WEBVTT 00:00.600 --> 00:05.880 I'm going to talk to you guys about biohacking using an SDR when you don't know what you're doing. 00:06.000 --> 00:19.120 And my name is J9, and I'm a security researcher, former systems administrator and former web developer. 00:19.120 --> 00:21.900 I'm almost done working on my bachelor's. 00:22.260 --> 00:23.780 I know, I'm fucking old. 00:23.780 --> 00:25.420 It's like, why are you still in college? 00:25.800 --> 00:28.160 I am an actual velociraptor. 00:28.460 --> 00:32.080 They've learned that in my family and at work. 00:32.640 --> 00:39.300 And so I have a health issue I'm trying to solve, and it led me down this road of what you're about to see. 00:39.300 --> 00:43.060 And my Twitter handle, if you want to follow me, is fuckyou99. 00:43.800 --> 00:48.340 Spelled F-A-C-K-Q-U-E-99. 00:53.160 --> 00:55.440 So what the hell is wrong with me? 00:56.080 --> 01:04.580 So for the last few years, I've been having trouble where I can't burp, I have horrible heartburn, and I don't poop often. 01:04.880 --> 01:10.780 So I went to the doctor, and I told him all of this, and he was like, yeah, there's something wrong there. 01:10.780 --> 01:17.180 So we did a whole shit ton of tests, and we're trying to get to the bottom of it. 01:17.340 --> 01:29.740 The can't burping part is probably the worst, because imagine you have an air bubble that gets stuck up here, and you can't let it out, so it just hurts all the time, and it just keeps moving up and down, and then you have to go into the bathroom and, 01:29.740 --> 01:37.340 like, make noises like you're gonna throw up until it comes out, and then it sounds like a giraffe being bludgeoned to death. 01:37.960 --> 01:42.720 And when you're in the bathroom with other people, everyone gets concerned. 01:43.740 --> 01:44.980 Like, oh my god, are you okay? 01:44.980 --> 01:46.080 Did you have too much to drink? 01:46.080 --> 01:47.660 And I'm like, no, no, no, I just had to burp. 01:47.660 --> 01:48.900 They're like, what the fuck? 01:49.120 --> 01:49.540 Yeah. 01:50.820 --> 01:51.460 Yeah. 01:52.980 --> 02:00.200 So we had some medical tests done, and there were two tests done on the same day, and one of them was a manometry. 02:00.220 --> 02:17.640 And if you don't know what a manometry is, the gentleman to my right here, wearing the lovely pasties, because this is family-friendly after all, has a large tube of pressure sensors that get shoved up your nose until it goes down into your throat, and the tube is basically, 02:17.640 --> 02:20.820 like, pushed all the way down into your esophagus, into your stomach. 02:21.120 --> 02:28.700 You're awake during this, and then after the tube is in, they feed you, like, little baby bird portions of saline, and you have to swallow. 02:28.700 --> 02:32.120 And as you swallow, they measure the pressure of the esophagus all the way down. 02:32.300 --> 02:37.100 So when they tried to get the tube up my nose, they gave me lidocaine, but lidocaine doesn't do shit for me. 02:37.220 --> 02:46.880 So apparently, when you're in the hospital, and you're in an operating room setting, there's four analgesics that are approved for use in that setting, and they're made from cocaine. 02:49.980 --> 02:51.260 So they gave me that. 02:51.260 --> 02:53.840 My doctor literally said, go get the rocket. 02:56.280 --> 02:59.900 They gave it to me, and he looked at me, and he goes, now you're ready to be a stockbroker. 02:59.900 --> 03:01.080 And I'm like, thank you. 03:01.760 --> 03:03.860 Just skip right over the Series 7. 03:04.400 --> 03:07.780 So, you know, they get it up there. 03:07.780 --> 03:13.400 I'm, I'm, like, focusing on something so it doesn't hurt so much, because it is literally actually torture. 03:13.560 --> 03:25.920 And we, we did the test, and they noticed that there were issues where the upper esophageal sphincter squeezing way too much, and my esophagus itself is just like, I don't fucking know what you want from me, but I ain't doing shit for you. 03:26.020 --> 03:31.240 So we had the next medical test, and that was a pH sensor test. 03:31.240 --> 03:45.780 So after they pulled this giant snake out of my face, the, the beautiful, wonderful, lovely, and I love this man, anesthesiologist, hit the plunger on ketamine, because this hospital uses ketamine to knock your ass the fuck out. 03:45.920 --> 03:59.500 So I get knocked out, and they proceed to outfit me with a medical device in my esophagus, right above my stomach, that will measure the pH while I'm not on my acid reflux medication. 03:59.500 --> 04:07.280 And it stays pinned in there for about four days, or five days, and it'll detach on its own and pass through your system and, and go away. 04:08.140 --> 04:24.960 While I was under, I didn't know that the combination of cocaine and ketamine can actually cause your brainwaves to change to, like, a delta pattern, which is similar to what happens to you when you have DMT, which is also similar to what happens to you when you're dying. 04:25.540 --> 04:34.160 So I'm laying there, and my mom, who's been dead for about 15 years, came, like, tapped me on the shoulders, and she's like, hey, kiddo. 04:34.160 --> 04:35.720 She's like, come with me. 04:37.740 --> 04:39.540 So I said, okay, let's go. 04:41.420 --> 04:46.440 And so we went through the wall, and I, I looked at my body behind me, I'm like, fuck that bitch right there. 04:46.440 --> 04:47.380 Fuck that. 04:47.680 --> 04:51.840 So, and then we went on this amazing adventure, and it was all, like, black. 04:52.900 --> 04:57.560 And we came upon this thing that I can only describe as a sun, but with no heat. 04:57.940 --> 04:59.860 And, all right, here's where it gets weird. 05:00.660 --> 05:02.460 If it wasn't weird already. 05:04.780 --> 05:06.580 So there's a sun with no heat. 05:06.620 --> 05:11.700 And my mom and I are having a conversation, but we're not using our mouths, because you don't have to, and everything's telepathic. 05:11.700 --> 05:18.600 And so she turns into, like, this piece of paper and, like, envelopes into the sun like an onion skin, and then I do the same thing. 05:18.600 --> 05:21.740 And you know how they say, like, your life flashes before your eyes? 05:21.920 --> 05:27.320 What that is, is you're uploading all of your experiences that you've already had to this thing. 05:27.680 --> 05:37.820 And so what I came out of this experience with was, we're all actually part of this thing, and we are the only way this thing can grow. 05:37.820 --> 05:47.180 And this thing, if I had to place an age on it, is like an angsty teenager, which makes sense, because I think the whole world is basically angsty teenagers. 05:48.000 --> 05:51.720 So yeah, long story short, God's an angsty teenager. 05:51.720 --> 05:52.780 He doesn't know shit. 05:52.780 --> 05:54.240 We're all onion skins. 05:55.480 --> 05:57.120 The sun is not hot. 05:57.260 --> 05:58.600 And then I came back. 05:58.600 --> 06:00.840 And when I woke up, I woke up screaming. 06:02.500 --> 06:03.980 I scared the nurses. 06:03.980 --> 06:04.940 I made one of them cry. 06:04.940 --> 06:05.820 It was great. 06:07.920 --> 06:11.700 But the cool thing is, when you wake up screaming, they give you all the apple juice you want. 06:14.200 --> 06:16.420 So you're probably thinking, wait a minute, what? 06:16.740 --> 06:19.240 So let's take a step back for a second. 06:19.240 --> 06:28.300 So a pH sensor was put into my body, and this pH sensor sent data to a receiving device that I had to wear. 06:28.300 --> 06:38.060 So when I woke up, I was wearing this little mechanical purse that just would beep with flashing lights every now and then, which is horrible when you're trying to sleep, because it's the brightest goddamn thing in the room. 06:38.380 --> 06:40.660 And they told me, wear this for four days. 06:40.660 --> 06:44.980 It's going to record whatever the sensor inside your body is saying. 06:44.980 --> 06:45.960 And I'm like, okay. 06:46.480 --> 06:48.820 So can I listen to it with a software -defined radio? 06:49.580 --> 06:51.500 And they were like, I don't know what that is. 06:53.640 --> 06:58.640 So kind of in a haze, I just was telling all the nurses and doctors, I'm going to hack this thing. 06:58.640 --> 07:01.000 I'm going to fucking hack the shit out of it when I get home. 07:01.500 --> 07:02.760 I don't know how to do it. 07:02.760 --> 07:04.240 I'm going to fucking do it. 07:04.760 --> 07:14.240 So I get home, and immediately, once I'm actually not falling over and bumping into walls, I realize that I have limited time to do this. 07:14.240 --> 07:19.560 The test ends in four days, and I also had no idea what the fuck I was doing. 07:19.760 --> 07:24.840 So I figured, let me try and get started. 07:24.840 --> 07:31.740 So I started Googling what software to use and how to get started, and I did have a software-defined radio that I got at DEF CON 27. 07:32.360 --> 07:40.960 So I pulled that out of a box, and I hooked it up to my machine, and after some Googling, I realized SDR Sharp would be a great way to start. 07:41.080 --> 07:43.140 So I installed that on my machine. 07:43.140 --> 07:46.520 There were issues installing SDR Sharp, because I had a Windows 10 machine. 07:46.580 --> 07:51.900 Antivirus thinks it's malicious, but your face is malicious, so whatever. 07:52.720 --> 07:55.600 Then there were issues installing the drivers. 07:56.120 --> 08:12.520 The ones on the SDR Sharp website don't actually work, so you need to do it a slightly different way, and you can, if you Google for SDR Sharp driver Windows 10, you get this awesome link, and the guide to install it is basically idiot-proof. 08:12.900 --> 08:20.240 Everything you need is actually already in your install of SDR Sharp, but the documentation on the SDR Sharp website doesn't say that. 08:21.440 --> 08:28.820 So I hooked up my SDR, and I didn't listen yet, because I didn't know what to listen for. 08:28.820 --> 08:33.200 So I figured, okay, well, if it's radio-based, it's got an FCC ID. 08:33.440 --> 08:47.600 So I searched for the FCC ID, and I found the information that said it was operating frequency that was allowed for the 433.92 megahertz. 08:48.140 --> 08:53.920 And then I was like, okay, well, let me learn a little bit more about this device, and I researched the patent of the device. 08:54.680 --> 09:01.680 Because, you know, I knew who made the device, and I figured, you know, they have to have filed for a patent, and they did. 09:01.680 --> 09:05.500 So I found all of that information, and the patent was really complete. 09:05.500 --> 09:09.760 I mean, these guys were basically like, yeah, here's how you can go home and make your own, you know. 09:10.500 --> 09:21.540 So I'm not really great at reading electronics-based drawings, so I don't know what half the shit says, but I know, you know, I kind of get it. 09:22.140 --> 09:27.760 So the way it actually works is, it uses an ion-sensitive field effect transistor. 09:27.760 --> 09:30.900 I had to google the shit out of that, because I was like, I don't know what the fuck that is. 09:31.540 --> 09:33.120 And that's the pH sensor. 09:33.120 --> 09:48.200 So essentially what happens is, that's what comes in contact with the H positive ions, and depending on how many ions it detects, it spits out a number, and that's your pH reading. 09:49.400 --> 09:59.520 So to continue with the patent, the other awesome thing about the patent was, it had the packet structure for how the data was going to be sent to the device that you had to wear around you. 09:59.600 --> 10:07.820 So I was like, okay, this is great, but it didn't necessarily say how many bytes or how many bits each thing was. 10:07.820 --> 10:13.400 You don't know how long the preamble is, you don't know how long the transmitter ID, message ID, data, or checksum is. 10:13.400 --> 10:16.060 So you've got to kind of figure that out. 10:16.420 --> 10:19.660 And then I thought, all right, now let me try and capture it. 10:19.660 --> 10:29.340 So I opened up SDR Sharp, and I actually found it not exactly at 433.92, and that was something interesting that I didn't know, that 433.92 is kind of a suggestion. 10:29.360 --> 10:30.880 It's like, it's going to be around here. 10:31.160 --> 10:39.340 So I kept surfing around, and I finally found it, and it's literally that little tiny blurb, blip, right? 10:39.340 --> 10:41.140 You could see it kind of in the center. 10:43.260 --> 10:46.440 That little itty-bitty dark spot, that's it chirping. 10:47.080 --> 10:53.660 And it was really weak, and it was competing with everything in my house that's also on the same frequency. 10:54.160 --> 10:56.900 So I got a lot of noise when I captured it. 10:57.400 --> 10:59.760 And then I asked myself, had others done this before? 10:59.760 --> 11:01.520 Am I doing this the right way in the first place? 11:01.520 --> 11:04.860 Am I even, like, going down the same, the right path? 11:04.880 --> 11:09.240 Or did someone else find something that maybe I didn't catch on to? 11:09.260 --> 11:12.560 And I did find that there were two other researchers who had done this before. 11:12.560 --> 11:20.240 One of them was named Justin Dulski, and he captured the sensor emanations using an application called GQRX in Linux. 11:20.360 --> 11:24.840 Well, he used a Mac, which I guess is actually Linux. 11:24.840 --> 11:29.080 He also saved emanations as AM demodulated audio. 11:29.080 --> 11:35.720 So then I went back and did the same thing, and I heard it actually go, you know, and I was like, ooh, that's cool. 11:35.720 --> 11:37.300 I need that to be my ringtone. 11:38.740 --> 11:49.100 He used an application called Odyssey to analyze the waveform and decode it, and he also found the same patent information and used the packet format information that I also found to decode his results. 11:49.140 --> 11:52.140 And his link to find that is here. 11:53.300 --> 11:55.320 James Wu was the other researcher. 11:55.320 --> 12:09.500 He had a far more technical write-up that actually delved into the waveforms and math and bit length and pulse modulation and encoding, and I had to Google everything. 12:10.000 --> 12:12.140 I was like, I don't know what this means. 12:12.340 --> 12:18.660 But he also used an application called RTL433 to capture and decode the sensor emanations on the fly. 12:19.520 --> 12:24.320 And that's kind of like, in my opinion, that's kind of cheating a little bit, because the application is doing everything for you. 12:25.040 --> 12:28.660 I know it's not actually cheating, but like, I don't know. 12:28.780 --> 12:30.180 I don't know. 12:30.300 --> 12:31.720 That's the easy way. 12:32.020 --> 12:44.680 But he speculated the formula for converting the raw pH readings into actual pH, and since he was able to see his human-readable pH levels on his monitor, I was not. 12:44.680 --> 12:47.300 Mine weren't coming up on the screen. 12:47.700 --> 12:57.000 There's his link there, and as you can see on the right, he found some great information about modulation and bit length. 12:57.660 --> 13:03.920 So then I followed his instructions and I did exactly the same thing, and I got the pH readings. 13:03.920 --> 13:18.300 I was like, cool, okay, but I also got the actual hexadecimal codes to look for, and now I had something to actually say, now if I find something, I know I'm on the right track, because I had all these recordings, but I didn't know what the hell I was looking at, 13:18.300 --> 13:21.440 because it was a mess, because none of it was really truly clean. 13:24.200 --> 13:29.640 So I said, okay, now let's do it the hard way, because mama didn't raise no script kitty. 13:30.960 --> 13:31.880 Hell no. 13:31.880 --> 13:36.260 She would smack the shit out of me if she was alive and I tried to do shit the easy way. 13:37.300 --> 13:51.160 So now I knew what to look for, 59-bit hex string, preambles, first nine bytes, TXID, 16 bits, message ID, eight bits, pH reading, another eight bits, another pH reading, another eight bits, and check some eight bits. 13:51.160 --> 13:58.640 So the reason why there's two pH readings is because it actually reads every six seconds, but only chirps at you every 12 seconds. 13:58.640 --> 14:02.880 So every 12 seconds, it gives you the two readings, the first one and the second one. 14:03.420 --> 14:18.420 And through more Googling, I heard about Universal Radio Hacker to both record and analyze RF emanations, so I wouldn't need SDR sharp anymore, so I installed that on Kali Linux in a VM, and I needed Python 3 and NumPy to do that. 14:18.940 --> 14:25.240 So I got that running, and I tuned in and recorded it, clicked analyze, and instantly filled my hard drive. 14:27.300 --> 14:28.420 Oops. 14:28.500 --> 14:37.880 I crashed URH about a bazillion times, started clicking around like a toddler, Googled everything, and finally got some bytes that made sense. 14:37.880 --> 14:40.200 That process took a few hours. 14:40.200 --> 14:48.360 But my family was just like, all right, you just do what you're doing, we're just going to leave you alone, because for a while everyone was like, I'm hungry. 14:49.320 --> 14:51.320 I need food. 14:51.380 --> 14:53.200 I'm like, go away. 14:53.220 --> 14:55.120 So yeah, they did. 14:56.060 --> 14:56.880 So yeah. 14:56.880 --> 15:01.320 So here's an example of something I was able to pull out with URH. 15:01.320 --> 15:04.240 Now, I don't need this entire string of bits right here. 15:04.240 --> 15:07.700 I only needed the first few chunks. 15:07.700 --> 15:09.200 And this is not actually complete. 15:09.200 --> 15:15.060 This does not include the preamble, and it doesn't include the TXID, but it includes... I'm sorry, no. 15:15.060 --> 15:19.480 It doesn't include the preamble, but it includes the TXID and the message ID. 15:19.480 --> 15:25.120 And now, since I already knew what to look for with the TXID and the message ID, right? 15:25.120 --> 15:30.460 The message ID being BD, and the TXID being FF6D, right? 15:30.460 --> 15:32.660 So it's FF6DBD. 15:33.320 --> 15:39.060 As you can see in here, you've got that DB6DB. 15:40.180 --> 15:41.160 There you go. 15:41.160 --> 15:42.380 That's part of it. 15:42.420 --> 15:50.160 So since I don't need the preamble, because it's just going to go anyway, I pulled out the piece I needed. 15:50.160 --> 15:56.000 I knew how many bytes I needed or bits out of this piece, and I was able to decipher what it was saying manually. 15:57.320 --> 15:59.460 Now, pencil's down. 15:59.460 --> 16:00.500 The test is over. 16:00.500 --> 16:17.220 I have to hand in the little tiny device that I'm wearing back to the hospital, but I wasn't done testing, because now I wanted to be able to take what I had and retransmit it into a receiver to see if I could change the data and have the receiver accept data that's fake, 16:17.220 --> 16:24.180 or accept too much data, or what happens if the receiver accepts data that shouldn't even work? 16:25.020 --> 16:35.300 So I tried to buy a receiver off of eBay, but it got cancelled, because I think the dude just wanted $75, and there was no actual device. 16:35.560 --> 16:38.820 So I couldn't get that, so I tried to buy another one. 16:38.820 --> 16:47.700 It would have taken two weeks to get to me, and that was too long, because the device, according to the patent, the batteries run out after four days, the sensor device. 16:47.700 --> 16:51.040 And I had already had it in my body for four or five at that point. 16:52.220 --> 17:00.480 So yeah, I would have liked to have messed with my test results, but I also didn't want to mess with my test results, because I didn't want to piss off the doctor. 17:00.480 --> 17:10.660 But at the time, I also didn't realize that my SDR was receive-only, so I wouldn't have been able to do that anyway without going shopping first. 17:11.520 --> 17:14.420 And yeah, so the implant was still chirping every 12 seconds. 17:14.420 --> 17:18.400 I started experimenting results with results from eating different foods. 17:18.400 --> 17:21.820 So while it was still in there, I was like, all right, well, what happens if I eat hot sauce? 17:21.880 --> 17:23.400 What happens if I have orange juice? 17:23.460 --> 17:25.080 What happens if I have coffee? 17:25.200 --> 17:26.500 What happens when I drink water? 17:26.500 --> 17:28.780 So I was trying to like get those different readings. 17:28.780 --> 17:35.000 And then as it, after it detached, and you could tell when it detaches because you're just like, oh my god, that feels so much better. 17:36.380 --> 17:39.280 I followed it like through my digestive tract. 17:39.280 --> 17:43.600 So every few hours, I would take a reading and be like, what's it doing now? 17:43.640 --> 17:45.520 I think it's in my poop. 17:45.560 --> 17:46.160 Yeah. 17:46.540 --> 17:52.780 So speaking of, I made the decision to recover the implant because it still had some life in it. 18:01.220 --> 18:03.820 So I could do pH baseline testing. 18:03.820 --> 18:15.660 So I went on Amazon and I ordered those pH strips that they give you like in middle school, that like you put something on it changes color, you know, so if you lick it, and it comes out basic, you're like, I'm so basic. 18:16.160 --> 18:21.460 So I bought those, and I waited. 18:22.020 --> 18:23.640 And all 18:27.120 --> 18:29.980 right , so I love my husband. 18:30.840 --> 18:31.820 I really do. 18:31.820 --> 18:33.300 He's a very patient man. 18:33.780 --> 18:36.600 But he knew what he signed up for when he married me. 18:39.720 --> 18:47.440 So he goes into the bathroom, he's like, honey, I'm like, yeah, he's like, um, what's the bucket for? 18:48.300 --> 18:54.300 And it is actually the orange Home Depot bucket that says let's do it. 18:59.880 --> 19:03.340 Because you know, when you're when you're thinking about what bucket should I use for this? 19:03.340 --> 19:04.880 What do I have in my house already? 19:04.880 --> 19:07.520 I don't want to spend money on something I'm gonna shit in. 19:09.200 --> 19:10.280 I was like, oh, cool. 19:10.280 --> 19:12.340 The one we painted the living room with that'll work. 19:13.840 --> 19:23.420 So yeah, I shit into a bucket, slapped on some rubber gloves, and unfortunately, it wasn't in that poop. 19:26.140 --> 19:39.920 So after I got done, I realized I probably should have before sticking my hands in there, gone back over to my computer, turned on the software to find radio to see if I was still chirping every 12 seconds. 19:40.580 --> 19:41.940 But I didn't do that. 19:41.940 --> 19:43.400 I was like, all right, let's just fucking go. 19:43.400 --> 19:45.360 Let's get in there, you know. 19:45.360 --> 19:49.820 And you know, in your brain, like the whole time this is happening, your brain is like, that's chocolate mousse. 19:49.820 --> 19:50.860 That's chocolate mousse. 19:50.860 --> 19:52.160 That's chocolate mousse. 19:52.440 --> 19:54.100 You're like, no. 19:54.100 --> 19:54.820 Yeah. 19:55.520 --> 19:57.860 So try, try again, right? 19:57.940 --> 19:59.020 Try, try again. 19:59.020 --> 20:05.460 So it took some laxatives and the next day it was go time again. 20:05.540 --> 20:18.700 So of course the bucket had already been used, so I had to bring it out to the front yard and get the sprayer hose and put on the equivalent of like a hazmat suit and spray shit out of the bucket in front of the neighbors. 20:24.060 --> 20:27.780 And everyone's looking at me like, I think she needs a beer. 20:30.560 --> 20:32.680 So yeah, that's the power of the Home Depot. 20:32.700 --> 20:42.860 It did come out in the second trip to the bucket and there was much cleaning of the sensor and that's how big the sensor is. 20:42.860 --> 20:51.920 And I have it next to a guitar pick for scale and I have it with me if anyone would like to see it and get hands on with it. 20:51.920 --> 20:53.440 You can even taste it if you want. 21:04.500 --> 21:09.340 So after I got that out, I did do more testing with it and then it died. 21:09.340 --> 21:11.560 It died on me day 14. 21:11.800 --> 21:13.440 I did the lemon juice test. 21:13.440 --> 21:17.120 I thought, cool, I wanted to do the bleach test next and it was dead. 21:17.120 --> 21:18.500 And I'm like, no. 21:18.780 --> 21:36.140 But I got the results I wanted to be able to formulate some sort of baseline based on the numbers that I was being shown in the actual pH readings and what the actual pH was on the litmus strip of the same liquids that I was sticking the device and the litmus strip into at the same time. 21:36.140 --> 21:40.940 And I was able to refine the calculation that Justin Wu made. 21:41.300 --> 21:42.860 His was way over complicated. 21:42.860 --> 21:47.960 It's literally just the number divided by 25.5 and you get the actual pH. 21:47.960 --> 21:52.360 So for me, that's kind of like, okay, did I extend the work that they did? 21:52.360 --> 21:54.080 I feel like I did. 21:54.080 --> 21:54.600 I don't know. 21:54.600 --> 21:58.600 I don't think either of them went to the point where they're, you know, let me dig around my poop. 22:00.180 --> 22:01.140 So, yeah. 22:01.700 --> 22:06.680 But anyway, the pitfalls in trying to learn all of this is I fucked up a lot during the way. 22:07.520 --> 22:09.180 There was a limited time to do this. 22:09.180 --> 22:10.120 Life gets in the way. 22:10.120 --> 22:11.040 I worked full time. 22:11.040 --> 22:11.800 I have a family. 22:11.800 --> 22:13.580 Obviously they're hungry all the time. 22:14.040 --> 22:16.060 The implant's battery died at day 14. 22:16.060 --> 22:19.760 The receiver would not arrive from eBay in time, so I couldn't test with the receiver. 22:19.760 --> 22:25.260 I still could if I wanted to order a receiver and then just try to replay the stuff in there. 22:25.560 --> 22:30.740 The capture data that I had was not always usable, because again, there's a lot of noise. 22:31.100 --> 22:35.700 I had difficulty trying to capture a clean signal where I was. 22:35.740 --> 22:39.000 Had I known that we had a Faraday tent at work, I would have gone there. 22:39.200 --> 22:42.520 Although I don't think they would have let me poop into a bucket at work. 22:42.520 --> 22:44.460 That might have been too much. 22:45.040 --> 22:47.600 And there was an enormous learning curve. 22:48.480 --> 22:51.900 So I had all this data that I recorded. 22:51.900 --> 22:53.520 Some of it I couldn't quite figure out. 22:53.520 --> 22:59.140 I couldn't figure out if the data I was looking at was pure enough for me to actually get real results from. 22:59.140 --> 23:01.060 So I went to ShmooCon. 23:01.440 --> 23:03.140 And I went to the RF Village. 23:03.140 --> 23:05.500 And I participated in the RF Village CTF. 23:05.500 --> 23:08.520 And while I was there, I asked all my questions. 23:08.780 --> 23:10.420 And it was wonderful. 23:10.420 --> 23:11.880 These guys are amazing. 23:11.880 --> 23:13.180 Seriously, can we clap for them? 23:13.180 --> 23:14.600 Because they're fucking awesome. 23:15.700 --> 23:17.720 You guys are fucking awesome. 23:18.000 --> 23:19.780 You made this shit possible. 23:19.880 --> 23:20.800 You guys. 23:20.940 --> 23:24.840 So yeah, some of the data I was seeing in my capture was confusing. 23:24.840 --> 23:26.320 They helped me figure it out. 23:26.320 --> 23:38.540 They showed me like different ways to kind of weed out noise, how to play with like the FTTs and stuff and kind of refine where your zero point is to try and turn your wave into the right thing. 23:38.540 --> 23:43.660 At the time, I also was confused about ASK and FSK and they really explained it well. 23:43.660 --> 23:46.320 A lot better than the internet was explaining it. 23:46.640 --> 23:48.660 And yeah, they just freely shared their knowledge. 23:48.660 --> 23:49.480 It was amazing. 23:49.480 --> 23:51.320 And then I did the RF CTF and it was fun. 23:51.320 --> 23:53.200 So 10 out of 10, highly recommend. 23:54.880 --> 23:56.220 So my findings. 23:56.560 --> 23:58.520 I still don't know what the fuck I'm doing. 23:59.740 --> 24:01.680 But I learned a shit ton. 24:02.540 --> 24:06.880 The data recorded in the RF emanations was unencrypted, obviously. 24:06.900 --> 24:09.840 The implant and receiver were not key paired. 24:10.080 --> 24:11.440 So that's an issue. 24:11.440 --> 24:18.200 I know that the company that makes the medical device has a submission area where I could report this to them. 24:18.200 --> 24:21.900 And I probably will, but they're probably going to be like, yeah, yeah, yeah, we know. 24:21.960 --> 24:30.440 They did somewhat obscure the data by having it be in a packet format and hexadecimal. 24:30.440 --> 24:33.920 And I mean, it's obviously not clear text in that way. 24:33.920 --> 24:37.560 I mean, it's not going to tell you, hey, the pH is this. 24:37.760 --> 24:42.160 But if someone like me can figure this out in four days, really anybody can. 24:42.160 --> 24:43.580 So how obscure is it? 24:44.140 --> 24:45.780 But yeah, I learned stuff. 24:45.980 --> 24:48.180 The pH in my stomach was that of vinegar. 24:49.240 --> 24:56.080 I learned the formula to try and calculate on my own what the expensive software that they used at the hospital was doing. 24:57.280 --> 25:08.700 And vinegar, by the way, is enough to cause the erosion in the esophagus that I was experiencing, but not enough to digest my food, which is why all the burping and why all the pain and why the problem's pooping and all that jazz. 25:09.120 --> 25:12.180 My doctor is currently afraid of me. 25:12.380 --> 25:13.700 And he should be. 25:13.700 --> 25:14.920 He bills too much. 25:15.700 --> 25:16.640 I'm just kidding. 25:16.640 --> 25:17.220 No, he's great. 25:17.220 --> 25:18.680 He's actually fantastic. 25:19.080 --> 25:28.480 And my employer, when I told them about this, and yes, I told them about the shitting into a bucket part, they put me on an RF project, and it's going well. 25:28.480 --> 25:30.180 So I'm really happy about that. 25:30.580 --> 25:31.580 I think it's going well. 25:31.580 --> 25:32.040 I don't know. 25:32.040 --> 25:36.320 I have to... we'll see if I still have a job after this. 25:38.680 --> 25:41.280 So where that took me. 25:42.000 --> 25:46.840 Smucon, the day before, I participated in Hackers on the Hill, which was awesome. 25:47.980 --> 25:58.040 Some of the people that I knew who were part of that, I told them what I was doing, and they were like, you know what, if you have a concern about device security, you should come do this and talk to Senate staffers. 25:58.040 --> 25:59.980 So I did, which is really amazing. 26:00.080 --> 26:04.300 The Capitol's really cool when you can get in and you're not like marauding it. 26:04.300 --> 26:05.340 It's really good. 26:06.420 --> 26:08.140 They don't like when you do that. 26:09.160 --> 26:13.340 So there's a Froyo underneath the Capitol complex. 26:13.820 --> 26:15.840 It's a self-serve Froyo machine. 26:15.840 --> 26:19.160 These guys are so fucking lucky to have this. 26:20.160 --> 26:23.280 Like seriously, this is where our tax dollars went, but I'm cool with it. 26:23.280 --> 26:26.360 I'm like, yes, have all the Froyo you want. 26:27.020 --> 26:30.780 So yeah, I met with them and I talked to them about three things. 26:30.780 --> 26:41.440 One, ICS, obviously I work in the ICS community, and I said, I understand that we have recommendations, we have lots of NIST recommendations, but what about enforceable standards? 26:41.440 --> 26:42.640 I don't see those. 26:42.960 --> 26:46.260 And I think it's time now to move to enforceable standards for those. 26:46.260 --> 26:48.420 And then I told them about the medical device thing. 26:48.420 --> 26:50.920 And yes, I told the staffers about shitting into a bucket. 26:51.380 --> 27:02.000 And I said, is what this company is doing to conceal their data, is that a best effort or should it be concealed more? 27:02.000 --> 27:05.300 Obviously there's no encryption, no key pairing to the device. 27:05.740 --> 27:08.840 And where are the standards for this? 27:08.840 --> 27:13.920 And they said that the FDA has a lot of medical standards, try finding them on the site, it's impossible. 27:14.880 --> 27:20.480 And then the third thing I talked to them about was the federal view of cannabis for medical users, because why the fuck not? 27:22.820 --> 27:31.800 And yeah, so aside from the Froyo machine, Monorail's fucking cool, and you can buy Senate-branded Solo cups in the gift shop there, which are amazing for beer pong. 27:33.060 --> 27:33.740 Thank you.