start	end	text
0	4760	Welcome to Wicked War Driving with GPS and GLONASS. I'm White Shadow, and I'm going to
4760	10160	be describing to you GPS, how it works, the data that you receive from GPS satellites,
10160	14320	other satellite constellations that provide similar location data, some dongles you can
14320	19100	use to receive all of that information and use that in your war driving efforts.
20120	26140	So who am I? I'm a private staff sergeant from the US Air Force. I was in Space Command,
26140	31200	which is now called the Space Force. Since getting out of the military, I've become a
31200	37340	wireless security researcher. And some of my public works are SNF Air back in 2017,
37340	43240	as well as last year, I presented at the DEFCON Wireless Village with Solstice on some attacks
43240	50440	on WPA3-OWE. On the picture on the right there, you can see that's me and Solstice on stage
50440	56080	last year. That's my Twitter profile picture there.
58000	62940	So war driving, why do people do war driving? Before becoming a pen tester, I had this vague
62940	66620	understanding of war driving that you could drive around and sniff wireless networks and
66620	73240	then kind of plot them out. But why would anyone actually do that? Well, once I became
73360	78340	a pen tester, I realized that there is a valuable need for this skill set. Many times clients
78340	81340	could set up new wireless infrastructure in their building and they want to measure
81340	86460	the signal bleed outside of their building. So performing a war drive for a client may
86460	91400	be useful, or maybe they're just curious if their neighboring businesses are able to receive
91400	96120	their Wi-Fi signal. So they may want a wireless pen tester to go out and do a war drive to
96120	100100	measure how far the signal goes out and where exactly it can be picked up from.
100620	107780	It could also just be done as a hobby. Wiggle.net is a great resource for this. You can see
107780	111920	in the bottom right-hand corner the picture of Wiggle.net there. It's an open-source database
111920	118320	that hobbyists can war drive and upload their results to, and anyone can upload to it and
118320	123620	anyone can query it. So you can look up any of the data that has been uploaded there by
123620	130480	hobbyist war drivers that drive around mapping Wi-Fi networks to GPS coordinates.
131320	136160	And as I got into war driving professionally, I realized that the research on GPS dongles
136160	142140	was extremely lacking. When it came to choosing a GPS dongle to perform war driving, there's
142140	147560	basically only one that everyone has used. And whenever you ask somebody why they chose
147560	152680	that dongle, the answer is usually, because somebody told me to use it. There really isn't
152680	157380	much on it. If you Google it, it's really hard to find any information on it.
157720	164220	So taking my experience from Air Force Space Command, I knew that GPS is an American-owned
164220	170100	and operated satellite. Specifically, Air Force Space Command handles the operations
170100	177880	of GPS. A little history on that. Satellite navigation goes back to the 1960s when the
177880	183380	Navy had their own satellite. Other branches of the military had their own navigational
183380	190040	satellites as well. The Air Force and the Army did. In 1968, the DoD made everyone collaborate
190040	194920	together and act as one big happy family. So the Army satellites were decommissioned
194920	199920	and the Air Force and Navy satellites combined into one constellation that was used for navigation
200460	206300	up until 1978 when Navstar 1 was launched. So that is the first GPS as we know it today
206300	213780	satellite that was launched. Since then, 72 have been launched with 24 currently in orbit.
213780	220800	So they need 24 satellites to maintain worldwide coverage. Now there are additional satellites
220800	226660	on orbit. You can see there's 33 up there in orbit about, give or take. These are referred
226660	231560	to as on-orbit spares. These are typically older satellites that get pushed out as newer
231560	236900	ones are launched to take their place. And these typically don't have the best capabilities
236900	243940	so they're typically not in use. GPS is in a MEO orbit, or Medium Earth Orbit. This means
243940	250600	that it goes around Earth twice a day. So one full orbit every 12 hours. Now there are
250600	254980	other orbits out there that people should be familiar with such as LEO, Low Earth Orbit.
254980	259180	These are things like the Space Station, which goes around the Earth every 90 minutes. So
259580	266280	a LEO orbit is about 90 minutes, whereas a MEO orbit here is about 12 hours. There's
266280	270000	other orbits out there such as HEO, a Highly Elliptical Orbit. This is when satellites
271200	275660	have some kind of wonky orbit, typically to hang out over a certain position of Earth
276380	282920	for a certain amount of time and then go around the Earth again. Then there's also GEO, Geostationary
282920	288820	or Geosynchronous satellites as well. And those satellites are out so far from Earth
288820	294180	that they're actually in sync with the Earth rotating. So they revolve around the Earth
294180	298560	at the same rate that Earth rotates. This creates this illusion that these satellites
298560	302900	are over a static point of Earth. A common example that everyone would know of this is
302900	307920	satellite TV. Whenever the technician came over to set up your satellite TV at home,
307920	313760	he set up a satellite dish, pointed it at a single point in the sky, screwed it in place,
313760	318560	and then never touched it again because he pointed it at a satellite that is in a static
318560	328380	point in the sky. Now, GPS uses trilateration to determine the location of an individual.
328460	333560	So what is trilateration? It's hard to explain in the three-dimensional plane, so I'm going
333560	339540	to do my best to describe it in the two-dimensional plane. Let's say you're somewhere in the U.S.
339540	346220	and you turn on a GPS receiver. Well, the first satellite sees you and it's going to
346220	350820	say you're within its spot beam here in this red circle. So according to that satellite
350820	356200	with just data from that, your location is anywhere within this red circle. That's not
356200	362280	very valuable. That's not very accurate. Now, your receiver picks up a second satellite.
362500	367900	According to this satellite, you are anywhere within this blue circle. Again, individually
367900	371340	that doesn't make a lot of sense because you could be anywhere, but you see where the circles
371340	376800	overlap. You can start to see how this is whittling down to where we might be. Now,
376800	381520	let's say a third satellite sees where you are and you're anywhere within the green circle.
381520	385440	We can kind of see that these circles have overlapped at a common point. And when you
385440	392660	zoom in on that, you can see that is how a latitude and longitude is calculated from
393540	399100	GPS satellites using trilateration to find you on Earth. Now, you can use your imagination
399100	404140	here to see if I were to continue to draw circles on this map, that the area where they
404140	412220	overlap would get smaller and thus more precise. So we know GPS needs three satellites for
412220	418700	trilateration. And there's four satellites visible at all times. Most satellite receivers
418700	423560	typically won't provide information until they get that fourth lock from a fourth satellite.
426120	429760	Instead of latitude and longitude, once you get the fourth satellite, you can also calculate
429760	433820	altitude and additional things from there. The bottom line is, the more satellites you
433820	438160	have, the more accurate the information is going to be. But what is that information?
438160	441880	What is the data that comes down from these GPS satellites? Well, I have an example of
441880	446140	it here. These are called NMEA messages. I know that's a funny word, and I'm going to
446140	450920	skip over what it is right now, but I just want you to look at these messages. Now, you
450920	457760	can see the... what I want you to pay attention to are the last three letters of these messages.
457760	465440	GGA, GLL, GSA, GSV, RMC. These refer to the type of message that this is. The first two
465440	470640	letters of each message indicate which satellite that it came from. So GP indicates that this
470640	474880	message came from a GPS satellite. So you can see the different messages that we have
474880	480140	here. And then at the bottom of the screen, you can see those are legitimate NMEA strings
480140	483760	coming down from satellites in space. And so that's what they look like. That's what
483760	490800	the data looks like coming down from space. So being an Air Force Space Command, I knew
490800	497480	that I was aware of US GPS, but then I was also aware that other countries did not want
497480	503740	to use US GPS just in case we went to war with them or something like that. They may
503740	508080	want to jam GPS, so they created their own satellite constellations that do the exact
508080	515100	same thing. So this is where Russian GLONASS comes in. So just like US GPS, Russia has
515100	519920	their own satellite constellation that does the exact same job. It was originally launched
519920	526880	in 1982. Since then, 27 satellites have been launched. 21 of them are in use, with 24 total
526880	532900	in orbit. So they have about three on-orbit spares. And they accomplished the same task
532900	539540	as GPS, which used 24 satellites in orbit, with only 21 satellites by using a slightly
539540	546800	faster orbital period. Remember when I was talking about a medium Earth orbit, MEO, GPS
546800	551040	satellites go around the Earth every 12 hours. Well, GLONASS goes around a little over 11
551040	560220	hours. So after thinking about Russian GLONASS, I started thinking about why wouldn't you
560220	565880	want to receive data from both? Thinking about GPS, at any given time, if you're in
565880	572980	an empty field on a perfect day with perfect weather, you could receive 12 GPS satellites.
572980	579480	With GLONASS, it's about 6 to 10, given where you are in Earth and given the weather conditions
579480	585340	and everything. So why wouldn't you want to receive both? While GPS does have worldwide
585340	590660	coverage, it's coverage around the poles in northern Europe, northern Russia, the coverage
590660	596440	there is not that great. So GLONASS actually makes up for that. So again, it's making up
596440	601880	for the areas where GPS is lacking. So why wouldn't you want to receive both? They both
601880	606040	have worldwide coverage. This is a common misconception that people think that GLONASS
606040	610980	receivers are only accurate in Russia, that you can only use a GLONASS receiver in Russia.
611600	618740	Just how the US military uses GPS to guide ships, planes, and bombs, we want those ships, planes,
618740	622600	and bombs to have accurate navigation data, whether they're in the US or whether they're
622600	628300	in Russia or anywhere in the world. The same thing applies to GLONASS. Russia also has ships,
628300	633160	planes, and bombs that are navigated by GLONASS, and they want that to have accurate navigational
633160	638740	data regardless of where they are in the world. So both of these satellite constellations do work
639480	644740	worldwide. And as I started looking into it, I realized a lot of smartphones have actually
644740	650420	started implementing this. I believe the iPhone 7 or the iPhone 8 actually implemented a GPS and
650420	656880	GLONASS receiver. So I was sitting there and continuing to think about constellations, and
656880	663040	then I realized that Galileo is another one made by the European Space Agency. And it was first
663040	671000	launched in 2011. Since then, 24 satellites have been launched, and mainly all their satellites
671000	675180	are going through the process of being commissioned to be brought online. You see there's 14 satellites
675180	682440	in use, but a lot of them are being tested and are being brought online to actually work with
682440	690900	the constellation. And again, these are MEO satellites as well. And so when you look at all
690900	697500	of these satellites and compare the pictures here, and if anyone's curious, all these pictures
697500	705600	are from Kerbal Space Program, but you compare GPS on the left, 24 satellites for worldwide coverage,
705600	712700	versus the satellites on the right, and you see how many there are there. The circles on the map
713860	719460	of trilateration that you can draw increase numerously.
720440	725040	So then I was wondering, well, how many satellite constellations are there? Well, there's several
725040	732880	GNSS constellations. Europe has Galileo, Japan has QZSS, Russia has GLONASS, India has IRNSS,
732880	739140	the U.S. has GPS, and China has Beidou. And they are all classified under this umbrella term
739140	745400	of GNSS, Global Navigation Satellite System. Now that's confusing because that's also what
745400	752440	GLONASS stands for. However, whenever you see GNSS, it's referring to all of the satellite constellations.
753740	759300	And it's interesting because regardless of where the satellite constellation originates from,
759300	764360	they all speak the same language, and that language is NMIA. That's that word that I said earlier
764360	770460	I would skip over, and it stands for National Marine Electronics Association. So this is the
770460	775820	standard that defines how data is transmitted in a sentence form from one talker to multiple
775820	782020	listeners, from one satellite to multiple receivers on the planet at once. And you can see in this
782020	788560	screenshot, these are NMIA strings or sentences sent from multiple satellites because you can see
788560	796460	the last three letters of that message, GSV, GSV, GSV, but the first two indicate which satellite
796460	803960	they came from. So GPGSV came from a GPS satellite. GLGSV came from a Russian GLONASS satellite.
803960	810080	We have two more of these GL messages. Then we have a GAGSV message, which came from a European
810080	816700	Galileo satellite. Then there's this GNRMC. That's another GNSS satellite. They're satellites that I
816700	821160	didn't even mention in the previous slide that sit out in a geosynchronous orbit and provide
821160	826820	error correction information. So we can receive all of these things because they speak a common
826820	837180	language. So now that we know that GPS is not the only satellite that does location services,
837700	842320	we know that they all speak a common language. Well, there's got to be dongles out there that
842910	848400	could receive all this information, right? So that is what sent me on this quest to
849400	856520	buy a bunch of dongles, analyze what they could do, see if I could reconfigure them in ways to
856520	861540	receive additional satellite constellations, and then perform some tests with them. So
863220	869280	aside from just going to Amazon and buying every GPS GNSS dongle I could find,
869280	875920	these are the software tools that I used. So GPSD, this is what
877800	882460	takes the information from your dongle and starts a server that you can connect to with tools like
882460	889000	GPSmon to troubleshoot or just view the information, or Kismet. And Kismet will actually correlate
889000	894900	that GPS data with the Wi-Fi information it sees so that you can war drive. Now the commands that
894900	902380	I've laid out here, GPSD, tick D2, that's the debug level. So you can increase that number or
902380	912160	decrease it and that'll change the verbosity of the output. Tick little n is to not wait for
913040	919300	GPS lock before querying for messages. So that's important because you want to see those
919300	924180	NMEA strings as they're coming down from the dongle without having to wait for it to receive
924180	931260	full lock. Then the tick capital N there tells GPSD not to run as a background process and leave
931260	938940	it in the foreground. Then I'm specifying my serial device. Then I'm using tick S and 2948 to specify
939680	947540	a different port to host the GPSD service on. I did this because Kali has a service that it starts
947540	954540	on 2947 which is the default for GPSD. So instead of just disabling that I just got in the habit of
954540	964180	starting this on my own port. I'm also using GPSmon to troubleshoot or to just to analyze the
964180	970740	information coming down from GPSD. And you can do that with GPSmon tick N which specifies GPSmon
970740	978560	to look for NMEA strings. And then you specify localhost and the port that I used in starting
978560	985820	GPSD. I also use the uCenter software from uBlocks which only works on Windows but it's extremely
985820	992620	useful in configuring GPS dongles and GNSS dongles and I'll get into that a little bit later.
992980	998640	And then I also used Kismet in this and it's important to note that you have to go into the
998640	1007060	Kismet config file and uncomment the line where it says that you want to use GPSD.
1008640	1016720	So first up was the BU353S4. This is the dongle that everyone uses. This is the one that
1016720	1024620	everyone recommends that everyone use and it's GPS only. So on the right side of the screen here
1024620	1031140	we have output from GPSmon and I've highlighted some fields here. So on the left we see PRN and
1031140	1037300	this number is the designator for each satellite in the constellation. So when it comes to USGPS
1037300	1042780	you're only going to see numbers between 1 and 32 in this PRN field. Now at the very bottom of
1042780	1047040	that PRN field you see a number that says 138. That is actually one of the geosynchronous
1047040	1052540	satellites that sits out and provides error correction. Next to the PRN field I've highlighted
1052540	1057920	SNN. That's the signal to noise ratio. So that shows you the signal that you're getting from a
1057920	1063960	specific GPS satellite. And then on the far right of that picture I've highlighted the number of
1063960	1070280	satellites and it says the number of satellites is seven. You can see that in the signal to noise
1070280	1074760	ratio block that only seven of these satellites there are providing a signal there. So that's
1074760	1078260	most likely why GPSmon is only showing seven satellites.
1079940	1086440	So that's cool. Now in this example I'm using the older version of Kismet. Sorry if Dragorn is
1086440	1091220	watching but actually this is a feature request if I could get this back into the newer version
1091220	1098240	of Kismet because space nerds like to see GPS information like this. You can see on the top
1098240	1104120	right I'm pulling down the NMEA strings straight from the serial device by just using the cat
1104120	1109240	command and then specifying the serial device. And you can see the NMEA strings coming down
1109240	1117240	from space. But on the left side after starting up Kismet and everything it can see the satellites
1117240	1121920	however it says I don't have a signal. I don't have a strong enough signal on enough satellite
1121920	1129220	to determine my location. And that's stressful. That's infuriating when you're trying to perform
1129360	1133340	a war drive. Maybe there's bad weather outside or something and you just want to get it done.
1134720	1137660	This isn't going to help anyone just sitting around waiting for lock.
1138440	1142800	So this was what inspired me to look for additional dongles is because I've been in
1142800	1146900	this situation many times on a wireless pen test when I'm waiting on this GPS dongle to lock up so
1146900	1153780	that I can start my war drive or war walk and hurry up and get out of there. But you could see
1153780	1159560	if we just had more satellites in space to lock up on other than the 32 in the entire GPS
1159560	1164880	constellation you know maybe that would make it easier to obtain lock. So when I started talking
1164880	1169580	to people about this this was one of the first dongles that was recommended to me.
1169920	1177180	Now it's important to note it says GPS slash GLONASS. That slash means or and not both. So
1177180	1185580	you can only configure this dongle to work with GLONASS or GPS and not both. And you can use the
1185580	1192260	UCenter software to configure this. And I've highlighted the configuration screen from that
1192260	1196560	on the right here. You can see it has all the satellite constellations that you could actually
1196560	1202500	select. And some of them are grayed out. In this example Galileo, Beto, and IMES are grayed out.
1202500	1214300	But GPS, SBAS, and QZSS are selectable. And whenever you select a configuration here
1214300	1218000	at the bottom of this configuration menu there is a send button that you must push
1218000	1225860	to push the configuration to the dongle. And again in this testing I found out very quickly
1225860	1230860	that I could only configure this dongle for GPS or GLONASS. So I ended all my testing with that
1230860	1235980	because I was looking for dongles that could do both. Now I wanted to talk about the UCenter
1235980	1241620	software because it can be a pain to use, a pain to learn, and there's not a lot of resources out
1241620	1246440	there on how to use it. Like I mentioned before, it's a Windows-only piece of software that you
1246440	1253500	can download for free from their website. Once you install it and everything, you launch it,
1253500	1258100	and then from the receiver drop-down menu you go into connection, and then you'll see the
1258100	1264260	COM devices there for you to select your USB dongle. Once you've selected that, you can then
1264260	1269440	go to the view drop-down, go to configuration view, select GNS config, and then you can actually
1269440	1276620	select which satellite constellations you want to receive from. And I mentioned it before, but after
1276620	1282460	you select which constellations you want to receive from, you go down to the bottom and click send,
1282460	1287320	and then that will push the configuration to the dongle. However, you have to save that
1287320	1292980	configuration after you have sent it. So from receiver drop-down menu, go to action and save
1292980	1299080	config, and that will store that configuration in the memory on the dongle. So when you unplug it
1299080	1303700	and then plug it into another computer, that configuration is saved there.
1305520	1311740	Specifically, if you want to only receive GLONASS satellites. So I configured a dongle here to only
1311740	1317940	receive data from GLONASS satellites. In the bottom left hand corner, you can see that GLONASS
1317940	1323540	is the only constellation that is enabled. In the top left, you can see all the NMEA strings
1323540	1330820	that are coming from GLONASS satellites indicated by the GL in front of every message. And then on
1330820	1334520	the right side, I just have a pretty picture showing the Russian flag next to every satellite
1334520	1341620	that I'm receiving a signal from. Now, once I save that configuration from the UCenter software,
1341620	1345960	unplug that dongle from my Windows machine, and then plug it into my Linux computer,
1345960	1352800	and use GPSD and GPSMOD to receive information. You can see here in GPSMOD, the PRN numbers are
1352800	1358660	now between 65 and 88. That is because those are Russian GLONASS satellites that I'm receiving a
1358660	1364760	signal from. And again, on the right side, I've highlighted that there's seven satellites I'm
1364760	1369660	receiving signal from. And you can see that from the signal to noise ratio there that two satellites
1371120	1378220	aren't reporting a signal. So this was one of the first dongles that I found that could do both.
1378220	1381760	It was advertised as a GNS receiver. It said it could receive all the things.
1381760	1387900	And I wanted to test it out. And just buying it and plugging it in to Kali Linux, it worked right
1387900	1394380	out of the box. I was able to hook it up with KISMET after starting up GPSD. And then you can
1394380	1400080	see from the output on the left side of the screen there from the GPSINFO and KISMET, you can see all
1400080	1406480	the satellites that I'm receiving data from. So 1 through 32 would be U.S. GPS satellites, 65 through
1406480	1413520	88 are Russian GLONASS satellites, and then 131, 135, 138 are the geosynchronous satellites that
1413520	1423610	provide error correction data. So that's cool, but I want to receive more. And so I found this dongle
1423610	1432230	that receives all of the things. GPS, GLONASS, Galileo, Beidou, QZSS. And you can see that in
1432230	1440730	the U-Center software. You can see the first six satellites are U.S. GPS, then the next
1440730	1447170	six or seven satellites are Russian GLONASS satellites, then there is another
1447170	1451350	geosynchronous satellite that provides error correction, and then the final two satellites
1451350	1458810	in that picture are European Galileo satellites. This is the same screenshot, but on the left side
1458810	1465770	you can see the NMIA data coming down from them. You can see that the very top GL, GSA, came from a
1465770	1474030	Russian GLONASS satellite. GA, GSA, come from a European Galileo satellite. GP, GSV, came from a
1474030	1481670	U.S. GPS satellite. So we are receiving information from all three constellations
1481790	1486330	with a single dongle. What does that look like in GPSMON? GPSMON couldn't even handle all the
1486330	1492450	satellites that it was picking up, so this screen only goes to 11, and you can see on the right side
1492450	1501550	that I picked up at least 15. And then I also showed the sentences block of GPSMON, and in this
1501550	1508430	block you can see those messages that I was just referencing. GN, GGA, came from a GNSS satellite.
1508430	1514930	GP, GSA, came from a GPS satellite. GL, GSA, came from a Russian GLONASS satellite. So this is a quick way
1514930	1521730	to see how or to see what messages you're receiving and which satellites you're receiving from. So if
1521730	1527990	you were to plug this into KISMET, what would that look like? Again, you can see I have lock on 23
1527990	1536670	satellites, and again 1 through 32 is U.S. GPS. From there up to 83 is U.S. or Russian GLONASS,
1536670	1546030	and then 309 and 312 are European Galileo satellites. Okay, so big whoop. You found all these GPS dongles,
1546030	1550150	you found some that could pick up other satellites, but what does it mean? What does it mean to
1550150	1557090	war driving, and what does it mean to accuracy in general? So I ran some tests. I set up equipment
1557090	1563670	with each dongle and drove around a neighborhood, and let's see the results. So with GPS only, using
1563670	1573150	the BU-353, you could see here that, yeah, it looks pretty good. I did a little loop over here in this
1573150	1577550	neighborhood to kind of test the precision there. It looks a little off, but I mean for the most part
1577550	1582230	it looks like I'm on the road. I was in a car, so I was on the street the entire time. So there are
1582230	1585190	some areas where it looks like I was on the sidewalk, but for the most part this is pretty
1585190	1591990	accurate. Next, I had one of the dongles configured for GLONASS only. So just using Russian GLONASS
1591990	1597570	satellites, it kind of looks like I was off in the grass and driving over people's houses, but
1597570	1604430	for the most part it still captured the same path. Then we have the GNSS receiver. So this is
1604430	1612870	receiving all the things from GPS, GLONASS, Galileo. And you can see this actually looks much better.
1612870	1618110	It looks like I'm in more in the center of the road, which is more closer to where I was actually
1618110	1624190	driving. The circle around this tree up here looks a lot better, but let's compare all of them
1624190	1631950	when we overlay them together. So the green lines are going to be GPS, GLONASS is red, and the GNSS
1631950	1639570	receiver is yellow. So for the most part the tracks all look the same with GLONASS sticking
1639570	1646970	out a little bit, but let's zoom in on that circle there. So you can see the way I drove this path
1646970	1653570	was I came down through the top of that parking lot and did a lap around the tree and then left
1653570	1660350	out the front entrance there. So with the yellow line you can see that I actually stayed on the road.
1660350	1665270	With the green line it shows me off in the grass a little bit, but for the most part it's
1665270	1671410	fairly accurate. And the red line from just GLONASS only information shows me running off in
1671410	1677790	the grass and driving over cars like a monster truck, which is not what I did. But yeah, so what
1677790	1684550	did we learn from that? In a rural area with not much in the way to obscure the sky, it really
1684550	1691630	doesn't matter which dongle you use. They're all fairly accurate for the most part. I mean it wasn't
1691630	1698530	off by too much if I was plotting Wi-Fi networks. But let's test this again in an area where
1698530	1705630	there are things obscuring the view to the sky. So I drove to downtown Denver and ran the same test.
1705830	1711170	So we can see here GPS. Wow, that looks pretty good. There's only a few sections there where
1711170	1715750	it got a little squirrely going around the corners of some buildings, but for the most part that's
1715750	1724510	really accurate. GLONASS only... I don't even know what happened. Clearly it can't handle
1724510	1732030	an urban environment. But using the GNSS receiver, this was definitely the most accurate.
1732170	1737630	In all the results there you can see it shows you exactly which street I'm on and you can see
1737630	1746470	the path that I drove. Let's overlay them all together and you can see for the most part the
1746470	1755130	GPS by itself was fairly accurate as well. It just got off path a little bit. But yeah,
1755130	1759790	we can zoom in and see that there. That GPS kind of showed that I drove through a building and
1759790	1765210	off through some trees, but for the most part it stuck close to the road where I actually was.
1765250	1770930	And if we're mapping Wi-Fi networks in something like Wiggle or something like that,
1770930	1775410	this information, it doesn't need to be the most accurate. I mean if you're sending someone on site
1775410	1783750	to go and attack this Wi-Fi network, they're going to find it if they're within that same
1784730	1792970	area that GPS is kind of saying that we went to. So while it is not the most accurate,
1792970	1798570	it's still pretty accurate there. So the results here is that the GNSS dongle was the most accurate
1798570	1805990	in all of the war driving results. GLONASS by itself was the least accurate, and the GNSS
1805990	1811610	receiver locked up the fastest. In all of these cases when I was testing this out, what I did was
1811610	1817390	I drove to the starting location, plugged in everything, and then sat there, waited for it
1817390	1824190	to get locked, and then I gave each one 10 minutes to stay stationary before I conducted the drive.
1824190	1832450	And the GNSS receiver locked up instantly every time, and that's simply due to the number of
1832450	1838670	satellites in the sky that it can pull information from. So what do you want to look for when you're
1838670	1845150	looking for a GNSS dongle? First, make sure it's a GNSS receiver. GNSS means that it receives all
1845150	1850650	of the things. The uBlocks chipset is easy to configure with that uCenter software. Everything
1850650	1858270	is point and click. There are some Python pip modules to interact with uBlocks chips or chipsets
1858810	1863770	such as the one seen on the right here, which leads me to the third bullet point of looking
1863770	1868930	at the supported operating system. When you're looking at various dongles, they may say it
1868930	1874890	supports Windows. It may say it supports Linux. You want to make sure that it's going to work
1874890	1878930	with the operating system that you're going to use in your war driving efforts. So this
1881130	1886490	$200 Raspberry Pi hat isn't going to work with a Windows computer. It's important to note that.
1886830	1892270	And I also wanted to note that I'm not telling you to buy the dongle that I
1892850	1897810	used in this. I'm not saying that my research is the end-all be-all. All I wanted to do was
1897810	1903390	provide enough knowledge to the community to be able to be educated enough to make decisions on
1903390	1908450	what kind of dongles to buy. Now that you know that GPS is not the only satellite out there,
1908450	1912390	you know what kind of data comes down from these satellites, and you know that there are dongles
1912390	1917750	out there that can receive that NMEA data and determine location. So now that everyone is
1917750	1925610	educated on this topic, you can go out there and do your own research. This SparkFun Pi hat was
1925610	1932330	brought to my attention shortly before this presentation was made, so I didn't have enough
1932330	1939890	time to play around with this and get it working enough to be a part of this presentation. But
1941490	1946150	it's certainly up for anyone. Anyone could do that. I'm not the expert on this. I just wanted
1946150	1951930	to provide my background knowledge, the fundamental knowledge of how GPS works, so that everyone else
1951930	1955330	could go out there and make the same kind of decisions that I did. Just buy a bunch of dongles
1955330	1961090	and do the research yourself and try to find out what works best for you. Now that you are armed
1961090	1964930	with all that knowledge, and you can go out there and buy your own dongles, and you know exactly
1965610	1971930	what's coming down from space to provide your location, go war drive the world. Wiggle's doing
1972110	1978970	a war driving contest with Defcon this year as part of their wireless CTF. Check it out, sign up,
1978970	1984590	select a block on the world, war drive some access points, and collect some points.
1987030	1990730	If you want to continue the conversation with me on war driving, you can find me
1990730	1996550	twitter at TheDerricott. If you want to see projects that I'm working on, there's my github link.