WEBVTT 00:03.480 --> 00:09.580 All right, good morning, afternoon, evening, whatever time it is when you get around to watching this. 00:09.800 --> 00:15.200 I'm pretty excited to be participating for the first time in DEF CON. 00:15.200 --> 00:17.680 I really wish, obviously, I could be there in person. 00:17.680 --> 00:26.420 It would be far easier to present this if I was able to see people face-to-face and you would see, you know, my passion and excitement. 00:26.420 --> 00:40.980 I'm sure you might not hear it in my voice, but this is a project that I have been working on for about the beginning of the year, maybe even into last year, and that is Dragon OS Focal. 00:41.440 --> 00:43.480 Like I said, my name is Aaron. 00:43.580 --> 00:45.840 This is DEF CON 2020 safe mode. 00:45.840 --> 00:47.460 So we'll go down through here. 00:47.460 --> 00:54.500 I've got some just a few slides and then we'll go right into just kind of showing you what Dragon OS is. 00:55.060 --> 01:10.120 Background on it, I, you know, personally was working on some tools right prior to COVID-19 to try to aid in teaching software-defined radios, SDRs. 01:10.120 --> 01:13.740 So, you know, I had kind of that going for me. 01:13.740 --> 01:25.060 And then a couple projects way back 2008, 2009 or so, I built everything that was AWD Mesh. 01:25.800 --> 01:30.040 Some of you may be familiar with OpenMesh back then when they had the OM1P. 01:30.040 --> 01:45.800 So I was kind of on my own using some open source and the router station, everyone probably had one at one point or another, and built OpenMesh with a few other people there, sold the stuff all over the world, dual radio mesh equipment. 01:45.800 --> 01:52.000 So, and then about that same time, I was pretty active in the ZoneMinder forums for some reason or another. 01:52.000 --> 02:00.780 And I just noticed that people have a lot of problems with compiling things and building ZoneMinder from source. 02:00.780 --> 02:07.480 So I thought, well, why not use Remaster Syst and help people out and get it all pre-built and working. 02:07.480 --> 02:13.920 So kind of take those two things, and it got me thinking about doing another distribution. 02:13.920 --> 02:20.960 And then, of course, COVID-19 hit really big and, you know, a lot of people stuck at home. 02:20.960 --> 02:40.580 So I thought, well, why not take my little project, take it to the next level, get it out there, you know, to the public so people could install, have something fairly new in terms of software, free, and get into software-defined radios while they were stuck at home. 02:41.020 --> 02:44.320 Put that, you know, out to the public. 02:44.320 --> 02:47.340 A lot of people were interested in it. 02:47.540 --> 02:51.780 RTLSDR.com and Hackaday did, you know, a few articles here. 02:51.780 --> 02:57.520 I just copied and pasted one article that you can see was dated back March 24, 2020. 02:57.520 --> 02:59.320 Talks a little bit about the project. 02:59.320 --> 03:03.440 So, you know, if you look online, you'll find a lot more articles. 03:03.440 --> 03:08.900 But the progress I've made, I started with Debian Buster, just called it Dragon OS X. 03:10.120 --> 03:10.480 That was... 03:12.400 --> 03:14.720 Actually, Debian is probably my favorite. 03:14.720 --> 03:16.360 Had a lot of tools in there. 03:16.360 --> 03:19.020 You can find that on SourceForge. 03:19.700 --> 03:23.460 I just got to a point where I wanted to be able to support disk encryption and UEFI. 03:23.460 --> 03:28.600 So I moved on to Lubuntu 18.04, called that Dragon OS LTS. 03:29.060 --> 03:32.480 That was... the bulk of my time was spent making that. 03:32.480 --> 03:34.960 I think I've made the most videos on that. 03:35.320 --> 03:42.480 And I guess I should point out, too, I tried to keep all distributions, even though, you know, went from Debian to Lubuntu. 03:42.620 --> 03:49.780 I tried to keep as close as possible I could with the tools and applications that were installed. 03:49.780 --> 03:58.760 So, you know, for the most part, any of the videos, you know, I label should apply to any of the builds, hopefully. 03:58.920 --> 04:02.300 Well, anyways, so now I'm on to Lubuntu 20.04. 04:03.040 --> 04:06.600 And I just called that Dragon OS Focal. 04:06.980 --> 04:25.360 So yeah, the goal I spend, I don't even know how many hours, all these, you know, countless amount of hours pre-installing anything I could possibly find that would be of interest to people that are into software-defined radios. 04:25.460 --> 04:31.880 That could be from repositories, dev packages, you know, source, so on and so forth. 04:31.880 --> 04:38.520 And I try to combine it all and spend and just be meticulous about everything working together. 04:38.520 --> 04:53.480 So, you know, from remastering it to installing it, to testing the whole installation, to checking every possible software-defined radio I can with it, or at least that I've owned or have been donated. 04:53.480 --> 05:04.460 You know, I have B205 here, USRP radio, RTL-SDR, Blade RF, some SDR Play equipment. 05:04.460 --> 05:10.220 The SDR Play people were extremely helpful in sending me some equipment out. 05:10.220 --> 05:11.760 That's been really awesome. 05:12.540 --> 05:17.820 Ubertooth from Hacker's Warehouse, they were really nice, sent some equipment out. 05:18.280 --> 05:32.120 And then as I kind of go through, I'll point out, I'll say thanks to a lot of people that have helped just with input and kind of behind-the-scenes discussion on what software is out there and what to include. 05:32.460 --> 05:35.080 All right, so let's get out of the slides here. 05:35.080 --> 05:44.940 And, you know, I try to do everything within Dragon OS, which is running right now, my latest build, which I was going to put out in conjunction with this. 05:44.940 --> 05:50.580 I just kept it still a beta build, Dragon OS Focal Public Beta 3. 05:51.240 --> 05:53.060 That's what's running this right now. 05:53.480 --> 06:01.440 I have to admit, I was not familiar with OBS and making videos like this, so hopefully it comes out okay. 06:01.560 --> 06:03.880 So we'll get down off the slides here. 06:03.900 --> 06:05.500 This is Dragon OS. 06:05.500 --> 06:06.620 I know it doesn't look like much. 06:06.620 --> 06:11.200 You're just looking at the desktop here, but this is running live from a USB stick. 06:12.160 --> 06:14.420 I've made it as easy as I can. 06:14.420 --> 06:16.320 You can see there's a little icon on the desktop. 06:16.400 --> 06:26.440 I've actually already ran through the installer, but I will show how easy it is to get it to install. 06:26.440 --> 06:31.580 You'll just come through here, answer a few questions. 06:31.580 --> 06:38.340 I'll just uncheck this for now, just so that it's not hanging here and you all are staring at this screen while it's loading. 06:41.360 --> 06:52.860 I'm not going to make this video over again, but just trust me, I've already ran through the installer and it finished. 06:52.860 --> 06:54.340 Normally you would reboot. 06:55.440 --> 06:58.320 That's why you see that error pop up there. 07:00.280 --> 07:05.680 Anyways, I'll just let that run in the background. 07:05.680 --> 07:09.980 That was kind of to show you how easy it is to install. 07:11.040 --> 07:12.920 Lesson learned. 07:12.920 --> 07:18.460 Don't run it twice within the same as it's running live, but it's kind of hard. 07:18.460 --> 07:20.400 I have everything set up to make this video. 07:21.060 --> 07:31.560 One of the big things, I'll just go right down the list I wanted to demonstrate here, so you can get an understanding of why is this any different than any other distribution. 07:31.560 --> 07:37.500 You got Kali out there for your offensive security or pen testing. 07:37.500 --> 07:42.020 I just tried to make this distribution all about software-defined radios. 07:42.020 --> 07:46.880 So, base Lubuntu system with everything installed on top of it. 07:47.020 --> 07:50.020 One point right out at the front, I've actually got it running here. 07:50.020 --> 07:53.940 SigDigger that I've put in here, built from source. 07:53.940 --> 07:55.280 I find this program really great. 07:55.560 --> 07:57.460 The super awesome. 07:57.500 --> 08:05.640 I know he was trying to help me out to have a TV decoder, I guess you'd say, with sync and everything ready for this. 08:05.860 --> 08:10.380 But I think you all will see that here in the real near future. 08:10.380 --> 08:11.580 So, keep an eye on that. 08:11.580 --> 08:20.920 But what I'll show you is SigDigger running using the B205 mini that I have here. 08:21.180 --> 08:24.520 And if you happen to have, so I have a five gigahertz antenna on it. 08:24.520 --> 08:29.660 I've got a five gigahertz FPV cam sitting here. 08:30.440 --> 08:38.500 So, if you open up your sample rate and your bandwidth, you should be able to do what I'm doing here. 08:39.060 --> 08:43.140 Which is, we'll look at this in the spectrum. 08:43.140 --> 08:47.880 I've got my window open as far as I can here. 08:48.020 --> 08:53.000 I've got an inspection tab open here. 08:53.000 --> 08:56.460 And I've got an FSK inspector. 08:56.460 --> 08:58.000 So, that's another thing. 08:58.000 --> 09:07.360 When I make these videos, I try to go through and get people interested in what these different acronyms, FSK means. 09:07.680 --> 09:14.940 I don't explain everything, but I hope I generate enough interest where people will go out and do some more research. 09:15.020 --> 09:18.880 So, I've opened up the FSK inspector here. 09:18.900 --> 09:26.200 And you'll see where I've paused before, the video, so you know what's coming here. 09:28.160 --> 09:30.880 Let's just open this up the whole way here. 09:37.340 --> 09:39.120 Actually, let's close out of this. 09:39.120 --> 09:41.980 We'll open another inspector. 09:42.400 --> 09:46.780 You would bump up your bits per tone and start the clock recovery. 09:47.240 --> 09:57.560 I come up here, I left click and drag and open this aperture up here, release, uncheck fit the window and click record. 09:57.560 --> 10:01.800 And come down to about the, let's see, 550 or so. 10:01.800 --> 10:04.960 And you should see where I left off here. 10:04.960 --> 10:06.000 And this is live. 10:06.000 --> 10:08.040 This is capturing this live. 10:08.040 --> 10:18.600 I had hoped to literally just record the whole video like this, but not, you know, in such a way to give everyone a seizure or something. 10:18.600 --> 10:29.100 So that's, I felt that that was a really unique, very powerful signal analysis tool. 10:29.100 --> 10:32.080 And that just shows you that that's literally out of the box. 10:32.080 --> 10:34.060 It's running live. 10:34.060 --> 10:36.480 You don't have to use a B205. 10:36.480 --> 10:39.640 I've actually did this with a hack RF. 10:41.160 --> 10:46.820 So yeah, you know, as long as you can get in the five gigahertz range, you should be, you should be fine. 10:46.820 --> 10:51.320 I'm sure I could probably do it with the, some of the Blade RS that go up that far. 10:51.320 --> 10:55.580 This is a Blade RF Micro AXA4, I think it is. 10:57.740 --> 11:05.320 So yeah, that just shows you that's really not the primary feature of this or of that window, that symbol stream window. 11:05.320 --> 11:08.160 It just happens to, to be able to do that. 11:08.160 --> 11:14.200 So I'm sure if you pause, you'll, you'll see me and yeah. 11:14.360 --> 11:15.420 So let's see. 11:15.420 --> 11:18.460 Anyways, I'm going to close out of this. 11:19.720 --> 11:22.160 I'm going to change out a couple of things here. 11:22.160 --> 11:26.420 What I want to show is we'll open up a few terminal windows here. 11:26.440 --> 11:28.680 I'll do this as quick as I can here. 11:28.680 --> 11:37.980 This is just to show you something else that is on here and running out of the box. 11:37.980 --> 11:41.380 I grab a few cellular antennas here. 11:44.640 --> 11:49.400 And I'm sure a lot of you are familiar with SRS LTE. 11:50.040 --> 12:02.380 I had a big interest in getting LTE and GSM actually, as well, running out of the box. 12:02.380 --> 12:04.540 I know there's a lot of interest in that. 12:04.980 --> 12:13.000 Obviously, you got to have shielding and stuff when you're transmitting any of this. 12:13.000 --> 12:20.720 So I just recommend be careful when you're doing any of what I'm showing here. 12:20.720 --> 12:24.680 But let me see SRS. 12:26.260 --> 12:29.920 So this just shows you how fast we can get up and running. 12:31.000 --> 12:36.400 We'd want to start our core networking, our EPC here. 12:37.240 --> 12:39.520 See, we can bring that online. 12:42.100 --> 12:47.600 And we would do our EMB. 12:52.920 --> 12:56.480 And for this, I found that 13:00.580 --> 13:07.220 it will use the EDIS by default. 13:08.960 --> 13:14.680 But these two commands start at the core network and then starting up your EMB. 13:14.680 --> 13:23.180 And that failure you see there, that's SOPI for SDR play. 13:23.280 --> 13:32.060 What I have done is, when you run the installer, that's another thing I guess that makes this unique, but you run the installer and then you reboot. 13:33.440 --> 13:40.360 You're going to be presented with a little pop-up that will prompt you to install the SDR play. 13:40.600 --> 13:42.540 So that'll happen. 13:42.540 --> 13:45.160 Your user will be added to Kismet. 13:45.160 --> 13:47.440 So everything just kind of works out of the box. 13:47.600 --> 13:49.060 I know I keep saying that. 13:51.020 --> 14:03.320 So these two commands here, I'd have to, you know, of course this happens right when I do the presentation, but let's see. 14:04.280 --> 14:08.480 With those two there, you can be up and broadcasting your 14:14.360 --> 14:16.680 base station, basically. 14:16.680 --> 14:31.000 If you had a second laptop and another EDIS or BladeRF, which I have demonstrated in some of the YouTube videos, you can use a virtual handset through that radio to connect. 14:31.300 --> 14:34.020 So yeah, that's how easy that is. 14:34.020 --> 14:36.980 That's all, you know, pre-configured and working. 14:37.160 --> 14:42.820 You can do the same in my latest build with GSM now. 14:42.820 --> 14:49.080 So I'm sure a lot of you are probably familiar with Osmocom here. 14:49.080 --> 14:57.680 I've got the HLR, the BTS, the BSC, and the transmitting all in here. 14:57.680 --> 15:05.880 So you should be able to get a GSM base station up and working pretty quick. 15:05.880 --> 15:13.300 If you have a EDIS, so if we start up our 15:21.400 --> 15:26.290 BSC and we start up our... 16:01.960 --> 16:06.000 and then if I start up my might 16:09.100 --> 16:10.180 be a 16:20.570 --> 16:22.730 and that's it. 16:23.650 --> 16:27.710 And so 16:33.330 --> 16:41.730 now you see, now we've got our base station online. 16:41.730 --> 16:48.710 I know there's an error here, but let's see. 17:01.890 --> 17:03.370 All right, there we go. 17:03.370 --> 17:18.690 So you can, this is actually something I'll address in the next build, but that's actually a pretty common thing and explained on EDIS how to get around setting the thread priority. 17:23.410 --> 17:29.770 All right, so there's three things right out of the box. 17:30.690 --> 17:40.230 Way to decode 5 GHz video, the LTE network, GSM network. 17:41.810 --> 18:08.590 Something else that I do is I keep everything that I install from source or not a packaged installation, I keep it all here in the actual build when you finish installing it so that you have all of the source that you need to make any changes or uninstall anything that you may want to, 18:08.590 --> 18:10.810 you may want to remove. 18:12.150 --> 18:15.090 Let's see, I'll show another example here. 18:15.090 --> 18:18.610 So GNU Radio 3.8 is in here. 18:18.610 --> 18:31.490 If we take a look at, let's just take a look at GR RDS, you'll see right there you got ADS-B, Deck 2, and I've checked all of this. 18:31.490 --> 18:37.370 GSM in GNU Radio 3.8 works perfectly fine with the Emsi capture script. 18:37.370 --> 18:44.410 You got Radium there, not super familiar with satellites, but I've included that. 18:44.410 --> 18:56.930 GR Tempest, I checked that and actually got that working with some SDR play equipment and was able to view a monitor without having to use the Tempest SDR which I know a lot of people use. 18:57.350 --> 19:10.930 So if you want to get into GNU Radio, which I recommend, you can take a look at one of the examples here, a real easy one. 19:15.600 --> 19:23.580 And again, I really feel like a benefit of this distribution is you can run it live if you don't want to install it. 19:23.700 --> 19:31.700 There may be some things that may have some issues running live, but for the most part it works pretty well. 19:33.960 --> 19:38.920 So this is GNU Radio, I'm sure a lot of people are familiar with this. 19:49.090 --> 19:52.830 So again, right out of the box. 20:00.190 --> 20:05.250 You got your RDS on there, you've got your gain settings. 20:07.330 --> 20:16.670 So I have tried to go, or I have went through every application you can possibly think of on here. 20:16.670 --> 20:23.690 SDR trunk, Airband, Retrogram, everything. 20:23.710 --> 20:28.390 I have spent a lot of time making this work. 20:28.390 --> 20:34.150 So I know I said that I'd thank some people here. 20:34.150 --> 20:39.310 I'm trying to think what else can I open up and show before we or before I close this out. 20:40.150 --> 20:42.670 Just run down the list here. 20:42.670 --> 20:43.490 You see under 20:46.970 --> 20:51.410 internet you got GQRX, SDR, ANGEL. 20:51.410 --> 20:57.410 I just recently built SDR ANGEL with SOPI support. 20:57.410 --> 21:11.630 So now I can't not show SDR play equipment in this video considering how much help that they have given. 21:11.950 --> 21:17.830 So this is a RSP1 Alpha and SDR ANGEL. 21:25.790 --> 21:27.390 Let's see here. 21:27.390 --> 21:35.730 So now we can use our SDR play equipment. 21:35.870 --> 21:37.570 Let's see. 21:44.720 --> 21:51.120 Actually, you know what, since we're running live I'm going to fix this real quick. 21:53.180 --> 21:57.960 See there's always something because I haven't 22:02.040 --> 22:04.780 because I haven't installed and rebooted. 22:04.780 --> 22:06.420 My script didn't take place. 22:06.420 --> 22:12.710 So I just when you're running live you would have to actually install the API. 22:13.300 --> 22:21.400 So now we should be able to come back here open up our SDR ANGEL. 22:30.040 --> 22:38.920 So now, fingers crossed, we have our RSP1 Alpha. 22:41.750 --> 22:45.450 You can add a, well anything. 22:45.450 --> 22:57.970 You can do DMR, DSD, demodulators, DATV, all sorts of options here. 23:46.470 --> 23:52.110 See, doesn't that get awkward when you're doing something live and then it doesn't work like you expect? 24:16.480 --> 24:20.120 Okay, threw me off there a second. 24:24.920 --> 24:31.880 So that's SDR play equipment in SDR ANGEL now. 24:46.540 --> 24:47.840 There we go. 24:47.840 --> 24:54.300 Okay, so you gotta obviously adjust the game correctly there. 24:54.300 --> 24:57.100 So that's SDR ANGEL. 24:57.120 --> 24:59.700 Same thing if you come down the list here. 24:59.780 --> 25:10.460 We've got Cubic SDR, Cubic SDR with SDR play support, Q-Spectrum Analyzer, really good to use with the HackRF. 25:10.460 --> 25:18.360 If you want to do some replay, capture and replay attacks, you got Universal Radio Hacker. 25:18.360 --> 25:41.700 That also, yeah, actually I should have put SDR play support next to there, which I believe, I believe it, no, actually that does not have SDR play support yet. 25:41.700 --> 25:46.180 They're still, that's still being worked on. 25:46.240 --> 25:47.360 Let's see, what else? 25:48.100 --> 26:08.040 We've got Spike, which is the gentleman by the name of Rick, who suggested I do this video, is a big fan of that equipment, that program. 26:08.320 --> 26:09.620 Let's see, what else? 26:09.620 --> 26:24.100 And then really anything else that's sitting in the, that is not installed with a nice easy to click GUI, you can run from here and you can kind of get an idea there. 26:24.100 --> 26:32.500 So Sparrow Wi-Fi, matter of fact, I know a lot of people are familiar with Kismet. 26:34.480 --> 26:38.160 I suggest taking a look at Sparrow Wi-Fi too. 26:39.960 --> 26:44.900 They've got some nice integration there with the Hacker F and Ubertooth. 26:55.580 --> 27:11.000 I don't actually have my Hacker F right now, but what you can do with Sparrow Wi-Fi is overlay the 2.4 gigahertz and 5 gigahertz spectrum over top of your wireless NIC card that would run up in the top here. 27:11.000 --> 27:19.980 And of course do similar to Kismet, but really not do the full packet capture and, you'd see the access points. 27:20.500 --> 27:31.900 And so not to give away, you know, all my access points here, I'll just kind of show you the spectrum analyzer with the Ubertooth that's plugged in here. 27:32.440 --> 27:37.260 So thank you to Hacker Warehouse for that, to let me check that. 27:41.960 --> 27:45.840 All right, let's see. 27:46.300 --> 27:52.180 So I think that's enough kind of programs. 27:52.180 --> 28:03.440 I hit on a lot of the big stuff and I would encourage anyone to take a look at the YouTube page that I have here. 28:29.870 --> 28:41.150 So I would say, I would encourage anyone to, that wants to know more, take a look at my YouTube page here, Cima Executor. 28:41.210 --> 28:47.470 You can come down through all the videos that I've put on here. 28:47.930 --> 29:13.790 I don't know, I think there's about maybe 60 or so, over all sorts of various different topics, from showing the installation, to doing capture and replay, using the Kerberos SDR for direction finding, proof of concept on smart cell phone jamming, signal analysis, 29:13.790 --> 29:22.910 spy server, everything you could think of, I've tried to cover here and educate. 29:23.550 --> 29:27.070 All right, I think that about wraps it up. 29:27.070 --> 29:36.430 If you need to find the project, you can just Google Dragon OS, you can do Focal if you want, that's the latest. 29:36.950 --> 29:41.950 You know, come find it on SourceForge, you got your files and you get your latest there. 29:41.950 --> 29:58.050 So yeah, I appreciate everyone kind of listening up to this point and just want to say, you know, thank you to developer of, you know, SigDigger, the SDR play equipment, Hackers Warehouse. 29:59.170 --> 30:08.570 You know, I'm drawing a blank right now, but there's been so many, oh wow, everyone on YouTube that has provided suggestions or emailed me kind of behind the scenes. 30:08.570 --> 30:09.590 I appreciate it. 30:09.590 --> 30:16.050 I hope that this has been helpful during COVID-19. 30:16.330 --> 30:24.410 I know a lot of people have been stuck at home, so I just wanted to try and do what I could to help others. 30:24.630 --> 30:26.930 So, all right, thanks.