So, Twitter.
No IQ 15.
My first real introduction to Wi-Fi was here in a similar CTF, I don't know, three, four, five years ago with DC-719 as we tried to slam through the CTF.
And it's really where I got my introduction.
And after I left Lockheed, I've been hacking drones.
So it's a kind of intersection of embedded IoT stuff, cyber stuff, and now RS stuff.
And while I've been doing that, the guy who's been paying me is from the government.
So part of Darkwith Solutions, and we were doing, I don't know, two dozen different drones.
So the drone I'm going to be discussing here, you'll be able to figure it out.
I'll talk about it later, but I'm not going to throw his name on the front of the talk.
They were a little perturbed that they were going to be introduced to the cyber community at Black Hat.
So they wanted to make sure that I was clear with you that the kind of access that I had to the radio was largely due to negligence, they didn't use that word, on the part of the system integrator who's not using all the features that they had on a much older radio than the current versions they're running.
So with that disclaimer, you can't go out and hack their current radios with just this.
But we'll go.
So drones.
This is what you think of when you've got a drone.
If you'll notice there's a radio on that thing in the front, there's another radio on the back, that's the GPS.
There is a flight controller on top.
There are multiple sensors that can feed into this, including CAN based sensors.
Once you get outside of the retail, up to the COTS level where they're flying video and special payloads.
So we're talking about thousand to fifty thousand dollar range drones.
They often have more advanced buses than you would find on the cheaper ones.
But is this really the drone?
Well, it's a drone, it's a UAV.
It's the vehicle, it's the platform in the air.
But it's really part of a much larger system.
Including cloud-based supply chain, software security stuff.
The drone itself is going to have, by law, a ground control unit that a human being sitting in front of that can take control of the drone.
Typically these drones are only allowed to fly line of sight.
And the communication between those can be an RF, they can be on Wi-Fi, they can be on both.
Drones carry payloads.
Payloads are usually on Wi-Fi or they're sharing the mesh radio.
And of course you can do a little bit of fuckery with the sensors there, the GPS and the ADS-B.
We're concentrating on the RF comms between the ground and the drone.
So according to documentation, it's a Wi-Fi system.
And you access web pages that allow you to define the Wi-Fi.
Then your ground system should be talking to your drone.
And indeed they were.
But when I stood up Wi-Fi components to listen, I heard nothing.
Could not find a stupid signal.
And it turns out that I was not the first one at DarkWave to look at some of this stuff.
We had looked at a similar radio set for a different problem set earlier in the year.
So these are getting to be popular with the government for various purposes.
So once I couldn't find it, then I had to read the fucking manual.
These are dual smart radios.
This one was an embedded version, RM2450, which is on the, for you I guess that would be on your left wing.
And it's got special connectors for that, that are feedback up to the drone and are controlled over the, actually the Ethernet connection.
So why would Doodle want to make a signal disappear?
Well it wasn't security.
They're doing it for performance purposes.
And the performance they're looking for is not bandwidth per se.
They're looking for range.
So with the smaller channel width on their Wi-Fi, they're able to achieve longer ranges, lower data rates.
But in most of their use cases, it's the range they're stretching for.
And so you'll see some of the samples there they have on one of their data sheets.
40, 20, 10, 5, and 3.
We didn't have to deal with 3.
We had 5, 10, and 15 megahertz.
By default, it was delivered to us at 15.
You can't see those with 99% of the Wi-Fi chips out there because although the Linux kernel allows it, they have logic for it, the chips don't have the interface that will allow you to access those capabilities.
Atheros does, but we'll get to that in a second.
So some actually had, because I'm a little slow sometimes, had a colleague point out to me this stupid menu feature right here and said, you know, have you played with this?
And that's where we started getting, finally getting a little handle on it.
Because when we change it up to 20 megahertz, of course, boom, instant SSID.
We see it.
We connect to it.
It's just normal 802.11.
And it's just those lower ones that we had to kind of figure out how to get access to.
So doing other forms of hackery, this one was mostly involving u-boot, modifying the boot up parameters and getting shell on the box, which allowed us in turn to secure shell into the radio.
We were able to fingerprint the actual chips that they were using, the QCA9533 and the AR9531 there.
And those looked vaguely familiar to me.
And that's because OpenWrt supports those.
And while I didn't realize it at the time, I had a whole Wi-Fi kit full of them.
That is the GL-iNet-RM300M-Lite.
And what that is, is a tiny little travel router that cost, well, at the time 20 bucks, today 35 bucks.
And I used them to build a Wi-Fi range so I could practice Wi-Fi attacks.
So I could bring them here and actually execute on the CTF well.
That part of the plan didn't work, but I was able to repurpose these for this.
The board there is not actually quite the same board.
That's not the Lite.
And it has two Ethernet connections as opposed to the Lite, which only has one.
Not a big problem here, but you do have to be aware of that when you try to connect and boot up because there's a little bit of extra work to get it on the right, on the LAN interface instead of the WAN.
So once we did that, we had the same chipset.
We were running OpenWrt.
How do you actually go find those narrow channel bandwidths, at least the 5 and the 10?
And the answer is, there's a couple different ways.
I mean, it supports it, but not through the web GUI.
While I showed you a web interface that did, that was especially modified by Doodle to support their customers.
So to get it on the access, there's a whole UCI configuration command set, REPL basic, well not a REPL, but that allows you to pretty much modify anything you need in the radio set.
So you're able to do the channel bandwidth right there, wireless.radio 0, channel bandwidth 5 or 10, and apply it that way.
Or you can go to etsy.config.wireless if you're better at VI than you are at UCI, and modify things there and reboot them, restart them.
So once we did that, we were able to then see the hotspot of interest.
And so we were able to scan to them, and we were able to then actually connect into the mesh network, so that we then can continue further attacks.
Secure shell, or sniffing the communications traffic, or if we wanted to, we could run jam attacks.
Of course we don't actually need that, just do it from raw frequency, but jam attacks against the mavelink comms that are running over that, so at a higher network layer.
So that was great.
That got me to 5 megahertz and 10 megahertz, supported by a Linux kernel, out of the box, with the right chip set.
OpenWRT had the right hardware, the GLI net travel router had the right hardware.
OpenWRT had the right software.
I'm in, I'm connected.
But what about that freaking 15 megahertz, which I will remind you was the default it was delivered to us at.
So pretty proud that we were able to understand this, because I don't come from a strong radio background, but I wanted to get to the 15.
Side note, had I waited a year, or had my integrator, drone integrator, updated their firmware, I wouldn't have been following it this far, because 10 is the new default.
So I'm in the atheros driver source code, and I at least got to the point where I was able to convert the 5 megahertz to 10 megahertz.
And that was an important touchstone for me, because it allowed me to know that I was on the right, had my hands on the right controls, the right knobs, in order to modify the megahertz within the driver.
And the attempt here was to place a 15 megahertz option and build that into the kernel.
But it just got too hard.
I'm not saying you can't do it.
Matter of fact, I'm 100% confident you can at this point.
But given the limited time and resources, I wanted to go explore other modes, though this is still there to be done.
So other modes.
Microtech is another router OS that advertised that they had, sexy voice, the ability to go down to 500 megahertz at 500 megahertz step size.
So it would get that 3, it would get that 10, it would get that 15, it would get the 20, it would get all of those.
And that was great.
So it wasn't all that hard to scramble up, though this is all obsolete hardware now.
So the router board, I don't know, cost I think 40 bucks on eBay, and the chip costs like 10.
For some reason they got a bunch of those over in Czechoslovakia.
And again, you can't really go in the GUI directly to do this because you're off the normal paths, but you can define your own frequency set and channel width and that will then pop into the GUI allowing you to select it.
And if you do that, you're actually able to connect to the radio.
So here's example, here's at 5, 10, and 15.
I'm able to, although only at this point, connect to the SSIDs.
And I'm only able to establish an actual working connection if it's unencrypted.
It was failing on the encryption.
I was looking at packets for that, but once again we're running into a resource issue.
How much time was going to take for me to figure out the encryption problems I was having on a radio I didn't have source code for.
I did reach out to MicroTik for some support, but they started throwing are you in the right country code kind of issues at me, which wasn't the issue and I doubted I was talking to the right techs.
So, have a radio, can't find shit at first, that's my own problem, my ignorance.
Figuring out the 5 and 10, available in the Atheros chipset, figuring out OpenWRT supports that I had routers that could do that, OpenWRT and stood those up and was able to connect clean, except for 15.
Looked at Linux kernel, suspect that that will work, but it was too hard of a nut for me to crack within the time I had, so I shifted over to MicroTik.
Slightly better solution, but again tripped up on the crypto.
So, we're coming to my last gasp, which actually worked better than I expected, but still not a full success.
This is kind of a flattened version of these graphs, but they were intended to make sure that 15 wasn't something special.
I didn't really think it would be, but I also heard you can't do 15 megahertz, so I just wanted to take a quick peek to make sure I understood the channel width and bandwidth for those guys.
And once I did that, I spun up the GREIE80211 and I was able to connect to it using the sample rate matching the channel width.
So, 15 megahertz, not a problem for them.
And just proof of that, I was able to catch that SSID and you can see it there at six megabits, a very slow, the bottom, the slowest rate available is the rate that this thing defaults to.
So, once again I connect to it, but can I actually access the mesh radio network with it?
Potentially, I might.
But again, I have a crypto problem.
I haven't had time yet to go back to the author who is available on Discord, so I'll be hitting him up.
But currently, this is only really effective with open networks, at least in my setup.
So, getting to that last part where I'm the mesh network is TBD, but this GREIE80211 open source project does support that concept.
So, I made progress, but didn't get quite to the goalpost.
This is kind of a repeat of that earlier checkmark where OpenWrt works great on 5 and 10, doesn't give me 15.
Microtix gave me 15, but in a very limited sense.
The Linux kernel modules, I know you can get to there, but I didn't.
And then the GRE is slightly not as good as Microtix, because while it also requires unencrypted, I haven't actually established entry into the mesh network itself, the Ethernet connection.
So, that was fun hack around.
I really enjoyed doing that.
It pushed my typical network enterprise cyber background a lot.
And I had a colleague who was telling me, why are you even bothering with this?
Just buy another doodle radio.
Problem solved.
Not understanding the flexibility, once you're able to do this, how you're freed up from the hardware and now you can pursue them in other avenues.
Once you master this, maybe they push it somewhere else.
But what was the point?
Where's the hack?
Well, the hack here was nothing to do with the radio per se.
Almost all the hacks that come in drones that I'm looking at, $1,000 to $50,000 range, are just crappy security configuration.
Default passwords, no passwords, encryption options not enabled, things that look like they're 128 or 256 bit encryption, until you're realizing they don't take all the bits you need to feed them in the web interface.
So, they have a much smaller entropy space.
So, in this case, this was literally out of their manual.
So, once I'm able to prove I can connect to these networks, I was able to then establish that they were vulnerable to different kinds of attacks.
The odd thing here, the SSID for this drone was wireless hotspot.
The manual says it's due to labs Wi-Fi.
So, either the manual is wrong, or the integrator, the system designer for this, went in and changed the SSID and never changed the password.
So, don't know which it was.
What kind of attacks can you do once you have access to a drone over the air?
Well, you can sniff the traffic.
So, that includes command and control channels, and that includes payload data.
So, you may be seeing what they're saying, which might be an important thing if you're trying to avoid getting attacked by missiles.
You can spoof.
One of the engagements that we had this year was actually not the security assessments with the drones, but security of a counter drone system.
And we were able to go in and lay down false tracks on their system through their radio network.
So, spoofing data, hiding where things are, and then the denial of service, of course.
While frequency jamming is available, that's always very noisy.
But if you can actually jam the protocol they're using, but for overflows or other mistakes in the protocol implementation, then you've got a much more subtle attack than just loudly announcing yourself.
So, once again, Doodle would like you to know this is not their current model.
This is not their current encryption standard, and we should not be able to do that with their current radios.
In addition to all the problems I've already had, they have a frequency shifting capability of taking the whole 802.11 Center Freak and moving it up or down the spectrum.
So, you can stick it down at 1800 megahertz, for instance, or you can push it up to whatever non-standard military frequency range you might want.
They state they have better encryption, and they have vaguely mentioned, without going into details, they have some different waveform components, different modulations that they put in place that should make it impossible for me just to drop an 802.11 decoder on it.
So, that's pretty much the end of the talk.
I've been hacking drones, applying things I learned here at the CTF.
One of the important components of that drone is the radio communication.
A lot of the security assessments are just focusing on that physical, but of course the comms is really the more important component because that's over-air the attacks.
So, once you can achieve that, then you have the ability to affect mission capabilities at a distance, and that's really the goal, to prevent that.
And our job as security assessors is to expose the vulnerability.
So, any questions?
I did interface with GNU Radio.
So, the GR IEE 811-2 project allowed me to connect to the SSID.
The next step after that is you have to build a transceiver that allows you to build an Ethernet tunnel.
And I started that work and I've had some access, but again, I'm doing it on an open version of the wireless network, not one that has encryption enabled.
I was a little shocked.
I was seriously shocked.
I mean, the nameplate SDR this project uses is the Edis B210.
But I pulled up the HackRF1 and I was in.
I'm now working on the transceiver with the two of them.
If you've been following drones and RF, you will probably aware of the Doodle radio decoder, excuse me, the DGI radio decoders.
So, DGA, DGI squawks information about the drone, drone ID.
And they've built some decoders now for that.
And the backend of those things are using MATLAB modules.
So, when I went through this thing and I found there were no MATLAB modules, I was a little surprised.
But that lack there might be an issue for like the encryption components.
So, there may be, if I get familiar enough with it, there may be some work there about bringing in some backend optionally that might be able to handle encryption.
All right.
Well, I appreciate your attention and thank you very much.