00:24:31,800
And they show a bunch of examples of vessels thinking that they're docked in the water and yet actually being, or the GPS telling them that they're at an airport.

251
00:24:32,500 --> 00:24:34,600
Usually it's a nearby airport.

252
00:24:35,200 --> 00:24:46,660
And it's been a real interesting, it's a very, very interesting read, because particularly now, if you read some of the more current literature, they're talking about, well, it's not just Russia.

253
00:24:46,660 --> 00:24:47,980
China is doing the same thing.

254
00:24:47,980 --> 00:24:49,880
North Korea is doing the same thing.

255
00:24:49,880 --> 00:24:54,040
And, you know, obviously, spoofing is a problem.

256
00:24:54,820 --> 00:25:00,000
Four years ago, spoofing was something that a nation state could pull off.

257
00:25:00,660 --> 00:25:11,700
Increasingly, GNSS spoofing technology is becoming such that a terrorist group can use this, criminal gangs can use this, loan operators can use this.

258
00:25:11,760 --> 00:25:16,920
So, I mean, this is a big issue right now for, you know, well, all the obvious reasons.

259
00:25:17,700 --> 00:25:24,020
So one case study that's worth mentioning, some of you may know about this, this was about a year ago.

260
00:25:24,540 --> 00:25:30,740
The tanker Stena Impero, it's a British ship, was seized by the Iranians.

261
00:25:30,740 --> 00:25:43,040
Now, the suspicion was that the Iranians seized Stena Impero because the Brits had seized an Iranian vessel in Gibraltar for violating some of the European Union sanctions.

262
00:25:43,040 --> 00:25:49,940
But in any case, when they went back and they looked at the AIS data, they saw, well, here was the path of Stena Impero.

263
00:25:50,040 --> 00:25:54,380
And it's gone through the Strait of Hormuz, staying right down the middle where ships are supposed to stay.

264
00:25:54,380 --> 00:26:02,240
And then all of a sudden it turns north and starts to go into Iranian waters where it was seized for violating their waters.

265
00:26:02,920 --> 00:26:12,420
And there has been a lot of, a lot of talk and a lot of ink spread about the fact that they believe that this was a GPS spoof.

266
00:26:12,420 --> 00:26:15,100
That caused the ship to go off course.

267
00:26:16,080 --> 00:26:23,260
But more interestingly is what happened, or at least started to be reported, last year in the port of Shanghai.

268
00:26:23,620 --> 00:26:32,400
So all of the spoofing so far has been directed either at a single vessel or at a group of vessels, placing them all in the same place.

269
00:26:32,820 --> 00:26:40,660
So what happened in the port of Shanghai, and it's really interesting to read this, we have this vessel, Manukai, and he's going up the river.

270
00:26:41,440 --> 00:26:50,980
And he's checking his ectus, and the AIS is reporting that there's a ship at a berth that's in the channel, making seven knots.

271
00:26:51,020 --> 00:26:52,800
Then all of a sudden it disappeared.

272
00:26:52,840 --> 00:26:55,780
And then all of a sudden it was back at the dock.

273
00:26:55,780 --> 00:27:00,280
Then it was now underway at a variety of different speeds, then it disappeared.

274
00:27:00,280 --> 00:27:03,240
And this pattern continued over and over.

275
00:27:03,240 --> 00:27:11,980
Now again, the master of the vessel is no fool, goes out to the bridge, looks at his binoculars and says, yeah, that other vessel has never left the dock.

276
00:27:13,420 --> 00:27:29,900
And so when some analysis was done of the spoofing events that had been going on in the port of Shanghai, what they found was that multiple vessels had been spoofed simultaneously to be in multiple locations.

277
00:27:29,900 --> 00:27:36,620
One vessel was in multiple locations, but all of the different ships were at different locations.

278
00:27:36,680 --> 00:27:40,980
And that was actually really hard to pull off.

279
00:27:41,000 --> 00:27:57,000
And then when they looked at the collection and intensity, they found that, as it says here, this crop circle, they found that the most reported spoofed location came out in these circles.

280
00:27:57,000 --> 00:27:59,580
And it hasn't been just Shanghai.

281
00:28:00,340 --> 00:28:04,440
Earlier or late last year, we started to hear about circle spoofing in Iran.

282
00:28:04,440 --> 00:28:10,960
This is Tehran, where some ships out at the harbor were all finding themselves downtown Tehran.

283
00:28:11,440 --> 00:28:25,400
And in one of the most interesting things that was recently reported was a whole bunch of circle spoofing in the area of Point Reyes near San Francisco and up the west coast of California.

284
00:28:25,400 --> 00:28:29,720
And you'll notice we have all these different circle spoofs here.

285
00:28:29,940 --> 00:28:41,520
And what's really interesting about this is in all the previous circle spoofing that the boats having their GPS spoofed in Shanghai were at least in Shanghai.

286
00:28:41,760 --> 00:28:49,760
The West Coast spoofing happened over a whole bunch of dates, but the ships were actually in a whole different hemisphere.

287
00:28:49,760 --> 00:28:56,560
And yet their GPS was putting them off the coast of California, off the West Coast of Canada, up near Alaska.

288
00:28:57,300 --> 00:29:00,320
Really, really interesting stuff.

289
00:29:00,900 --> 00:29:05,640
I say interesting in an intellectual way and an academic way.

290
00:29:05,640 --> 00:29:09,320
It's actually horrifyingly bad if you're on that vessel.

291
00:29:11,360 --> 00:29:17,720
Now, you can spoof GPS without actually having a GPS device.

292
00:29:17,720 --> 00:29:30,420
So, again, Eric Raymond has a really cool site where, if you go to it, I'm going to try to get over there.

293
00:29:31,920 --> 00:29:43,640
And this page called NMEA Revealed talks about, you know, all the different NMEA messages that you can associate with GPS.

294
00:29:43,640 --> 00:29:45,940
So I'm going to leave that there for now.

295
00:29:45,940 --> 00:29:49,280
But in any case, the point is, you know, you can get to all these things.

296
00:29:49,340 --> 00:29:52,180
At the bottom there, I have an example of a GPS message.

297
00:29:53,280 --> 00:29:58,800
The GP says that the talker, the device that you're communicating with, is a GPS device.

298
00:29:58,960 --> 00:30:01,180
The GLL is a particular type of message.

299
00:30:01,180 --> 00:30:03,260
This is the geographic position message.

300
00:30:03,300 --> 00:30:06,940
And then you can see all the other information that's here.

301
00:30:06,940 --> 00:30:12,500
I've got my latitude, 29 degrees, 11.585 minutes north.

302
00:30:12,500 --> 00:30:14,040
Here's my longitude.

303
00:30:14,160 --> 00:30:17,860
Here's the UTC time when this fix was taken.

304
00:30:17,960 --> 00:30:20,160
This thing here is a checksum.

305
00:30:20,720 --> 00:30:22,860
This message is a GPS fix.

306
00:30:22,860 --> 00:30:25,760
It's slightly, just has slightly more information.

307
00:30:25,760 --> 00:30:31,620
But the point is, it's pretty easy to download code that can generate these messages for you.

308
00:30:31,620 --> 00:30:40,100
In fact, it's easy enough... hang on, I'm not sure what just broke there.

309
00:30:43,470 --> 00:30:46,610
Okay, well, this appears to still be there.

310
00:30:46,810 --> 00:30:52,070
I'll get back to... hopefully you're all still seeing the PowerPoint.

311
00:30:52,310 --> 00:30:56,770
Anyway, you can create these messages relatively simply.

312
00:30:57,710 --> 00:31:08,110
And then there's all sorts of ways you can use something like a software-defined radio to poke this stuff out on the L1 frequency, which I happen to give you here.

313
00:31:08,430 --> 00:31:12,950
And again, a ton of open source tools available to do this.

314
00:31:13,410 --> 00:31:19,630
Now, there are a number of ways in which spoofing can be mitigated.

315
00:31:19,710 --> 00:31:23,890
Because I don't want to leave you with the impression that, oh, GPS is going to hell now.

316
00:31:24,310 --> 00:31:35,750
First of all, and this is starting to be built into a lot of receivers, is you can detect the signal distortion at the instant when the bogus signal overpowers the legitimate message.

317
00:31:35,750 --> 00:31:41,110
It turns out there are some blips if the spoofer doesn't do this right.

318
00:31:41,110 --> 00:31:49,670
The other thing is, when you're getting GPS signals from X number of satellites, they're coming from X directions.

319
00:31:49,670 --> 00:31:52,490
Most spoofing comes in from a single direction.

320
00:31:52,490 --> 00:32:03,430
Even if it comes in from multiple directions, you can see that all of a sudden I have a new signal and it's not coming from where I'm expecting it to have been coming from.

321
00:32:03,710 --> 00:32:09,890
The other thing is, the spoofed signals won't have the encrypted military signal on it.

322
00:32:09,950 --> 00:32:19,250
So one thing that people are starting to do is they're starting to correlate the encrypted signal to be sure that it is an authentic encrypted signal.

323
00:32:19,250 --> 00:32:25,570
Now, my receiver can't interpret the military signal, but at least I can tell if it's legit.

324
00:32:26,530 --> 00:32:34,030
And then, of course, more and more GNSS receivers on the big boats are monitoring multiple constellations.

325
00:32:34,030 --> 00:32:39,950
So if I think that GPS isn't working, I can switch over to, you know, GLONASS.

326
00:32:39,950 --> 00:32:50,510
Now, it turns out there is a report that just came out that said that U-2 pilots currently are reportedly using watches that have all four constellations.

327
00:32:50,810 --> 00:32:59,470
And the Raymarine GA-150 unit I just mentioned, because I found it as an example, has this built-in GPS GLONASS receiver.

328
00:32:59,470 --> 00:33:02,370
So, you know, it's using both constellations.

329
00:33:04,270 --> 00:33:07,150
Now, I really wanted to talk about AIS.

330
00:33:07,150 --> 00:33:10,230
So that gets me here.

331
00:33:10,390 --> 00:33:18,450
But AIS doesn't work without GPS, although there are ways that I can spoof AIS and I don't even have to worry about GPS.

332
00:33:18,850 --> 00:33:24,230
So I've already mentioned AIS is, or we've already talked about.

333
00:33:24,230 --> 00:33:28,130
Automatic ID system is a situational awareness system for ships.

334
00:33:28,330 --> 00:33:40,530
It provides a way that ships can identify who they are, in some cases, what their cargo is, what type of vessel they are, their position, speed, heading, destination, all that kind of stuff.

335
00:33:40,630 --> 00:33:45,670
It also means that maritime authorities can track the vessels that are coming within their areas of responsibility.

336
00:33:45,790 --> 00:33:49,010
Ports can track vessels coming into their port, etc., etc.

337
00:33:50,970 --> 00:33:56,390
Now, there are rules about who is required to carry AIS.

338
00:33:56,630 --> 00:34:00,390
And this page is trying to give you some idea of those.

339
00:34:00,390 --> 00:34:06,490
You can get the idea that AIS is required on big vessels, which probably doesn't come as a surprise to anybody.

340
00:34:06,890 --> 00:34:11,590
There is a warship exemption, which I'm not going to worry too much about.

341
00:34:11,870 --> 00:34:20,170
But in any case, the point is big ships and or ships with a lot of passengers all need to be broadcasting their AIS information.

342
00:34:21,050 --> 00:34:26,070
So here is just an example of an ECTIS display that you might see on a boat.

343
00:34:26,990 --> 00:34:32,370
And, you know, again, you've got all your targets here, at least all the targets that are broadcasting.

344
00:34:33,330 --> 00:34:38,670
And you can click on them and they're going to show you whatever information they're going to show you.

345
00:34:40,330 --> 00:34:44,350
I use a program called OpenCPN.

346
00:34:44,870 --> 00:34:47,190
If you were in my last talk, you saw that there.

347
00:34:47,190 --> 00:34:50,910
I'm going to actually get rid of this right now because I don't care.

348
00:34:50,910 --> 00:34:56,430
But right now I'm getting information off the area of Daytona Beach.

349
00:34:56,450 --> 00:34:58,570
So, for example, right here I have a vessel.

350
00:34:58,570 --> 00:35:00,390
Oh, the Ho Detroit.

351
00:35:00,390 --> 00:35:02,250
That is a new one for me.

352
00:35:02,450 --> 00:35:05,910
Anyway, another ship from Norway.

353
00:35:07,730 --> 00:35:17,570
And so right now I'm getting the fact that, OK, its destination is Jacksonville, which, of course, is north of us by about 90 miles from where they are.

354
00:35:17,810 --> 00:35:20,070
Yeah, probably about 100 or so miles from where they are.

355
00:35:21,190 --> 00:35:25,990
And their ETA is to get there tomorrow morning at 0700 UTC.

356
00:35:26,470 --> 00:35:28,770
Here's their speed, their course, their heading.

357
00:35:28,770 --> 00:35:30,230
They're going in a straight line.

358
00:35:31,610 --> 00:35:33,510
And here's the size of the vessel.

359
00:35:33,510 --> 00:35:35,810
So this is no small vessel.

360
00:35:36,730 --> 00:35:39,110
Over here, I've got another vessel as well.

361
00:35:39,110 --> 00:35:39,930
The Charles A.

362
00:35:39,930 --> 00:35:40,910
That one's new.

363
00:35:41,230 --> 00:35:42,770
At least I haven't seen it recently.

364
00:35:42,970 --> 00:35:43,870
You know, same kind of thing.

365
00:35:43,870 --> 00:35:47,150
Here we have a tug and it's actually towing a stern.

366
00:35:47,150 --> 00:35:48,290
We get that a lot.

367
00:35:48,290 --> 00:35:51,450
We have sea-going barges up here.

368
00:35:51,450 --> 00:35:54,790
So getting a tug, towing something, not unusual.

369
00:35:55,050 --> 00:35:56,570
This one's going to New York.

370
00:35:56,770 --> 00:35:58,510
Don't know where it came from.

371
00:35:58,530 --> 00:36:01,710
And it says it's going to get there on June 19th.

372
00:36:03,590 --> 00:36:04,230
Yeah, OK.

373
00:36:04,230 --> 00:36:12,390
So all the information that you see on AIS may not be 100% accurate because I don't think they're going to take another year to get where they're going.

374
00:36:12,930 --> 00:36:15,350
But in any case, you take what you can get.

375
00:36:15,350 --> 00:36:17,990
Here we're actually seeing it report its rate of turn.

376
00:36:18,570 --> 00:36:23,230
It's turning at least five degrees every 30 seconds to the port.

377
00:36:24,390 --> 00:36:27,190
So this can be useful information as well.

378
00:36:27,830 --> 00:36:30,170
In any case, I told you that.

379
00:36:30,310 --> 00:36:34,250
So I can tell you some other stuff that I'm going to show you here.

380
00:36:37,430 --> 00:36:46,920
So in any case, the AIS communication protocol largely uses something called self-organizing time division multiple access, which is a little bit of a mouthful.

381
00:36:47,310 --> 00:36:56,630
But basically, you're broadcasting in what you consider to be your time slot and you make reservations for other time slots.

382
00:36:56,630 --> 00:37:01,430
Every vessel that can hear you hears your time slot reservations.

383
00:37:02,850 --> 00:37:11,610
Usually you're only talking to other vessels that are within about a 10 or 15 mile range.

384
00:37:12,610 --> 00:37:17,910
I mentioned here on the page that there's a bunch of protocols from the National Maritime Electronics Association.

385
00:37:18,430 --> 00:37:21,550
0183 is the most common one that we're going to see over the year.

386
00:37:22,350 --> 00:37:25,770
This protocol has been around since about 1986.

387
00:37:25,870 --> 00:37:30,130
NMEA 2000 has been around for about 20 years.

388
00:37:30,130 --> 00:37:32,790
And the OneNet protocol is brand new.

389
00:37:33,510 --> 00:37:38,170
And I thought I had some additional information on that, but I don't right here.

390
00:37:38,370 --> 00:37:46,250
In any case, if you want to know more about AIS, you can also read these ITUR recommendations and you can download those online.

391
00:37:48,510 --> 00:37:58,610
Now, the folks at Trend Micro, a team led by a fellow named Marco Balduzzi, actually has published stuff.

392
00:37:58,710 --> 00:38:03,770
And he's spoken probably at DEF CONs or Black Hats about issues with AIS.

393
00:38:03,770 --> 00:38:07,150
And he's been talking about this for, you know, seven years.

394
00:38:07,770 --> 00:38:14,590
But there are four main vulnerabilities with the AIS protocol that are important that I want to address.

395
00:38:14,590 --> 00:38:17,610
One of them is lack of message integrity.

396
00:38:17,690 --> 00:38:24,810
And the lack of message integrity being that when you get a message, you don't actually know that that was the message that was sent by the other person.

397
00:38:24,930 --> 00:38:39,910
So it is theoretically possible, although very difficult, and I would argue maybe even unnecessary, but it is theoretically possible that some ship will transmit a message and another vessel could overwrite a portion of the message.

398
00:38:39,910 --> 00:38:47,270
But in any case, there's no way to prove that the message you receive is the message that was transmitted.

399
00:38:47,510 --> 00:38:49,810
There's also no timing integrity.

400
00:38:49,870 --> 00:38:53,830
So when you receive a message, you're receiving it obviously in real time.

401
00:38:53,830 --> 00:38:56,450
You don't actually know when the message was sent.

402
00:38:56,830 --> 00:39:06,970
There is no authentication, meaning that when you get a message purporting to come from a particular vessel, you have no way of knowing that it really came from that vessel.

403
00:39:06,970 --> 00:39:10,670
And there's also no validity check.

404
00:39:10,670 --> 00:39:17,810
Namely, if a vessel says, I am located at the following lat and long, there's no way to prove that they're really at the lat and long.

405
00:39:18,330 --> 00:39:24,170
Now, if we compromise AIS communications, I can do all sorts of, you know, weird things.

406
00:39:24,170 --> 00:39:28,550
I can create fake vessels that now other ships are going to respond to.

407
00:39:28,550 --> 00:39:40,510
I can trigger false SOSs, search and rescue messages, collision alerts, closest point of approach alerts, bogus weather information that might cause you to deviate when you don't have to deviate.

408
00:39:41,090 --> 00:39:42,930
Why would I want to do that?

409
00:39:42,930 --> 00:39:44,390
Well, I'm a pirate.

410
00:39:44,470 --> 00:39:47,070
I can only make it 30 miles offshore.

411
00:39:47,070 --> 00:39:48,790
You're 50 miles offshore.

412
00:39:48,790 --> 00:39:54,230
If I can somehow get you to deviate 20 miles closer to the coast, you're now within my range.

413
00:39:54,230 --> 00:39:56,550
So reasons such as that.

414
00:39:56,550 --> 00:40:05,690
So anyway, so when you get the presentation, you'll see I mentioned some, you know, I mentioned these again with a few more verbs.

415
00:40:06,050 --> 00:40:08,850
But again, there's other things you can do.

416
00:40:08,850 --> 00:40:12,470
By the way, you can create vessels that aren't real, ghost vessels.

417
00:40:12,770 --> 00:40:16,490
You can also do something called a frequency hopping attack.

418
00:40:16,490 --> 00:40:29,830
You can actually launch a denial of service attack on other vessels and basically either usurp all of the frequency or you can cause them to just transmit in areas where nobody else is listening.

419
00:40:33,140 --> 00:40:37,100
This is also a picture that was a little bit inspired by the Balduzzi group.

420
00:40:37,100 --> 00:40:48,860
Just showing all the different vessels and their communication of AIS messages and ways in which you can or attack vectors that are possible.

421
00:40:48,860 --> 00:40:52,380
There are a lot of lines here in green.

422
00:40:52,460 --> 00:40:55,180
The green are RF based threats.

423
00:40:55,180 --> 00:41:00,160
So there's a lot of ways that if you can get yourself on the radio network, which is not hard to do.

424
00:41:00,160 --> 00:41:08,260
You can send out bogus information that is going to impact vessel traffic management, vessels at sea.

425
00:41:08,260 --> 00:41:11,940
And then, of course, there's other ways of doing it with just straight out software.

426
00:41:13,780 --> 00:41:30,260
Now, AIS is used to transmit information, not only to the vessels in the local area, but there are a lot of services that gather this information, aggregate it and then post it online.

427
00:41:30,260 --> 00:41:44,100
And so I just want to observe that the International Maritime Organization recognized 15 years ago that this information leakage potentially impacts safety at sea.

428
00:41:44,840 --> 00:41:47,920
I think they were right 15 years ago.

429
00:41:47,920 --> 00:41:52,180
I think today that that horse has left the barn.

430
00:41:52,300 --> 00:41:55,300
So it's something that we need to deal with.

431
00:41:55,300 --> 00:41:58,020
I don't think it's something that we can stop doing.

432
00:41:58,020 --> 00:42:02,300
But as an example, this is MarineTraffic.com.

433
00:42:02,540 --> 00:42:06,200
It's one of many aggregator sites.

434
00:42:06,200 --> 00:42:11,520
And you can sort of get an idea right here of, you know, all these vessels that are floating around the world right now.

435
00:42:11,520 --> 00:42:21,360
There's something on the order of 75,000 merchant cargo ships going around the world at any given point in time.

436
00:42:21,920 --> 00:42:25,060
They're all required to be broadcasting with AIS.

437
00:42:26,440 --> 00:42:28,260
This is the White Rose of Drax.

438
00:42:28,260 --> 00:42:34,260
You may remember White Rose was the vessel that the University of Texas at Austin people used.

439
00:42:34,640 --> 00:42:37,740
On the date where I actually did this, they were in Monaco.

440
00:42:38,520 --> 00:42:42,040
Oh, by the way, there's a picture of the boat.

441
00:42:44,520 --> 00:42:45,940
Here's Find Ship.

442
00:42:46,840 --> 00:42:53,040
I took this screenshot, you know, about, well, a little over two, probably about two and a half years ago.

443
00:42:53,800 --> 00:42:55,920
Atria happened to be in Barcelona.

444
00:42:56,620 --> 00:42:59,700
You can do real-time tracking of vessels.

445
00:42:59,700 --> 00:43:03,720
These are vessels that are off of Titusville and Port Canaveral.

446
00:43:03,900 --> 00:43:12,280
And so not only am I getting the vessel and information about the vessel, but I can see the track of the vessel, where it had been coming from.

447
00:43:12,280 --> 00:43:13,860
This is from Vessel Finder.

448
00:43:14,940 --> 00:43:19,980
Now, I talked in my last talk, and so I'll merely just mention it again.

449
00:43:19,980 --> 00:43:23,400
It's easy enough to build your own AIS receiver.

450
00:43:23,580 --> 00:43:26,000
There's a variety of tools to help you do that.

451
00:43:26,000 --> 00:43:32,160
I use the Raspberry Pi and Daisy Hat and bring in information that way.

452
00:43:33,540 --> 00:43:39,480
And then what you can do is you can display this information using any number of open source software.

453
00:43:39,860 --> 00:43:41,660
I happen to use OpenCPN.

454
00:43:41,660 --> 00:43:46,380
It is probably one of the more commonly used, but there's other software that can display this as well.

455
00:43:46,380 --> 00:43:49,400
But really where I want to go is this.

456
00:43:49,740 --> 00:43:53,920
This is what an AIS message looks like.

457
00:43:53,920 --> 00:44:00,420
This is a particular type of AIS message that is being transmitted from another vessel.

458
00:44:00,740 --> 00:44:05,220
And I'm going to break this down just real quickly for you.

459
00:44:05,680 --> 00:44:15,320
So the exclamation point at the beginning says this is an NMEA 0183 message that has special encapsulation.

460
00:44:15,320 --> 00:44:20,380
The AI says this is an AIS message.

461
00:44:21,260 --> 00:44:26,140
The VDN is a VHF data link message.

462
00:44:26,140 --> 00:44:31,500
So this is a message coming in from an AIS device on another vessel.

463
00:44:31,500 --> 00:44:33,080
It's not your message going out.

464
00:44:33,080 --> 00:44:35,020
Somebody else is coming in.

465
00:44:36,210 --> 00:44:43,640
So AIS messages are transmitted as a set of one or more sentences.

466
00:44:43,640 --> 00:44:50,100
So what this is telling me is that there are two sentences comprising this message.

467
00:44:50,100 --> 00:44:52,380
This is sentence number one.

468
00:44:52,380 --> 00:44:56,080
And this sentence has serial number zero.

469
00:44:56,080 --> 00:44:59,260
I need a serial number so that I can reassemble, right?

470
00:44:59,380 --> 00:45:02,820
Then I have A telling me this is being broadcast on channel A.

471
00:45:02,820 --> 00:45:10,960
And then the rest of this gobbledygook up until I get to the comma is the encapsulated AIS message.

472
00:45:10,960 --> 00:45:19,380
The zero here tells me that I'm going to have to add no bits to get six bit alignment.

473
00:45:19,380 --> 00:45:21,760
And then the 7B is the checksum.

474
00:45:22,200 --> 00:45:27,860
The second line says, well, two sentences or two sentences in the message.

475
00:45:27,860 --> 00:45:32,700
This is sentence number two of serial number zero on channel A.

476
00:45:32,700 --> 00:45:33,880
Here's the message.

477
00:45:33,880 --> 00:45:35,580
We need two padding bits.

478
00:45:35,580 --> 00:45:37,500
Here's the checksum of the second message.

479
00:45:37,500 --> 00:45:39,160
Anyway, this is a message type five.

480
00:45:39,160 --> 00:45:41,740
It's called the ship static and voyage related data.

481
00:45:41,840 --> 00:45:44,060
And here's the information that we get.

482
00:45:44,360 --> 00:45:45,780
So here's the name of the ship.

483
00:45:45,780 --> 00:45:47,000
Here's the type of cargo.

484
00:45:47,020 --> 00:45:48,300
Here's the ship dimensions.

485
00:45:48,620 --> 00:45:51,940
This is actually telling me where is your AIS antenna.

486
00:45:53,380 --> 00:46:00,820
So this is how far from the bow, how far from the stern, how far from the port side, how far from the starboard side.

487
00:46:00,820 --> 00:46:02,040
Anyway, there's all this information.

488
00:46:02,040 --> 00:46:04,320
Oh, and by the way, where it's going and what it drops.

489
00:46:06,700 --> 00:46:10,640
Here is some of the code that I've written, an AIS parser.

490
00:46:10,640 --> 00:46:16,940
This is taking a different AIS message, but it's parsed it out same way and giving you a URL.

491
00:46:16,940 --> 00:46:21,780
So when you click on the latitude and longitude, up comes a map and shows you where this thing is.

492
00:46:23,840 --> 00:46:27,080
So I have a couple of tools that are on my website.

493
00:46:29,420 --> 00:46:31,700
One is called timestamp data.

494
00:46:31,700 --> 00:46:33,660
It's a Perl program.

495
00:46:33,660 --> 00:46:52,400
And what timestamp data does is if you point timestamp data at a TCP or UDP socket, IP address and a port number, it will take AIS data from there and put a timestamp on it and collect it into a file.

496
00:46:52,400 --> 00:47:03,800
You can then take that file and use a program called play AIS, also a Perl program, and it will take the AIS data and put it out to a TCP UDP socket.

497
00:47:03,900 --> 00:47:06,980
So I'm telling you that so I can tell you this.

498
00:47:06,980 --> 00:47:08,760
I'm not going to show you a video.

499
00:47:09,040 --> 00:47:11,820
What I'm going to do is this.

500
00:47:12,160 --> 00:47:14,660
And you guys will get to see this live.

501
00:47:15,420 --> 00:47:19,140
So this is Daytona Beach, more or less.

502
00:47:20,100 --> 00:47:23,560
Down here where this black boat is, it says Middle Island.

503
00:47:23,620 --> 00:47:26,540
This is Ponce de Leon Inlet.

504
00:47:27,720 --> 00:47:29,900
So we're on the east coast of the Atlantic.

505
00:47:29,900 --> 00:47:31,760
And you see we got all these boats here.

506
00:47:31,820 --> 00:47:35,520
I need to go around to my terminal window.

507
00:47:38,400 --> 00:47:41,520
I need to get to the right window here.

508
00:47:41,520 --> 00:47:42,380
That's timestamp.

509
00:47:42,380 --> 00:47:43,820
I don't want timestamp.

510
00:47:45,920 --> 00:47:48,040
Okay, so we got play AIS here.

511
00:47:48,040 --> 00:47:52,920
You would have thought that I would have set this up already, but I was playing around with it so much.

512
00:47:52,920 --> 00:47:58,520
What I'm going to do is I'm going to run a program or run a file.

513
00:47:59,680 --> 00:48:02,100
And actually, I'll let you see what the file says.

514
00:48:02,100 --> 00:48:09,140
All this is doing is it's play AIS, and it is going to replay a whole bunch of data.

515
00:48:10,400 --> 00:48:14,840
And if I show you what this data looks like...

516
00:48:21,290 --> 00:48:25,430
I mean, all this is is a whole crapload of AIS data.

517
00:48:25,690 --> 00:48:31,950
Now, really, what I want to do here is actually play this for you.

518
00:48:33,410 --> 00:48:33,890
So...

519
00:48:35,710 --> 00:48:37,690
Rats, I was right there, too.

520
00:48:37,690 --> 00:48:38,610
Here we are.

521
00:48:38,610 --> 00:48:42,610
Okay, so we're actually going to run this program or run this shell script.

522
00:48:44,850 --> 00:48:48,030
Now, I'm going to go back over here to OpenCPN.

523
00:48:48,070 --> 00:48:53,730
And what's going to happen is right around here somewhere, watch closely, a vessel will appear.

524
00:48:54,210 --> 00:48:56,370
It will be called the CFOX.

525
00:48:58,410 --> 00:48:59,550
Yeah, live demos.

526
00:48:59,550 --> 00:49:00,370
Don't you love them?

527
00:49:00,370 --> 00:49:03,490
Okay, so here is the CFOX.

528
00:49:05,030 --> 00:49:08,090
And that's what the information we have on the CFOX.

529
00:49:08,430 --> 00:49:10,770
Now, the CFOX is a real ship.

530
00:49:11,010 --> 00:49:14,210
So is this ship that also magically appeared, Jupiter.

531
00:49:14,430 --> 00:49:16,150
They're also a real ship.

532
00:49:16,590 --> 00:49:20,530
But the difference is... I'm going to go back here for a second.

533
00:49:20,810 --> 00:49:22,490
See this data that's going out?

534
00:49:22,490 --> 00:49:23,870
Well, let's ignore that.

535
00:49:24,050 --> 00:49:25,750
Let's just look back up here.

536
00:49:25,750 --> 00:49:27,570
You see the date of the data?

537
00:49:27,570 --> 00:49:30,310
2019-7-23.

538
00:49:30,330 --> 00:49:34,370
Those vessels are real, but they were there a year ago.

539
00:49:35,150 --> 00:49:38,670
So this is a classic replay attack.

540
00:49:38,670 --> 00:49:50,630
If you're a vessel relying on your AIS, and all of a sudden you see a couple of ships appear that weren't there before, well, you're going to take certain action.

541
00:49:50,770 --> 00:49:52,230
Here's a ship called the Voyager.

542
00:49:52,230 --> 00:49:53,310
It's a sailboat.

543
00:49:53,310 --> 00:49:59,690
And to be honest with you, I don't remember whether that was there before, so I don't know if that's a real ship or a stupid ship.

544
00:49:59,950 --> 00:50:03,050
Now, this is merely a demonstration of capability.

545
00:50:03,050 --> 00:50:04,890
I'm not actually transmitting this on the radio.

546
00:50:04,890 --> 00:50:07,710
I'm transmitting this from one end of my computer to the other.

547
00:50:07,850 --> 00:50:16,930
And one of the criticisms that I have sometimes gotten when I showed this demo is, well, you know, if you had radar, you would know that that's not a real ship.

548
00:50:16,930 --> 00:50:22,850
And that may be true, but I've been on plenty of boats that don't have radar.

549
00:50:22,850 --> 00:50:24,430
They do have AIS.

550
00:50:24,470 --> 00:50:26,290
But I'm going to show you this instead.

551
00:50:26,490 --> 00:50:28,130
This is Ponce Inlet.

552
00:50:28,230 --> 00:50:32,470
Now, for those of you who are mariners, you understand the reds and the greens and all that kind of stuff.

553
00:50:32,470 --> 00:50:37,030
You also understand the difference between the dark blue and light blue.

554
00:50:37,030 --> 00:50:42,230
And in this case, the dark blue is shallow water and the light blue is deep water.

555
00:50:42,330 --> 00:50:45,470
So Ponce Inlet is dredged up here at the north side.

556
00:50:45,470 --> 00:50:49,630
And you'll notice if you look at the buoys, it's very clear.

557
00:50:49,630 --> 00:50:53,710
Here's your number two buoy, and they want you coming in on the north side.

558
00:50:54,170 --> 00:50:58,570
So I have something else I want to show you.

559
00:50:59,370 --> 00:51:01,350
And let's see.

560
00:51:03,030 --> 00:51:04,430
Well, here we go.

561
00:51:04,430 --> 00:51:07,950
Let me see if I can just remember the name without embarrassing myself.

562
00:51:12,480 --> 00:51:18,640
So if we go back here, note we have a bunch of things just appearing.

563
00:51:19,200 --> 00:51:23,460
These are virtual ATONs, virtual aids to navigation.

564
00:51:23,860 --> 00:51:32,780
This first virtual ATON, which I have dutifully named PI for Ponce Inlet, is telling me that this is a preferred channel marker.

565
00:51:32,800 --> 00:51:40,740
Not only is it a preferred channel marker, but it's telling me that the preferred channel keeps this marker on my starboard side.

566
00:51:40,740 --> 00:51:43,600
Meaning I want to come in this way.

567
00:51:43,960 --> 00:51:52,220
And now if you look at the triangles and the squares, it's telling me that my preferred channel brings me in right here, right into the shallow zone.

568
00:51:52,580 --> 00:52:03,800
If I do a target query on this, I'm going to see that this has an appropriate ID that tells me that the Coast Guard put this out there.

569
00:52:03,800 --> 00:52:11,660
Because the Coast Guard is the only authority in the United States that has... well, it's the only organization that has the authority to put out virtual ATONs.

570
00:52:11,660 --> 00:52:15,040
But there's no authentication in AIS.

571
00:52:15,400 --> 00:52:19,980
So my observation is here, all the radar in the world isn't going to help you now.

572
00:52:20,240 --> 00:52:31,080
Because if you don't know this inlet, you don't have a chart, and you're not talking to anybody, and you're relying on your AIS, you just saw that this is the preferred way in.

573
00:52:31,780 --> 00:52:35,660
And maybe somebody knows something that your chart doesn't.

574
00:52:35,900 --> 00:52:39,660
And you'll actually run out of water somewhere around here.

575
00:52:41,260 --> 00:52:46,800
That is my... I don't even know where anything is anymore.

576
00:52:46,800 --> 00:52:52,160
That is my demo of spoofing.

577
00:52:52,280 --> 00:52:56,360
So a couple things I want to say before I go over to Q&A.

578
00:52:56,360 --> 00:53:04,800
Here's a picture of my wife herding fish, because I like to give that as an analogy of these problems.

579
00:53:05,280 --> 00:53:07,560
Some of the stuff I've talked about is very, very real.

580
00:53:07,560 --> 00:53:10,280
And you can pick up the newspaper and read about it all the time.

581
00:53:10,520 --> 00:53:16,360
Some of the problems, you know, some people pass off and say, well, that's theoretically possible, but...

582
00:53:17,100 --> 00:53:23,000
And, you know, there's a whole bunch of people in the community who have been making the, well, that's theoretical.

583
00:53:23,000 --> 00:53:25,180
They've been making it practical for decades.

584
00:53:25,180 --> 00:53:27,100
I like this quote by Arthur C.

585
00:53:27,100 --> 00:53:27,740
Clarke.

586
00:53:28,340 --> 00:53:33,420
If an elderly but distinguished scientist says that something is possible, he's most certainly right.

587
00:53:33,420 --> 00:53:36,300
If he says it's impossible, he's very probably wrong.

588
00:53:37,200 --> 00:53:42,300
There's a lot of things that I can think of that are bad things that I could do.

589
00:53:42,300 --> 00:53:48,400
I may not be able to do them today, but they might... the technology might catch up with me in the next couple of years.

590
00:53:48,400 --> 00:53:55,040
And the last thing I want to give is a quick analogy and story, and then I'll be mostly done.

591
00:53:55,320 --> 00:54:00,160
For those of you who are mariners, you recognize this lighting configuration.

592
00:54:00,540 --> 00:54:02,280
Roll 27F.

593
00:54:02,380 --> 00:54:06,580
This is a minesweeper engaged in minesweeping activity.

594
00:54:06,720 --> 00:54:14,960
By the way, based on the red, white and green lights, it's aimed directly at you, which means you're already in the minefield.

595
00:54:14,960 --> 00:54:19,100
But the analogy that I really want to use is this.

596
00:54:19,320 --> 00:54:23,100
If you're in a minefield, what's your problem?

597
00:54:23,300 --> 00:54:33,180
Is your problem the threat of the mine, or is it the vulnerability of your ship to the explosion?

598
00:54:33,580 --> 00:54:38,760
And I ask that because, again, I'm going to give you a story out of early World War II history.

599
00:54:38,780 --> 00:54:43,200
During the Battle of the Atlantic, the Germans came up with the idea of a magnetic mine.

600
00:54:43,200 --> 00:54:46,400
So they planted magnetic mines in all sorts of places.

601
00:54:46,400 --> 00:54:57,520
The way a magnetic mine got tripped was because when a battleship or any metal-hulled ship went over it, it disrupted the Earth's magnetic field sufficiently so that the mine could deploy.

602
00:54:57,740 --> 00:54:59,760
The British figured that out.

603
00:54:59,760 --> 00:55:03,260
They then figured out a way to degauss all of their ships.

604
00:55:03,260 --> 00:55:07,260
And now they could go over magnetic mines and there was no problem.

605
00:55:07,260 --> 00:55:13,880
The point is, what they did was fix the vulnerability of the ship.

606
00:55:14,120 --> 00:55:17,320
That obviated the threat of the mine.

607
00:55:17,580 --> 00:55:21,920
So when we're talking about threats and vulnerabilities, we need to know which to go after.

608
00:55:21,920 --> 00:55:24,360
Basically, we can't stop all the threats.

609
00:55:24,360 --> 00:55:26,720
We can find and fix our vulnerabilities.

610
00:55:27,280 --> 00:55:29,600
In any case, here's some contact information.

611
00:55:29,600 --> 00:55:31,260
I'll leave that up for now.

612
00:55:31,260 --> 00:55:34,200
I'm going to go back to the beginning here.

613
00:55:34,400 --> 00:55:40,060
And we have some time for Q&A if people have some Qs and As.

614
00:55:45,410 --> 00:55:47,550
There are questions from Twitch.

615
00:55:48,170 --> 00:55:49,150
Okay.

616
00:55:49,590 --> 00:55:53,310
I'm trying to find out where I can get my...

617
00:55:53,310 --> 00:55:55,410
Oh, I think I've gone too far.

618
00:55:58,860 --> 00:56:00,840
I can get questions from AIS techs.

619
00:56:00,840 --> 00:56:06,320
If there are questions, I'm not sure the best way to get them to me, but feel free to get them to me.

620
00:56:12,290 --> 00:56:13,370
Let's see.

621
00:56:16,220 --> 00:56:18,680
No, let's go back up here and see what we got.

622
00:56:26,360 --> 00:56:27,720
Transmitting fake packets?

623
00:56:28,000 --> 00:56:31,280
Yeah, you can actually transmit fake packets.

624
00:56:31,280 --> 00:56:35,560
And I'm not 100% sure what devices will do.

625
00:56:35,560 --> 00:56:42,540
If you're a legitimate ship, you send out your packet, it displays on the AIS, and then all of a sudden I send out a fake packet.

626
00:56:42,720 --> 00:56:44,360
I'm sorry, you send out the real packet.

627
00:56:44,360 --> 00:56:46,320
I followed up with a fake packet.

628
00:56:46,500 --> 00:56:52,240
My suspicion is that other vessels are going to display the latest information they got.

629
00:56:55,630 --> 00:56:57,550
You can, in fact, flood.

630
00:56:57,550 --> 00:57:00,070
You can flood the system.

631
00:57:00,170 --> 00:57:02,870
You can launch a denial of service on AIS.

632
00:57:02,870 --> 00:57:13,270
You can cause some ships to go blind or get blinded and only be transmitting to effectively you as the attacker can see them.

633
00:57:17,110 --> 00:57:23,910
AIS is mostly TDMA, but it's not strictly TDMA because it's self-organizing.

634
00:57:28,970 --> 00:57:30,570
So let's see.

635
00:57:30,570 --> 00:57:33,270
I'm getting a message over here on Slack.

636
00:57:33,270 --> 00:57:35,670
What does the shadow have for me?

637
00:57:36,870 --> 00:57:38,610
Oh, nothing over there.

638
00:57:39,250 --> 00:57:41,530
Got a whole bunch of things over here.

639
00:57:47,270 --> 00:57:51,110
Ah, a question from Twitch.

640
00:57:51,110 --> 00:57:53,630
Did it figure out how the crop circle spoofing worked?

641
00:57:53,830 --> 00:58:01,390
You know, I have not read anything that describes how the crop circle is working.

642
00:58:01,390 --> 00:58:08,250
In fact, I have read a number of things where people at first were saying, we have no clue how they did this.

643
00:58:10,670 --> 00:58:13,770
How realistic is the concern that AIS spoofing...

644
00:58:13,770 --> 00:58:14,950
Oh, how do I get rid of this?

645
00:58:14,950 --> 00:58:15,830
Oh, here we go.

646
00:58:15,830 --> 00:58:17,550
Can lead to ship collisions.

647
00:58:17,630 --> 00:58:20,590
Okay, so how realistic is the concern?

648
00:58:20,590 --> 00:58:32,530
I don't know that it can lead to collisions per se, other than altering the information so that other vessels can't see that you're there.

649
00:58:32,530 --> 00:58:36,470
So, for example, you know, the collisions with the U.S.

650
00:58:36,470 --> 00:58:42,650
Navy vessels, particularly the John McCain a couple years ago, were probably not due to anything like this.

651
00:58:42,650 --> 00:58:44,290
And they did investigate it.

652
00:58:44,290 --> 00:59:01,530
But if you don't have an appropriate watch and it's nighttime and you don't have good situational awareness, I can probably devise scenarios where ships get way closer to each other than they want to be.

653
00:59:04,230 --> 00:59:11,830
There's a question here about incidents of spoofing on the space and control segments, not of which I am aware.

654
00:59:15,630 --> 00:59:18,170
And readout's got a couple things.

655
00:59:18,990 --> 00:59:21,950
Where did I get the vessel name for the Shanghai incident?

656
00:59:23,010 --> 00:59:31,410
Well, certainly not from a secret document because I don't have access to those and I would be very careful about sharing it.

657
00:59:31,410 --> 00:59:32,170
I got it.

658
00:59:32,170 --> 00:59:34,690
I must have gotten it from the Coast Guard.

659
00:59:34,690 --> 00:59:36,050
So hang on two seconds.

660
00:59:39,170 --> 00:59:41,270
That's Estella Imparo, right?

661
00:59:41,270 --> 00:59:44,430
Yeah, I got something from U.S.

662
00:59:44,430 --> 00:59:47,350
Coast Guard NABCEN back.

663
00:59:47,350 --> 00:59:49,150
Well, that's when it got reported.

664
00:59:49,290 --> 00:59:57,570
So I guess I'm not 100% sure right now where I got it, but I know that it was out there somewhere.

665
01:00:10,680 --> 01:00:12,080
Oh, dear.

666
01:00:12,480 --> 01:00:14,360
I've now lost myself.

667
01:00:20,770 --> 01:00:22,770
Oh, there was something I just missed there.

668
01:00:23,730 --> 01:00:25,890
Something about the Fitzgerald.

669
01:00:28,530 --> 01:00:30,790
Let me get back up here.

670
01:00:39,470 --> 01:00:44,870
I heard some stuff about the Fitzgerald being subjected to any number of things.

671
01:00:45,370 --> 01:00:55,950
I thought the latest that I'd read was that they said, sorry, it was operator error, because a lot of warships turn off their AIS.

672
01:00:55,950 --> 01:00:59,510
Now, when they turn it off, they're still receiving, they're just not transmitting.

673
01:01:00,230 --> 01:01:02,410
And I've actually been on a couple ships.

674
01:01:02,410 --> 01:01:03,730
It's sort of funny.

675
01:01:04,130 --> 01:01:07,570
I was on one boat where they could turn off their AIS.

676
01:01:07,570 --> 01:01:09,190
They had a toggle switch.

677
01:01:09,310 --> 01:01:15,370
Like, you know, a toggle switch like you could go to Lowe's and get a two-position toggle switch.

678
01:01:15,370 --> 01:01:19,090
And then they had like a plastic label that said on-off.

679
01:01:19,090 --> 01:01:21,550
And that was their AIS switch.

680
01:01:21,550 --> 01:01:23,070
They could turn it on and off.

681
01:01:25,310 --> 01:01:29,050
But I don't know the detail of the Fitzgerald.

682
01:01:29,050 --> 01:01:31,790
I had not read that it was spoofed.

683
01:01:31,790 --> 01:01:35,830
But if anybody has any detail about that you'd like to forward to me, I would love to see it.

684
01:02:01,820 --> 01:02:03,240
Thank you very much.

685
01:02:04,780 --> 01:02:05,940
My pleasure.

686
01:02:07,560 --> 01:02:11,700
So, listen, I'm going to stay on for a few more minutes.

687
01:02:11,760 --> 01:02:14,540
I know that I'm at the end of my witching hour.

688
01:02:14,720 --> 01:02:17,260
If you've got more questions, obviously, feel free.

689
01:02:17,340 --> 01:02:19,820
I will be taking the slides.

690
01:02:20,000 --> 01:02:25,380
And within the next 10 or 15 minutes, I'll be making a PDF and I'll upload them.

691
01:02:25,380 --> 01:02:29,320
Or I'll send them to the people who will upload them to places.

692
01:02:30,160 --> 01:02:33,940
Obviously, anybody is welcome to contact me at any point about any of this.

693
01:02:34,440 --> 01:02:36,580
I should give a little bit of an advertisement.

694
01:02:37,100 --> 01:02:49,560
Some of the research that I've been doing for the last year and a half or so that caused me to build some of these tools was I came up with a demonstration and capability system to build a protected AIS, which I had a lot of fun doing.

695
01:02:50,120 --> 01:02:56,880
I'm going to talk, I'll be talking about that tomorrow at, I think, I think is it four o'clock Eastern time?

696
01:02:56,880 --> 01:02:58,460
So one o'clock Pacific time.

697
01:02:58,600 --> 01:03:08,780
And if anybody wants to sit in on that and, you know, I'll talk a little bit more about what AIS looks like and how I built in the protected code and, you know, that kind of stuff.

698
01:03:09,600 --> 01:03:11,940
And I think that's that's it for now.

699
01:03:11,940 --> 01:03:16,160
Otherwise, but like I said, I'll hang here for a couple of minutes before they kick me out.

700
01:03:16,160 --> 01:03:17,280
But thank you all very much.