start	end	text
3480	8500	All right, good morning, afternoon, evening, whatever time it is when you get around to
8500	15200	watching this. I'm pretty excited to be participating for the first time in DEF CON.
15200	20420	I really wish, obviously, I could be there in person. It would be far easier to present this
20420	26420	if I was able to see people face-to-face and you would see, you know, my passion and excitement.
26420	32080	I'm sure you might not hear it in my voice, but this is a project that I have been working on for
33480	40980	about the beginning of the year, maybe even into last year, and that is Dragon OS Focal.
41440	47460	Like I said, my name is Aaron. This is DEF CON 2020 safe mode. So we'll go down through here.
47460	52260	I've got some just a few slides and then we'll go right into just kind of showing you what
52260	60980	Dragon OS is. Background on it, I, you know, personally was working on some tools right prior
60980	71820	to COVID-19 to try to aid in teaching software-defined radios, SDRs. So, you know, I had
71820	81200	kind of that going for me. And then a couple projects way back 2008, 2009 or so, I built
81200	89160	everything that was AWD Mesh. Some of you may be familiar with OpenMesh back then when they had the
89160	95780	OM1P. So I was kind of on my own using some open source and the router station, everyone probably
95780	101680	had one at one point or another, and built OpenMesh with a few other people there, sold the stuff
102460	109400	all over the world, dual radio mesh equipment. So, and then about that same time, I was pretty
109400	113440	active in the ZoneMinder forums for some reason or another. And I just noticed that people have
114440	121980	a lot of problems with compiling things and building ZoneMinder from source. So I thought,
121980	127480	well, why not use Remaster Syst and help people out and get it all pre-built and working. So
128380	133920	kind of take those two things, and it got me thinking about doing another distribution.
133920	140960	And then, of course, COVID-19 hit really big and, you know, a lot of people stuck at home.
140960	148220	So I thought, well, why not take my little project, take it to the next level, get it out there,
148220	154860	you know, to the public so people could install, have something fairly new in terms of software,
155380	160580	free, and get into software-defined radios while they were stuck at home.
161020	169060	Put that, you know, out to the public. A lot of people were interested in it. RTLSDR.com and
169060	173500	Hackaday did, you know, a few articles here. I just copied and pasted one article
174020	180380	that you can see was dated back March 24, 2020. Talks a little bit about the project. So,
180380	184920	you know, if you look online, you'll find a lot more articles. But the progress I've made,
184920	190480	I started with Debian Buster, just called it Dragon OS X. That was...
192400	197600	Actually, Debian is probably my favorite. Had a lot of tools in there. You can find that on
198140	203460	SourceForge. I just got to a point where I wanted to be able to support disk encryption and UEFI.
203460	211740	So I moved on to Lubuntu 18.04, called that Dragon OS LTS. That was... the bulk of my time was spent
211740	217500	making that. I think I've made the most videos on that. And I guess I should point out, too,
217500	223600	I tried to keep all distributions, even though, you know, went from Debian to Lubuntu. I tried to
223600	230100	keep as close as possible I could with the tools and applications that were installed. So,
230100	237320	you know, for the most part, any of the videos, you know, I label should apply to any of the
237320	245300	builds, hopefully. Well, anyways, so now I'm on to Lubuntu 20.04. And I just called that Dragon OS
245300	254580	Focal. So yeah, the goal I spend, I don't even know how many hours, all these, you know,
254580	262540	countless amount of hours pre-installing anything I could possibly find that would be of interest
262540	268420	to people that are into software-defined radios. That could be from repositories,
268420	273800	dev packages, you know, source, so on and so forth. And I try to combine it all and spend
274390	282320	and just be meticulous about everything working together. So, you know, from remastering it to
282320	289320	installing it, to testing the whole installation, to checking every possible software-defined radio
289320	296560	I can with it, or at least that I've owned or have been donated. You know, I have B205 here,
296560	305820	USRP radio, RTL-SDR, Blade RF, some SDR Play equipment. The SDR Play people were
305820	313900	extremely helpful in sending me some equipment out. That's been really awesome. Ubertooth from
314480	319300	Hacker's Warehouse, they were really nice, sent some equipment out. And then as I kind of go
319300	325400	through, I'll point out, I'll say thanks to a lot of people that have helped just with input
325400	332120	and kind of behind-the-scenes discussion on what software is out there and what to include.
332460	336920	All right, so let's get out of the slides here. And, you know, I try to do everything
337460	343640	within Dragon OS, which is running right now, my latest build, which I was going to put out
343640	350580	in conjunction with this. I just kept it still a beta build, Dragon OS Focal Public Beta 3.
351240	358100	That's what's running this right now. I have to admit, I was not familiar with OBS and making
358100	363880	videos like this, so hopefully it comes out okay. So we'll get down off the slides here.
363900	368220	This is Dragon OS. I know it doesn't look like much. You're just looking at the desktop here,
368220	375140	but this is running live from a USB stick. I've made it as easy as I can. You can see there's a
375140	383260	little icon on the desktop. I've actually already ran through the installer, but I will show how
383260	392040	easy it is to get it to install. You'll just come through here, answer a few questions. I'll just
392040	396920	uncheck this for now, just so that it's not hanging here and you all are staring at this
396920	407880	screen while it's loading. I'm not going to make this video over again, but just trust me, I've
408560	414340	already ran through the installer and it finished. Normally you would reboot.
415440	425680	That's why you see that error pop up there. Anyways, I'll just let that run in the background.
425680	433840	That was kind of to show you how easy it is to install. Lesson learned. Don't run it twice
433840	439820	within the same as it's running live, but it's kind of hard. I have everything set up to make
439820	445460	this video. One of the big things, I'll just go right down the list I wanted to demonstrate here,
445460	451560	so you can get an understanding of why is this any different than any other distribution.
451560	458340	You got Kali out there for your offensive security or pen testing. I just tried to make
458340	465100	this distribution all about software-defined radios. So, base Lubuntu system with everything
465100	470020	installed on top of it. One point right out at the front, I've actually got it running here.
470020	476040	SigDigger that I've put in here, built from source. I find this program really great. The
476040	483080	super awesome. I know he was trying to help me out to have a TV decoder, I guess you'd say,
483080	489360	with sync and everything ready for this. But I think you all will see that here in the real
489360	496200	near future. So, keep an eye on that. But what I'll show you is SigDigger running using the
498900	504520	B205 mini that I have here. And if you happen to have, so I have a five gigahertz antenna on it.
504520	514040	I've got a five gigahertz FPV cam sitting here. So, if you open up your sample rate and your
514040	522620	bandwidth, you should be able to do what I'm doing here. Which is, we'll look at this in the
522620	533260	spectrum. I've got my window open as far as I can here. I've got an inspection tab open here. And
533260	539740	I've got an FSK inspector. So, that's another thing. When I make these videos, I try to go
539740	549100	through and get people interested in what these different acronyms, FSK means. I don't explain
549100	554940	everything, but I hope I generate enough interest where people will go out and do some more research.
555020	562380	So, I've opened up the FSK inspector here. And you'll see where I've paused before,
562380	566200	the video, so you know what's coming here.
568160	579460	Let's just open this up the whole way here. Actually, let's close out of this. We'll open
579460	586780	another inspector. You would bump up your bits per tone and start the clock recovery.
587240	594700	I come up here, I left click and drag and open this aperture up here, release,
594700	601800	uncheck fit the window and click record. And come down to about the, let's see, 550 or so.
601800	608440	And you should see where I left off here. And this is live. This is capturing this live. I had hoped
608440	617040	to literally just record the whole video like this, but not, you know, in such a way to give
617040	626720	everyone a seizure or something. So that's, I felt that that was a really unique, very powerful
627320	632700	signal analysis tool. And that just shows you that that's literally out of the box. It's running
633240	639640	live. You don't have to use a B205. I've actually did this with a hack RF.
641160	644860	So yeah, you know, as long as you can get in the five gigahertz range,
644860	648560	you should be, you should be fine. I'm sure I could probably do it with the,
648560	655580	some of the Blade RS that go up that far. This is a Blade RF Micro AXA4, I think it is.
657740	664120	So yeah, that just shows you that's really not the primary feature of this or of that window,
664120	669600	that symbol stream window. It just happens to, to be able to do that. So I'm sure if you pause,
669600	678460	you'll, you'll see me and yeah. So let's see. Anyways, I'm going to close out of this.
679720	684860	I'm going to change out a couple of things here. What I want to show is we'll open up a few
684860	691460	terminal windows here. I'll do this as quick as I can here. This is just to show you something else
691460	701380	that is on here and running out of the box. I grab a few cellular antennas here.
704640	711960	And I'm sure a lot of you are familiar with SRS LTE. I had a big interest in
714560	723360	getting LTE and GSM actually, as well, running out of the box. I know there's a lot of interest
723360	733000	in that. Obviously, you got to have shielding and stuff when you're transmitting any of this.
733000	740920	So I just recommend be careful when you're doing any of what I'm showing here. But
742440	744680	let me see SRS.
746260	749920	So this just shows you how fast we can get up and running.
751000	759520	We'd want to start our core networking, our EPC here. See, we can bring that online.
762100	764380	And we would do our
765800	776480	EMB. And for this, I found that
780580	787220	it will use the EDIS by default.
788960	794680	But these two commands start at the core network and then starting up your EMB.
794680	804920	And that failure you see there, that's SOPI for SDR play. What I have done is,
804920	808440	when you run the installer, that's another thing I guess that makes this unique, but
808440	815240	you run the installer and then you reboot. You're going to be presented with a little
815240	822960	pop-up that will prompt you to install the SDR play. So that'll happen. Your
823440	828360	user will be added to Kismet. So everything just kind of works out of the box. I know I keep saying
828360	837520	that. So these two commands here, I'd have to, you know, of course this happens right when I do the
838240	848480	presentation, but let's see. With those two there, you can be up and broadcasting your
854360	862980	base station, basically. If you had a second laptop and another EDIS or BladeRF, which I have
862980	870100	demonstrated in some of the YouTube videos, you can use a virtual handset through that radio to
870100	877600	connect. So yeah, that's how easy that is. That's all, you know, pre-configured and working. You
877600	885340	can do the same in my latest build with GSM now. So I'm sure a lot of you are probably familiar with
887780	898180	Osmocom here. I've got the HLR, the BTS, the BSC, and the transmitting all in here. So
899040	907080	you should be able to get a GSM base station up and working pretty quick. If you have a
909220	913300	EDIS, so if we start up our
921400	926290	BSC and we start up our...
961960	970180	and then if I start up my might be a
980570	987710	and that's it. And so
993330	995670	now you see, now we've got our
997830	1005570	base station online. I know there's an error here, but
1007190	1028610	let's see. All right, there we go. So you can, this is actually something I'll address
1028610	1034570	in the next build, but that's actually a pretty common thing and explained on EDIS how to
1034570	1049770	get around setting the thread priority. All right, so there's three things right out of the box.
1050690	1060230	Way to decode 5 GHz video, the LTE network, GSM network.
1061810	1072650	Something else that I do is I keep everything that I install from source or not a packaged
1072650	1080090	installation, I keep it all here in the actual build when you finish installing it so that you
1080090	1086830	have all of the source that you need to make any changes or uninstall anything that
1087570	1095410	you may want to, you may want to remove. Let's see, I'll show another example here. So
1095410	1103290	GNU Radio 3.8 is in here. If we take a look at, let's just take a look at
1104210	1112010	GR RDS, you'll see right there you got ADS-B, Deck 2, and I've checked all of this. GSM
1112730	1119670	in GNU Radio 3.8 works perfectly fine with the Emsi capture script. You got Radium there,
1120490	1125970	not super familiar with satellites, but I've included that. GR Tempest, I checked that
1125970	1131410	and actually got that working with some SDR play equipment and was able to view a monitor
1132130	1137370	without having to use the Tempest SDR which I know a lot of people use. So
1138190	1145710	if you want to get into GNU Radio, which I recommend, you can take a look at
1148050	1150930	one of the examples here, a real easy one.
1155600	1162320	And again, I really feel like a benefit of this distribution is you can run it live if you don't
1162320	1169520	want to install it. There may be some things that may have some issues running live, but for
1169520	1177780	the most part it works pretty well. So this is GNU Radio, I'm sure a lot of people are familiar
1177780	1205250	with this. So again, right out of the box. You got your RDS on there, you've got your gain settings.
1207330	1214430	So I have tried to go, or I have went through every application you can possibly
1215250	1221350	think of on here. SDR trunk, Airband, Retrogram,
1222810	1230830	everything. I have spent a lot of time making this work. So I know I said that
1232410	1236750	I'd thank some people here. I'm trying to think what else can I open up and show before we
1236750	1243490	or before I close this out. Just run down the list here. You see under
1246970	1254630	internet you got GQRX, SDR, ANGEL. I just recently built SDR ANGEL with
1254630	1265050	SOPI support. So now I can't not show SDR play equipment
1266040	1277830	in this video considering how much help that they have given. So this is a RSP1 Alpha and SDR ANGEL.
1285790	1297570	Let's see here. So now we can use our SDR play equipment. Let's see.
1304720	1311120	Actually, you know what, since we're running live I'm going to fix this real quick.
1313180	1317960	See there's always something because I haven't
1322040	1327060	because I haven't installed and rebooted. My script didn't take place. So I just
1327670	1332710	when you're running live you would have to actually install the API.
1333300	1341400	So now we should be able to come back here open up our SDR ANGEL.
1350040	1369630	So now, fingers crossed, we have our RSP1 Alpha. You can add a, well anything. You can do DMR,
1369630	1377970	DSD, demodulators, DATV, all sorts of options here.
1426470	1432110	See, doesn't that get awkward when you're doing something live and then it doesn't work like you expect?
1456480	1460120	Okay, threw me off there a second.
1464920	1471880	So that's SDR play equipment in SDR ANGEL now.
1486540	1497100	There we go. Okay, so you gotta obviously adjust the game correctly there. So that's SDR ANGEL.
1497120	1506620	Same thing if you come down the list here. We've got Cubic SDR, Cubic SDR with SDR play support,
1506620	1513100	Q-Spectrum Analyzer, really good to use with the HackRF. If you want to do some replay, capture
1513100	1522000	and replay attacks, you got Universal Radio Hacker. That also, yeah, actually I should have
1522000	1539060	put SDR play support next to there, which I believe, I believe it, no, actually that does not have
1539780	1547360	SDR play support yet. They're still, that's still being worked on. Let's see, what else?
1548100	1560280	We've got Spike, which is the gentleman by the name of Rick, who suggested I do this video,
1561420	1570760	is a big fan of that equipment, that program. Let's see, what else? And then really anything
1570760	1577100	else that's sitting in the, that is not installed with a nice easy to click
1578500	1586760	GUI, you can run from here and you can kind of get an idea there. So Sparrow Wi-Fi,
1586760	1592500	matter of fact, I know a lot of people are familiar with Kismet.
1594480	1598160	I suggest taking a look at Sparrow Wi-Fi too.
1599960	1604900	They've got some nice integration there with the Hacker F and Ubertooth.
1615580	1622600	I don't actually have my Hacker F right now, but what you can do with Sparrow Wi-Fi is overlay the
1622600	1630240	2.4 gigahertz and 5 gigahertz spectrum over top of your wireless NIC card that would run up in
1630240	1637180	the top here. And of course do similar to Kismet, but really not do the full packet capture and,
1637180	1645620	you'd see the access points. And so not to give away, you know, all my access points here,
1645620	1651900	I'll just kind of show you the spectrum analyzer with the Ubertooth that's plugged in here.
1652440	1657260	So thank you to Hacker Warehouse for that, to let me check that.
1661960	1674200	All right, let's see. So I think that's enough kind of programs. I hit on a lot of the big stuff
1674200	1683440	and I would encourage anyone to take a look at the YouTube page that I have here.
1709870	1718010	So I would say, I would encourage anyone to, that wants to know more, take a look at my
1718010	1727470	YouTube page here, Cima Executor. You can come down through all the videos that I've put on here.
1727930	1734770	I don't know, I think there's about maybe 60 or so, over all sorts of various different topics,
1735150	1739410	from showing the installation, to doing capture and replay,
1739810	1750170	using the Kerberos SDR for direction finding, proof of concept on smart cell phone jamming,
1751250	1762910	signal analysis, spy server, everything you could think of, I've tried to cover here and educate.
1763550	1771290	All right, I think that about wraps it up. If you need to find the project, you can just Google
1771290	1779210	Dragon OS, you can do Focal if you want, that's the latest. You know, come find it on SourceForge,
1779210	1785650	you got your files and you get your latest there. So yeah, I appreciate everyone
1786990	1792290	kind of listening up to this point and just want to say, you know, thank you to
1792990	1798050	developer of, you know, SigDigger, the SDR play equipment, Hackers Warehouse.
1799170	1803530	You know, I'm drawing a blank right now, but there's been so many,
1803530	1808090	oh wow, everyone on YouTube that has provided suggestions or emailed me kind of behind the
1808090	1818810	scenes. I appreciate it. I hope that this has been helpful during COVID-19. I know a lot of people
1818810	1826050	have been stuck at home, so I just wanted to try and do what I could to help others. So, all right,
1826050	1826930	thanks.