WEBVTT 00:00.000 --> 00:03.160 Welcome to Wicked War Driving with GPS and GLONASS. 00:03.160 --> 00:19.100 I'm White Shadow, and I'm going to be describing to you GPS, how it works, the data that you receive from GPS satellites, other satellite constellations that provide similar location data, some dongles you can use to receive all of that information and use that in your war driving efforts. 00:20.120 --> 00:21.400 So who am I? 00:21.400 --> 00:24.480 I'm a private staff sergeant from the US Air Force. 00:24.840 --> 00:28.480 I was in Space Command, which is now called the Space Force. 00:28.760 --> 00:32.840 Since getting out of the military, I've become a wireless security researcher. 00:33.260 --> 00:45.440 And some of my public works are SNF Air back in 2017, as well as last year, I presented at the DEFCON Wireless Village with Solstice on some attacks on WPA3-OWE. 00:45.900 --> 00:51.500 On the picture on the right there, you can see that's me and Solstice on stage last year. 00:52.040 --> 00:56.080 That's my Twitter profile picture there. 00:58.000 --> 01:01.020 So war driving, why do people do war driving? 01:01.020 --> 01:07.680 Before becoming a pen tester, I had this vague understanding of war driving that you could drive around and sniff wireless networks and then kind of plot them out. 01:07.680 --> 01:11.780 But why would anyone actually do that? 01:12.160 --> 01:17.140 Well, once I became a pen tester, I realized that there is a valuable need for this skill set. 01:17.180 --> 01:24.400 Many times clients could set up new wireless infrastructure in their building and they want to measure the signal bleed outside of their building. 01:24.400 --> 01:32.700 So performing a war drive for a client may be useful, or maybe they're just curious if their neighboring businesses are able to receive their Wi-Fi signal. 01:32.700 --> 01:40.100 So they may want a wireless pen tester to go out and do a war drive to measure how far the signal goes out and where exactly it can be picked up from. 01:40.620 --> 01:43.840 It could also just be done as a hobby. 01:44.680 --> 01:46.980 Wiggle.net is a great resource for this. 01:46.980 --> 01:50.620 You can see in the bottom right-hand corner the picture of Wiggle.net there. 01:50.960 --> 01:59.660 It's an open-source database that hobbyists can war drive and upload their results to, and anyone can upload to it and anyone can query it. 01:59.660 --> 02:10.480 So you can look up any of the data that has been uploaded there by hobbyist war drivers that drive around mapping Wi-Fi networks to GPS coordinates. 02:11.320 --> 02:17.900 And as I got into war driving professionally, I realized that the research on GPS dongles was extremely lacking. 02:18.500 --> 02:24.660 When it came to choosing a GPS dongle to perform war driving, there's basically only one that everyone has used. 02:24.660 --> 02:31.760 And whenever you ask somebody why they chose that dongle, the answer is usually, because somebody told me to use it. 02:31.760 --> 02:33.420 There really isn't much on it. 02:33.420 --> 02:37.380 If you Google it, it's really hard to find any information on it. 02:37.720 --> 02:45.600 So taking my experience from Air Force Space Command, I knew that GPS is an American-owned and operated satellite. 02:45.720 --> 02:51.160 Specifically, Air Force Space Command handles the operations of GPS. 02:51.840 --> 02:53.620 A little history on that. 02:54.780 --> 02:59.780 Satellite navigation goes back to the 1960s when the Navy had their own satellite. 03:00.660 --> 03:04.340 Other branches of the military had their own navigational satellites as well. 03:04.340 --> 03:06.000 The Air Force and the Army did. 03:06.020 --> 03:12.140 In 1968, the DoD made everyone collaborate together and act as one big happy family. 03:12.140 --> 03:24.220 So the Army satellites were decommissioned and the Air Force and Navy satellites combined into one constellation that was used for navigation up until 1978 when Navstar 1 was launched. 03:24.220 --> 03:27.520 So that is the first GPS as we know it today satellite that was launched. 03:27.520 --> 03:33.780 Since then, 72 have been launched with 24 currently in orbit. 03:33.780 --> 03:37.340 So they need 24 satellites to maintain worldwide coverage. 03:37.340 --> 03:41.940 Now there are additional satellites on orbit. 03:41.940 --> 03:46.000 You can see there's 33 up there in orbit about, give or take. 03:46.000 --> 03:48.420 These are referred to as on-orbit spares. 03:48.480 --> 03:54.040 These are typically older satellites that get pushed out as newer ones are launched to take their place. 03:54.060 --> 03:58.840 And these typically don't have the best capabilities so they're typically not in use. 03:59.040 --> 04:03.360 GPS is in a MEO orbit, or Medium Earth Orbit. 04:03.360 --> 04:07.040 This means that it goes around Earth twice a day. 04:07.040 --> 04:10.200 So one full orbit every 12 hours. 04:10.200 --> 04:14.980 Now there are other orbits out there that people should be familiar with such as LEO, Low Earth Orbit. 04:14.980 --> 04:19.080 These are things like the Space Station, which goes around the Earth every 90 minutes. 04:19.080 --> 04:25.280 So a LEO orbit is about 90 minutes, whereas a MEO orbit here is about 12 hours. 04:25.760 --> 04:29.240 There's other orbits out there such as HEO, a Highly Elliptical Orbit. 04:29.240 --> 04:40.520 This is when satellites have some kind of wonky orbit, typically to hang out over a certain position of Earth for a certain amount of time and then go around the Earth again. 04:40.660 --> 04:45.800 Then there's also GEO, Geostationary or Geosynchronous satellites as well. 04:45.800 --> 04:52.820 And those satellites are out so far from Earth that they're actually in sync with the Earth rotating. 04:52.820 --> 04:56.820 So they revolve around the Earth at the same rate that Earth rotates. 04:56.820 --> 05:00.700 This creates this illusion that these satellites are over a static point of Earth. 05:00.700 --> 05:04.140 A common example that everyone would know of this is satellite TV. 05:04.260 --> 05:20.120 Whenever the technician came over to set up your satellite TV at home, he set up a satellite dish, pointed it at a single point in the sky, screwed it in place, and then never touched it again because he pointed it at a satellite that is in a static point in the sky. 05:21.960 --> 05:28.380 Now, GPS uses trilateration to determine the location of an individual. 05:28.460 --> 05:30.400 So what is trilateration? 05:30.760 --> 05:36.520 It's hard to explain in the three-dimensional plane, so I'm going to do my best to describe it in the two-dimensional plane. 05:36.940 --> 05:39.540 Let's say you're somewhere in the U.S. 05:39.540 --> 05:41.960 and you turn on a GPS receiver. 05:42.420 --> 05:49.540 Well, the first satellite sees you and it's going to say you're within its spot beam here in this red circle. 05:49.540 --> 05:55.440 So according to that satellite with just data from that, your location is anywhere within this red circle. 05:55.600 --> 05:57.020 That's not very valuable. 05:57.020 --> 05:58.380 That's not very accurate. 05:59.360 --> 06:02.280 Now, your receiver picks up a second satellite. 06:02.500 --> 06:06.120 According to this satellite, you are anywhere within this blue circle. 06:06.540 --> 06:12.560 Again, individually that doesn't make a lot of sense because you could be anywhere, but you see where the circles overlap. 06:13.140 --> 06:16.340 You can start to see how this is whittling down to where we might be. 06:16.340 --> 06:21.520 Now, let's say a third satellite sees where you are and you're anywhere within the green circle. 06:21.520 --> 06:25.080 We can kind of see that these circles have overlapped at a common point. 06:25.080 --> 06:37.920 And when you zoom in on that, you can see that is how a latitude and longitude is calculated from GPS satellites using trilateration to find you on Earth. 06:37.920 --> 06:47.480 Now, you can use your imagination here to see if I were to continue to draw circles on this map, that the area where they overlap would get smaller and thus more precise. 06:49.560 --> 06:53.700 So we know GPS needs three satellites for trilateration. 06:54.240 --> 06:57.760 And there's four satellites visible at all times. 06:57.760 --> 07:03.560 Most satellite receivers typically won't provide information until they get that fourth lock from a fourth satellite. 07:06.120 --> 07:12.160 Instead of latitude and longitude, once you get the fourth satellite, you can also calculate altitude and additional things from there. 07:12.160 --> 07:16.500 The bottom line is, the more satellites you have, the more accurate the information is going to be. 07:16.780 --> 07:18.160 But what is that information? 07:18.160 --> 07:20.980 What is the data that comes down from these GPS satellites? 07:20.980 --> 07:22.460 Well, I have an example of it here. 07:22.460 --> 07:24.520 These are called NMEA messages. 07:24.520 --> 07:30.380 I know that's a funny word, and I'm going to skip over what it is right now, but I just want you to look at these messages. 07:30.560 --> 07:37.760 Now, you can see the... what I want you to pay attention to are the last three letters of these messages. 07:37.760 --> 07:41.380 GGA, GLL, GSA, GSV, RMC. 07:41.540 --> 07:44.700 These refer to the type of message that this is. 07:44.700 --> 07:48.960 The first two letters of each message indicate which satellite that it came from. 07:48.960 --> 07:52.820 So GP indicates that this message came from a GPS satellite. 07:52.920 --> 07:55.380 So you can see the different messages that we have here. 07:55.380 --> 08:02.580 And then at the bottom of the screen, you can see those are legitimate NMEA strings coming down from satellites in space. 08:02.580 --> 08:03.540 And so that's what they look like. 08:03.540 --> 08:06.440 That's what the data looks like coming down from space. 08:07.660 --> 08:23.140 So being an Air Force Space Command, I knew that I was aware of US GPS, but then I was also aware that other countries did not want to use US GPS just in case we went to war with them or something like that. 08:23.140 --> 08:29.340 They may want to jam GPS, so they created their own satellite constellations that do the exact same thing. 08:29.420 --> 08:31.980 So this is where Russian GLONASS comes in. 08:31.980 --> 08:38.760 So just like US GPS, Russia has their own satellite constellation that does the exact same job. 08:38.760 --> 08:41.060 It was originally launched in 1982. 08:41.060 --> 08:43.460 Since then, 27 satellites have been launched. 08:43.460 --> 08:47.660 21 of them are in use, with 24 total in orbit. 08:47.660 --> 08:50.500 So they have about three on-orbit spares. 08:50.500 --> 09:01.140 And they accomplished the same task as GPS, which used 24 satellites in orbit, with only 21 satellites by using a slightly faster orbital period. 09:01.140 --> 09:08.780 Remember when I was talking about a medium Earth orbit, MEO, GPS satellites go around the Earth every 12 hours. 09:08.780 --> 09:12.020 Well, GLONASS goes around a little over 11 hours. 09:13.840 --> 09:22.420 So after thinking about Russian GLONASS, I started thinking about why wouldn't you want to receive data from both? 09:22.420 --> 09:32.980 Thinking about GPS, at any given time, if you're in an empty field on a perfect day with perfect weather, you could receive 12 GPS satellites. 09:32.980 --> 09:40.220 With GLONASS, it's about 6 to 10, given where you are in Earth and given the weather conditions and everything. 09:40.220 --> 09:43.160 So why wouldn't you want to receive both? 09:43.160 --> 09:52.000 While GPS does have worldwide coverage, it's coverage around the poles in northern Europe, northern Russia, the coverage there is not that great. 09:52.000 --> 09:54.560 So GLONASS actually makes up for that. 09:54.560 --> 09:59.200 So again, it's making up for the areas where GPS is lacking. 09:59.200 --> 10:01.280 So why wouldn't you want to receive both? 10:01.280 --> 10:03.620 They both have worldwide coverage. 10:03.620 --> 10:10.980 This is a common misconception that people think that GLONASS receivers are only accurate in Russia, that you can only use a GLONASS receiver in Russia. 10:11.600 --> 10:24.800 Just how the US military uses GPS to guide ships, planes, and bombs, we want those ships, planes, and bombs to have accurate navigation data, whether they're in the US or whether they're in Russia or anywhere in the world. 10:24.800 --> 10:26.440 The same thing applies to GLONASS. 10:26.440 --> 10:35.600 Russia also has ships, planes, and bombs that are navigated by GLONASS, and they want that to have accurate navigational data regardless of where they are in the world. 10:35.600 --> 10:40.480 So both of these satellite constellations do work worldwide. 10:41.180 --> 10:45.900 And as I started looking into it, I realized a lot of smartphones have actually started implementing this. 10:45.900 --> 10:51.760 I believe the iPhone 7 or the iPhone 8 actually implemented a GPS and GLONASS receiver. 10:52.780 --> 11:01.680 So I was sitting there and continuing to think about constellations, and then I realized that Galileo is another one made by the European Space Agency. 11:02.080 --> 11:04.380 And it was first launched in 2011. 11:04.380 --> 11:14.040 Since then, 24 satellites have been launched, and mainly all their satellites are going through the process of being commissioned to be brought online. 11:14.040 --> 11:23.740 You see there's 14 satellites in use, but a lot of them are being tested and are being brought online to actually work with the constellation. 11:23.860 --> 11:26.600 And again, these are MEO satellites as well. 11:27.800 --> 11:47.980 And so when you look at all of these satellites and compare the pictures here, and if anyone's curious, all these pictures are from Kerbal Space Program, but you compare GPS on the left, 24 satellites for worldwide coverage, versus the satellites on the right, 11:47.980 --> 11:51.080 and you see how many there are there. 11:51.320 --> 11:59.460 The circles on the map of trilateration that you can draw increase numerously. 12:00.440 --> 12:04.260 So then I was wondering, well, how many satellite constellations are there? 12:04.260 --> 12:06.860 Well, there's several GNSS constellations. 12:06.860 --> 12:13.400 Europe has Galileo, Japan has QZSS, Russia has GLONASS, India has IRNSS, the U.S. 12:13.400 --> 12:16.320 has GPS, and China has Beidou. 12:16.320 --> 12:23.360 And they are all classified under this umbrella term of GNSS, Global Navigation Satellite System. 12:23.360 --> 12:26.820 Now that's confusing because that's also what GLONASS stands for. 12:26.820 --> 12:32.440 However, whenever you see GNSS, it's referring to all of the satellite constellations. 12:33.740 --> 12:43.000 And it's interesting because regardless of where the satellite constellation originates from, they all speak the same language, and that language is NMIA. 12:43.000 --> 12:49.920 That's that word that I said earlier I would skip over, and it stands for National Marine Electronics Association. 12:49.920 --> 13:01.120 So this is the standard that defines how data is transmitted in a sentence form from one talker to multiple listeners, from one satellite to multiple receivers on the planet at once. 13:01.120 --> 13:17.300 And you can see in this screenshot, these are NMIA strings or sentences sent from multiple satellites because you can see the last three letters of that message, GSV, GSV, GSV, but the first two indicate which satellite they came from. 13:17.300 --> 13:20.620 So GPGSV came from a GPS satellite. 13:21.120 --> 13:23.960 GLGSV came from a Russian GLONASS satellite. 13:23.960 --> 13:26.300 We have two more of these GL messages. 13:26.300 --> 13:31.640 Then we have a GAGSV message, which came from a European Galileo satellite. 13:31.660 --> 13:33.960 Then there's this GNRMC. 13:33.960 --> 13:36.020 That's another GNSS satellite. 13:36.020 --> 13:43.040 They're satellites that I didn't even mention in the previous slide that sit out in a geosynchronous orbit and provide error correction information. 13:43.200 --> 13:47.980 So we can receive all of these things because they speak a common language. 13:48.340 --> 14:00.040 So now that we know that GPS is not the only satellite that does location services, we know that they all speak a common language. 14:00.040 --> 14:05.500 Well, there's got to be dongles out there that could receive all this information, right? 14:05.500 --> 14:21.260 So that is what sent me on this quest to buy a bunch of dongles, analyze what they could do, see if I could reconfigure them in ways to receive additional satellite constellations, and then perform some tests with them. 14:21.340 --> 14:31.560 So aside from just going to Amazon and buying every GPS GNSS dongle I could find, these are the software tools that I used. 14:31.780 --> 14:46.820 So GPSD, this is what takes the information from your dongle and starts a server that you can connect to with tools like GPSmon to troubleshoot or just view the information, or Kismet. 14:46.820 --> 14:53.740 And Kismet will actually correlate that GPS data with the Wi-Fi information it sees so that you can war drive. 14:53.740 --> 15:00.700 Now the commands that I've laid out here, GPSD, tick D2, that's the debug level. 15:00.700 --> 15:06.180 So you can increase that number or decrease it and that'll change the verbosity of the output. 15:06.180 --> 15:16.680 Tick little n is to not wait for GPS lock before querying for messages. 15:16.680 --> 15:25.220 So that's important because you want to see those NMEA strings as they're coming down from the dongle without having to wait for it to receive full lock. 15:25.220 --> 15:32.260 Then the tick capital N there tells GPSD not to run as a background process and leave it in the foreground. 15:32.260 --> 15:34.880 Then I'm specifying my serial device. 15:34.880 --> 15:44.040 Then I'm using tick S and 2948 to specify a different port to host the GPSD service on. 15:44.040 --> 15:51.860 I did this because Kali has a service that it starts on 2947 which is the default for GPSD. 15:51.900 --> 15:56.380 So instead of just disabling that I just got in the habit of starting this on my own port. 15:58.920 --> 16:06.100 I'm also using GPSmon to troubleshoot or to just to analyze the information coming down from GPSD. 16:06.100 --> 16:13.440 And you can do that with GPSmon tick N which specifies GPSmon to look for NMEA strings. 16:13.460 --> 16:19.860 And then you specify localhost and the port that I used in starting GPSD. 16:19.940 --> 16:32.620 I also use the uCenter software from uBlocks which only works on Windows but it's extremely useful in configuring GPS dongles and GNSS dongles and I'll get into that a little bit later. 16:32.980 --> 16:47.060 And then I also used Kismet in this and it's important to note that you have to go into the Kismet config file and uncomment the line where it says that you want to use GPSD. 16:48.640 --> 16:54.260 So first up was the BU353S4. 16:54.260 --> 16:56.140 This is the dongle that everyone uses. 16:56.140 --> 17:01.040 This is the one that everyone recommends that everyone use and it's GPS only. 17:01.320 --> 17:08.540 So on the right side of the screen here we have output from GPSmon and I've highlighted some fields here. 17:08.540 --> 17:15.920 So on the left we see PRN and this number is the designator for each satellite in the constellation. 17:15.920 --> 17:21.820 So when it comes to USGPS you're only going to see numbers between 1 and 32 in this PRN field. 17:21.820 --> 17:25.120 Now at the very bottom of that PRN field you see a number that says 138. 17:25.120 --> 17:30.140 That is actually one of the geosynchronous satellites that sits out and provides error correction. 17:30.620 --> 17:33.380 Next to the PRN field I've highlighted SNN. 17:33.380 --> 17:35.000 That's the signal to noise ratio. 17:35.000 --> 17:39.560 So that shows you the signal that you're getting from a specific GPS satellite. 17:40.100 --> 17:46.420 And then on the far right of that picture I've highlighted the number of satellites and it says the number of satellites is seven. 17:46.460 --> 17:54.300 You can see that in the signal to noise ratio block that only seven of these satellites there are providing a signal there. 17:54.300 --> 17:58.260 So that's most likely why GPSmon is only showing seven satellites. 17:59.940 --> 18:01.780 So that's cool. 18:02.180 --> 18:05.600 Now in this example I'm using the older version of Kismet. 18:05.600 --> 18:15.380 Sorry if Dragorn is watching but actually this is a feature request if I could get this back into the newer version of Kismet because space nerds like to see GPS information like this. 18:16.200 --> 18:27.160 You can see on the top right I'm pulling down the NMEA strings straight from the serial device by just using the cat command and then specifying the serial device. 18:27.160 --> 18:31.040 And you can see the NMEA strings coming down from space. 18:31.040 --> 18:39.400 But on the left side after starting up Kismet and everything it can see the satellites however it says I don't have a signal. 18:39.400 --> 18:43.760 I don't have a strong enough signal on enough satellite to determine my location. 18:44.460 --> 18:47.220 And that's stressful. 18:47.220 --> 18:50.380 That's infuriating when you're trying to perform a war drive. 18:50.440 --> 18:53.340 Maybe there's bad weather outside or something and you just want to get it done. 18:54.720 --> 18:57.660 This isn't going to help anyone just sitting around waiting for lock. 18:58.440 --> 19:11.260 So this was what inspired me to look for additional dongles is because I've been in this situation many times on a wireless pen test when I'm waiting on this GPS dongle to lock up so that I can start my war drive or war walk and hurry up and get out of there. 19:11.260 --> 19:24.080 But you could see if we just had more satellites in space to lock up on other than the 32 in the entire GPS constellation you know maybe that would make it easier to obtain lock. 19:24.080 --> 19:29.580 So when I started talking to people about this this was one of the first dongles that was recommended to me. 19:29.920 --> 19:33.820 Now it's important to note it says GPS slash GLONASS. 19:33.820 --> 19:36.900 That slash means or and not both. 19:36.900 --> 19:43.220 So you can only configure this dongle to work with GLONASS or GPS and not both. 19:43.640 --> 19:48.060 And you can use the UCenter software to configure this. 19:48.220 --> 19:53.020 And I've highlighted the configuration screen from that on the right here. 19:53.020 --> 19:57.460 You can see it has all the satellite constellations that you could actually select. 19:57.460 --> 19:58.700 And some of them are grayed out. 19:58.700 --> 20:02.500 In this example Galileo, Beto, and IMES are grayed out. 20:02.500 --> 20:11.020 But GPS, SBAS, and QZSS are selectable. 20:11.020 --> 20:20.980 And whenever you select a configuration here at the bottom of this configuration menu there is a send button that you must push to push the configuration to the dongle. 20:22.440 --> 20:29.200 And again in this testing I found out very quickly that I could only configure this dongle for GPS or GLONASS. 20:29.200 --> 20:33.460 So I ended all my testing with that because I was looking for dongles that could do both. 20:33.700 --> 20:42.880 Now I wanted to talk about the UCenter software because it can be a pain to use, a pain to learn, and there's not a lot of resources out there on how to use it. 20:42.880 --> 20:48.860 Like I mentioned before, it's a Windows-only piece of software that you can download for free from their website. 20:49.020 --> 21:01.960 Once you install it and everything, you launch it, and then from the receiver drop-down menu you go into connection, and then you'll see the COM devices there for you to select your USB dongle. 21:02.120 --> 21:12.880 Once you've selected that, you can then go to the view drop-down, go to configuration view, select GNS config, and then you can actually select which satellite constellations you want to receive from. 21:14.400 --> 21:25.160 And I mentioned it before, but after you select which constellations you want to receive from, you go down to the bottom and click send, and then that will push the configuration to the dongle. 21:25.160 --> 21:29.240 However, you have to save that configuration after you have sent it. 21:29.240 --> 21:37.760 So from receiver drop-down menu, go to action and save config, and that will store that configuration in the memory on the dongle. 21:37.760 --> 21:43.700 So when you unplug it and then plug it into another computer, that configuration is saved there. 21:45.520 --> 21:49.020 Specifically, if you want to only receive GLONASS satellites. 21:49.020 --> 21:53.620 So I configured a dongle here to only receive data from GLONASS satellites. 21:53.620 --> 22:00.780 In the bottom left hand corner, you can see that GLONASS is the only constellation that is enabled. 22:00.780 --> 22:10.380 In the top left, you can see all the NMEA strings that are coming from GLONASS satellites indicated by the GL in front of every message. 22:10.520 --> 22:16.340 And then on the right side, I just have a pretty picture showing the Russian flag next to every satellite that I'm receiving a signal from. 22:18.060 --> 22:29.760 Now, once I save that configuration from the UCenter software, unplug that dongle from my Windows machine, and then plug it into my Linux computer, and use GPSD and GPSMOD to receive information. 22:29.920 --> 22:35.140 You can see here in GPSMOD, the PRN numbers are now between 65 and 88. 22:35.500 --> 22:39.460 That is because those are Russian GLONASS satellites that I'm receiving a signal from. 22:40.340 --> 22:45.640 And again, on the right side, I've highlighted that there's seven satellites I'm receiving signal from. 22:45.640 --> 22:52.420 And you can see that from the signal to noise ratio there that two satellites aren't reporting a signal. 22:54.040 --> 22:57.520 So this was one of the first dongles that I found that could do both. 22:57.680 --> 22:59.860 It was advertised as a GNS receiver. 22:59.860 --> 23:01.760 It said it could receive all the things. 23:01.760 --> 23:03.520 And I wanted to test it out. 23:03.520 --> 23:08.660 And just buying it and plugging it in to Kali Linux, it worked right out of the box. 23:08.660 --> 23:13.760 I was able to hook it up with KISMET after starting up GPSD. 23:13.760 --> 23:21.960 And then you can see from the output on the left side of the screen there from the GPSINFO and KISMET, you can see all the satellites that I'm receiving data from. 23:21.960 --> 23:24.400 So 1 through 32 would be U.S. 23:24.400 --> 23:35.480 GPS satellites, 65 through 88 are Russian GLONASS satellites, and then 131, 135, 138 are the geosynchronous satellites that provide error correction data. 23:38.370 --> 23:41.730 So that's cool, but I want to receive more. 23:41.730 --> 23:46.670 And so I found this dongle that receives all of the things. 23:46.670 --> 23:50.590 GPS, GLONASS, Galileo, Beidou, QZSS. 23:50.590 --> 23:56.010 And you can see that in the U-Center software. 23:56.010 --> 23:59.470 You can see the first six satellites are U.S. 23:59.470 --> 24:14.730 GPS, then the next six or seven satellites are Russian GLONASS satellites, then there is another geosynchronous satellite that provides error correction, and then the final two satellites in that picture are European Galileo satellites. 24:15.290 --> 24:21.130 This is the same screenshot, but on the left side you can see the NMIA data coming down from them. 24:21.130 --> 24:27.110 You can see that the very top GL, GSA, came from a Russian GLONASS satellite. 24:27.110 --> 24:31.790 GA, GSA, come from a European Galileo satellite. 24:31.790 --> 24:34.270 GP, GSV, came from a U .S. 24:34.270 --> 24:35.770 GPS satellite. 24:35.810 --> 24:42.730 So we are receiving information from all three constellations with a single dongle. 24:42.730 --> 24:44.590 What does that look like in GPSMON? 24:44.630 --> 24:54.830 GPSMON couldn't even handle all the satellites that it was picking up, so this screen only goes to 11, and you can see on the right side that I picked up at least 15. 24:55.730 --> 25:05.710 And then I also showed the sentences block of GPSMON, and in this block you can see those messages that I was just referencing. 25:05.710 --> 25:08.430 GN, GGA, came from a GNSS satellite. 25:08.430 --> 25:11.110 GP, GSA, came from a GPS satellite. 25:11.110 --> 25:13.910 GL, GSA, came from a Russian GLONASS satellite. 25:13.910 --> 25:21.450 So this is a quick way to see how or to see what messages you're receiving and which satellites you're receiving from. 25:21.490 --> 25:25.370 So if you were to plug this into KISMET, what would that look like? 25:25.930 --> 25:31.990 Again, you can see I have lock on 23 satellites, and again 1 through 32 is U.S. 25:31.990 --> 25:32.770 GPS. 25:32.950 --> 25:35.230 From there up to 83 is U.S. 25:35.230 --> 25:42.010 or Russian GLONASS, and then 309 and 312 are European Galileo satellites. 25:42.550 --> 25:44.190 Okay, so big whoop. 25:44.190 --> 25:49.450 You found all these GPS dongles, you found some that could pick up other satellites, but what does it mean? 25:49.450 --> 25:53.830 What does it mean to war driving, and what does it mean to accuracy in general? 25:53.830 --> 25:55.110 So I ran some tests. 25:55.110 --> 26:02.170 I set up equipment with each dongle and drove around a neighborhood, and let's see the results. 26:02.170 --> 26:10.830 So with GPS only, using the BU-353, you could see here that, yeah, it looks pretty good. 26:11.270 --> 26:15.370 I did a little loop over here in this neighborhood to kind of test the precision there. 26:15.370 --> 26:18.750 It looks a little off, but I mean for the most part it looks like I'm on the road. 26:18.750 --> 26:21.810 I was in a car, so I was on the street the entire time. 26:21.810 --> 26:25.870 So there are some areas where it looks like I was on the sidewalk, but for the most part this is pretty accurate. 26:26.150 --> 26:30.430 Next, I had one of the dongles configured for GLONASS only. 26:30.430 --> 26:40.670 So just using Russian GLONASS satellites, it kind of looks like I was off in the grass and driving over people's houses, but for the most part it still captured the same path. 26:41.390 --> 26:43.810 Then we have the GNSS receiver. 26:43.810 --> 26:48.630 So this is receiving all the things from GPS, GLONASS, Galileo. 26:49.270 --> 26:52.870 And you can see this actually looks much better. 26:52.870 --> 26:59.150 It looks like I'm in more in the center of the road, which is more closer to where I was actually driving. 26:59.150 --> 27:05.990 The circle around this tree up here looks a lot better, but let's compare all of them when we overlay them together. 27:05.990 --> 27:13.770 So the green lines are going to be GPS, GLONASS is red, and the GNSS receiver is yellow. 27:14.590 --> 27:23.210 So for the most part the tracks all look the same with GLONASS sticking out a little bit, but let's zoom in on that circle there. 27:23.210 --> 27:35.730 So you can see the way I drove this path was I came down through the top of that parking lot and did a lap around the tree and then left out the front entrance there. 27:35.730 --> 27:40.350 So with the yellow line you can see that I actually stayed on the road. 27:40.350 --> 27:46.790 With the green line it shows me off in the grass a little bit, but for the most part it's fairly accurate. 27:46.790 --> 27:55.590 And the red line from just GLONASS only information shows me running off in the grass and driving over cars like a monster truck, which is not what I did. 27:55.590 --> 27:58.770 But yeah, so what did we learn from that? 27:58.770 --> 28:06.230 In a rural area with not much in the way to obscure the sky, it really doesn't matter which dongle you use. 28:06.230 --> 28:10.890 They're all fairly accurate for the most part. 28:10.890 --> 28:14.770 I mean it wasn't off by too much if I was plotting Wi-Fi networks. 28:14.850 --> 28:21.770 But let's test this again in an area where there are things obscuring the view to the sky. 28:21.910 --> 28:25.630 So I drove to downtown Denver and ran the same test. 28:25.830 --> 28:27.750 So we can see here GPS. 28:27.870 --> 28:29.550 Wow, that looks pretty good. 28:29.550 --> 28:36.970 There's only a few sections there where it got a little squirrely going around the corners of some buildings, but for the most part that's really accurate. 28:37.810 --> 28:41.250 GLONASS only... I don't even know what happened. 28:43.130 --> 28:46.430 Clearly it can't handle an urban environment. 28:47.070 --> 28:52.030 But using the GNSS receiver, this was definitely the most accurate. 28:52.170 --> 28:59.370 In all the results there you can see it shows you exactly which street I'm on and you can see the path that I drove. 29:01.510 --> 29:09.590 Let's overlay them all together and you can see for the most part the GPS by itself was fairly accurate as well. 29:09.590 --> 29:12.810 It just got off path a little bit. 29:13.010 --> 29:17.250 But yeah, we can zoom in and see that there. 29:17.250 --> 29:25.210 That GPS kind of showed that I drove through a building and off through some trees, but for the most part it stuck close to the road where I actually was. 29:25.250 --> 29:34.150 And if we're mapping Wi-Fi networks in something like Wiggle or something like that, this information, it doesn't need to be the most accurate. 29:34.150 --> 29:48.410 I mean if you're sending someone on site to go and attack this Wi-Fi network, they're going to find it if they're within that same area that GPS is kind of saying that we went to. 29:48.410 --> 29:54.850 So while it is not the most accurate, it's still pretty accurate there. 29:54.970 --> 30:00.670 So the results here is that the GNSS dongle was the most accurate in all of the war driving results. 30:00.830 --> 30:07.950 GLONASS by itself was the least accurate, and the GNSS receiver locked up the fastest. 30:08.090 --> 30:24.190 In all of these cases when I was testing this out, what I did was I drove to the starting location, plugged in everything, and then sat there, waited for it to get locked, and then I gave each one 10 minutes to stay stationary before I conducted the drive. 30:24.190 --> 30:35.130 And the GNSS receiver locked up instantly every time, and that's simply due to the number of satellites in the sky that it can pull information from. 30:36.610 --> 30:40.150 So what do you want to look for when you're looking for a GNSS dongle? 30:40.150 --> 30:42.790 First, make sure it's a GNSS receiver. 30:42.790 --> 30:46.350 GNSS means that it receives all of the things. 30:46.610 --> 30:50.370 The uBlocks chipset is easy to configure with that uCenter software. 30:50.370 --> 30:53.610 Everything is point and click. 30:53.610 --> 31:05.970 There are some Python pip modules to interact with uBlocks chips or chipsets such as the one seen on the right here, which leads me to the third bullet point of looking at the supported operating system. 31:06.410 --> 31:09.930 When you're looking at various dongles, they may say it supports Windows. 31:09.930 --> 31:11.610 It may say it supports Linux. 31:12.090 --> 31:18.050 You want to make sure that it's going to work with the operating system that you're going to use in your war driving efforts. 31:18.190 --> 31:25.090 So this $200 Raspberry Pi hat isn't going to work with a Windows computer. 31:25.090 --> 31:26.490 It's important to note that. 31:26.830 --> 31:34.170 And I also wanted to note that I'm not telling you to buy the dongle that I used in this. 31:34.170 --> 31:36.810 I'm not saying that my research is the end-all be-all. 31:36.810 --> 31:45.070 All I wanted to do was provide enough knowledge to the community to be able to be educated enough to make decisions on what kind of dongles to buy. 31:45.070 --> 31:56.110 Now that you know that GPS is not the only satellite out there, you know what kind of data comes down from these satellites, and you know that there are dongles out there that can receive that NMEA data and determine location. 31:56.490 --> 32:02.210 So now that everyone is educated on this topic, you can go out there and do your own research. 32:03.030 --> 32:19.830 This SparkFun Pi hat was brought to my attention shortly before this presentation was made, so I didn't have enough time to play around with this and get it working enough to be a part of this presentation. 32:19.830 --> 32:23.150 But it's certainly up for anyone. 32:23.150 --> 32:24.250 Anyone could do that. 32:24.370 --> 32:25.770 I'm not the expert on this. 32:25.770 --> 32:34.450 I just wanted to provide my background knowledge, the fundamental knowledge of how GPS works, so that everyone else could go out there and make the same kind of decisions that I did. 32:34.450 --> 32:39.510 Just buy a bunch of dongles and do the research yourself and try to find out what works best for you. 32:39.930 --> 32:51.210 Now that you are armed with all that knowledge, and you can go out there and buy your own dongles, and you know exactly what's coming down from space to provide your location, go war drive the world. 32:51.290 --> 32:56.030 Wiggle's doing a war driving contest with Defcon this year as part of their wireless CTF. 32:57.050 --> 33:04.590 Check it out, sign up, select a block on the world, war drive some access points, and collect some points. 33:07.030 --> 33:13.210 If you want to continue the conversation with me on war driving, you can find me twitter at TheDerricott. 33:13.290 --> 33:16.550 If you want to see projects that I'm working on, there's my github link.