All right, good morning, afternoon, evening, whatever time it is when you get around to
watching this. I'm pretty excited to be participating for the first time in DEF CON.
I really wish, obviously, I could be there in person. It would be far easier to present this
if I was able to see people face-to-face and you would see, you know, my passion and excitement.
I'm sure you might not hear it in my voice, but this is a project that I have been working on for
about the beginning of the year, maybe even into last year, and that is Dragon OS Focal.
Like I said, my name is Aaron. This is DEF CON 2020 safe mode. So we'll go down through here.
I've got some just a few slides and then we'll go right into just kind of showing you what
Dragon OS is. Background on it, I, you know, personally was working on some tools right prior
to COVID-19 to try to aid in teaching software-defined radios, SDRs. So, you know, I had
kind of that going for me. And then a couple projects way back 2008, 2009 or so, I built
everything that was AWD Mesh. Some of you may be familiar with OpenMesh back then when they had the
OM1P. So I was kind of on my own using some open source and the router station, everyone probably
had one at one point or another, and built OpenMesh with a few other people there, sold the stuff
all over the world, dual radio mesh equipment. So, and then about that same time, I was pretty
active in the ZoneMinder forums for some reason or another. And I just noticed that people have
a lot of problems with compiling things and building ZoneMinder from source. So I thought,
well, why not use Remaster Syst and help people out and get it all pre-built and working. So
kind of take those two things, and it got me thinking about doing another distribution.
And then, of course, COVID-19 hit really big and, you know, a lot of people stuck at home.
So I thought, well, why not take my little project, take it to the next level, get it out there,
you know, to the public so people could install, have something fairly new in terms of software,
free, and get into software-defined radios while they were stuck at home.
Put that, you know, out to the public. A lot of people were interested in it. RTLSDR.com and
Hackaday did, you know, a few articles here. I just copied and pasted one article
that you can see was dated back March 24, 2020. Talks a little bit about the project. So,
you know, if you look online, you'll find a lot more articles. But the progress I've made,
I started with Debian Buster, just called it Dragon OS X. That was...
Actually, Debian is probably my favorite. Had a lot of tools in there. You can find that on
SourceForge. I just got to a point where I wanted to be able to support disk encryption and UEFI.
So I moved on to Lubuntu 18.04, called that Dragon OS LTS. That was... the bulk of my time was spent
making that. I think I've made the most videos on that. And I guess I should point out, too,
I tried to keep all distributions, even though, you know, went from Debian to Lubuntu. I tried to
keep as close as possible I could with the tools and applications that were installed. So,
you know, for the most part, any of the videos, you know, I label should apply to any of the
builds, hopefully. Well, anyways, so now I'm on to Lubuntu 20.04. And I just called that Dragon OS
Focal. So yeah, the goal I spend, I don't even know how many hours, all these, you know,
countless amount of hours pre-installing anything I could possibly find that would be of interest
to people that are into software-defined radios. That could be from repositories,
dev packages, you know, source, so on and so forth. And I try to combine it all and spend
and just be meticulous about everything working together. So, you know, from remastering it to
installing it, to testing the whole installation, to checking every possible software-defined radio
I can with it, or at least that I've owned or have been donated. You know, I have B205 here,
USRP radio, RTL-SDR, Blade RF, some SDR Play equipment. The SDR Play people were
extremely helpful in sending me some equipment out. That's been really awesome. Ubertooth from
Hacker's Warehouse, they were really nice, sent some equipment out. And then as I kind of go
through, I'll point out, I'll say thanks to a lot of people that have helped just with input
and kind of behind-the-scenes discussion on what software is out there and what to include.
All right, so let's get out of the slides here. And, you know, I try to do everything
within Dragon OS, which is running right now, my latest build, which I was going to put out
in conjunction with this. I just kept it still a beta build, Dragon OS Focal Public Beta 3.
That's what's running this right now. I have to admit, I was not familiar with OBS and making
videos like this, so hopefully it comes out okay. So we'll get down off the slides here.
This is Dragon OS. I know it doesn't look like much. You're just looking at the desktop here,
but this is running live from a USB stick. I've made it as easy as I can. You can see there's a
little icon on the desktop. I've actually already ran through the installer, but I will show how
easy it is to get it to install. You'll just come through here, answer a few questions. I'll just
uncheck this for now, just so that it's not hanging here and you all are staring at this
screen while it's loading. I'm not going to make this video over again, but just trust me, I've
already ran through the installer and it finished. Normally you would reboot.
That's why you see that error pop up there. Anyways, I'll just let that run in the background.
That was kind of to show you how easy it is to install. Lesson learned. Don't run it twice
within the same as it's running live, but it's kind of hard. I have everything set up to make
this video. One of the big things, I'll just go right down the list I wanted to demonstrate here,
so you can get an understanding of why is this any different than any other distribution.
You got Kali out there for your offensive security or pen testing. I just tried to make
this distribution all about software-defined radios. So, base Lubuntu system with everything
installed on top of it. One point right out at the front, I've actually got it running here.
SigDigger that I've put in here, built from source. I find this program really great. The
super awesome. I know he was trying to help me out to have a TV decoder, I guess you'd say,
with sync and everything ready for this. But I think you all will see that here in the real
near future. So, keep an eye on that. But what I'll show you is SigDigger running using the
B205 mini that I have here. And if you happen to have, so I have a five gigahertz antenna on it.
I've got a five gigahertz FPV cam sitting here. So, if you open up your sample rate and your
bandwidth, you should be able to do what I'm doing here. Which is, we'll look at this in the
spectrum. I've got my window open as far as I can here. I've got an inspection tab open here. And
I've got an FSK inspector. So, that's another thing. When I make these videos, I try to go
through and get people interested in what these different acronyms, FSK means. I don't explain
everything, but I hope I generate enough interest where people will go out and do some more research.
So, I've opened up the FSK inspector here. And you'll see where I've paused before,
the video, so you know what's coming here.
Let's just open this up the whole way here. Actually, let's close out of this. We'll open
another inspector. You would bump up your bits per tone and start the clock recovery.
I come up here, I left click and drag and open this aperture up here, release,
uncheck fit the window and click record. And come down to about the, let's see, 550 or so.
And you should see where I left off here. And this is live. This is capturing this live. I had hoped
to literally just record the whole video like this, but not, you know, in such a way to give
everyone a seizure or something. So that's, I felt that that was a really unique, very powerful
signal analysis tool. And that just shows you that that's literally out of the box. It's running
live. You don't have to use a B205. I've actually did this with a hack RF.
So yeah, you know, as long as you can get in the five gigahertz range,
you should be, you should be fine. I'm sure I could probably do it with the,
some of the Blade RS that go up that far. This is a Blade RF Micro AXA4, I think it is.
So yeah, that just shows you that's really not the primary feature of this or of that window,
that symbol stream window. It just happens to, to be able to do that. So I'm sure if you pause,
you'll, you'll see me and yeah. So let's see. Anyways, I'm going to close out of this.
I'm going to change out a couple of things here. What I want to show is we'll open up a few
terminal windows here. I'll do this as quick as I can here. This is just to show you something else
that is on here and running out of the box. I grab a few cellular antennas here.
And I'm sure a lot of you are familiar with SRS LTE. I had a big interest in
getting LTE and GSM actually, as well, running out of the box. I know there's a lot of interest
in that. Obviously, you got to have shielding and stuff when you're transmitting any of this.
So I just recommend be careful when you're doing any of what I'm showing here. But
let me see SRS.
So this just shows you how fast we can get up and running.
We'd want to start our core networking, our EPC here. See, we can bring that online.
And we would do our
EMB. And for this, I found that
it will use the EDIS by default.
But these two commands start at the core network and then starting up your EMB.
And that failure you see there, that's SOPI for SDR play. What I have done is,
when you run the installer, that's another thing I guess that makes this unique, but
you run the installer and then you reboot. You're going to be presented with a little
pop-up that will prompt you to install the SDR play. So that'll happen. Your
user will be added to Kismet. So everything just kind of works out of the box. I know I keep saying
that. So these two commands here, I'd have to, you know, of course this happens right when I do the
presentation, but let's see. With those two there, you can be up and broadcasting your
base station, basically. If you had a second laptop and another EDIS or BladeRF, which I have
demonstrated in some of the YouTube videos, you can use a virtual handset through that radio to
connect. So yeah, that's how easy that is. That's all, you know, pre-configured and working. You
can do the same in my latest build with GSM now. So I'm sure a lot of you are probably familiar with
Osmocom here. I've got the HLR, the BTS, the BSC, and the transmitting all in here. So
you should be able to get a GSM base station up and working pretty quick. If you have a
EDIS, so if we start up our
BSC and we start up our...
and then if I start up my might be a
and that's it. And so
now you see, now we've got our
base station online. I know there's an error here, but
let's see. All right, there we go. So you can, this is actually something I'll address
in the next build, but that's actually a pretty common thing and explained on EDIS how to
get around setting the thread priority. All right, so there's three things right out of the box.
Way to decode 5 GHz video, the LTE network, GSM network.
Something else that I do is I keep everything that I install from source or not a packaged
installation, I keep it all here in the actual build when you finish installing it so that you
have all of the source that you need to make any changes or uninstall anything that
you may want to, you may want to remove. Let's see, I'll show another example here. So
GNU Radio 3.8 is in here. If we take a look at, let's just take a look at
GR RDS, you'll see right there you got ADS-B, Deck 2, and I've checked all of this. GSM
in GNU Radio 3.8 works perfectly fine with the Emsi capture script. You got Radium there,
not super familiar with satellites, but I've included that. GR Tempest, I checked that
and actually got that working with some SDR play equipment and was able to view a monitor
without having to use the Tempest SDR which I know a lot of people use. So
if you want to get into GNU Radio, which I recommend, you can take a look at
one of the examples here, a real easy one.
And again, I really feel like a benefit of this distribution is you can run it live if you don't
want to install it. There may be some things that may have some issues running live, but for
the most part it works pretty well. So this is GNU Radio, I'm sure a lot of people are familiar
with this. So again, right out of the box. You got your RDS on there, you've got your gain settings.
So I have tried to go, or I have went through every application you can possibly
think of on here. SDR trunk, Airband, Retrogram,
everything. I have spent a lot of time making this work. So I know I said that
I'd thank some people here. I'm trying to think what else can I open up and show before we
or before I close this out. Just run down the list here. You see under
internet you got GQRX, SDR, ANGEL. I just recently built SDR ANGEL with
SOPI support. So now I can't not show SDR play equipment
in this video considering how much help that they have given. So this is a RSP1 Alpha and SDR ANGEL.
Let's see here. So now we can use our SDR play equipment. Let's see.
Actually, you know what, since we're running live I'm going to fix this real quick.
See there's always something because I haven't
because I haven't installed and rebooted. My script didn't take place. So I just
when you're running live you would have to actually install the API.
So now we should be able to come back here open up our SDR ANGEL.
So now, fingers crossed, we have our RSP1 Alpha. You can add a, well anything. You can do DMR,
DSD, demodulators, DATV, all sorts of options here.
See, doesn't that get awkward when you're doing something live and then it doesn't work like you expect?
Okay, threw me off there a second.
So that's SDR play equipment in SDR ANGEL now.
There we go. Okay, so you gotta obviously adjust the game correctly there. So that's SDR ANGEL.
Same thing if you come down the list here. We've got Cubic SDR, Cubic SDR with SDR play support,
Q-Spectrum Analyzer, really good to use with the HackRF. If you want to do some replay, capture
and replay attacks, you got Universal Radio Hacker. That also, yeah, actually I should have
put SDR play support next to there, which I believe, I believe it, no, actually that does not have
SDR play support yet. They're still, that's still being worked on. Let's see, what else?
We've got Spike, which is the gentleman by the name of Rick, who suggested I do this video,
is a big fan of that equipment, that program. Let's see, what else? And then really anything
else that's sitting in the, that is not installed with a nice easy to click
GUI, you can run from here and you can kind of get an idea there. So Sparrow Wi-Fi,
matter of fact, I know a lot of people are familiar with Kismet.
I suggest taking a look at Sparrow Wi-Fi too.
They've got some nice integration there with the Hacker F and Ubertooth.
I don't actually have my Hacker F right now, but what you can do with Sparrow Wi-Fi is overlay the
2.4 gigahertz and 5 gigahertz spectrum over top of your wireless NIC card that would run up in
the top here. And of course do similar to Kismet, but really not do the full packet capture and,
you'd see the access points. And so not to give away, you know, all my access points here,
I'll just kind of show you the spectrum analyzer with the Ubertooth that's plugged in here.
So thank you to Hacker Warehouse for that, to let me check that.
All right, let's see. So I think that's enough kind of programs. I hit on a lot of the big stuff
and I would encourage anyone to take a look at the YouTube page that I have here.
So I would say, I would encourage anyone to, that wants to know more, take a look at my
YouTube page here, Cima Executor. You can come down through all the videos that I've put on here.
I don't know, I think there's about maybe 60 or so, over all sorts of various different topics,
from showing the installation, to doing capture and replay,
using the Kerberos SDR for direction finding, proof of concept on smart cell phone jamming,
signal analysis, spy server, everything you could think of, I've tried to cover here and educate.
All right, I think that about wraps it up. If you need to find the project, you can just Google
Dragon OS, you can do Focal if you want, that's the latest. You know, come find it on SourceForge,
you got your files and you get your latest there. So yeah, I appreciate everyone
kind of listening up to this point and just want to say, you know, thank you to
developer of, you know, SigDigger, the SDR play equipment, Hackers Warehouse.
You know, I'm drawing a blank right now, but there's been so many,
oh wow, everyone on YouTube that has provided suggestions or emailed me kind of behind the
scenes. I appreciate it. I hope that this has been helpful during COVID-19. I know a lot of people
have been stuck at home, so I just wanted to try and do what I could to help others. So, all right,
thanks.