[00:00.600 --> 00:05.880]  I'm going to talk to you guys about biohacking using an SDR when you don't know what you're doing.
[00:06.000 --> 00:19.120]  And my name is J9, and I'm a security researcher, former systems administrator and former web developer.
[00:19.120 --> 00:21.900]  I'm almost done working on my bachelor's.
[00:22.260 --> 00:23.780]  I know, I'm fucking old.
[00:23.780 --> 00:25.420]  It's like, why are you still in college?
[00:25.800 --> 00:28.160]  I am an actual velociraptor.
[00:28.460 --> 00:32.080]  They've learned that in my family and at work.
[00:32.640 --> 00:39.300]  And so I have a health issue I'm trying to solve, and it led me down this road of what you're about to see.
[00:39.300 --> 00:43.060]  And my Twitter handle, if you want to follow me, is fuckyou99.
[00:43.800 --> 00:48.340]  Spelled F-A-C-K-Q-U-E-99.
[00:53.160 --> 00:55.440]  So what the hell is wrong with me?
[00:56.080 --> 01:04.580]  So for the last few years, I've been having trouble where I can't burp, I have horrible heartburn, and I don't poop often.
[01:04.880 --> 01:10.780]  So I went to the doctor, and I told him all of this, and he was like, yeah, there's something wrong there.
[01:10.780 --> 01:17.180]  So we did a whole shit ton of tests, and we're trying to get to the bottom of it.
[01:17.340 --> 01:29.740]  The can't burping part is probably the worst, because imagine you have an air bubble that gets stuck up here, and you can't let it out, so it just hurts all the time, and it just keeps moving up and down, and then you have to go into the bathroom and,
[01:29.740 --> 01:37.340]  like, make noises like you're gonna throw up until it comes out, and then it sounds like a giraffe being bludgeoned to death.
[01:37.960 --> 01:42.720]  And when you're in the bathroom with other people, everyone gets concerned.
[01:43.740 --> 01:44.980]  Like, oh my god, are you okay?
[01:44.980 --> 01:46.080]  Did you have too much to drink?
[01:46.080 --> 01:47.660]  And I'm like, no, no, no, I just had to burp.
[01:47.660 --> 01:48.900]  They're like, what the fuck?
[01:49.120 --> 01:49.540]  Yeah.
[01:50.820 --> 01:51.460]  Yeah.
[01:52.980 --> 02:00.200]  So we had some medical tests done, and there were two tests done on the same day, and one of them was a manometry.
[02:00.220 --> 02:17.640]  And if you don't know what a manometry is, the gentleman to my right here, wearing the lovely pasties, because this is family-friendly after all, has a large tube of pressure sensors that get shoved up your nose until it goes down into your throat, and the tube is basically,
[02:17.640 --> 02:20.820]  like, pushed all the way down into your esophagus, into your stomach.
[02:21.120 --> 02:28.700]  You're awake during this, and then after the tube is in, they feed you, like, little baby bird portions of saline, and you have to swallow.
[02:28.700 --> 02:32.120]  And as you swallow, they measure the pressure of the esophagus all the way down.
[02:32.300 --> 02:37.100]  So when they tried to get the tube up my nose, they gave me lidocaine, but lidocaine doesn't do shit for me.
[02:37.220 --> 02:46.880]  So apparently, when you're in the hospital, and you're in an operating room setting, there's four analgesics that are approved for use in that setting, and they're made from cocaine.
[02:49.980 --> 02:51.260]  So they gave me that.
[02:51.260 --> 02:53.840]  My doctor literally said, go get the rocket.
[02:56.280 --> 02:59.900]  They gave it to me, and he looked at me, and he goes, now you're ready to be a stockbroker.
[02:59.900 --> 03:01.080]  And I'm like, thank you.
[03:01.760 --> 03:03.860]  Just skip right over the Series 7.
[03:04.400 --> 03:07.780]  So, you know, they get it up there.
[03:07.780 --> 03:13.400]  I'm, I'm, like, focusing on something so it doesn't hurt so much, because it is literally actually torture.
[03:13.560 --> 03:25.920]  And we, we did the test, and they noticed that there were issues where the upper esophageal sphincter squeezing way too much, and my esophagus itself is just like, I don't fucking know what you want from me, but I ain't doing shit for you.
[03:26.020 --> 03:31.240]  So we had the next medical test, and that was a pH sensor test.
[03:31.240 --> 03:45.780]  So after they pulled this giant snake out of my face, the, the beautiful, wonderful, lovely, and I love this man, anesthesiologist, hit the plunger on ketamine, because this hospital uses ketamine to knock your ass the fuck out.
[03:45.920 --> 03:59.500]  So I get knocked out, and they proceed to outfit me with a medical device in my esophagus, right above my stomach, that will measure the pH while I'm not on my acid reflux medication.
[03:59.500 --> 04:07.280]  And it stays pinned in there for about four days, or five days, and it'll detach on its own and pass through your system and, and go away.
[04:08.140 --> 04:24.960]  While I was under, I didn't know that the combination of cocaine and ketamine can actually cause your brainwaves to change to, like, a delta pattern, which is similar to what happens to you when you have DMT, which is also similar to what happens to you when you're dying.
[04:25.540 --> 04:34.160]  So I'm laying there, and my mom, who's been dead for about 15 years, came, like, tapped me on the shoulders, and she's like, hey, kiddo.
[04:34.160 --> 04:35.720]  She's like, come with me.
[04:37.740 --> 04:39.540]  So I said, okay, let's go.
[04:41.420 --> 04:46.440]  And so we went through the wall, and I, I looked at my body behind me, I'm like, fuck that bitch right there.
[04:46.440 --> 04:47.380]  Fuck that.
[04:47.680 --> 04:51.840]  So, and then we went on this amazing adventure, and it was all, like, black.
[04:52.900 --> 04:57.560]  And we came upon this thing that I can only describe as a sun, but with no heat.
[04:57.940 --> 04:59.860]  And, all right, here's where it gets weird.
[05:00.660 --> 05:02.460]  If it wasn't weird already.
[05:04.780 --> 05:06.580]  So there's a sun with no heat.
[05:06.620 --> 05:11.700]  And my mom and I are having a conversation, but we're not using our mouths, because you don't have to, and everything's telepathic.
[05:11.700 --> 05:18.600]  And so she turns into, like, this piece of paper and, like, envelopes into the sun like an onion skin, and then I do the same thing.
[05:18.600 --> 05:21.740]  And you know how they say, like, your life flashes before your eyes?
[05:21.920 --> 05:27.320]  What that is, is you're uploading all of your experiences that you've already had to this thing.
[05:27.680 --> 05:37.820]  And so what I came out of this experience with was, we're all actually part of this thing, and we are the only way this thing can grow.
[05:37.820 --> 05:47.180]  And this thing, if I had to place an age on it, is like an angsty teenager, which makes sense, because I think the whole world is basically angsty teenagers.
[05:48.000 --> 05:51.720]  So yeah, long story short, God's an angsty teenager.
[05:51.720 --> 05:52.780]  He doesn't know shit.
[05:52.780 --> 05:54.240]  We're all onion skins.
[05:55.480 --> 05:57.120]  The sun is not hot.
[05:57.260 --> 05:58.600]  And then I came back.
[05:58.600 --> 06:00.840]  And when I woke up, I woke up screaming.
[06:02.500 --> 06:03.980]  I scared the nurses.
[06:03.980 --> 06:04.940]  I made one of them cry.
[06:04.940 --> 06:05.820]  It was great.
[06:07.920 --> 06:11.700]  But the cool thing is, when you wake up screaming, they give you all the apple juice you want.
[06:14.200 --> 06:16.420]  So you're probably thinking, wait a minute, what?
[06:16.740 --> 06:19.240]  So let's take a step back for a second.
[06:19.240 --> 06:28.300]  So a pH sensor was put into my body, and this pH sensor sent data to a receiving device that I had to wear.
[06:28.300 --> 06:38.060]  So when I woke up, I was wearing this little mechanical purse that just would beep with flashing lights every now and then, which is horrible when you're trying to sleep, because it's the brightest goddamn thing in the room.
[06:38.380 --> 06:40.660]  And they told me, wear this for four days.
[06:40.660 --> 06:44.980]  It's going to record whatever the sensor inside your body is saying.
[06:44.980 --> 06:45.960]  And I'm like, okay.
[06:46.480 --> 06:48.820]  So can I listen to it with a software -defined radio?
[06:49.580 --> 06:51.500]  And they were like, I don't know what that is.
[06:53.640 --> 06:58.640]  So kind of in a haze, I just was telling all the nurses and doctors, I'm going to hack this thing.
[06:58.640 --> 07:01.000]  I'm going to fucking hack the shit out of it when I get home.
[07:01.500 --> 07:02.760]  I don't know how to do it.
[07:02.760 --> 07:04.240]  I'm going to fucking do it.
[07:04.760 --> 07:14.240]  So I get home, and immediately, once I'm actually not falling over and bumping into walls, I realize that I have limited time to do this.
[07:14.240 --> 07:19.560]  The test ends in four days, and I also had no idea what the fuck I was doing.
[07:19.760 --> 07:24.840]  So I figured, let me try and get started.
[07:24.840 --> 07:31.740]  So I started Googling what software to use and how to get started, and I did have a software-defined radio that I got at DEF CON 27.
[07:32.360 --> 07:40.960]  So I pulled that out of a box, and I hooked it up to my machine, and after some Googling, I realized SDR Sharp would be a great way to start.
[07:41.080 --> 07:43.140]  So I installed that on my machine.
[07:43.140 --> 07:46.520]  There were issues installing SDR Sharp, because I had a Windows 10 machine.
[07:46.580 --> 07:51.900]  Antivirus thinks it's malicious, but your face is malicious, so whatever.
[07:52.720 --> 07:55.600]  Then there were issues installing the drivers.
[07:56.120 --> 08:12.520]  The ones on the SDR Sharp website don't actually work, so you need to do it a slightly different way, and you can, if you Google for SDR Sharp driver Windows 10, you get this awesome link, and the guide to install it is basically idiot-proof.
[08:12.900 --> 08:20.240]  Everything you need is actually already in your install of SDR Sharp, but the documentation on the SDR Sharp website doesn't say that.
[08:21.440 --> 08:28.820]  So I hooked up my SDR, and I didn't listen yet, because I didn't know what to listen for.
[08:28.820 --> 08:33.200]  So I figured, okay, well, if it's radio-based, it's got an FCC ID.
[08:33.440 --> 08:47.600]  So I searched for the FCC ID, and I found the information that said it was operating frequency that was allowed for the 433.92 megahertz.
[08:48.140 --> 08:53.920]  And then I was like, okay, well, let me learn a little bit more about this device, and I researched the patent of the device.
[08:54.680 --> 09:01.680]  Because, you know, I knew who made the device, and I figured, you know, they have to have filed for a patent, and they did.
[09:01.680 --> 09:05.500]  So I found all of that information, and the patent was really complete.
[09:05.500 --> 09:09.760]  I mean, these guys were basically like, yeah, here's how you can go home and make your own, you know.
[09:10.500 --> 09:21.540]  So I'm not really great at reading electronics-based drawings, so I don't know what half the shit says, but I know, you know, I kind of get it.
[09:22.140 --> 09:27.760]  So the way it actually works is, it uses an ion-sensitive field effect transistor.
[09:27.760 --> 09:30.900]  I had to google the shit out of that, because I was like, I don't know what the fuck that is.
[09:31.540 --> 09:33.120]  And that's the pH sensor.
[09:33.120 --> 09:48.200]  So essentially what happens is, that's what comes in contact with the H positive ions, and depending on how many ions it detects, it spits out a number, and that's your pH reading.
[09:49.400 --> 09:59.520]  So to continue with the patent, the other awesome thing about the patent was, it had the packet structure for how the data was going to be sent to the device that you had to wear around you.
[09:59.600 --> 10:07.820]  So I was like, okay, this is great, but it didn't necessarily say how many bytes or how many bits each thing was.
[10:07.820 --> 10:13.400]  You don't know how long the preamble is, you don't know how long the transmitter ID, message ID, data, or checksum is.
[10:13.400 --> 10:16.060]  So you've got to kind of figure that out.
[10:16.420 --> 10:19.660]  And then I thought, all right, now let me try and capture it.
[10:19.660 --> 10:29.340]  So I opened up SDR Sharp, and I actually found it not exactly at 433.92, and that was something interesting that I didn't know, that 433.92 is kind of a suggestion.
[10:29.360 --> 10:30.880]  It's like, it's going to be around here.
[10:31.160 --> 10:39.340]  So I kept surfing around, and I finally found it, and it's literally that little tiny blurb, blip, right?
[10:39.340 --> 10:41.140]  You could see it kind of in the center.
[10:43.260 --> 10:46.440]  That little itty-bitty dark spot, that's it chirping.
[10:47.080 --> 10:53.660]  And it was really weak, and it was competing with everything in my house that's also on the same frequency.
[10:54.160 --> 10:56.900]  So I got a lot of noise when I captured it.
[10:57.400 --> 10:59.760]  And then I asked myself, had others done this before?
[10:59.760 --> 11:01.520]  Am I doing this the right way in the first place?
[11:01.520 --> 11:04.860]  Am I even, like, going down the same, the right path?
[11:04.880 --> 11:09.240]  Or did someone else find something that maybe I didn't catch on to?
[11:09.260 --> 11:12.560]  And I did find that there were two other researchers who had done this before.
[11:12.560 --> 11:20.240]  One of them was named Justin Dulski, and he captured the sensor emanations using an application called GQRX in Linux.
[11:20.360 --> 11:24.840]  Well, he used a Mac, which I guess is actually Linux.
[11:24.840 --> 11:29.080]  He also saved emanations as AM demodulated audio.
[11:29.080 --> 11:35.720]  So then I went back and did the same thing, and I heard it actually go, you know, and I was like, ooh, that's cool.
[11:35.720 --> 11:37.300]  I need that to be my ringtone.
[11:38.740 --> 11:49.100]  He used an application called Odyssey to analyze the waveform and decode it, and he also found the same patent information and used the packet format information that I also found to decode his results.
[11:49.140 --> 11:52.140]  And his link to find that is here.
[11:53.300 --> 11:55.320]  James Wu was the other researcher.
[11:55.320 --> 12:09.500]  He had a far more technical write-up that actually delved into the waveforms and math and bit length and pulse modulation and encoding, and I had to Google everything.
[12:10.000 --> 12:12.140]  I was like, I don't know what this means.
[12:12.340 --> 12:18.660]  But he also used an application called RTL433 to capture and decode the sensor emanations on the fly.
[12:19.520 --> 12:24.320]  And that's kind of like, in my opinion, that's kind of cheating a little bit, because the application is doing everything for you.
[12:25.040 --> 12:28.660]  I know it's not actually cheating, but like, I don't know.
[12:28.780 --> 12:30.180]  I don't know.
[12:30.300 --> 12:31.720]  That's the easy way.
[12:32.020 --> 12:44.680]  But he speculated the formula for converting the raw pH readings into actual pH, and since he was able to see his human-readable pH levels on his monitor, I was not.
[12:44.680 --> 12:47.300]  Mine weren't coming up on the screen.
[12:47.700 --> 12:57.000]  There's his link there, and as you can see on the right, he found some great information about modulation and bit length.
[12:57.660 --> 13:03.920]  So then I followed his instructions and I did exactly the same thing, and I got the pH readings.
[13:03.920 --> 13:18.300]  I was like, cool, okay, but I also got the actual hexadecimal codes to look for, and now I had something to actually say, now if I find something, I know I'm on the right track, because I had all these recordings, but I didn't know what the hell I was looking at,
[13:18.300 --> 13:21.440]  because it was a mess, because none of it was really truly clean.
[13:24.200 --> 13:29.640]  So I said, okay, now let's do it the hard way, because mama didn't raise no script kitty.
[13:30.960 --> 13:31.880]  Hell no.
[13:31.880 --> 13:36.260]  She would smack the shit out of me if she was alive and I tried to do shit the easy way.
[13:37.300 --> 13:51.160]  So now I knew what to look for, 59-bit hex string, preambles, first nine bytes, TXID, 16 bits, message ID, eight bits, pH reading, another eight bits, another pH reading, another eight bits, and check some eight bits.
[13:51.160 --> 13:58.640]  So the reason why there's two pH readings is because it actually reads every six seconds, but only chirps at you every 12 seconds.
[13:58.640 --> 14:02.880]  So every 12 seconds, it gives you the two readings, the first one and the second one.
[14:03.420 --> 14:18.420]  And through more Googling, I heard about Universal Radio Hacker to both record and analyze RF emanations, so I wouldn't need SDR sharp anymore, so I installed that on Kali Linux in a VM, and I needed Python 3 and NumPy to do that.
[14:18.940 --> 14:25.240]  So I got that running, and I tuned in and recorded it, clicked analyze, and instantly filled my hard drive.
[14:27.300 --> 14:28.420]  Oops.
[14:28.500 --> 14:37.880]  I crashed URH about a bazillion times, started clicking around like a toddler, Googled everything, and finally got some bytes that made sense.
[14:37.880 --> 14:40.200]  That process took a few hours.
[14:40.200 --> 14:48.360]  But my family was just like, all right, you just do what you're doing, we're just going to leave you alone, because for a while everyone was like, I'm hungry.
[14:49.320 --> 14:51.320]  I need food.
[14:51.380 --> 14:53.200]  I'm like, go away.
[14:53.220 --> 14:55.120]  So yeah, they did.
[14:56.060 --> 14:56.880]  So yeah.
[14:56.880 --> 15:01.320]  So here's an example of something I was able to pull out with URH.
[15:01.320 --> 15:04.240]  Now, I don't need this entire string of bits right here.
[15:04.240 --> 15:07.700]  I only needed the first few chunks.
[15:07.700 --> 15:09.200]  And this is not actually complete.
[15:09.200 --> 15:15.060]  This does not include the preamble, and it doesn't include the TXID, but it includes... I'm sorry, no.
[15:15.060 --> 15:19.480]  It doesn't include the preamble, but it includes the TXID and the message ID.
[15:19.480 --> 15:25.120]  And now, since I already knew what to look for with the TXID and the message ID, right?
[15:25.120 --> 15:30.460]  The message ID being BD, and the TXID being FF6D, right?
[15:30.460 --> 15:32.660]  So it's FF6DBD.
[15:33.320 --> 15:39.060]  As you can see in here, you've got that DB6DB.
[15:40.180 --> 15:41.160]  There you go.
[15:41.160 --> 15:42.380]  That's part of it.
[15:42.420 --> 15:50.160]  So since I don't need the preamble, because it's just going to go anyway, I pulled out the piece I needed.
[15:50.160 --> 15:56.000]  I knew how many bytes I needed or bits out of this piece, and I was able to decipher what it was saying manually.
[15:57.320 --> 15:59.460]  Now, pencil's down.
[15:59.460 --> 16:00.500]  The test is over.
[16:00.500 --> 16:17.220]  I have to hand in the little tiny device that I'm wearing back to the hospital, but I wasn't done testing, because now I wanted to be able to take what I had and retransmit it into a receiver to see if I could change the data and have the receiver accept data that's fake,
[16:17.220 --> 16:24.180]  or accept too much data, or what happens if the receiver accepts data that shouldn't even work?
[16:25.020 --> 16:35.300]  So I tried to buy a receiver off of eBay, but it got cancelled, because I think the dude just wanted $75, and there was no actual device.
[16:35.560 --> 16:38.820]  So I couldn't get that, so I tried to buy another one.
[16:38.820 --> 16:47.700]  It would have taken two weeks to get to me, and that was too long, because the device, according to the patent, the batteries run out after four days, the sensor device.
[16:47.700 --> 16:51.040]  And I had already had it in my body for four or five at that point.
[16:52.220 --> 17:00.480]  So yeah, I would have liked to have messed with my test results, but I also didn't want to mess with my test results, because I didn't want to piss off the doctor.
[17:00.480 --> 17:10.660]  But at the time, I also didn't realize that my SDR was receive-only, so I wouldn't have been able to do that anyway without going shopping first.
[17:11.520 --> 17:14.420]  And yeah, so the implant was still chirping every 12 seconds.
[17:14.420 --> 17:18.400]  I started experimenting results with results from eating different foods.
[17:18.400 --> 17:21.820]  So while it was still in there, I was like, all right, well, what happens if I eat hot sauce?
[17:21.880 --> 17:23.400]  What happens if I have orange juice?
[17:23.460 --> 17:25.080]  What happens if I have coffee?
[17:25.200 --> 17:26.500]  What happens when I drink water?
[17:26.500 --> 17:28.780]  So I was trying to like get those different readings.
[17:28.780 --> 17:35.000]  And then as it, after it detached, and you could tell when it detaches because you're just like, oh my god, that feels so much better.
[17:36.380 --> 17:39.280]  I followed it like through my digestive tract.
[17:39.280 --> 17:43.600]  So every few hours, I would take a reading and be like, what's it doing now?
[17:43.640 --> 17:45.520]  I think it's in my poop.
[17:45.560 --> 17:46.160]  Yeah.
[17:46.540 --> 17:52.780]  So speaking of, I made the decision to recover the implant because it still had some life in it.
[18:01.220 --> 18:03.820]  So I could do pH baseline testing.
[18:03.820 --> 18:15.660]  So I went on Amazon and I ordered those pH strips that they give you like in middle school, that like you put something on it changes color, you know, so if you lick it, and it comes out basic, you're like, I'm so basic.
[18:16.160 --> 18:21.460]  So I bought those, and I waited.
[18:22.020 --> 18:23.640]  And all
[18:27.120 --> 18:29.980]  right , so I love my husband.
[18:30.840 --> 18:31.820]  I really do.
[18:31.820 --> 18:33.300]  He's a very patient man.
[18:33.780 --> 18:36.600]  But he knew what he signed up for when he married me.
[18:39.720 --> 18:47.440]  So he goes into the bathroom, he's like, honey, I'm like, yeah, he's like, um, what's the bucket for?
[18:48.300 --> 18:54.300]  And it is actually the orange Home Depot bucket that says let's do it.
[18:59.880 --> 19:03.340]  Because you know, when you're when you're thinking about what bucket should I use for this?
[19:03.340 --> 19:04.880]  What do I have in my house already?
[19:04.880 --> 19:07.520]  I don't want to spend money on something I'm gonna shit in.
[19:09.200 --> 19:10.280]  I was like, oh, cool.
[19:10.280 --> 19:12.340]  The one we painted the living room with that'll work.
[19:13.840 --> 19:23.420]  So yeah, I shit into a bucket, slapped on some rubber gloves, and unfortunately, it wasn't in that poop.
[19:26.140 --> 19:39.920]  So after I got done, I realized I probably should have before sticking my hands in there, gone back over to my computer, turned on the software to find radio to see if I was still chirping every 12 seconds.
[19:40.580 --> 19:41.940]  But I didn't do that.
[19:41.940 --> 19:43.400]  I was like, all right, let's just fucking go.
[19:43.400 --> 19:45.360]  Let's get in there, you know.
[19:45.360 --> 19:49.820]  And you know, in your brain, like the whole time this is happening, your brain is like, that's chocolate mousse.
[19:49.820 --> 19:50.860]  That's chocolate mousse.
[19:50.860 --> 19:52.160]  That's chocolate mousse.
[19:52.440 --> 19:54.100]  You're like, no.
[19:54.100 --> 19:54.820]  Yeah.
[19:55.520 --> 19:57.860]  So try, try again, right?
[19:57.940 --> 19:59.020]  Try, try again.
[19:59.020 --> 20:05.460]  So it took some laxatives and the next day it was go time again.
[20:05.540 --> 20:18.700]  So of course the bucket had already been used, so I had to bring it out to the front yard and get the sprayer hose and put on the equivalent of like a hazmat suit and spray shit out of the bucket in front of the neighbors.
[20:24.060 --> 20:27.780]  And everyone's looking at me like, I think she needs a beer.
[20:30.560 --> 20:32.680]  So yeah, that's the power of the Home Depot.
[20:32.700 --> 20:42.860]  It did come out in the second trip to the bucket and there was much cleaning of the sensor and that's how big the sensor is.
[20:42.860 --> 20:51.920]  And I have it next to a guitar pick for scale and I have it with me if anyone would like to see it and get hands on with it.
[20:51.920 --> 20:53.440]  You can even taste it if you want.
[21:04.500 --> 21:09.340]  So after I got that out, I did do more testing with it and then it died.
[21:09.340 --> 21:11.560]  It died on me day 14.
[21:11.800 --> 21:13.440]  I did the lemon juice test.
[21:13.440 --> 21:17.120]  I thought, cool, I wanted to do the bleach test next and it was dead.
[21:17.120 --> 21:18.500]  And I'm like, no.
[21:18.780 --> 21:36.140]  But I got the results I wanted to be able to formulate some sort of baseline based on the numbers that I was being shown in the actual pH readings and what the actual pH was on the litmus strip of the same liquids that I was sticking the device and the litmus strip into at the same time.
[21:36.140 --> 21:40.940]  And I was able to refine the calculation that Justin Wu made.
[21:41.300 --> 21:42.860]  His was way over complicated.
[21:42.860 --> 21:47.960]  It's literally just the number divided by 25.5 and you get the actual pH.
[21:47.960 --> 21:52.360]  So for me, that's kind of like, okay, did I extend the work that they did?
[21:52.360 --> 21:54.080]  I feel like I did.
[21:54.080 --> 21:54.600]  I don't know.
[21:54.600 --> 21:58.600]  I don't think either of them went to the point where they're, you know, let me dig around my poop.
[22:00.180 --> 22:01.140]  So, yeah.
[22:01.700 --> 22:06.680]  But anyway, the pitfalls in trying to learn all of this is I fucked up a lot during the way.
[22:07.520 --> 22:09.180]  There was a limited time to do this.
[22:09.180 --> 22:10.120]  Life gets in the way.
[22:10.120 --> 22:11.040]  I worked full time.
[22:11.040 --> 22:11.800]  I have a family.
[22:11.800 --> 22:13.580]  Obviously they're hungry all the time.
[22:14.040 --> 22:16.060]  The implant's battery died at day 14.
[22:16.060 --> 22:19.760]  The receiver would not arrive from eBay in time, so I couldn't test with the receiver.
[22:19.760 --> 22:25.260]  I still could if I wanted to order a receiver and then just try to replay the stuff in there.
[22:25.560 --> 22:30.740]  The capture data that I had was not always usable, because again, there's a lot of noise.
[22:31.100 --> 22:35.700]  I had difficulty trying to capture a clean signal where I was.
[22:35.740 --> 22:39.000]  Had I known that we had a Faraday tent at work, I would have gone there.
[22:39.200 --> 22:42.520]  Although I don't think they would have let me poop into a bucket at work.
[22:42.520 --> 22:44.460]  That might have been too much.
[22:45.040 --> 22:47.600]  And there was an enormous learning curve.
[22:48.480 --> 22:51.900]  So I had all this data that I recorded.
[22:51.900 --> 22:53.520]  Some of it I couldn't quite figure out.
[22:53.520 --> 22:59.140]  I couldn't figure out if the data I was looking at was pure enough for me to actually get real results from.
[22:59.140 --> 23:01.060]  So I went to ShmooCon.
[23:01.440 --> 23:03.140]  And I went to the RF Village.
[23:03.140 --> 23:05.500]  And I participated in the RF Village CTF.
[23:05.500 --> 23:08.520]  And while I was there, I asked all my questions.
[23:08.780 --> 23:10.420]  And it was wonderful.
[23:10.420 --> 23:11.880]  These guys are amazing.
[23:11.880 --> 23:13.180]  Seriously, can we clap for them?
[23:13.180 --> 23:14.600]  Because they're fucking awesome.
[23:15.700 --> 23:17.720]  You guys are fucking awesome.
[23:18.000 --> 23:19.780]  You made this shit possible.
[23:19.880 --> 23:20.800]  You guys.
[23:20.940 --> 23:24.840]  So yeah, some of the data I was seeing in my capture was confusing.
[23:24.840 --> 23:26.320]  They helped me figure it out.
[23:26.320 --> 23:38.540]  They showed me like different ways to kind of weed out noise, how to play with like the FTTs and stuff and kind of refine where your zero point is to try and turn your wave into the right thing.
[23:38.540 --> 23:43.660]  At the time, I also was confused about ASK and FSK and they really explained it well.
[23:43.660 --> 23:46.320]  A lot better than the internet was explaining it.
[23:46.640 --> 23:48.660]  And yeah, they just freely shared their knowledge.
[23:48.660 --> 23:49.480]  It was amazing.
[23:49.480 --> 23:51.320]  And then I did the RF CTF and it was fun.
[23:51.320 --> 23:53.200]  So 10 out of 10, highly recommend.
[23:54.880 --> 23:56.220]  So my findings.
[23:56.560 --> 23:58.520]  I still don't know what the fuck I'm doing.
[23:59.740 --> 24:01.680]  But I learned a shit ton.
[24:02.540 --> 24:06.880]  The data recorded in the RF emanations was unencrypted, obviously.
[24:06.900 --> 24:09.840]  The implant and receiver were not key paired.
[24:10.080 --> 24:11.440]  So that's an issue.
[24:11.440 --> 24:18.200]  I know that the company that makes the medical device has a submission area where I could report this to them.
[24:18.200 --> 24:21.900]  And I probably will, but they're probably going to be like, yeah, yeah, yeah, we know.
[24:21.960 --> 24:30.440]  They did somewhat obscure the data by having it be in a packet format and hexadecimal.
[24:30.440 --> 24:33.920]  And I mean, it's obviously not clear text in that way.
[24:33.920 --> 24:37.560]  I mean, it's not going to tell you, hey, the pH is this.
[24:37.760 --> 24:42.160]  But if someone like me can figure this out in four days, really anybody can.
[24:42.160 --> 24:43.580]  So how obscure is it?
[24:44.140 --> 24:45.780]  But yeah, I learned stuff.
[24:45.980 --> 24:48.180]  The pH in my stomach was that of vinegar.
[24:49.240 --> 24:56.080]  I learned the formula to try and calculate on my own what the expensive software that they used at the hospital was doing.
[24:57.280 --> 25:08.700]  And vinegar, by the way, is enough to cause the erosion in the esophagus that I was experiencing, but not enough to digest my food, which is why all the burping and why all the pain and why the problem's pooping and all that jazz.
[25:09.120 --> 25:12.180]  My doctor is currently afraid of me.
[25:12.380 --> 25:13.700]  And he should be.
[25:13.700 --> 25:14.920]  He bills too much.
[25:15.700 --> 25:16.640]  I'm just kidding.
[25:16.640 --> 25:17.220]  No, he's great.
[25:17.220 --> 25:18.680]  He's actually fantastic.
[25:19.080 --> 25:28.480]  And my employer, when I told them about this, and yes, I told them about the shitting into a bucket part, they put me on an RF project, and it's going well.
[25:28.480 --> 25:30.180]  So I'm really happy about that.
[25:30.580 --> 25:31.580]  I think it's going well.
[25:31.580 --> 25:32.040]  I don't know.
[25:32.040 --> 25:36.320]  I have to... we'll see if I still have a job after this.
[25:38.680 --> 25:41.280]  So where that took me.
[25:42.000 --> 25:46.840]  Smucon, the day before, I participated in Hackers on the Hill, which was awesome.
[25:47.980 --> 25:58.040]  Some of the people that I knew who were part of that, I told them what I was doing, and they were like, you know what, if you have a concern about device security, you should come do this and talk to Senate staffers.
[25:58.040 --> 25:59.980]  So I did, which is really amazing.
[26:00.080 --> 26:04.300]  The Capitol's really cool when you can get in and you're not like marauding it.
[26:04.300 --> 26:05.340]  It's really good.
[26:06.420 --> 26:08.140]  They don't like when you do that.
[26:09.160 --> 26:13.340]  So there's a Froyo underneath the Capitol complex.
[26:13.820 --> 26:15.840]  It's a self-serve Froyo machine.
[26:15.840 --> 26:19.160]  These guys are so fucking lucky to have this.
[26:20.160 --> 26:23.280]  Like seriously, this is where our tax dollars went, but I'm cool with it.
[26:23.280 --> 26:26.360]  I'm like, yes, have all the Froyo you want.
[26:27.020 --> 26:30.780]  So yeah, I met with them and I talked to them about three things.
[26:30.780 --> 26:41.440]  One, ICS, obviously I work in the ICS community, and I said, I understand that we have recommendations, we have lots of NIST recommendations, but what about enforceable standards?
[26:41.440 --> 26:42.640]  I don't see those.
[26:42.960 --> 26:46.260]  And I think it's time now to move to enforceable standards for those.
[26:46.260 --> 26:48.420]  And then I told them about the medical device thing.
[26:48.420 --> 26:50.920]  And yes, I told the staffers about shitting into a bucket.
[26:51.380 --> 27:02.000]  And I said, is what this company is doing to conceal their data, is that a best effort or should it be concealed more?
[27:02.000 --> 27:05.300]  Obviously there's no encryption, no key pairing to the device.
[27:05.740 --> 27:08.840]  And where are the standards for this?
[27:08.840 --> 27:13.920]  And they said that the FDA has a lot of medical standards, try finding them on the site, it's impossible.
[27:14.880 --> 27:20.480]  And then the third thing I talked to them about was the federal view of cannabis for medical users, because why the fuck not?
[27:22.820 --> 27:31.800]  And yeah, so aside from the Froyo machine, Monorail's fucking cool, and you can buy Senate-branded Solo cups in the gift shop there, which are amazing for beer pong.
[27:33.060 --> 27:33.740]  Thank you.