1
00:00:00,000 --> 00:00:01,860
So, Twitter.

2
00:00:02,220 --> 00:00:03,840
No IQ 15.

3
00:00:04,000 --> 00:00:19,360
My first real introduction to Wi-Fi was here in a similar CTF, I don't know, three, four, five years ago with DC-719 as we tried to slam through the CTF.

4
00:00:19,360 --> 00:00:21,700
And it's really where I got my introduction.

5
00:00:21,700 --> 00:00:25,420
And after I left Lockheed, I've been hacking drones.

6
00:00:25,460 --> 00:00:34,520
So it's a kind of intersection of embedded IoT stuff, cyber stuff, and now RS stuff.

7
00:00:34,820 --> 00:00:41,540
And while I've been doing that, the guy who's been paying me is from the government.

8
00:00:41,680 --> 00:00:48,240
So part of Darkwith Solutions, and we were doing, I don't know, two dozen different drones.

9
00:00:48,240 --> 00:00:53,620
So the drone I'm going to be discussing here, you'll be able to figure it out.

10
00:00:53,620 --> 00:00:56,180
I'll talk about it later, but I'm not going to throw his name on the front of the talk.

11
00:00:56,220 --> 00:01:02,620
They were a little perturbed that they were going to be introduced to the cyber community at Black Hat.

12
00:01:02,620 --> 00:01:22,940
So they wanted to make sure that I was clear with you that the kind of access that I had to the radio was largely due to negligence, they didn't use that word, on the part of the system integrator who's not using all the features that they had on a much older radio than the current versions they're running.

13
00:01:22,940 --> 00:01:28,380
So with that disclaimer, you can't go out and hack their current radios with just this.

14
00:01:28,440 --> 00:01:30,400
But we'll go.

15
00:01:31,280 --> 00:01:33,360
So drones.

16
00:01:33,360 --> 00:01:35,360
This is what you think of when you've got a drone.

17
00:01:35,760 --> 00:01:40,800
If you'll notice there's a radio on that thing in the front, there's another radio on the back, that's the GPS.

18
00:01:42,200 --> 00:01:45,840
There is a flight controller on top.

19
00:01:45,880 --> 00:01:49,700
There are multiple sensors that can feed into this, including CAN based sensors.

20
00:01:49,700 --> 00:01:55,560
Once you get outside of the retail, up to the COTS level where they're flying video and special payloads.

21
00:01:55,560 --> 00:01:59,380
So we're talking about thousand to fifty thousand dollar range drones.

22
00:01:59,380 --> 00:02:04,140
They often have more advanced buses than you would find on the cheaper ones.

23
00:02:04,560 --> 00:02:07,580
But is this really the drone?

24
00:02:08,300 --> 00:02:10,680
Well, it's a drone, it's a UAV.

25
00:02:10,680 --> 00:02:13,140
It's the vehicle, it's the platform in the air.

26
00:02:13,160 --> 00:02:15,600
But it's really part of a much larger system.

27
00:02:16,320 --> 00:02:19,700
Including cloud-based supply chain, software security stuff.

28
00:02:20,260 --> 00:02:28,500
The drone itself is going to have, by law, a ground control unit that a human being sitting in front of that can take control of the drone.

29
00:02:28,760 --> 00:02:32,020
Typically these drones are only allowed to fly line of sight.

30
00:02:32,480 --> 00:02:37,980
And the communication between those can be an RF, they can be on Wi-Fi, they can be on both.

31
00:02:38,160 --> 00:02:39,580
Drones carry payloads.

32
00:02:39,580 --> 00:02:42,920
Payloads are usually on Wi-Fi or they're sharing the mesh radio.

33
00:02:44,120 --> 00:02:49,980
And of course you can do a little bit of fuckery with the sensors there, the GPS and the ADS-B.

34
00:02:50,260 --> 00:02:55,860
We're concentrating on the RF comms between the ground and the drone.

35
00:02:57,100 --> 00:03:02,300
So according to documentation, it's a Wi-Fi system.

36
00:03:03,260 --> 00:03:09,440
And you access web pages that allow you to define the Wi-Fi.

37
00:03:09,440 --> 00:03:14,400
Then your ground system should be talking to your drone.

38
00:03:14,400 --> 00:03:16,040
And indeed they were.

39
00:03:16,400 --> 00:03:20,960
But when I stood up Wi-Fi components to listen, I heard nothing.

40
00:03:21,260 --> 00:03:23,460
Could not find a stupid signal.

41
00:03:23,460 --> 00:03:27,940
And it turns out that I was not the first one at DarkWave to look at some of this stuff.

42
00:03:27,940 --> 00:03:32,680
We had looked at a similar radio set for a different problem set earlier in the year.

43
00:03:33,000 --> 00:03:37,360
So these are getting to be popular with the government for various purposes.

44
00:03:37,860 --> 00:03:42,060
So once I couldn't find it, then I had to read the fucking manual.

45
00:03:42,540 --> 00:03:44,300
These are dual smart radios.

46
00:03:44,300 --> 00:03:52,580
This one was an embedded version, RM2450, which is on the, for you I guess that would be on your left wing.

47
00:03:52,840 --> 00:04:05,940
And it's got special connectors for that, that are feedback up to the drone and are controlled over the, actually the Ethernet connection.

48
00:04:06,240 --> 00:04:13,120
So why would Doodle want to make a signal disappear?

49
00:04:13,120 --> 00:04:14,620
Well it wasn't security.

50
00:04:14,620 --> 00:04:16,940
They're doing it for performance purposes.

51
00:04:16,940 --> 00:04:20,140
And the performance they're looking for is not bandwidth per se.

52
00:04:20,140 --> 00:04:22,060
They're looking for range.

53
00:04:22,240 --> 00:04:33,420
So with the smaller channel width on their Wi-Fi, they're able to achieve longer ranges, lower data rates.

54
00:04:33,500 --> 00:04:38,900
But in most of their use cases, it's the range they're stretching for.

55
00:04:39,240 --> 00:04:43,200
And so you'll see some of the samples there they have on one of their data sheets.

56
00:04:43,200 --> 00:04:45,560
40, 20, 10, 5, and 3.

57
00:04:45,600 --> 00:04:47,380
We didn't have to deal with 3.

58
00:04:47,400 --> 00:04:50,600
We had 5, 10, and 15 megahertz.

59
00:04:50,600 --> 00:04:53,300
By default, it was delivered to us at 15.

60
00:04:53,720 --> 00:05:07,700
You can't see those with 99% of the Wi-Fi chips out there because although the Linux kernel allows it, they have logic for it, the chips don't have the interface that will allow you to access those capabilities.

61
00:05:08,020 --> 00:05:10,280
Atheros does, but we'll get to that in a second.

62
00:05:11,800 --> 00:05:22,720
So some actually had, because I'm a little slow sometimes, had a colleague point out to me this stupid menu feature right here and said, you know, have you played with this?

63
00:05:22,720 --> 00:05:25,800
And that's where we started getting, finally getting a little handle on it.

64
00:05:25,800 --> 00:05:29,820
Because when we change it up to 20 megahertz, of course, boom, instant SSID.

65
00:05:29,820 --> 00:05:30,660
We see it.

66
00:05:30,660 --> 00:05:31,560
We connect to it.

67
00:05:31,560 --> 00:05:33,220
It's just normal 802.11.

68
00:05:33,980 --> 00:05:38,540
And it's just those lower ones that we had to kind of figure out how to get access to.

69
00:05:40,240 --> 00:05:53,860
So doing other forms of hackery, this one was mostly involving u-boot, modifying the boot up parameters and getting shell on the box, which allowed us in turn to secure shell into the radio.

70
00:05:54,060 --> 00:06:02,140
We were able to fingerprint the actual chips that they were using, the QCA9533 and the AR9531 there.

71
00:06:02,140 --> 00:06:05,040
And those looked vaguely familiar to me.

72
00:06:05,740 --> 00:06:10,560
And that's because OpenWrt supports those.

73
00:06:10,880 --> 00:06:19,160
And while I didn't realize it at the time, I had a whole Wi-Fi kit full of them.

74
00:06:20,160 --> 00:06:24,180
That is the GL-iNet-RM300M-Lite.

75
00:06:24,180 --> 00:06:30,820
And what that is, is a tiny little travel router that cost, well, at the time 20 bucks, today 35 bucks.

76
00:06:30,980 --> 00:06:36,820
And I used them to build a Wi-Fi range so I could practice Wi-Fi attacks.

77
00:06:36,820 --> 00:06:40,540
So I could bring them here and actually execute on the CTF well.

78
00:06:40,540 --> 00:06:43,580
That part of the plan didn't work, but I was able to repurpose these for this.

79
00:06:44,220 --> 00:06:46,800
The board there is not actually quite the same board.

80
00:06:46,840 --> 00:06:48,180
That's not the Lite.

81
00:06:48,260 --> 00:06:52,440
And it has two Ethernet connections as opposed to the Lite, which only has one.

82
00:06:52,440 --> 00:07:03,260
Not a big problem here, but you do have to be aware of that when you try to connect and boot up because there's a little bit of extra work to get it on the right, on the LAN interface instead of the WAN.

83
00:07:05,660 --> 00:07:09,080
So once we did that, we had the same chipset.

84
00:07:09,080 --> 00:07:11,200
We were running OpenWrt.

85
00:07:11,420 --> 00:07:16,180
How do you actually go find those narrow channel bandwidths, at least the 5 and the 10?

86
00:07:16,660 --> 00:07:19,020
And the answer is, there's a couple different ways.

87
00:07:19,020 --> 00:07:21,340
I mean, it supports it, but not through the web GUI.

88
00:07:21,340 --> 00:07:27,360
While I showed you a web interface that did, that was especially modified by Doodle to support their customers.

89
00:07:27,360 --> 00:07:43,920
So to get it on the access, there's a whole UCI configuration command set, REPL basic, well not a REPL, but that allows you to pretty much modify anything you need in the radio set.

90
00:07:43,920 --> 00:07:51,440
So you're able to do the channel bandwidth right there, wireless.radio 0, channel bandwidth 5 or 10, and apply it that way.

91
00:07:51,440 --> 00:07:59,600
Or you can go to etsy.config.wireless if you're better at VI than you are at UCI, and modify things there and reboot them, restart them.

92
00:08:00,120 --> 00:08:08,060
So once we did that, we were able to then see the hotspot of interest.

93
00:08:08,200 --> 00:08:21,900
And so we were able to scan to them, and we were able to then actually connect into the mesh network, so that we then can continue further attacks.

94
00:08:21,900 --> 00:08:31,060
Secure shell, or sniffing the communications traffic, or if we wanted to, we could run jam attacks.

95
00:08:31,060 --> 00:08:41,560
Of course we don't actually need that, just do it from raw frequency, but jam attacks against the mavelink comms that are running over that, so at a higher network layer.

96
00:08:43,420 --> 00:08:44,440
So that was great.

97
00:08:44,440 --> 00:08:52,920
That got me to 5 megahertz and 10 megahertz, supported by a Linux kernel, out of the box, with the right chip set.

98
00:08:53,380 --> 00:08:58,840
OpenWRT had the right hardware, the GLI net travel router had the right hardware.

99
00:08:59,520 --> 00:09:01,360
OpenWRT had the right software.

100
00:09:01,540 --> 00:09:02,880
I'm in, I'm connected.

101
00:09:02,880 --> 00:09:08,600
But what about that freaking 15 megahertz, which I will remind you was the default it was delivered to us at.

102
00:09:08,600 --> 00:09:17,060
So pretty proud that we were able to understand this, because I don't come from a strong radio background, but I wanted to get to the 15.

103
00:09:17,700 --> 00:09:27,340
Side note, had I waited a year, or had my integrator, drone integrator, updated their firmware, I wouldn't have been following it this far, because 10 is the new default.

104
00:09:27,960 --> 00:09:40,120
So I'm in the atheros driver source code, and I at least got to the point where I was able to convert the 5 megahertz to 10 megahertz.

105
00:09:40,120 --> 00:09:54,760
And that was an important touchstone for me, because it allowed me to know that I was on the right, had my hands on the right controls, the right knobs, in order to modify the megahertz within the driver.

106
00:09:54,960 --> 00:10:03,520
And the attempt here was to place a 15 megahertz option and build that into the kernel.

107
00:10:04,900 --> 00:10:08,660
But it just got too hard.

108
00:10:08,660 --> 00:10:09,640
I'm not saying you can't do it.

109
00:10:09,640 --> 00:10:12,800
Matter of fact, I'm 100% confident you can at this point.

110
00:10:12,800 --> 00:10:21,900
But given the limited time and resources, I wanted to go explore other modes, though this is still there to be done.

111
00:10:22,380 --> 00:10:24,300
So other modes.

112
00:10:25,000 --> 00:10:43,460
Microtech is another router OS that advertised that they had, sexy voice, the ability to go down to 500 megahertz at 500 megahertz step size.

113
00:10:43,600 --> 00:10:49,960
So it would get that 3, it would get that 10, it would get that 15, it would get the 20, it would get all of those.

114
00:10:49,960 --> 00:10:51,900
And that was great.

115
00:10:51,900 --> 00:10:56,960
So it wasn't all that hard to scramble up, though this is all obsolete hardware now.

116
00:10:57,040 --> 00:11:02,940
So the router board, I don't know, cost I think 40 bucks on eBay, and the chip costs like 10.

117
00:11:03,520 --> 00:11:06,440
For some reason they got a bunch of those over in Czechoslovakia.

118
00:11:07,000 --> 00:11:22,640
And again, you can't really go in the GUI directly to do this because you're off the normal paths, but you can define your own frequency set and channel width and that will then pop into the GUI allowing you to select it.

119
00:11:22,640 --> 00:11:28,080
And if you do that, you're actually able to connect to the radio.

120
00:11:28,080 --> 00:11:33,100
So here's example, here's at 5, 10, and 15.

121
00:11:33,100 --> 00:11:38,560
I'm able to, although only at this point, connect to the SSIDs.

122
00:11:38,860 --> 00:11:47,080
And I'm only able to establish an actual working connection if it's unencrypted.

123
00:11:47,100 --> 00:11:49,620
It was failing on the encryption.

124
00:11:49,680 --> 00:11:54,760
I was looking at packets for that, but once again we're running into a resource issue.

125
00:11:54,920 --> 00:12:02,460
How much time was going to take for me to figure out the encryption problems I was having on a radio I didn't have source code for.

126
00:12:02,460 --> 00:12:14,740
I did reach out to MicroTik for some support, but they started throwing are you in the right country code kind of issues at me, which wasn't the issue and I doubted I was talking to the right techs.

127
00:12:15,900 --> 00:12:24,100
So, have a radio, can't find shit at first, that's my own problem, my ignorance.

128
00:12:24,400 --> 00:12:36,880
Figuring out the 5 and 10, available in the Atheros chipset, figuring out OpenWRT supports that I had routers that could do that, OpenWRT and stood those up and was able to connect clean, except for 15.

129
00:12:38,060 --> 00:12:46,680
Looked at Linux kernel, suspect that that will work, but it was too hard of a nut for me to crack within the time I had, so I shifted over to MicroTik.

130
00:12:47,140 --> 00:12:52,120
Slightly better solution, but again tripped up on the crypto.

131
00:12:52,660 --> 00:12:59,260
So, we're coming to my last gasp, which actually worked better than I expected, but still not a full success.

132
00:12:59,540 --> 00:13:08,740
This is kind of a flattened version of these graphs, but they were intended to make sure that 15 wasn't something special.

133
00:13:08,740 --> 00:13:20,860
I didn't really think it would be, but I also heard you can't do 15 megahertz, so I just wanted to take a quick peek to make sure I understood the channel width and bandwidth for those guys.

134
00:13:21,540 --> 00:13:36,840
And once I did that, I spun up the GREIE80211 and I was able to connect to it using the sample rate matching the channel width.

135
00:13:36,840 --> 00:13:40,320
So, 15 megahertz, not a problem for them.

136
00:13:42,980 --> 00:13:56,400
And just proof of that, I was able to catch that SSID and you can see it there at six megabits, a very slow, the bottom, the slowest rate available is the rate that this thing defaults to.

137
00:13:57,280 --> 00:14:06,060
So, once again I connect to it, but can I actually access the mesh radio network with it?

138
00:14:07,080 --> 00:14:09,240
Potentially, I might.

139
00:14:09,280 --> 00:14:11,020
But again, I have a crypto problem.

140
00:14:11,700 --> 00:14:17,220
I haven't had time yet to go back to the author who is available on Discord, so I'll be hitting him up.

141
00:14:17,420 --> 00:14:24,100
But currently, this is only really effective with open networks, at least in my setup.

142
00:14:25,140 --> 00:14:37,440
So, getting to that last part where I'm the mesh network is TBD, but this GREIE80211 open source project does support that concept.

143
00:14:37,600 --> 00:14:43,080
So, I made progress, but didn't get quite to the goalpost.

144
00:14:43,240 --> 00:14:51,620
This is kind of a repeat of that earlier checkmark where OpenWrt works great on 5 and 10, doesn't give me 15.

145
00:14:51,620 --> 00:14:55,220
Microtix gave me 15, but in a very limited sense.

146
00:14:56,120 --> 00:15:01,160
The Linux kernel modules, I know you can get to there, but I didn't.

147
00:15:01,280 --> 00:15:14,380
And then the GRE is slightly not as good as Microtix, because while it also requires unencrypted, I haven't actually established entry into the mesh network itself, the Ethernet connection.

148
00:15:15,200 --> 00:15:20,620
So, that was fun hack around.

149
00:15:20,620 --> 00:15:23,060
I really enjoyed doing that.

150
00:15:23,420 --> 00:15:29,140
It pushed my typical network enterprise cyber background a lot.

151
00:15:30,040 --> 00:15:33,680
And I had a colleague who was telling me, why are you even bothering with this?

152
00:15:33,680 --> 00:15:35,360
Just buy another doodle radio.

153
00:15:35,360 --> 00:15:36,420
Problem solved.

154
00:15:36,420 --> 00:15:47,220
Not understanding the flexibility, once you're able to do this, how you're freed up from the hardware and now you can pursue them in other avenues.

155
00:15:47,220 --> 00:15:50,720
Once you master this, maybe they push it somewhere else.

156
00:15:50,720 --> 00:15:52,820
But what was the point?

157
00:15:52,820 --> 00:15:54,100
Where's the hack?

158
00:15:54,380 --> 00:15:58,920
Well, the hack here was nothing to do with the radio per se.

159
00:15:59,320 --> 00:16:10,180
Almost all the hacks that come in drones that I'm looking at, $1,000 to $50,000 range, are just crappy security configuration.

160
00:16:10,180 --> 00:16:24,020
Default passwords, no passwords, encryption options not enabled, things that look like they're 128 or 256 bit encryption, until you're realizing they don't take all the bits you need to feed them in the web interface.

161
00:16:24,020 --> 00:16:26,960
So, they have a much smaller entropy space.

162
00:16:27,980 --> 00:16:35,900
So, in this case, this was literally out of their manual.

163
00:16:35,900 --> 00:16:45,260
So, once I'm able to prove I can connect to these networks, I was able to then establish that they were vulnerable to different kinds of attacks.

164
00:16:45,460 --> 00:16:54,120
The odd thing here, the SSID for this drone was wireless hotspot.

165
00:16:54,120 --> 00:16:58,920
The manual says it's due to labs Wi-Fi.

166
00:17:00,100 --> 00:17:08,460
So, either the manual is wrong, or the integrator, the system designer for this, went in and changed the SSID and never changed the password.

167
00:17:08,460 --> 00:17:10,100
So, don't know which it was.

168
00:17:11,400 --> 00:17:15,420
What kind of attacks can you do once you have access to a drone over the air?

169
00:17:15,500 --> 00:17:17,200
Well, you can sniff the traffic.

170
00:17:17,260 --> 00:17:21,780
So, that includes command and control channels, and that includes payload data.

171
00:17:21,780 --> 00:17:28,020
So, you may be seeing what they're saying, which might be an important thing if you're trying to avoid getting attacked by missiles.

172
00:17:29,780 --> 00:17:31,560
You can spoof.

173
00:17:32,020 --> 00:17:39,880
One of the engagements that we had this year was actually not the security assessments with the drones, but security of a counter drone system.

174
00:17:39,960 --> 00:17:45,600
And we were able to go in and lay down false tracks on their system through their radio network.

175
00:17:45,600 --> 00:17:52,120
So, spoofing data, hiding where things are, and then the denial of service, of course.

176
00:17:52,120 --> 00:17:55,780
While frequency jamming is available, that's always very noisy.

177
00:17:55,780 --> 00:18:08,780
But if you can actually jam the protocol they're using, but for overflows or other mistakes in the protocol implementation, then you've got a much more subtle attack than just loudly announcing yourself.

178
00:18:09,900 --> 00:18:16,860
So, once again, Doodle would like you to know this is not their current model.

179
00:18:16,860 --> 00:18:24,680
This is not their current encryption standard, and we should not be able to do that with their current radios.

180
00:18:25,360 --> 00:18:35,700
In addition to all the problems I've already had, they have a frequency shifting capability of taking the whole 802.11 Center Freak and moving it up or down the spectrum.

181
00:18:35,700 --> 00:18:47,020
So, you can stick it down at 1800 megahertz, for instance, or you can push it up to whatever non-standard military frequency range you might want.

182
00:18:47,360 --> 00:19:05,940
They state they have better encryption, and they have vaguely mentioned, without going into details, they have some different waveform components, different modulations that they put in place that should make it impossible for me just to drop an 802.11 decoder on it.

183
00:19:06,540 --> 00:19:10,420
So, that's pretty much the end of the talk.

184
00:19:10,960 --> 00:19:16,040
I've been hacking drones, applying things I learned here at the CTF.

185
00:19:16,800 --> 00:19:21,920
One of the important components of that drone is the radio communication.

186
00:19:22,580 --> 00:19:30,680
A lot of the security assessments are just focusing on that physical, but of course the comms is really the more important component because that's over-air the attacks.

187
00:19:30,740 --> 00:19:39,320
So, once you can achieve that, then you have the ability to affect mission capabilities at a distance, and that's really the goal, to prevent that.

188
00:19:39,680 --> 00:19:43,520
And our job as security assessors is to expose the vulnerability.

189
00:19:44,060 --> 00:19:46,020
So, any questions?

190
00:19:53,600 --> 00:19:55,820
I did interface with GNU Radio.

191
00:19:55,820 --> 00:20:04,600
So, the GR IEE 811-2 project allowed me to connect to the SSID.

192
00:20:05,220 --> 00:20:12,040
The next step after that is you have to build a transceiver that allows you to build an Ethernet tunnel.

193
00:20:12,500 --> 00:20:24,780
And I started that work and I've had some access, but again, I'm doing it on an open version of the wireless network, not one that has encryption enabled.

194
00:20:27,940 --> 00:20:29,520
I was a little shocked.

195
00:20:29,520 --> 00:20:31,300
I was seriously shocked.

196
00:20:31,300 --> 00:20:38,620
I mean, the nameplate SDR this project uses is the Edis B210.

197
00:20:38,620 --> 00:20:42,960
But I pulled up the HackRF1 and I was in.

198
00:20:42,960 --> 00:20:46,120
I'm now working on the transceiver with the two of them.

199
00:20:46,420 --> 00:20:56,460
If you've been following drones and RF, you will probably aware of the Doodle radio decoder, excuse me, the DGI radio decoders.

200
00:20:56,460 --> 00:21:03,300
So, DGA, DGI squawks information about the drone, drone ID.

201
00:21:03,500 --> 00:21:06,480
And they've built some decoders now for that.

202
00:21:06,560 --> 00:21:09,380
And the backend of those things are using MATLAB modules.

203
00:21:09,380 --> 00:21:13,560
So, when I went through this thing and I found there were no MATLAB modules, I was a little surprised.

204
00:21:13,560 --> 00:21:18,980
But that lack there might be an issue for like the encryption components.

205
00:21:19,320 --> 00:21:29,960
So, there may be, if I get familiar enough with it, there may be some work there about bringing in some backend optionally that might be able to handle encryption.

206
00:21:34,760 --> 00:21:35,800
All right.

207
00:21:35,800 --> 00:21:39,380
Well, I appreciate your attention and thank you very much.