1 00:00:00,000 --> 00:00:03,160 Welcome to Wicked War Driving with GPS and GLONASS. 2 00:00:03,160 --> 00:00:19,100 I'm White Shadow, and I'm going to be describing to you GPS, how it works, the data that you receive from GPS satellites, other satellite constellations that provide similar location data, some dongles you can use to receive all of that information and use that in your war driving efforts. 3 00:00:20,120 --> 00:00:21,400 So who am I? 4 00:00:21,400 --> 00:00:24,480 I'm a private staff sergeant from the US Air Force. 5 00:00:24,840 --> 00:00:28,480 I was in Space Command, which is now called the Space Force. 6 00:00:28,760 --> 00:00:32,840 Since getting out of the military, I've become a wireless security researcher. 7 00:00:33,260 --> 00:00:45,440 And some of my public works are SNF Air back in 2017, as well as last year, I presented at the DEFCON Wireless Village with Solstice on some attacks on WPA3-OWE. 8 00:00:45,900 --> 00:00:51,500 On the picture on the right there, you can see that's me and Solstice on stage last year. 9 00:00:52,040 --> 00:00:56,080 That's my Twitter profile picture there. 10 00:00:58,000 --> 00:01:01,020 So war driving, why do people do war driving? 11 00:01:01,020 --> 00:01:07,680 Before becoming a pen tester, I had this vague understanding of war driving that you could drive around and sniff wireless networks and then kind of plot them out. 12 00:01:07,680 --> 00:01:11,780 But why would anyone actually do that? 13 00:01:12,160 --> 00:01:17,140 Well, once I became a pen tester, I realized that there is a valuable need for this skill set. 14 00:01:17,180 --> 00:01:24,400 Many times clients could set up new wireless infrastructure in their building and they want to measure the signal bleed outside of their building. 15 00:01:24,400 --> 00:01:32,700 So performing a war drive for a client may be useful, or maybe they're just curious if their neighboring businesses are able to receive their Wi-Fi signal. 16 00:01:32,700 --> 00:01:40,100 So they may want a wireless pen tester to go out and do a war drive to measure how far the signal goes out and where exactly it can be picked up from. 17 00:01:40,620 --> 00:01:43,840 It could also just be done as a hobby. 18 00:01:44,680 --> 00:01:46,980 Wiggle.net is a great resource for this. 19 00:01:46,980 --> 00:01:50,620 You can see in the bottom right-hand corner the picture of Wiggle.net there. 20 00:01:50,960 --> 00:01:59,660 It's an open-source database that hobbyists can war drive and upload their results to, and anyone can upload to it and anyone can query it. 21 00:01:59,660 --> 00:02:10,480 So you can look up any of the data that has been uploaded there by hobbyist war drivers that drive around mapping Wi-Fi networks to GPS coordinates. 22 00:02:11,320 --> 00:02:17,900 And as I got into war driving professionally, I realized that the research on GPS dongles was extremely lacking. 23 00:02:18,500 --> 00:02:24,660 When it came to choosing a GPS dongle to perform war driving, there's basically only one that everyone has used. 24 00:02:24,660 --> 00:02:31,760 And whenever you ask somebody why they chose that dongle, the answer is usually, because somebody told me to use it. 25 00:02:31,760 --> 00:02:33,420 There really isn't much on it. 26 00:02:33,420 --> 00:02:37,380 If you Google it, it's really hard to find any information on it. 27 00:02:37,720 --> 00:02:45,600 So taking my experience from Air Force Space Command, I knew that GPS is an American-owned and operated satellite. 28 00:02:45,720 --> 00:02:51,160 Specifically, Air Force Space Command handles the operations of GPS. 29 00:02:51,840 --> 00:02:53,620 A little history on that. 30 00:02:54,780 --> 00:02:59,780 Satellite navigation goes back to the 1960s when the Navy had their own satellite. 31 00:03:00,660 --> 00:03:04,340 Other branches of the military had their own navigational satellites as well. 32 00:03:04,340 --> 00:03:06,000 The Air Force and the Army did. 33 00:03:06,020 --> 00:03:12,140 In 1968, the DoD made everyone collaborate together and act as one big happy family. 34 00:03:12,140 --> 00:03:24,220 So the Army satellites were decommissioned and the Air Force and Navy satellites combined into one constellation that was used for navigation up until 1978 when Navstar 1 was launched. 35 00:03:24,220 --> 00:03:27,520 So that is the first GPS as we know it today satellite that was launched. 36 00:03:27,520 --> 00:03:33,780 Since then, 72 have been launched with 24 currently in orbit. 37 00:03:33,780 --> 00:03:37,340 So they need 24 satellites to maintain worldwide coverage. 38 00:03:37,340 --> 00:03:41,940 Now there are additional satellites on orbit. 39 00:03:41,940 --> 00:03:46,000 You can see there's 33 up there in orbit about, give or take. 40 00:03:46,000 --> 00:03:48,420 These are referred to as on-orbit spares. 41 00:03:48,480 --> 00:03:54,040 These are typically older satellites that get pushed out as newer ones are launched to take their place. 42 00:03:54,060 --> 00:03:58,840 And these typically don't have the best capabilities so they're typically not in use. 43 00:03:59,040 --> 00:04:03,360 GPS is in a MEO orbit, or Medium Earth Orbit. 44 00:04:03,360 --> 00:04:07,040 This means that it goes around Earth twice a day. 45 00:04:07,040 --> 00:04:10,200 So one full orbit every 12 hours. 46 00:04:10,200 --> 00:04:14,980 Now there are other orbits out there that people should be familiar with such as LEO, Low Earth Orbit. 47 00:04:14,980 --> 00:04:19,080 These are things like the Space Station, which goes around the Earth every 90 minutes. 48 00:04:19,080 --> 00:04:25,280 So a LEO orbit is about 90 minutes, whereas a MEO orbit here is about 12 hours. 49 00:04:25,760 --> 00:04:29,240 There's other orbits out there such as HEO, a Highly Elliptical Orbit. 50 00:04:29,240 --> 00:04:40,520 This is when satellites have some kind of wonky orbit, typically to hang out over a certain position of Earth for a certain amount of time and then go around the Earth again. 51 00:04:40,660 --> 00:04:45,800 Then there's also GEO, Geostationary or Geosynchronous satellites as well. 52 00:04:45,800 --> 00:04:52,820 And those satellites are out so far from Earth that they're actually in sync with the Earth rotating. 53 00:04:52,820 --> 00:04:56,820 So they revolve around the Earth at the same rate that Earth rotates. 54 00:04:56,820 --> 00:05:00,700 This creates this illusion that these satellites are over a static point of Earth. 55 00:05:00,700 --> 00:05:04,140 A common example that everyone would know of this is satellite TV. 56 00:05:04,260 --> 00:05:20,120 Whenever the technician came over to set up your satellite TV at home, he set up a satellite dish, pointed it at a single point in the sky, screwed it in place, and then never touched it again because he pointed it at a satellite that is in a static point in the sky. 57 00:05:21,960 --> 00:05:28,380 Now, GPS uses trilateration to determine the location of an individual. 58 00:05:28,460 --> 00:05:30,400 So what is trilateration? 59 00:05:30,760 --> 00:05:36,520 It's hard to explain in the three-dimensional plane, so I'm going to do my best to describe it in the two-dimensional plane. 60 00:05:36,940 --> 00:05:39,540 Let's say you're somewhere in the U.S. 61 00:05:39,540 --> 00:05:41,960 and you turn on a GPS receiver. 62 00:05:42,420 --> 00:05:49,540 Well, the first satellite sees you and it's going to say you're within its spot beam here in this red circle. 63 00:05:49,540 --> 00:05:55,440 So according to that satellite with just data from that, your location is anywhere within this red circle. 64 00:05:55,600 --> 00:05:57,020 That's not very valuable. 65 00:05:57,020 --> 00:05:58,380 That's not very accurate. 66 00:05:59,360 --> 00:06:02,280 Now, your receiver picks up a second satellite. 67 00:06:02,500 --> 00:06:06,120 According to this satellite, you are anywhere within this blue circle. 68 00:06:06,540 --> 00:06:12,560 Again, individually that doesn't make a lot of sense because you could be anywhere, but you see where the circles overlap. 69 00:06:13,140 --> 00:06:16,340 You can start to see how this is whittling down to where we might be. 70 00:06:16,340 --> 00:06:21,520 Now, let's say a third satellite sees where you are and you're anywhere within the green circle. 71 00:06:21,520 --> 00:06:25,080 We can kind of see that these circles have overlapped at a common point. 72 00:06:25,080 --> 00:06:37,920 And when you zoom in on that, you can see that is how a latitude and longitude is calculated from GPS satellites using trilateration to find you on Earth. 73 00:06:37,920 --> 00:06:47,480 Now, you can use your imagination here to see if I were to continue to draw circles on this map, that the area where they overlap would get smaller and thus more precise. 74 00:06:49,560 --> 00:06:53,700 So we know GPS needs three satellites for trilateration. 75 00:06:54,240 --> 00:06:57,760 And there's four satellites visible at all times. 76 00:06:57,760 --> 00:07:03,560 Most satellite receivers typically won't provide information until they get that fourth lock from a fourth satellite. 77 00:07:06,120 --> 00:07:12,160 Instead of latitude and longitude, once you get the fourth satellite, you can also calculate altitude and additional things from there. 78 00:07:12,160 --> 00:07:16,500 The bottom line is, the more satellites you have, the more accurate the information is going to be. 79 00:07:16,780 --> 00:07:18,160 But what is that information? 80 00:07:18,160 --> 00:07:20,980 What is the data that comes down from these GPS satellites? 81 00:07:20,980 --> 00:07:22,460 Well, I have an example of it here. 82 00:07:22,460 --> 00:07:24,520 These are called NMEA messages. 83 00:07:24,520 --> 00:07:30,380 I know that's a funny word, and I'm going to skip over what it is right now, but I just want you to look at these messages. 84 00:07:30,560 --> 00:07:37,760 Now, you can see the... what I want you to pay attention to are the last three letters of these messages. 85 00:07:37,760 --> 00:07:41,380 GGA, GLL, GSA, GSV, RMC. 86 00:07:41,540 --> 00:07:44,700 These refer to the type of message that this is. 87 00:07:44,700 --> 00:07:48,960 The first two letters of each message indicate which satellite that it came from. 88 00:07:48,960 --> 00:07:52,820 So GP indicates that this message came from a GPS satellite. 89 00:07:52,920 --> 00:07:55,380 So you can see the different messages that we have here. 90 00:07:55,380 --> 00:08:02,580 And then at the bottom of the screen, you can see those are legitimate NMEA strings coming down from satellites in space. 91 00:08:02,580 --> 00:08:03,540 And so that's what they look like. 92 00:08:03,540 --> 00:08:06,440 That's what the data looks like coming down from space. 93 00:08:07,660 --> 00:08:23,140 So being an Air Force Space Command, I knew that I was aware of US GPS, but then I was also aware that other countries did not want to use US GPS just in case we went to war with them or something like that. 94 00:08:23,140 --> 00:08:29,340 They may want to jam GPS, so they created their own satellite constellations that do the exact same thing. 95 00:08:29,420 --> 00:08:31,980 So this is where Russian GLONASS comes in. 96 00:08:31,980 --> 00:08:38,760 So just like US GPS, Russia has their own satellite constellation that does the exact same job. 97 00:08:38,760 --> 00:08:41,060 It was originally launched in 1982. 98 00:08:41,060 --> 00:08:43,460 Since then, 27 satellites have been launched. 99 00:08:43,460 --> 00:08:47,660 21 of them are in use, with 24 total in orbit. 100 00:08:47,660 --> 00:08:50,500 So they have about three on-orbit spares. 101 00:08:50,500 --> 00:09:01,140 And they accomplished the same task as GPS, which used 24 satellites in orbit, with only 21 satellites by using a slightly faster orbital period. 102 00:09:01,140 --> 00:09:08,780 Remember when I was talking about a medium Earth orbit, MEO, GPS satellites go around the Earth every 12 hours. 103 00:09:08,780 --> 00:09:12,020 Well, GLONASS goes around a little over 11 hours. 104 00:09:13,840 --> 00:09:22,420 So after thinking about Russian GLONASS, I started thinking about why wouldn't you want to receive data from both? 105 00:09:22,420 --> 00:09:32,980 Thinking about GPS, at any given time, if you're in an empty field on a perfect day with perfect weather, you could receive 12 GPS satellites. 106 00:09:32,980 --> 00:09:40,220 With GLONASS, it's about 6 to 10, given where you are in Earth and given the weather conditions and everything. 107 00:09:40,220 --> 00:09:43,160 So why wouldn't you want to receive both? 108 00:09:43,160 --> 00:09:52,000 While GPS does have worldwide coverage, it's coverage around the poles in northern Europe, northern Russia, the coverage there is not that great. 109 00:09:52,000 --> 00:09:54,560 So GLONASS actually makes up for that. 110 00:09:54,560 --> 00:09:59,200 So again, it's making up for the areas where GPS is lacking. 111 00:09:59,200 --> 00:10:01,280 So why wouldn't you want to receive both? 112 00:10:01,280 --> 00:10:03,620 They both have worldwide coverage. 113 00:10:03,620 --> 00:10:10,980 This is a common misconception that people think that GLONASS receivers are only accurate in Russia, that you can only use a GLONASS receiver in Russia. 114 00:10:11,600 --> 00:10:24,800 Just how the US military uses GPS to guide ships, planes, and bombs, we want those ships, planes, and bombs to have accurate navigation data, whether they're in the US or whether they're in Russia or anywhere in the world. 115 00:10:24,800 --> 00:10:26,440 The same thing applies to GLONASS. 116 00:10:26,440 --> 00:10:35,600 Russia also has ships, planes, and bombs that are navigated by GLONASS, and they want that to have accurate navigational data regardless of where they are in the world. 117 00:10:35,600 --> 00:10:40,480 So both of these satellite constellations do work worldwide. 118 00:10:41,180 --> 00:10:45,900 And as I started looking into it, I realized a lot of smartphones have actually started implementing this. 119 00:10:45,900 --> 00:10:51,760 I believe the iPhone 7 or the iPhone 8 actually implemented a GPS and GLONASS receiver. 120 00:10:52,780 --> 00:11:01,680 So I was sitting there and continuing to think about constellations, and then I realized that Galileo is another one made by the European Space Agency. 121 00:11:02,080 --> 00:11:04,380 And it was first launched in 2011. 122 00:11:04,380 --> 00:11:14,040 Since then, 24 satellites have been launched, and mainly all their satellites are going through the process of being commissioned to be brought online. 123 00:11:14,040 --> 00:11:23,740 You see there's 14 satellites in use, but a lot of them are being tested and are being brought online to actually work with the constellation. 124 00:11:23,860 --> 00:11:26,600 And again, these are MEO satellites as well. 125 00:11:27,800 --> 00:11:47,980 And so when you look at all of these satellites and compare the pictures here, and if anyone's curious, all these pictures are from Kerbal Space Program, but you compare GPS on the left, 24 satellites for worldwide coverage, versus the satellites on the right, 126 00:11:47,980 --> 00:11:51,080 and you see how many there are there. 127 00:11:51,320 --> 00:11:59,460 The circles on the map of trilateration that you can draw increase numerously. 128 00:12:00,440 --> 00:12:04,260 So then I was wondering, well, how many satellite constellations are there? 129 00:12:04,260 --> 00:12:06,860 Well, there's several GNSS constellations. 130 00:12:06,860 --> 00:12:13,400 Europe has Galileo, Japan has QZSS, Russia has GLONASS, India has IRNSS, the U.S. 131 00:12:13,400 --> 00:12:16,320 has GPS, and China has Beidou. 132 00:12:16,320 --> 00:12:23,360 And they are all classified under this umbrella term of GNSS, Global Navigation Satellite System. 133 00:12:23,360 --> 00:12:26,820 Now that's confusing because that's also what GLONASS stands for. 134 00:12:26,820 --> 00:12:32,440 However, whenever you see GNSS, it's referring to all of the satellite constellations. 135 00:12:33,740 --> 00:12:43,000 And it's interesting because regardless of where the satellite constellation originates from, they all speak the same language, and that language is NMIA. 136 00:12:43,000 --> 00:12:49,920 That's that word that I said earlier I would skip over, and it stands for National Marine Electronics Association. 137 00:12:49,920 --> 00:13:01,120 So this is the standard that defines how data is transmitted in a sentence form from one talker to multiple listeners, from one satellite to multiple receivers on the planet at once. 138 00:13:01,120 --> 00:13:17,300 And you can see in this screenshot, these are NMIA strings or sentences sent from multiple satellites because you can see the last three letters of that message, GSV, GSV, GSV, but the first two indicate which satellite they came from. 139 00:13:17,300 --> 00:13:20,620 So GPGSV came from a GPS satellite. 140 00:13:21,120 --> 00:13:23,960 GLGSV came from a Russian GLONASS satellite. 141 00:13:23,960 --> 00:13:26,300 We have two more of these GL messages. 142 00:13:26,300 --> 00:13:31,640 Then we have a GAGSV message, which came from a European Galileo satellite. 143 00:13:31,660 --> 00:13:33,960 Then there's this GNRMC. 144 00:13:33,960 --> 00:13:36,020 That's another GNSS satellite. 145 00:13:36,020 --> 00:13:43,040 They're satellites that I didn't even mention in the previous slide that sit out in a geosynchronous orbit and provide error correction information. 146 00:13:43,200 --> 00:13:47,980 So we can receive all of these things because they speak a common language. 147 00:13:48,340 --> 00:14:00,040 So now that we know that GPS is not the only satellite that does location services, we know that they all speak a common language. 148 00:14:00,040 --> 00:14:05,500 Well, there's got to be dongles out there that could receive all this information, right? 149 00:14:05,500 --> 00:14:21,260 So that is what sent me on this quest to buy a bunch of dongles, analyze what they could do, see if I could reconfigure them in ways to receive additional satellite constellations, and then perform some tests with them. 150 00:14:21,340 --> 00:14:31,560 So aside from just going to Amazon and buying every GPS GNSS dongle I could find, these are the software tools that I used. 151 00:14:31,780 --> 00:14:46,820 So GPSD, this is what takes the information from your dongle and starts a server that you can connect to with tools like GPSmon to troubleshoot or just view the information, or Kismet. 152 00:14:46,820 --> 00:14:53,740 And Kismet will actually correlate that GPS data with the Wi-Fi information it sees so that you can war drive. 153 00:14:53,740 --> 00:15:00,700 Now the commands that I've laid out here, GPSD, tick D2, that's the debug level. 154 00:15:00,700 --> 00:15:06,180 So you can increase that number or decrease it and that'll change the verbosity of the output. 155 00:15:06,180 --> 00:15:16,680 Tick little n is to not wait for GPS lock before querying for messages. 156 00:15:16,680 --> 00:15:25,220 So that's important because you want to see those NMEA strings as they're coming down from the dongle without having to wait for it to receive full lock. 157 00:15:25,220 --> 00:15:32,260 Then the tick capital N there tells GPSD not to run as a background process and leave it in the foreground. 158 00:15:32,260 --> 00:15:34,880 Then I'm specifying my serial device. 159 00:15:34,880 --> 00:15:44,040 Then I'm using tick S and 2948 to specify a different port to host the GPSD service on. 160 00:15:44,040 --> 00:15:51,860 I did this because Kali has a service that it starts on 2947 which is the default for GPSD. 161 00:15:51,900 --> 00:15:56,380 So instead of just disabling that I just got in the habit of starting this on my own port. 162 00:15:58,920 --> 00:16:06,100 I'm also using GPSmon to troubleshoot or to just to analyze the information coming down from GPSD. 163 00:16:06,100 --> 00:16:13,440 And you can do that with GPSmon tick N which specifies GPSmon to look for NMEA strings. 164 00:16:13,460 --> 00:16:19,860 And then you specify localhost and the port that I used in starting GPSD. 165 00:16:19,940 --> 00:16:32,620 I also use the uCenter software from uBlocks which only works on Windows but it's extremely useful in configuring GPS dongles and GNSS dongles and I'll get into that a little bit later. 166 00:16:32,980 --> 00:16:47,060 And then I also used Kismet in this and it's important to note that you have to go into the Kismet config file and uncomment the line where it says that you want to use GPSD. 167 00:16:48,640 --> 00:16:54,260 So first up was the BU353S4. 168 00:16:54,260 --> 00:16:56,140 This is the dongle that everyone uses. 169 00:16:56,140 --> 00:17:01,040 This is the one that everyone recommends that everyone use and it's GPS only. 170 00:17:01,320 --> 00:17:08,540 So on the right side of the screen here we have output from GPSmon and I've highlighted some fields here. 171 00:17:08,540 --> 00:17:15,920 So on the left we see PRN and this number is the designator for each satellite in the constellation. 172 00:17:15,920 --> 00:17:21,820 So when it comes to USGPS you're only going to see numbers between 1 and 32 in this PRN field. 173 00:17:21,820 --> 00:17:25,120 Now at the very bottom of that PRN field you see a number that says 138. 174 00:17:25,120 --> 00:17:30,140 That is actually one of the geosynchronous satellites that sits out and provides error correction. 175 00:17:30,620 --> 00:17:33,380 Next to the PRN field I've highlighted SNN. 176 00:17:33,380 --> 00:17:35,000 That's the signal to noise ratio. 177 00:17:35,000 --> 00:17:39,560 So that shows you the signal that you're getting from a specific GPS satellite. 178 00:17:40,100 --> 00:17:46,420 And then on the far right of that picture I've highlighted the number of satellites and it says the number of satellites is seven. 179 00:17:46,460 --> 00:17:54,300 You can see that in the signal to noise ratio block that only seven of these satellites there are providing a signal there. 180 00:17:54,300 --> 00:17:58,260 So that's most likely why GPSmon is only showing seven satellites. 181 00:17:59,940 --> 00:18:01,780 So that's cool. 182 00:18:02,180 --> 00:18:05,600 Now in this example I'm using the older version of Kismet. 183 00:18:05,600 --> 00:18:15,380 Sorry if Dragorn is watching but actually this is a feature request if I could get this back into the newer version of Kismet because space nerds like to see GPS information like this. 184 00:18:16,200 --> 00:18:27,160 You can see on the top right I'm pulling down the NMEA strings straight from the serial device by just using the cat command and then specifying the serial device. 185 00:18:27,160 --> 00:18:31,040 And you can see the NMEA strings coming down from space. 186 00:18:31,040 --> 00:18:39,400 But on the left side after starting up Kismet and everything it can see the satellites however it says I don't have a signal. 187 00:18:39,400 --> 00:18:43,760 I don't have a strong enough signal on enough satellite to determine my location. 188 00:18:44,460 --> 00:18:47,220 And that's stressful. 189 00:18:47,220 --> 00:18:50,380 That's infuriating when you're trying to perform a war drive. 190 00:18:50,440 --> 00:18:53,340 Maybe there's bad weather outside or something and you just want to get it done. 191 00:18:54,720 --> 00:18:57,660 This isn't going to help anyone just sitting around waiting for lock. 192 00:18:58,440 --> 00:19:11,260 So this was what inspired me to look for additional dongles is because I've been in this situation many times on a wireless pen test when I'm waiting on this GPS dongle to lock up so that I can start my war drive or war walk and hurry up and get out of there. 193 00:19:11,260 --> 00:19:24,080 But you could see if we just had more satellites in space to lock up on other than the 32 in the entire GPS constellation you know maybe that would make it easier to obtain lock. 194 00:19:24,080 --> 00:19:29,580 So when I started talking to people about this this was one of the first dongles that was recommended to me. 195 00:19:29,920 --> 00:19:33,820 Now it's important to note it says GPS slash GLONASS. 196 00:19:33,820 --> 00:19:36,900 That slash means or and not both. 197 00:19:36,900 --> 00:19:43,220 So you can only configure this dongle to work with GLONASS or GPS and not both. 198 00:19:43,640 --> 00:19:48,060 And you can use the UCenter software to configure this. 199 00:19:48,220 --> 00:19:53,020 And I've highlighted the configuration screen from that on the right here. 200 00:19:53,020 --> 00:19:57,460 You can see it has all the satellite constellations that you could actually select. 201 00:19:57,460 --> 00:19:58,700 And some of them are grayed out. 202 00:19:58,700 --> 00:20:02,500 In this example Galileo, Beto, and IMES are grayed out. 203 00:20:02,500 --> 00:20:11,020 But GPS, SBAS, and QZSS are selectable. 204 00:20:11,020 --> 00:20:20,980 And whenever you select a configuration here at the bottom of this configuration menu there is a send button that you must push to push the configuration to the dongle. 205 00:20:22,440 --> 00:20:29,200 And again in this testing I found out very quickly that I could only configure this dongle for GPS or GLONASS. 206 00:20:29,200 --> 00:20:33,460 So I ended all my testing with that because I was looking for dongles that could do both. 207 00:20:33,700 --> 00:20:42,880 Now I wanted to talk about the UCenter software because it can be a pain to use, a pain to learn, and there's not a lot of resources out there on how to use it. 208 00:20:42,880 --> 00:20:48,860 Like I mentioned before, it's a Windows-only piece of software that you can download for free from their website. 209 00:20:49,020 --> 00:21:01,960 Once you install it and everything, you launch it, and then from the receiver drop-down menu you go into connection, and then you'll see the COM devices there for you to select your USB dongle. 210 00:21:02,120 --> 00:21:12,880 Once you've selected that, you can then go to the view drop-down, go to configuration view, select GNS config, and then you can actually select which satellite constellations you want to receive from. 211 00:21:14,400 --> 00:21:25,160 And I mentioned it before, but after you select which constellations you want to receive from, you go down to the bottom and click send, and then that will push the configuration to the dongle. 212 00:21:25,160 --> 00:21:29,240 However, you have to save that configuration after you have sent it. 213 00:21:29,240 --> 00:21:37,760 So from receiver drop-down menu, go to action and save config, and that will store that configuration in the memory on the dongle. 214 00:21:37,760 --> 00:21:43,700 So when you unplug it and then plug it into another computer, that configuration is saved there. 215 00:21:45,520 --> 00:21:49,020 Specifically, if you want to only receive GLONASS satellites. 216 00:21:49,020 --> 00:21:53,620 So I configured a dongle here to only receive data from GLONASS satellites. 217 00:21:53,620 --> 00:22:00,780 In the bottom left hand corner, you can see that GLONASS is the only constellation that is enabled. 218 00:22:00,780 --> 00:22:10,380 In the top left, you can see all the NMEA strings that are coming from GLONASS satellites indicated by the GL in front of every message. 219 00:22:10,520 --> 00:22:16,340 And then on the right side, I just have a pretty picture showing the Russian flag next to every satellite that I'm receiving a signal from. 220 00:22:18,060 --> 00:22:29,760 Now, once I save that configuration from the UCenter software, unplug that dongle from my Windows machine, and then plug it into my Linux computer, and use GPSD and GPSMOD to receive information. 221 00:22:29,920 --> 00:22:35,140 You can see here in GPSMOD, the PRN numbers are now between 65 and 88. 222 00:22:35,500 --> 00:22:39,460 That is because those are Russian GLONASS satellites that I'm receiving a signal from. 223 00:22:40,340 --> 00:22:45,640 And again, on the right side, I've highlighted that there's seven satellites I'm receiving signal from. 224 00:22:45,640 --> 00:22:52,420 And you can see that from the signal to noise ratio there that two satellites aren't reporting a signal. 225 00:22:54,040 --> 00:22:57,520 So this was one of the first dongles that I found that could do both. 226 00:22:57,680 --> 00:22:59,860 It was advertised as a GNS receiver. 227 00:22:59,860 --> 00:23:01,760 It said it could receive all the things. 228 00:23:01,760 --> 00:23:03,520 And I wanted to test it out. 229 00:23:03,520 --> 00:23:08,660 And just buying it and plugging it in to Kali Linux, it worked right out of the box. 230 00:23:08,660 --> 00:23:13,760 I was able to hook it up with KISMET after starting up GPSD. 231 00:23:13,760 --> 00:23:21,960 And then you can see from the output on the left side of the screen there from the GPSINFO and KISMET, you can see all the satellites that I'm receiving data from. 232 00:23:21,960 --> 00:23:24,400 So 1 through 32 would be U.S. 233 00:23:24,400 --> 00:23:35,480 GPS satellites, 65 through 88 are Russian GLONASS satellites, and then 131, 135, 138 are the geosynchronous satellites that provide error correction data. 234 00:23:38,370 --> 00:23:41,730 So that's cool, but I want to receive more. 235 00:23:41,730 --> 00:23:46,670 And so I found this dongle that receives all of the things. 236 00:23:46,670 --> 00:23:50,590 GPS, GLONASS, Galileo, Beidou, QZSS. 237 00:23:50,590 --> 00:23:56,010 And you can see that in the U-Center software. 238 00:23:56,010 --> 00:23:59,470 You can see the first six satellites are U.S. 239 00:23:59,470 --> 00:24:14,730 GPS, then the next six or seven satellites are Russian GLONASS satellites, then there is another geosynchronous satellite that provides error correction, and then the final two satellites in that picture are European Galileo satellites. 240 00:24:15,290 --> 00:24:21,130 This is the same screenshot, but on the left side you can see the NMIA data coming down from them. 241 00:24:21,130 --> 00:24:27,110 You can see that the very top GL, GSA, came from a Russian GLONASS satellite. 242 00:24:27,110 --> 00:24:31,790 GA, GSA, come from a European Galileo satellite. 243 00:24:31,790 --> 00:24:34,270 GP, GSV, came from a U .S. 244 00:24:34,270 --> 00:24:35,770 GPS satellite. 245 00:24:35,810 --> 00:24:42,730 So we are receiving information from all three constellations with a single dongle. 246 00:24:42,730 --> 00:24:44,590 What does that look like in GPSMON? 247 00:24:44,630 --> 00:24:54,830 GPSMON couldn't even handle all the satellites that it was picking up, so this screen only goes to 11, and you can see on the right side that I picked up at least 15. 248 00:24:55,730 --> 00:25:05,710 And then I also showed the sentences block of GPSMON, and in this block you can see those messages that I was just referencing. 249 00:25:05,710 --> 00:25:08,430 GN, GGA, came from a GNSS satellite. 250 00:25:08,430 --> 00:25:11,110 GP, GSA, came from a GPS satellite. 251 00:25:11,110 --> 00:25:13,910 GL, GSA, came from a Russian GLONASS satellite. 252 00:25:13,910 --> 00:25:21,450 So this is a quick way to see how or to see what messages you're receiving and which satellites you're receiving from. 253 00:25:21,490 --> 00:25:25,370 So if you were to plug this into KISMET, what would that look like? 254 00:25:25,930 --> 00:25:31,990 Again, you can see I have lock on 23 satellites, and again 1 through 32 is U.S. 255 00:25:31,990 --> 00:25:32,770 GPS. 256 00:25:32,950 --> 00:25:35,230 From there up to 83 is U.S. 257 00:25:35,230 --> 00:25:42,010 or Russian GLONASS, and then 309 and 312 are European Galileo satellites. 258 00:25:42,550 --> 00:25:44,190 Okay, so big whoop. 259 00:25:44,190 --> 00:25:49,450 You found all these GPS dongles, you found some that could pick up other satellites, but what does it mean? 260 00:25:49,450 --> 00:25:53,830 What does it mean to war driving, and what does it mean to accuracy in general? 261 00:25:53,830 --> 00:25:55,110 So I ran some tests. 262 00:25:55,110 --> 00:26:02,170 I set up equipment with each dongle and drove around a neighborhood, and let's see the results. 263 00:26:02,170 --> 00:26:10,830 So with GPS only, using the BU-353, you could see here that, yeah, it looks pretty good. 264 00:26:11,270 --> 00:26:15,370 I did a little loop over here in this neighborhood to kind of test the precision there. 265 00:26:15,370 --> 00:26:18,750 It looks a little off, but I mean for the most part it looks like I'm on the road. 266 00:26:18,750 --> 00:26:21,810 I was in a car, so I was on the street the entire time. 267 00:26:21,810 --> 00:26:25,870 So there are some areas where it looks like I was on the sidewalk, but for the most part this is pretty accurate. 268 00:26:26,150 --> 00:26:30,430 Next, I had one of the dongles configured for GLONASS only. 269 00:26:30,430 --> 00:26:40,670 So just using Russian GLONASS satellites, it kind of looks like I was off in the grass and driving over people's houses, but for the most part it still captured the same path. 270 00:26:41,390 --> 00:26:43,810 Then we have the GNSS receiver. 271 00:26:43,810 --> 00:26:48,630 So this is receiving all the things from GPS, GLONASS, Galileo. 272 00:26:49,270 --> 00:26:52,870 And you can see this actually looks much better. 273 00:26:52,870 --> 00:26:59,150 It looks like I'm in more in the center of the road, which is more closer to where I was actually driving. 274 00:26:59,150 --> 00:27:05,990 The circle around this tree up here looks a lot better, but let's compare all of them when we overlay them together. 275 00:27:05,990 --> 00:27:13,770 So the green lines are going to be GPS, GLONASS is red, and the GNSS receiver is yellow. 276 00:27:14,590 --> 00:27:23,210 So for the most part the tracks all look the same with GLONASS sticking out a little bit, but let's zoom in on that circle there. 277 00:27:23,210 --> 00:27:35,730 So you can see the way I drove this path was I came down through the top of that parking lot and did a lap around the tree and then left out the front entrance there. 278 00:27:35,730 --> 00:27:40,350 So with the yellow line you can see that I actually stayed on the road. 279 00:27:40,350 --> 00:27:46,790 With the green line it shows me off in the grass a little bit, but for the most part it's fairly accurate. 280 00:27:46,790 --> 00:27:55,590 And the red line from just GLONASS only information shows me running off in the grass and driving over cars like a monster truck, which is not what I did. 281 00:27:55,590 --> 00:27:58,770 But yeah, so what did we learn from that? 282 00:27:58,770 --> 00:28:06,230 In a rural area with not much in the way to obscure the sky, it really doesn't matter which dongle you use. 283 00:28:06,230 --> 00:28:10,890 They're all fairly accurate for the most part. 284 00:28:10,890 --> 00:28:14,770 I mean it wasn't off by too much if I was plotting Wi-Fi networks. 285 00:28:14,850 --> 00:28:21,770 But let's test this again in an area where there are things obscuring the view to the sky. 286 00:28:21,910 --> 00:28:25,630 So I drove to downtown Denver and ran the same test. 287 00:28:25,830 --> 00:28:27,750 So we can see here GPS. 288 00:28:27,870 --> 00:28:29,550 Wow, that looks pretty good. 289 00:28:29,550 --> 00:28:36,970 There's only a few sections there where it got a little squirrely going around the corners of some buildings, but for the most part that's really accurate. 290 00:28:37,810 --> 00:28:41,250 GLONASS only... I don't even know what happened. 291 00:28:43,130 --> 00:28:46,430 Clearly it can't handle an urban environment. 292 00:28:47,070 --> 00:28:52,030 But using the GNSS receiver, this was definitely the most accurate. 293 00:28:52,170 --> 00:28:59,370 In all the results there you can see it shows you exactly which street I'm on and you can see the path that I drove. 294 00:29:01,510 --> 00:29:09,590 Let's overlay them all together and you can see for the most part the GPS by itself was fairly accurate as well. 295 00:29:09,590 --> 00:29:12,810 It just got off path a little bit. 296 00:29:13,010 --> 00:29:17,250 But yeah, we can zoom in and see that there. 297 00:29:17,250 --> 00:29:25,210 That GPS kind of showed that I drove through a building and off through some trees, but for the most part it stuck close to the road where I actually was. 298 00:29:25,250 --> 00:29:34,150 And if we're mapping Wi-Fi networks in something like Wiggle or something like that, this information, it doesn't need to be the most accurate. 299 00:29:34,150 --> 00:29:48,410 I mean if you're sending someone on site to go and attack this Wi-Fi network, they're going to find it if they're within that same area that GPS is kind of saying that we went to. 300 00:29:48,410 --> 00:29:54,850 So while it is not the most accurate, it's still pretty accurate there. 301 00:29:54,970 --> 00:30:00,670 So the results here is that the GNSS dongle was the most accurate in all of the war driving results. 302 00:30:00,830 --> 00:30:07,950 GLONASS by itself was the least accurate, and the GNSS receiver locked up the fastest. 303 00:30:08,090 --> 00:30:24,190 In all of these cases when I was testing this out, what I did was I drove to the starting location, plugged in everything, and then sat there, waited for it to get locked, and then I gave each one 10 minutes to stay stationary before I conducted the drive. 304 00:30:24,190 --> 00:30:35,130 And the GNSS receiver locked up instantly every time, and that's simply due to the number of satellites in the sky that it can pull information from. 305 00:30:36,610 --> 00:30:40,150 So what do you want to look for when you're looking for a GNSS dongle? 306 00:30:40,150 --> 00:30:42,790 First, make sure it's a GNSS receiver. 307 00:30:42,790 --> 00:30:46,350 GNSS means that it receives all of the things. 308 00:30:46,610 --> 00:30:50,370 The uBlocks chipset is easy to configure with that uCenter software. 309 00:30:50,370 --> 00:30:53,610 Everything is point and click. 310 00:30:53,610 --> 00:31:05,970 There are some Python pip modules to interact with uBlocks chips or chipsets such as the one seen on the right here, which leads me to the third bullet point of looking at the supported operating system. 311 00:31:06,410 --> 00:31:09,930 When you're looking at various dongles, they may say it supports Windows. 312 00:31:09,930 --> 00:31:11,610 It may say it supports Linux. 313 00:31:12,090 --> 00:31:18,050 You want to make sure that it's going to work with the operating system that you're going to use in your war driving efforts. 314 00:31:18,190 --> 00:31:25,090 So this $200 Raspberry Pi hat isn't going to work with a Windows computer. 315 00:31:25,090 --> 00:31:26,490 It's important to note that. 316 00:31:26,830 --> 00:31:34,170 And I also wanted to note that I'm not telling you to buy the dongle that I used in this. 317 00:31:34,170 --> 00:31:36,810 I'm not saying that my research is the end-all be-all. 318 00:31:36,810 --> 00:31:45,070 All I wanted to do was provide enough knowledge to the community to be able to be educated enough to make decisions on what kind of dongles to buy. 319 00:31:45,070 --> 00:31:56,110 Now that you know that GPS is not the only satellite out there, you know what kind of data comes down from these satellites, and you know that there are dongles out there that can receive that NMEA data and determine location. 320 00:31:56,490 --> 00:32:02,210 So now that everyone is educated on this topic, you can go out there and do your own research. 321 00:32:03,030 --> 00:32:19,830 This SparkFun Pi hat was brought to my attention shortly before this presentation was made, so I didn't have enough time to play around with this and get it working enough to be a part of this presentation. 322 00:32:19,830 --> 00:32:23,150 But it's certainly up for anyone. 323 00:32:23,150 --> 00:32:24,250 Anyone could do that. 324 00:32:24,370 --> 00:32:25,770 I'm not the expert on this. 325 00:32:25,770 --> 00:32:34,450 I just wanted to provide my background knowledge, the fundamental knowledge of how GPS works, so that everyone else could go out there and make the same kind of decisions that I did. 326 00:32:34,450 --> 00:32:39,510 Just buy a bunch of dongles and do the research yourself and try to find out what works best for you. 327 00:32:39,930 --> 00:32:51,210 Now that you are armed with all that knowledge, and you can go out there and buy your own dongles, and you know exactly what's coming down from space to provide your location, go war drive the world. 328 00:32:51,290 --> 00:32:56,030 Wiggle's doing a war driving contest with Defcon this year as part of their wireless CTF. 329 00:32:57,050 --> 00:33:04,590 Check it out, sign up, select a block on the world, war drive some access points, and collect some points. 330 00:33:07,030 --> 00:33:13,210 If you want to continue the conversation with me on war driving, you can find me twitter at TheDerricott. 331 00:33:13,290 --> 00:33:16,550 If you want to see projects that I'm working on, there's my github link.