1 00:00:00,540 --> 00:00:03,180 - All right you guys. You finally made it. 2 00:00:03,180 --> 00:00:05,910 This is the final talk of the day. 3 00:00:05,910 --> 00:00:09,390 And of course we saved the best for last. 4 00:00:09,390 --> 00:00:11,100 And this is basically Chris Rock. 5 00:00:11,100 --> 00:00:12,771 He's been here for quite a while. 6 00:00:12,771 --> 00:00:15,750 The third time I've seen you here. Third time, 7 00:00:15,750 --> 00:00:18,180 and he's been my personal favorite speaker, 8 00:00:18,180 --> 00:00:21,090 'cause the topics, and then we approach these problems, 9 00:00:21,090 --> 00:00:22,260 over the most interesting ones 10 00:00:22,260 --> 00:00:24,870 and hope you enjoy it, like I will. 11 00:00:24,870 --> 00:00:26,740 So please give a big hand to Chris 12 00:00:27,704 --> 00:00:31,042 - [Audience] (applause), (cheer) 13 00:00:31,042 --> 00:00:33,730 - and you guys are in for a big treat, all right. 14 00:00:42,900 --> 00:00:46,110 - Thanks for coming to my talk everybody, Killer Hertz. 15 00:00:46,110 --> 00:00:47,760 You hear me all right? 16 00:00:47,760 --> 00:00:48,873 Yep. Awesome. 17 00:00:54,180 --> 00:00:55,624 So for those who don't know me, 18 00:00:55,624 --> 00:00:58,050 I've been a cyber mercenary for 30 years, 19 00:00:58,050 --> 00:01:01,503 and I'm also the CISO and co-founder of SIEMonster. 20 00:01:03,150 --> 00:01:07,260 I was at DEFCON 23, where I presented, I Will Kill You. 21 00:01:07,260 --> 00:01:11,340 This was a talk on vulnerabilities in the death industry. 22 00:01:11,340 --> 00:01:13,260 And I was also at DEFCON 24 on 23 00:01:13,260 --> 00:01:15,753 How to Overthrow a Government, with Simon Mann. 24 00:01:19,170 --> 00:01:22,920 So the reason I'm doing this talk is, as a kid, 25 00:01:22,920 --> 00:01:26,580 I grew up with terrorists on the news all the time. 26 00:01:26,580 --> 00:01:31,290 We had the IRA, Hizballah and then later years, 27 00:01:31,290 --> 00:01:36,290 we had Al-Qaeda, ISIS, Jemiah Zamir, 28 00:01:37,011 --> 00:01:39,485 but it seems to have gone quiet. 29 00:01:39,485 --> 00:01:42,063 So where are all the good terrorists gone? 30 00:01:45,690 --> 00:01:47,970 Let's have a look at the numbers. 31 00:01:47,970 --> 00:01:51,870 Death from terrorism down 39% in Mena, Middle East, 32 00:01:51,870 --> 00:01:54,030 North Africa, in the last three years, 33 00:01:54,030 --> 00:01:59,030 and terrorist attacks in the west down 68% since 2018. 34 00:01:59,310 --> 00:02:00,510 So something's going on. 35 00:02:05,040 --> 00:02:08,340 The national intelligence report had terrorism 36 00:02:08,340 --> 00:02:09,573 as just a footnote. 37 00:02:11,910 --> 00:02:13,170 So we're gonna have to give these guys 38 00:02:13,170 --> 00:02:15,572 a bit of a helping hand and we're gonna have to 39 00:02:15,572 --> 00:02:16,800 give them a bit of a hand because 40 00:02:16,800 --> 00:02:18,360 if it's not considered a risk, 41 00:02:18,360 --> 00:02:20,873 we're not gonna get a budget to do what we need to do. 42 00:02:22,020 --> 00:02:24,300 Just to give you some reference, 43 00:02:24,300 --> 00:02:27,480 in 2016, they were number one as the world risk. 44 00:02:27,480 --> 00:02:29,430 So they've had a bit of a downfall. 45 00:02:29,430 --> 00:02:31,253 So we need to give them a bit of a hand. 46 00:02:34,140 --> 00:02:35,580 In the good old days, you could just walk 47 00:02:35,580 --> 00:02:38,883 into a house of worship and pull the trigger. 48 00:02:43,080 --> 00:02:46,290 And if your guy didn't have the balls to pull the trigger, 49 00:02:46,290 --> 00:02:47,990 you could do it yourself remotely, 50 00:02:51,300 --> 00:02:54,960 but you can't do that anymore because of jammers. 51 00:02:54,960 --> 00:02:57,900 Jammers are being installed in churches, 52 00:02:57,900 --> 00:02:59,610 synagogues and mosques, 53 00:02:59,610 --> 00:03:01,890 not so much for the terrorist aspect, 54 00:03:01,890 --> 00:03:05,703 but to keep the audience from using their mobile phones. 55 00:03:13,110 --> 00:03:14,790 I originally got this idea from the talk 56 00:03:14,790 --> 00:03:18,503 when Julian Assange was in the Ecuadorian embassy 57 00:03:18,503 --> 00:03:19,440 and they were using jammers 58 00:03:19,440 --> 00:03:21,510 to stop him communicating. 59 00:03:21,510 --> 00:03:23,797 So I reached out to Julian's team and said, 60 00:03:23,797 --> 00:03:25,297 "What's the problem?" And they said, 61 00:03:25,297 --> 00:03:28,017 "We've tried everything, but we're being jammed." 62 00:03:28,860 --> 00:03:31,230 And that was a bit of a challenge for me. 63 00:03:31,230 --> 00:03:33,780 How do jammers work and how do you get around them? 64 00:03:38,100 --> 00:03:41,940 The thieves are using jammers to block signals going back 65 00:03:41,940 --> 00:03:44,163 to security monitoring stations. 66 00:03:47,880 --> 00:03:49,663 So for those who know jammers, 67 00:03:49,663 --> 00:03:52,140 there's a wide variety of jammers out there. 68 00:03:52,140 --> 00:03:54,630 There's jammers to protect military convoys. 69 00:03:54,630 --> 00:03:58,650 There's the humvee's on the left. Also personnel. 70 00:03:58,650 --> 00:04:01,800 There's also jammers to protect the corporate sector 71 00:04:01,800 --> 00:04:05,250 as well, whether it be boardroom secrets leaking out, 72 00:04:05,250 --> 00:04:09,330 drones, the spying, and also the prison systems 73 00:04:09,330 --> 00:04:13,050 using jammers as well to stop the prisoners 74 00:04:13,050 --> 00:04:14,313 from using mobile phones. 75 00:04:21,630 --> 00:04:24,400 So here we have an example of a Humvee Jammer 76 00:04:26,146 --> 00:04:30,570 being protected by using jamming signals to stop the ID 77 00:04:30,570 --> 00:04:33,150 from blowing up the humvee and also 78 00:04:33,150 --> 00:04:37,140 the Thales Eclipse being protected by a wave 79 00:04:37,140 --> 00:04:40,890 to stop that jammer being targeted to been going off. 80 00:04:40,890 --> 00:04:44,111 So I'll give you just a basic overview of jammers. 81 00:04:44,111 --> 00:04:46,950 It's a complex topic, but I'll just give you the basics. 82 00:04:46,950 --> 00:04:49,320 So we have what's called a spot frequency 83 00:04:49,320 --> 00:04:51,120 where if you know the frequency of the target, 84 00:04:51,120 --> 00:04:54,540 like a mobile phone, you can just blast out the signal 85 00:04:54,540 --> 00:04:56,550 to that mobile phone frequency to block it. 86 00:04:56,550 --> 00:04:57,513 That's called spot. 87 00:04:58,350 --> 00:05:02,400 We have sweep, where you're sending out signals 88 00:05:02,400 --> 00:05:05,400 across a wide range of targets, whether it be 89 00:05:05,400 --> 00:05:08,670 garage door openers, baby monitors, digital phones, 90 00:05:08,670 --> 00:05:10,039 stuff like that. 91 00:05:10,039 --> 00:05:12,510 Or we have something called barrage, where we send 92 00:05:12,510 --> 00:05:14,793 power across all signals, all at once. 93 00:05:19,200 --> 00:05:20,430 Jammers are actually pretty smart 94 00:05:20,430 --> 00:05:21,900 and they've evolved over the last 10 years 95 00:05:21,900 --> 00:05:23,850 where they actually have active intelligence 96 00:05:23,850 --> 00:05:26,370 where they'll actually look for a signal, 97 00:05:26,370 --> 00:05:28,560 record the signal, and then play back the signal. 98 00:05:28,560 --> 00:05:29,880 So if there's something that the jammer 99 00:05:29,880 --> 00:05:32,220 has never seen before, it can be used to record 100 00:05:32,220 --> 00:05:35,073 and play back, for even pre detonation. 101 00:05:43,639 --> 00:05:45,810 Here's an example of a jammer being used. 102 00:05:45,810 --> 00:05:48,660 We've got the hurt locker on the left there, 103 00:05:48,660 --> 00:05:50,490 trying to disable the IED, 104 00:05:50,490 --> 00:05:52,050 and we've got the terrorist on the balcony 105 00:05:52,050 --> 00:05:57,050 of glink, trying to target, to blow up the guy, 106 00:05:57,390 --> 00:05:59,040 and he's got no protection. 107 00:05:59,040 --> 00:06:00,870 But on the right hand side, we have again, 108 00:06:00,870 --> 00:06:03,780 the hurt locker with a jammer protecting him 109 00:06:03,780 --> 00:06:06,063 from a detonation of that IED. 110 00:06:12,990 --> 00:06:16,260 Some of the big manufacturers of jammers. 111 00:06:16,260 --> 00:06:20,160 You guys will know these names and the counter ID market is 112 00:06:20,160 --> 00:06:21,663 a 2 billion dollar industry. 113 00:06:29,370 --> 00:06:31,620 Here's an example of a personnel jammer 114 00:06:31,620 --> 00:06:33,030 that the military will use, 115 00:06:33,030 --> 00:06:34,710 and you'll notice the different antennas there, 116 00:06:34,710 --> 00:06:37,320 high, medium, and low. We'll get into that more detail. 117 00:06:37,320 --> 00:06:38,850 And you can see the specs beside it. 118 00:06:38,850 --> 00:06:40,830 Jammers need a lot of power. 119 00:06:40,830 --> 00:06:42,720 So you'll actually see things like run time 120 00:06:42,720 --> 00:06:43,720 and stuff like that. 121 00:06:49,530 --> 00:06:51,240 The commercial sector's exactly the same. 122 00:06:51,240 --> 00:06:53,520 You'll actually get spec sheets on what frequencies 123 00:06:53,520 --> 00:06:57,063 they protect and also run time and wattage used per channel. 124 00:07:01,110 --> 00:07:06,110 Here's an example of a personal convoy, 125 00:07:06,120 --> 00:07:09,180 VIP jammer to protecting VIPs. 126 00:07:09,180 --> 00:07:11,760 And you can see the specs within there. 127 00:07:11,760 --> 00:07:14,550 I'll just expand on that a little bit there. 128 00:07:14,550 --> 00:07:16,770 You can see the channel one has a frequency 129 00:07:16,770 --> 00:07:19,950 between 20 and 60 megahertz. 130 00:07:19,950 --> 00:07:21,690 That gives you 40 megahertz. 131 00:07:21,690 --> 00:07:24,660 Now if each receiver on an IED can be configured 132 00:07:24,660 --> 00:07:27,060 down to 10 kilohertz, that's 4,000 channels 133 00:07:27,060 --> 00:07:28,770 that this jammer must protect against 134 00:07:28,770 --> 00:07:31,020 just within that channel one frequency. 135 00:07:31,020 --> 00:07:33,540 So we're talking about five watts per channel. 136 00:07:33,540 --> 00:07:36,210 You're looking at 20 kilowatts of power 137 00:07:36,210 --> 00:07:37,590 just for that channel one. 138 00:07:37,590 --> 00:07:40,500 So that's why jammers will use different techniques, 139 00:07:40,500 --> 00:07:43,353 whether it be spot, sweep or barrage for protection. 140 00:07:50,010 --> 00:07:51,450 You guys would've seen this diagram before. 141 00:07:51,450 --> 00:07:53,430 It's a pretty much radio frequency diagram 142 00:07:53,430 --> 00:07:56,264 all the way up from VLF to EHF. 143 00:07:56,264 --> 00:07:58,380 In the middle there, you'll see stuff that we use 144 00:07:58,380 --> 00:08:03,064 every day, for radio, wireless, mobile phones, 145 00:08:03,064 --> 00:08:04,964 short wave radio, and stuff like that. 146 00:08:13,050 --> 00:08:15,510 And you'll see the jammer essentially blocks out 147 00:08:15,510 --> 00:08:16,343 that frequency. 148 00:08:16,343 --> 00:08:17,880 You notice I haven't covered the lower frequencies. 149 00:08:17,880 --> 00:08:19,410 I'll get into those a little bit later on. 150 00:08:19,410 --> 00:08:21,840 So jammers effectively block anywhere between 151 00:08:21,840 --> 00:08:26,040 20 megahertz and 6,500 megahertz. 152 00:08:26,040 --> 00:08:27,870 There is some specialist jammers that'll block down 153 00:08:27,870 --> 00:08:31,530 to one megahertz, such as like radio frequencies, 154 00:08:31,530 --> 00:08:34,770 but that's huge scale jam protection. They're static. 155 00:08:34,770 --> 00:08:37,080 They're not mobile like we saw before on the humvee. 156 00:08:37,080 --> 00:08:40,173 So I was interested in what's below 20 megahertz. 157 00:08:46,800 --> 00:08:49,800 Here's an example of a IED, how an IED is put together. 158 00:08:49,800 --> 00:08:52,440 Obviously we're not gonna go into all the details of an IED 159 00:08:52,440 --> 00:08:53,940 and we're gonna focus on the switch component, 160 00:08:53,940 --> 00:08:56,670 but just so you know what we're looking at here. 161 00:08:56,670 --> 00:08:59,673 We have a container which essentially encompasses the IED. 162 00:09:00,614 --> 00:09:03,900 That can be anything. It can be a cigar box. 163 00:09:03,900 --> 00:09:07,020 It can be a steel box. It can be a cow, 164 00:09:07,020 --> 00:09:09,390 a dead cow on the side of the road or a vehicle. 165 00:09:09,390 --> 00:09:12,930 Obviously the shrapnel, the switch, the power source, 166 00:09:12,930 --> 00:09:15,570 and essentially the explosives down below. 167 00:09:15,570 --> 00:09:17,770 I'm only gonna focus on the switch component 168 00:09:24,960 --> 00:09:26,100 and you can see there, 169 00:09:26,100 --> 00:09:28,470 there's some military ordinance there. 170 00:09:28,470 --> 00:09:30,215 It makes a good IED because essentially it has 171 00:09:30,215 --> 00:09:33,900 some of those parts already, 172 00:09:33,900 --> 00:09:35,370 whether it be the container, the shrapnel 173 00:09:35,370 --> 00:09:37,410 and the main charge, so all we need to do 174 00:09:37,410 --> 00:09:40,413 is add power and a switch. 175 00:09:45,720 --> 00:09:47,580 So let's have a look at the different types of switches. 176 00:09:47,580 --> 00:09:49,440 We're not gonna go into all of them. I've written a paper. 177 00:09:49,440 --> 00:09:51,660 You can have a look at the other ones later on, 178 00:09:51,660 --> 00:09:53,550 but I was going from the bottom up. 179 00:09:53,550 --> 00:09:57,660 We have victim operated. This could be like a cigar box, 180 00:09:57,660 --> 00:09:59,790 similar to what the uni bomber used, 181 00:09:59,790 --> 00:10:03,147 where the victim opens it up and gets blown up. 182 00:10:03,147 --> 00:10:05,880 And we have a timer which, this could be anything, 183 00:10:05,880 --> 00:10:09,623 from a kitchen timer that can be a washing machine dial, 184 00:10:09,623 --> 00:10:12,510 or it can be something as complex 185 00:10:12,510 --> 00:10:13,998 as a number 10 delay pencil, 186 00:10:13,998 --> 00:10:16,020 which they used in World War II, 187 00:10:16,020 --> 00:10:18,990 which was essentially a pencil with a copper section, 188 00:10:18,990 --> 00:10:21,360 with a glass of vial inside that 189 00:10:21,360 --> 00:10:23,520 when you crush the copper section, 190 00:10:23,520 --> 00:10:25,590 the vial would break and cupric chloride 191 00:10:25,590 --> 00:10:30,123 would then melt a striker and then kick off the detonation. 192 00:10:31,230 --> 00:10:33,030 And the one we're looking at today is the command, 193 00:10:33,030 --> 00:10:34,563 the remote control component. 194 00:10:42,090 --> 00:10:43,800 So looking at the command, 195 00:10:43,800 --> 00:10:45,270 obviously we have things like trip wires 196 00:10:45,270 --> 00:10:46,103 and stuff like that. 197 00:10:46,103 --> 00:10:46,950 Now we're not looking at that today. 198 00:10:46,950 --> 00:10:48,770 We're looking at the radio control section. 199 00:10:48,770 --> 00:10:50,760 So in the red box there, 200 00:10:50,760 --> 00:10:53,280 you'll see things like cordless phone, mobile phone, 201 00:10:53,280 --> 00:10:56,220 garage door openers, baby monitors, and things like that. 202 00:10:56,220 --> 00:10:58,270 Something that can be triggered remotely. 203 00:11:01,110 --> 00:11:02,700 Now, the beauty of these technologies is 204 00:11:02,700 --> 00:11:04,230 when you're using things like mobile phone 205 00:11:04,230 --> 00:11:06,060 or cordless phones, digital phones, 206 00:11:06,060 --> 00:11:08,160 is they're being designed to put up with interference, 207 00:11:08,160 --> 00:11:09,390 So if they're being jammed, 208 00:11:09,390 --> 00:11:10,800 they'll actually switch frequencies. 209 00:11:10,800 --> 00:11:13,320 So jammers need to look at that and then 210 00:11:13,320 --> 00:11:15,093 move frequencies to support that. 211 00:11:22,200 --> 00:11:25,050 So I'm a bit of a practical guy. 212 00:11:25,050 --> 00:11:26,250 I'm happy to do the theory, 213 00:11:26,250 --> 00:11:28,800 but I like to look at the prac side together. 214 00:11:28,800 --> 00:11:31,980 So I've actually built the switch component of an IED 215 00:11:31,980 --> 00:11:33,393 with a garage door opener, 216 00:11:35,310 --> 00:11:36,750 but instead of having an initiator 217 00:11:36,750 --> 00:11:39,150 to kick the explosive off, I've just used a flashing light. 218 00:11:39,150 --> 00:11:40,700 That seemed a little bit safer. 219 00:11:52,650 --> 00:11:54,581 So you can see there's no container there. 220 00:11:54,581 --> 00:11:56,820 There's the power source, the 12 volt battery, 221 00:11:56,820 --> 00:11:59,010 the initiator, which is actually the light in this case 222 00:11:59,010 --> 00:12:00,810 and the remote control garage door, 223 00:12:00,810 --> 00:12:02,310 which is the switch component. 224 00:12:06,030 --> 00:12:07,980 I've done the same with a mobile phone. 225 00:12:09,540 --> 00:12:10,567 In this case, I haven't used a light. 226 00:12:10,567 --> 00:12:12,570 I've used a piece of nichrome wire, 227 00:12:12,570 --> 00:12:14,703 which is to act as an initiator. 228 00:12:32,850 --> 00:12:35,850 And I dunno if you can see that clearly, but it just lit up. 229 00:12:37,290 --> 00:12:39,420 So now that's the switch component, 230 00:12:39,420 --> 00:12:41,610 and then I'll show you how jammers work with that. 231 00:12:41,610 --> 00:12:44,730 So let's test our IEDs out in the field, 232 00:12:44,730 --> 00:12:46,290 first with a garage door opener, 233 00:12:46,290 --> 00:12:48,653 and then with a mobile phone. 234 00:12:49,552 --> 00:12:52,802 (explosive rock music) 235 00:13:50,472 --> 00:13:53,389 - [Automated Voice] Terrorists win. 236 00:13:55,443 --> 00:13:58,776 - [Audience] (applause) 237 00:14:00,140 --> 00:14:02,460 - So that was shot with a Phantom camera 238 00:14:02,460 --> 00:14:05,853 that does 1,000 frames per second to get that footage. 239 00:14:09,420 --> 00:14:10,680 So let's look at the counter measures. 240 00:14:10,680 --> 00:14:11,513 Let's look at the jammer. 241 00:14:11,513 --> 00:14:14,433 How does the jammer operate against these IEDs? 242 00:14:17,130 --> 00:14:19,800 Again, here's our garage door and let's have a look 243 00:14:19,800 --> 00:14:20,900 at what a jammer does. 244 00:14:47,010 --> 00:14:48,710 So it completely kills the signal. 245 00:14:53,160 --> 00:14:54,720 Again, let's have a look at the same example 246 00:14:54,720 --> 00:14:56,223 with a mobile phone. 247 00:15:28,606 --> 00:15:29,790 So you can see the jammer is very effective. 248 00:15:29,790 --> 00:15:30,960 This is just a portable jammer, 249 00:15:30,960 --> 00:15:33,150 but very effective in blocking the signal from the phone. 250 00:15:33,150 --> 00:15:35,550 Now the jammer will either block the transmitter, 251 00:15:35,550 --> 00:15:36,843 or the receiving device. 252 00:15:40,170 --> 00:15:41,820 Next we'll have a look at the jammer in the field. 253 00:15:41,820 --> 00:15:43,890 This case, I've used a more of a powerful jammer 254 00:15:43,890 --> 00:15:45,570 just because the ranges that we had to do. 255 00:15:45,570 --> 00:15:49,768 So this is based on a pelican suitcase jammer. 256 00:15:49,768 --> 00:15:53,018 (explosive rock music) 257 00:16:13,081 --> 00:16:15,998 - [Automated Voice] Terrorist wins. 258 00:16:17,990 --> 00:16:20,400 - So that jammer essentially blocks the communication. 259 00:16:20,400 --> 00:16:22,473 It's essentially a ten to one mute ratio. 260 00:16:27,180 --> 00:16:29,430 So now that we know how jammers work, 261 00:16:29,430 --> 00:16:31,330 where are the holes in the technology? 262 00:16:32,520 --> 00:16:34,290 So we can see the jammer will blocks those frequencies. 263 00:16:34,290 --> 00:16:37,440 We talked about it before, the 20 to 60 to 500 megahertz, 264 00:16:37,440 --> 00:16:39,030 but what about these other frequencies? 265 00:16:39,030 --> 00:16:40,593 VLF all the way down to ELF. 266 00:16:41,880 --> 00:16:43,140 You can see the wavelength size. 267 00:16:43,140 --> 00:16:44,850 I think that might be the problem of why jammers 268 00:16:44,850 --> 00:16:47,400 are not configured to work at those sort of ranges. 269 00:16:53,010 --> 00:16:54,706 Taking a closer look at these, 270 00:16:54,706 --> 00:16:56,940 the frequencies or wavelengths, 271 00:16:56,940 --> 00:16:58,500 you can see that they're used by the military, 272 00:16:58,500 --> 00:17:00,363 VLF, ULF, and ELF. 273 00:17:03,270 --> 00:17:05,430 And you can actually see that it's actually used 274 00:17:05,430 --> 00:17:07,800 from a military point of view for things like navigation 275 00:17:07,800 --> 00:17:11,223 is also a way of communicating to submarines underwater. 276 00:17:14,940 --> 00:17:17,640 So these wavelengths actually travel around the world. 277 00:17:23,550 --> 00:17:25,260 In the sixties there was actually a project called 278 00:17:25,260 --> 00:17:27,780 project Elf, where they actually built these rays. 279 00:17:27,780 --> 00:17:29,820 And you can see the sizing there, 280 00:17:29,820 --> 00:17:33,240 6,000 miles of buried cable and two 40 mile antennas 281 00:17:33,240 --> 00:17:34,560 to actually transmit. 282 00:17:34,560 --> 00:17:36,257 So you can see now why the jammers are pretty much 283 00:17:36,257 --> 00:17:38,250 not configured below 20, 284 00:17:38,250 --> 00:17:40,700 just 'cause of the size of the antennas required. 285 00:17:46,530 --> 00:17:49,830 Just to give you a visualization, how VLF works. 286 00:17:49,830 --> 00:17:52,860 Here's a cross section of the Earth, 400 kilometers. 287 00:17:52,860 --> 00:17:54,900 On the top Z, that's our ionosphere, 288 00:17:54,900 --> 00:17:57,660 that's 40 kilometers above the Earth surface. 289 00:17:57,660 --> 00:18:01,500 On the Y axis the lowest point is the Earths surface 290 00:18:01,500 --> 00:18:04,230 and you can see the VLF wavelength actually propagating 291 00:18:04,230 --> 00:18:06,333 or going around the Earths surface. 292 00:18:10,680 --> 00:18:13,713 So it's great for communication around the world. 293 00:18:20,640 --> 00:18:24,240 Okay. ULF lower than VLF, 294 00:18:24,240 --> 00:18:26,430 range from 300 Hertz to three kilohertz, 295 00:18:26,430 --> 00:18:29,730 wave length 1,000 to 100 kilometers in length, 296 00:18:29,730 --> 00:18:31,680 and the two kilohertz, which is gonna come up 297 00:18:31,680 --> 00:18:34,830 during this talk, the wave length's 150 kilometers long, 298 00:18:34,830 --> 00:18:37,290 and you can see by the antenna size at a half wave length, 299 00:18:37,290 --> 00:18:39,780 we're looking at a 75 kilometer antenna. 300 00:18:39,780 --> 00:18:42,360 Now having an IED with a 75 kilometer antenna up, 301 00:18:42,360 --> 00:18:44,283 is pretty obvious. 302 00:18:45,720 --> 00:18:48,570 The signal light travels through Earth and through water. 303 00:18:53,340 --> 00:18:55,230 I need to explain something called near field and 304 00:18:55,230 --> 00:18:57,300 far field. Some of you will already know what this is, 305 00:18:57,300 --> 00:18:58,680 but I need to cover this in depth 306 00:18:58,680 --> 00:19:01,410 so you can see what technology we're using here. 307 00:19:01,410 --> 00:19:03,690 I'll use the duck in the water example. 308 00:19:03,690 --> 00:19:06,090 So picture a dead duck that you chuck in a pond. 309 00:19:07,500 --> 00:19:09,150 When you chuck the duck in the water, 310 00:19:09,150 --> 00:19:11,300 it will bounce left and right, up and down. 311 00:19:12,900 --> 00:19:15,900 Away from that duck, you'll see ripples or waves 312 00:19:15,900 --> 00:19:17,403 form away from that target. 313 00:19:18,480 --> 00:19:20,550 Where the ducks moving left and right, up and down, 314 00:19:20,550 --> 00:19:22,470 we call that near field. 315 00:19:22,470 --> 00:19:25,920 Where it has those nice waves, consistent waves, 316 00:19:25,920 --> 00:19:27,213 we call that far field. 317 00:19:28,230 --> 00:19:29,520 When we're talking about far field, 318 00:19:29,520 --> 00:19:31,320 we're talking about all the wireless crap that you guys 319 00:19:31,320 --> 00:19:33,540 on a daily basis, mobile phone, garage store opener, 320 00:19:33,540 --> 00:19:36,180 baby monitors, everything. That's radio comms, 321 00:19:36,180 --> 00:19:38,640 but it's the near field part that I need to communicate to 322 00:19:38,640 --> 00:19:40,740 you guys on what this tech that I'm using. 323 00:19:47,100 --> 00:19:48,990 So here's a more technical than the duck view 324 00:19:48,990 --> 00:19:50,850 of near versus far. 325 00:19:50,850 --> 00:19:53,880 In this case, instead of the duck, we have the antenna, 326 00:19:53,880 --> 00:19:55,800 we have the wavelength reactive, 327 00:19:55,800 --> 00:19:57,540 I'll get into that a little bit later. 328 00:19:57,540 --> 00:19:59,793 moves into frotional pattern, then far field. 329 00:20:07,470 --> 00:20:12,450 Another technical view we have just before the transition 330 00:20:12,450 --> 00:20:14,190 period, that's our near field range 331 00:20:14,190 --> 00:20:15,150 and you can see something called 332 00:20:15,150 --> 00:20:16,650 an E field, electrical field, 333 00:20:16,650 --> 00:20:18,930 and also H field, magnetic field, 334 00:20:18,930 --> 00:20:21,930 essentially the antenna's getting it's shit together. 335 00:20:21,930 --> 00:20:23,670 It's 90 degrees out from phase, 336 00:20:23,670 --> 00:20:24,900 and as it moves into far field, 337 00:20:24,900 --> 00:20:27,663 which is essentially two wavelengths from the antenna. 338 00:20:29,160 --> 00:20:30,900 The reason I wanted to show you this, is the H field, 339 00:20:30,900 --> 00:20:33,150 is something that we're looking into, the magnetic field. 340 00:20:33,150 --> 00:20:34,470 We're not interested in the E field. 341 00:20:34,470 --> 00:20:36,660 It's the magnetic field we're after, 342 00:20:36,660 --> 00:20:38,103 before it reaches far field. 343 00:20:45,000 --> 00:20:46,710 Again, another diagram there. 344 00:20:46,710 --> 00:20:49,080 The point that I wanted to show you this diagram for 345 00:20:49,080 --> 00:20:52,500 is just where you can see where two wavelengths out 346 00:20:52,500 --> 00:20:57,500 for far field and one to two wavelengths for near field. 347 00:20:58,890 --> 00:21:01,170 And that reactive zone there near the antenna 348 00:21:01,170 --> 00:21:03,660 is actually, it transmits power. 349 00:21:03,660 --> 00:21:06,460 So we can actually transmit power in that reactive zone. 350 00:21:10,440 --> 00:21:11,820 And this is the far field. 351 00:21:11,820 --> 00:21:13,710 This is what we use pretty much every day 352 00:21:13,710 --> 00:21:15,210 with wireless comms. 353 00:21:15,210 --> 00:21:16,920 You can see we've got the electrical field 354 00:21:16,920 --> 00:21:20,040 and the magnetic field working at right angles, 355 00:21:20,040 --> 00:21:24,600 perpendicular to each other, with a clear path. 356 00:21:24,600 --> 00:21:25,950 This is like the waves from the ducks. 357 00:21:25,950 --> 00:21:28,383 It's just a clear communication path. 358 00:21:34,890 --> 00:21:36,330 And we use near field every day. 359 00:21:36,330 --> 00:21:40,500 You guys use it for payment processing or proximity cards 360 00:21:40,500 --> 00:21:45,500 running at 13.56 Megahertz or the older 125 kilohertz. 361 00:21:45,630 --> 00:21:48,390 You'll notice the antenna is a coil, 362 00:21:48,390 --> 00:21:50,430 and that coil is used to pick up that H field 363 00:21:50,430 --> 00:21:52,500 that we were talking about before in the near field range, 364 00:21:52,500 --> 00:21:53,343 not the E field. 365 00:21:59,324 --> 00:22:00,930 Now all our lives in security, we were taught 366 00:22:00,930 --> 00:22:04,890 near field, great for secure communications at short range. 367 00:22:04,890 --> 00:22:05,760 And that's true. 368 00:22:05,760 --> 00:22:08,070 It's got a great range from one to five centimeters, 369 00:22:08,070 --> 00:22:09,420 but what happens if we change that? 370 00:22:09,420 --> 00:22:11,283 What happens if we use two kilohertz? 371 00:22:12,120 --> 00:22:14,010 Our near field range is 75 kilometers. 372 00:22:14,010 --> 00:22:15,690 Now I can work with 75 kilometers. 373 00:22:15,690 --> 00:22:17,730 That gives me a communication channel that I can use 374 00:22:17,730 --> 00:22:20,122 as long as I can get a large enough antenna 375 00:22:20,122 --> 00:22:22,053 to communicate at that range. 376 00:22:30,060 --> 00:22:31,860 So how do we create a wavelength 377 00:22:31,860 --> 00:22:33,260 without the massive antenna? 378 00:22:35,820 --> 00:22:37,220 Something called Earth mode. 379 00:22:38,790 --> 00:22:41,190 We're essentially using the Earth as an antenna. 380 00:22:42,660 --> 00:22:45,030 So NATO defines Earth mode as three separate ways. 381 00:22:45,030 --> 00:22:46,110 I've gotta make sure that you guys know 382 00:22:46,110 --> 00:22:47,580 which one is which. 383 00:22:47,580 --> 00:22:49,410 The first one is, up and over. 384 00:22:49,410 --> 00:22:53,040 A large antenna is inserted into the ground and the VLF, 385 00:22:53,040 --> 00:22:54,840 that large wavelength or ULF 386 00:22:54,840 --> 00:22:57,750 will move up across and then down. 387 00:22:57,750 --> 00:23:00,180 That's not what we're using today. 388 00:23:00,180 --> 00:23:02,670 We have our Deep Strata Mining comms. 389 00:23:02,670 --> 00:23:04,200 The one that actually goes through the Earth. 390 00:23:04,200 --> 00:23:06,540 This is used in the mining industry. 391 00:23:06,540 --> 00:23:09,780 Up to eight kilometer loops on the surface of the Earth 392 00:23:09,780 --> 00:23:14,370 and uses a magnetic field to communicate down to miners. 393 00:23:14,370 --> 00:23:16,110 You guys may not be aware 394 00:23:16,110 --> 00:23:18,660 that you can't use radios underground. 395 00:23:18,660 --> 00:23:20,100 So there's ways of getting around that 396 00:23:20,100 --> 00:23:22,440 using magnetic fields. 397 00:23:22,440 --> 00:23:24,330 It can also be used for blasting as well. 398 00:23:24,330 --> 00:23:28,230 So if you've got a blast caps underground, 399 00:23:28,230 --> 00:23:29,910 you can actually send a signal which is safer 400 00:23:29,910 --> 00:23:31,740 from above the ground to blow it up. 401 00:23:31,740 --> 00:23:36,480 You can also communicate to miners on one way communication 402 00:23:36,480 --> 00:23:38,880 or used for asset tracking as well for objects 403 00:23:38,880 --> 00:23:40,180 that are under the ground. 404 00:23:41,340 --> 00:23:43,740 And the third one is the one that we're looking at today. 405 00:23:43,740 --> 00:23:45,180 It's an adaption of something called 406 00:23:45,180 --> 00:23:47,070 Conduction Current Mode, 407 00:23:47,070 --> 00:23:51,210 where two electrodes are inserted into the Earth 408 00:23:51,210 --> 00:23:53,850 with a voltage applied to both electrodes 409 00:23:53,850 --> 00:23:57,000 and a magnetic field is created in the Earth's surface 410 00:23:57,000 --> 00:23:58,620 to a receiving target. 411 00:23:58,620 --> 00:24:01,110 Now that can be either picked up by an E field, 412 00:24:01,110 --> 00:24:02,850 another two probes at the other end. 413 00:24:02,850 --> 00:24:04,020 I'm not interested in that. 414 00:24:04,020 --> 00:24:06,660 That was used by Morse and in World War I to communicate 415 00:24:06,660 --> 00:24:09,720 between bunkers. The one that we're using today is a 416 00:24:09,720 --> 00:24:11,403 magnetic field loop antenna. 417 00:24:16,620 --> 00:24:18,330 So before we create some hardware, 418 00:24:18,330 --> 00:24:20,370 we're gonna have to do some simulations to find out what's 419 00:24:20,370 --> 00:24:22,440 the best frequency, what's the best distance 420 00:24:22,440 --> 00:24:27,440 between electrodes and what's the best voltage to apply. 421 00:24:27,660 --> 00:24:29,790 So I used three different programs to do this. 422 00:24:29,790 --> 00:24:33,720 One's called ANSYS, one's RES2Mod, and one's CST Studio. 423 00:24:33,720 --> 00:24:35,280 You can see the block of the Earth we used for 424 00:24:35,280 --> 00:24:37,677 the simulation. Nine by nine by two kilometers, 425 00:24:37,677 --> 00:24:39,093 the two kilometers deep. 426 00:24:40,080 --> 00:24:42,450 And we used electrodes that were two meters in length, 427 00:24:42,450 --> 00:24:44,490 one meter into the ground. 428 00:24:44,490 --> 00:24:47,853 And they started off as 10 meters apart from each other. 429 00:24:52,860 --> 00:24:54,330 This will give you an idea of what the signal 430 00:24:54,330 --> 00:24:56,160 actually looks like. So from the simulation, 431 00:24:56,160 --> 00:24:58,590 you can actually now visualize to see that the signal 432 00:24:58,590 --> 00:25:01,200 not just travels along the surface of the Earth, 433 00:25:01,200 --> 00:25:03,303 it travels in the Earth itself. 434 00:25:07,650 --> 00:25:09,990 Again, radio frequencies don't travel underground, 435 00:25:09,990 --> 00:25:11,973 but at least low spectrum, it does. 436 00:25:15,660 --> 00:25:19,920 So the first three frequence we used were 73 kilohertz, 437 00:25:19,920 --> 00:25:22,530 nine kilohertz, and 0.1 kilohertz. 438 00:25:22,530 --> 00:25:24,960 And that shows you the bit of the range that we used. 439 00:25:24,960 --> 00:25:28,890 So 10 meter electrode separation, only one amp was applied. 440 00:25:28,890 --> 00:25:31,530 We're using no modulation, no pre amps. 441 00:25:31,530 --> 00:25:32,550 This is just basic, 442 00:25:32,550 --> 00:25:35,190 which frequency can generate the most amount of, 443 00:25:35,190 --> 00:25:36,490 in distance for signaling. 444 00:25:37,800 --> 00:25:39,870 And the 0.1, as you can see was at close to 445 00:25:39,870 --> 00:25:41,043 a kilometer in length. 446 00:25:46,680 --> 00:25:47,550 Here's a spreadsheet, 447 00:25:47,550 --> 00:25:50,700 more details in my paper about 73 kilohertz. 448 00:25:50,700 --> 00:25:53,670 We can effectively get a range of 1,600 meters 449 00:25:53,670 --> 00:25:57,583 using a thousand meter separation between electrodes, 450 00:25:57,583 --> 00:26:01,353 3,600 Watts of power, and that's the usable distance. 451 00:26:03,960 --> 00:26:07,080 At nine kilohertz you can see, we can get further distance. 452 00:26:07,080 --> 00:26:09,660 We can get up to 2,800 meters with nine kilohertz. 453 00:26:09,660 --> 00:26:11,850 Again, this is with no modulation. 454 00:26:11,850 --> 00:26:13,620 This is with no impedance matching. 455 00:26:13,620 --> 00:26:15,323 We'll get into that a little bit later. 456 00:26:18,810 --> 00:26:20,793 And finally, 0.1 megahertz. 457 00:26:21,889 --> 00:26:22,722 You can see there, 458 00:26:22,722 --> 00:26:25,043 we're getting ranges of up to five kilometers in length. 459 00:26:28,830 --> 00:26:31,683 And that was the simulation based on 0.1 megahertz. 460 00:26:35,460 --> 00:26:37,920 Now, why don't we just use 0.1 megahertz? 461 00:26:37,920 --> 00:26:39,870 It obviously goes really far. 462 00:26:39,870 --> 00:26:41,760 The problem we have is that that range, we're dealing with 463 00:26:41,760 --> 00:26:43,410 all the other nonsense in the world. 464 00:26:43,410 --> 00:26:46,290 So we're dealing with natural and manmade noise, 465 00:26:46,290 --> 00:26:50,100 natural being lightning strikes. So a lightning strike, 466 00:26:50,100 --> 00:26:51,300 I couldn't even believe this figure, 467 00:26:51,300 --> 00:26:54,330 8 million strikes per day hit the Earth. 468 00:26:54,330 --> 00:26:56,370 And like I showed you with that VLF wave length, 469 00:26:56,370 --> 00:26:57,540 that's goes around to Earth, 470 00:26:57,540 --> 00:26:59,400 exactly the same thing happens with lightning strikes 471 00:26:59,400 --> 00:27:01,592 and we're talking like a billion volts. 472 00:27:01,592 --> 00:27:03,092 So the signal goes pretty far. 473 00:27:04,500 --> 00:27:05,970 Manmade noise, we're talking about things 474 00:27:05,970 --> 00:27:07,800 like utilities, transformers, 475 00:27:07,800 --> 00:27:11,973 stuff that is a side effect of manmade equipment. 476 00:27:13,890 --> 00:27:17,430 So instead of using 0.1, which has a lot of noise, 477 00:27:17,430 --> 00:27:20,073 the best range was one to four kilohertz. 478 00:27:28,611 --> 00:27:29,730 In this slide, you can have a look at 479 00:27:29,730 --> 00:27:32,700 what it looks like between low power versus high power. 480 00:27:32,700 --> 00:27:36,240 Obviously the more power you submit, the longer the signal. 481 00:27:36,240 --> 00:27:39,390 So you can see one kilometer at 20 Watts, 482 00:27:39,390 --> 00:27:42,513 whereas we got 2.5 kilometers to 3,600 Watts of power. 483 00:27:48,240 --> 00:27:50,970 Also TX electrode separation, 484 00:27:50,970 --> 00:27:53,701 we've got one at 10 meters and one at 100. 485 00:27:53,701 --> 00:27:55,493 So we're starting to see a pattern here. 486 00:28:02,490 --> 00:28:04,110 Something I'll get into a little bit later, 487 00:28:04,110 --> 00:28:06,630 but it's something called normal versus tangential. 488 00:28:06,630 --> 00:28:08,760 Normal means an antenna is lying flat on the ground. 489 00:28:08,760 --> 00:28:11,130 That is that loop antenna lying flat on the ground. 490 00:28:11,130 --> 00:28:13,290 Tangential is when that area, that antenna, 491 00:28:13,290 --> 00:28:15,270 that loop is actually vertical, 492 00:28:15,270 --> 00:28:17,880 90 degrees from the Earth's surface. 493 00:28:17,880 --> 00:28:19,500 Now, why don't we use tangential? 494 00:28:19,500 --> 00:28:20,610 I'll get into that little bit later. 495 00:28:20,610 --> 00:28:21,720 We obviously get more distance, 496 00:28:21,720 --> 00:28:25,140 but we absolutely have some issues with an up and down, 497 00:28:25,140 --> 00:28:26,010 especially with an IED. 498 00:28:26,010 --> 00:28:28,620 You don't want that standing above the Earth's surface, 499 00:28:28,620 --> 00:28:30,320 but there's other reasons as well. 500 00:28:34,680 --> 00:28:36,600 We did some E-Field tests as well. 501 00:28:36,600 --> 00:28:39,180 You may remember from the picture I showed you before, 502 00:28:39,180 --> 00:28:40,680 And actually there's a tiny little picture there 503 00:28:40,680 --> 00:28:43,350 where we've got the E Field up the top in near field 504 00:28:43,350 --> 00:28:44,680 and also the H Field. 505 00:28:44,680 --> 00:28:46,890 This is done previously through history, 506 00:28:46,890 --> 00:28:48,993 as I said, Morse, and during World War I. 507 00:28:50,781 --> 00:28:52,081 The range was not as good. 508 00:28:58,740 --> 00:29:00,930 Another thing we had to take in effect before we designed 509 00:29:00,930 --> 00:29:03,090 our hardware was impedance matching. 510 00:29:03,090 --> 00:29:05,160 Impedance matching means matching the soil 511 00:29:05,160 --> 00:29:07,290 to what you are using the device in. 512 00:29:07,290 --> 00:29:09,510 By matching the impedance on the receiver 513 00:29:09,510 --> 00:29:12,810 and the transmitter, we actually got further gain 514 00:29:12,810 --> 00:29:15,750 from the hardware device and also within the simulations. 515 00:29:15,750 --> 00:29:19,440 So we can see, we got 1.5 kilometers in dry soil 516 00:29:19,440 --> 00:29:21,360 with matched impedance, 517 00:29:21,360 --> 00:29:23,659 but we only got 0.7 with non matched. 518 00:29:23,659 --> 00:29:25,950 In the hardware we needed to actually put in 519 00:29:25,950 --> 00:29:27,243 some impedance matching. 520 00:29:31,920 --> 00:29:33,931 Another thing to take into account because we're using 521 00:29:33,931 --> 00:29:37,680 frequencies which have a lot of noise 522 00:29:37,680 --> 00:29:39,810 is modulation techniques. 523 00:29:39,810 --> 00:29:42,480 The best one to use through the Earth is something called 524 00:29:42,480 --> 00:29:45,030 ANC, adapted noise cancellation. 525 00:29:45,030 --> 00:29:47,460 MLD, maximum likelihood detection, 526 00:29:47,460 --> 00:29:50,100 and DAFB, decision aided feedback. 527 00:29:50,100 --> 00:29:51,660 We could double our distance by using 528 00:29:51,660 --> 00:29:53,763 the right modulation techniques. 529 00:29:55,432 --> 00:29:56,850 In the paper that I've written, 530 00:29:56,850 --> 00:29:58,260 which is on the DEFCON media server, 531 00:29:58,260 --> 00:30:00,930 I've actually got schematics for different modulations, 532 00:30:00,930 --> 00:30:02,130 so you can try them out. 533 00:30:09,360 --> 00:30:12,810 We talked before about using power through the Earth. 534 00:30:12,810 --> 00:30:16,230 We can actually transmit at 3,600 Watts, 535 00:30:16,230 --> 00:30:18,090 we can actually move power through the Earth 536 00:30:18,090 --> 00:30:20,610 at about 50 meters. It's not a huge range, 537 00:30:20,610 --> 00:30:22,860 but we can actually move power through the Earth. 538 00:30:22,860 --> 00:30:24,210 And you might think, "Well, what's the point of that?" 539 00:30:24,210 --> 00:30:26,520 Well, it can be used in things like agriculture. 540 00:30:26,520 --> 00:30:28,560 We can actually run this across a farm 541 00:30:28,560 --> 00:30:30,710 and have sensors underground without power. 542 00:30:39,171 --> 00:30:42,240 I talked before about normal versus tangential 543 00:30:42,240 --> 00:30:45,113 antenna placement, where tangential had better range 544 00:30:45,113 --> 00:30:47,970 than normal. The beauty of normal is 545 00:30:47,970 --> 00:30:50,520 if you're lying it flat on the ground, 546 00:30:50,520 --> 00:30:51,873 it's immune from jammers. 547 00:30:54,450 --> 00:30:57,390 With tangential, in the unlikely scenario 548 00:30:57,390 --> 00:30:58,990 that someone's running a jammer, 549 00:30:59,850 --> 00:31:02,340 we're talking thousands of kilometers away in far field 550 00:31:02,340 --> 00:31:05,583 against the one to four kilohertz range, 551 00:31:06,600 --> 00:31:09,064 what we need to do is use two antennas 552 00:31:09,064 --> 00:31:10,950 at right angles to each other. 553 00:31:10,950 --> 00:31:13,260 And sometimes we would need a whip antenna 554 00:31:13,260 --> 00:31:14,433 to confuse the jammer. 555 00:31:21,990 --> 00:31:23,790 And just using the simulation software. 556 00:31:23,790 --> 00:31:27,120 we can actually say that by using the right frequency, 557 00:31:27,120 --> 00:31:29,760 the right separation, the right modulation, 558 00:31:29,760 --> 00:31:31,080 and upping the power, 559 00:31:31,080 --> 00:31:33,780 we can actually get big ranges with this thing. 560 00:31:33,780 --> 00:31:37,533 That's 4,200 meters, that's without pre amps. 561 00:31:41,940 --> 00:31:43,410 Okay that's enough of the simulation stuff. 562 00:31:43,410 --> 00:31:44,660 Let's go to the hardware. 563 00:31:45,570 --> 00:31:49,320 This was my prototype using those simulations. 564 00:31:49,320 --> 00:31:51,450 So on the left, we have the transmitter, 565 00:31:51,450 --> 00:31:56,450 which has got a signal generation power pack, a modulation. 566 00:31:56,580 --> 00:31:59,790 And on the right hand side, we have a circular antenna. 567 00:31:59,790 --> 00:32:03,870 I'll get deeper into that, a laptop for doing modulation 568 00:32:03,870 --> 00:32:08,100 as well as de logging encryption and stuff like that, 569 00:32:08,100 --> 00:32:09,660 and battery and analog. 570 00:32:09,660 --> 00:32:12,180 A lot of this can be replaced by using things like Arduino, 571 00:32:12,180 --> 00:32:13,803 where we can use pure synthesis. 572 00:32:18,960 --> 00:32:21,720 So here's our transmitter with a commercial version 573 00:32:21,720 --> 00:32:24,300 where we've replaced a lot of those parts 574 00:32:24,300 --> 00:32:27,330 with smaller parts obviously. When I design hardware, 575 00:32:27,330 --> 00:32:28,800 it's always best to build big, 576 00:32:28,800 --> 00:32:31,140 make it easier on yourself and then shrink it down, 577 00:32:31,140 --> 00:32:33,090 when you know it actually bloody works. 578 00:32:38,790 --> 00:32:40,890 So in this case, we're using the Arduino/Pi 579 00:32:40,890 --> 00:32:43,563 to do the encryption and processing. 580 00:32:52,710 --> 00:32:54,150 And here's the RX component. 581 00:32:54,150 --> 00:32:56,010 We shrunk that down quite considerably, 582 00:32:56,010 --> 00:32:57,933 again using a Arduino. 583 00:32:59,100 --> 00:33:01,200 You can see on the ground there, that circle, 584 00:33:01,200 --> 00:33:05,850 I'll give you a close up on that in a sec, and LCD display, 585 00:33:05,850 --> 00:33:09,360 so you can actually communicate not only on an IED, 586 00:33:09,360 --> 00:33:11,310 but you can actually communicate messages between 587 00:33:11,310 --> 00:33:13,510 transmitter and receiver at those distances. 588 00:33:19,320 --> 00:33:21,900 And on the one on the left, we have the transmitter, 589 00:33:21,900 --> 00:33:23,610 there's the electrodes. 590 00:33:23,610 --> 00:33:26,820 In the real world, in a IED setting, 591 00:33:26,820 --> 00:33:27,780 you're not gonna use electrodes. 592 00:33:27,780 --> 00:33:30,019 You're gonna use things that already exist, stop signs, 593 00:33:30,019 --> 00:33:34,020 picket fences, stuff like that. 594 00:33:34,020 --> 00:33:36,810 And on the right, we have our antenna, 595 00:33:36,810 --> 00:33:38,880 which I'll expand that out. 596 00:33:38,880 --> 00:33:41,370 So that's a one meter diameter antenna with copper wire 597 00:33:41,370 --> 00:33:44,583 that's rounded. That is our loop antenna at large scale. 598 00:33:54,030 --> 00:33:56,530 Here are the field tests that we did in Australia, 599 00:33:59,520 --> 00:34:02,160 TX electrodes, 50 meters apart. 600 00:34:02,160 --> 00:34:04,020 We only used 20 Watts of power 'cause we're in the middle of 601 00:34:04,020 --> 00:34:09,020 nowhere and we got to 923 meters in distance, 602 00:34:09,300 --> 00:34:11,553 and that was with basic ASK modulation. 603 00:34:16,980 --> 00:34:20,910 Something interesting that did pop up was this result here, 604 00:34:20,910 --> 00:34:23,970 and when on closer analysis, you'll see that red line 605 00:34:23,970 --> 00:34:26,010 that's going across from east to west, 606 00:34:26,010 --> 00:34:28,410 that was actually some fencing wire underground. 607 00:34:28,410 --> 00:34:31,260 So you'll notice the signal being a H field 608 00:34:31,260 --> 00:34:35,670 magnetic field actually transmitted along the wire. 609 00:34:35,670 --> 00:34:37,920 And the beauty of that is you can actually get 610 00:34:37,920 --> 00:34:39,930 longer distances by using something called 611 00:34:39,930 --> 00:34:41,370 utilities, assisted mode. 612 00:34:41,370 --> 00:34:42,867 And there's actually some literature on the internet where 613 00:34:42,867 --> 00:34:45,119 you can actually look where hobbyists are be using 614 00:34:45,119 --> 00:34:48,540 underground pipes in the UK to get longer signals 615 00:34:48,540 --> 00:34:52,620 with even basic equipment that I'm putting forward here. 616 00:34:52,620 --> 00:34:54,750 So in other words, if you're using it in an urban setting, 617 00:34:54,750 --> 00:34:56,200 you'll get further distances. 618 00:35:01,980 --> 00:35:04,883 Everything I built is home brew, so you can build your own, 619 00:35:10,350 --> 00:35:12,450 including the schematics. And again, 620 00:35:12,450 --> 00:35:14,050 they're all on the media server. 621 00:35:18,090 --> 00:35:20,090 So in summary, this is what we've built. 622 00:35:22,020 --> 00:35:24,240 We've got a commercial transmitter with two electrodes in 623 00:35:24,240 --> 00:35:26,280 the ground at varying distance. 624 00:35:26,280 --> 00:35:29,190 We've got a large scale jammer 625 00:35:29,190 --> 00:35:31,980 and we've got our loop antenna under the ground. 626 00:35:31,980 --> 00:35:33,830 So let's have a look at it in effect. 627 00:35:38,009 --> 00:35:41,259 (explosive rock music) 628 00:36:17,780 --> 00:36:20,697 - [Automated Voice] Terrorists win. 629 00:36:23,700 --> 00:36:27,033 - [Audience] (applause) 630 00:36:30,773 --> 00:36:32,460 - Besides the ID component, 631 00:36:32,460 --> 00:36:34,650 we have other use cases for this technology. 632 00:36:34,650 --> 00:36:36,720 Again, agriculture, which I mentioned before 633 00:36:36,720 --> 00:36:39,240 about communicating with underground sensors. 634 00:36:39,240 --> 00:36:40,590 Again, you don't need power. 635 00:36:40,590 --> 00:36:43,163 You can actually communicate short distance with power. 636 00:36:47,130 --> 00:36:49,020 Also another use case is spying. 637 00:36:49,020 --> 00:36:50,790 We're running at one to two kilohertz. 638 00:36:50,790 --> 00:36:52,350 The jammer, like I said, is not listening 639 00:36:52,350 --> 00:36:54,180 at 20 to 65 megahertz. 640 00:36:54,180 --> 00:36:56,460 And you need large antennas 641 00:36:56,460 --> 00:36:58,113 to pick these sort of signals up. 642 00:37:07,560 --> 00:37:09,060 Also in a war setting as well. 643 00:37:14,400 --> 00:37:16,020 So just to summarize, 644 00:37:16,020 --> 00:37:18,870 the device will communicate up to seven miles in length. 645 00:37:18,870 --> 00:37:21,180 It operates at 1 to 4 kilohertz, 646 00:37:21,180 --> 00:37:24,450 conductive current magnetic field ULF in near field, 647 00:37:24,450 --> 00:37:26,973 not far field. Jammers work in far field. 648 00:37:30,330 --> 00:37:33,090 Configurable from 20 Watts to 3,600 Watts 649 00:37:33,090 --> 00:37:34,440 and scale up to 20 kilowatt. 650 00:37:34,440 --> 00:37:36,090 Obviously the more kilowatts you're running, 651 00:37:36,090 --> 00:37:40,200 the more difficult hardware is to manage 652 00:37:40,200 --> 00:37:44,940 at the transmitter end. RX only runs on 20 Watts, 653 00:37:44,940 --> 00:37:47,040 impedance matching for different soil types, 654 00:37:47,040 --> 00:37:51,620 whether it be dry, sand or wet soil, encrypted message, 655 00:37:51,620 --> 00:37:55,353 modulation options, and as I said, jammer proof. 656 00:37:58,860 --> 00:38:00,030 And that's the end of the talk. 657 00:38:00,030 --> 00:38:02,930 If you want any further details on the tech 658 00:38:02,930 --> 00:38:05,730 you can have a look at the paper on the media server. 659 00:38:05,730 --> 00:38:07,338 Thank you very much. Thank you. 660 00:38:07,338 --> 00:38:11,096 - [Audience] (applause) 661 00:38:11,096 --> 00:38:12,096 - Thank you.