WEBVTT 00:00.000 --> 00:01.860 So, Twitter. 00:02.220 --> 00:03.840 No IQ 15. 00:04.000 --> 00:19.360 My first real introduction to Wi-Fi was here in a similar CTF, I don't know, three, four, five years ago with DC-719 as we tried to slam through the CTF. 00:19.360 --> 00:21.700 And it's really where I got my introduction. 00:21.700 --> 00:25.420 And after I left Lockheed, I've been hacking drones. 00:25.460 --> 00:34.520 So it's a kind of intersection of embedded IoT stuff, cyber stuff, and now RS stuff. 00:34.820 --> 00:41.540 And while I've been doing that, the guy who's been paying me is from the government. 00:41.680 --> 00:48.240 So part of Darkwith Solutions, and we were doing, I don't know, two dozen different drones. 00:48.240 --> 00:53.620 So the drone I'm going to be discussing here, you'll be able to figure it out. 00:53.620 --> 00:56.180 I'll talk about it later, but I'm not going to throw his name on the front of the talk. 00:56.220 --> 01:02.620 They were a little perturbed that they were going to be introduced to the cyber community at Black Hat. 01:02.620 --> 01:22.940 So they wanted to make sure that I was clear with you that the kind of access that I had to the radio was largely due to negligence, they didn't use that word, on the part of the system integrator who's not using all the features that they had on a much older radio than the current versions they're running. 01:22.940 --> 01:28.380 So with that disclaimer, you can't go out and hack their current radios with just this. 01:28.440 --> 01:30.400 But we'll go. 01:31.280 --> 01:33.360 So drones. 01:33.360 --> 01:35.360 This is what you think of when you've got a drone. 01:35.760 --> 01:40.800 If you'll notice there's a radio on that thing in the front, there's another radio on the back, that's the GPS. 01:42.200 --> 01:45.840 There is a flight controller on top. 01:45.880 --> 01:49.700 There are multiple sensors that can feed into this, including CAN based sensors. 01:49.700 --> 01:55.560 Once you get outside of the retail, up to the COTS level where they're flying video and special payloads. 01:55.560 --> 01:59.380 So we're talking about thousand to fifty thousand dollar range drones. 01:59.380 --> 02:04.140 They often have more advanced buses than you would find on the cheaper ones. 02:04.560 --> 02:07.580 But is this really the drone? 02:08.300 --> 02:10.680 Well, it's a drone, it's a UAV. 02:10.680 --> 02:13.140 It's the vehicle, it's the platform in the air. 02:13.160 --> 02:15.600 But it's really part of a much larger system. 02:16.320 --> 02:19.700 Including cloud-based supply chain, software security stuff. 02:20.260 --> 02:28.500 The drone itself is going to have, by law, a ground control unit that a human being sitting in front of that can take control of the drone. 02:28.760 --> 02:32.020 Typically these drones are only allowed to fly line of sight. 02:32.480 --> 02:37.980 And the communication between those can be an RF, they can be on Wi-Fi, they can be on both. 02:38.160 --> 02:39.580 Drones carry payloads. 02:39.580 --> 02:42.920 Payloads are usually on Wi-Fi or they're sharing the mesh radio. 02:44.120 --> 02:49.980 And of course you can do a little bit of fuckery with the sensors there, the GPS and the ADS-B. 02:50.260 --> 02:55.860 We're concentrating on the RF comms between the ground and the drone. 02:57.100 --> 03:02.300 So according to documentation, it's a Wi-Fi system. 03:03.260 --> 03:09.440 And you access web pages that allow you to define the Wi-Fi. 03:09.440 --> 03:14.400 Then your ground system should be talking to your drone. 03:14.400 --> 03:16.040 And indeed they were. 03:16.400 --> 03:20.960 But when I stood up Wi-Fi components to listen, I heard nothing. 03:21.260 --> 03:23.460 Could not find a stupid signal. 03:23.460 --> 03:27.940 And it turns out that I was not the first one at DarkWave to look at some of this stuff. 03:27.940 --> 03:32.680 We had looked at a similar radio set for a different problem set earlier in the year. 03:33.000 --> 03:37.360 So these are getting to be popular with the government for various purposes. 03:37.860 --> 03:42.060 So once I couldn't find it, then I had to read the fucking manual. 03:42.540 --> 03:44.300 These are dual smart radios. 03:44.300 --> 03:52.580 This one was an embedded version, RM2450, which is on the, for you I guess that would be on your left wing. 03:52.840 --> 04:05.940 And it's got special connectors for that, that are feedback up to the drone and are controlled over the, actually the Ethernet connection. 04:06.240 --> 04:13.120 So why would Doodle want to make a signal disappear? 04:13.120 --> 04:14.620 Well it wasn't security. 04:14.620 --> 04:16.940 They're doing it for performance purposes. 04:16.940 --> 04:20.140 And the performance they're looking for is not bandwidth per se. 04:20.140 --> 04:22.060 They're looking for range. 04:22.240 --> 04:33.420 So with the smaller channel width on their Wi-Fi, they're able to achieve longer ranges, lower data rates. 04:33.500 --> 04:38.900 But in most of their use cases, it's the range they're stretching for. 04:39.240 --> 04:43.200 And so you'll see some of the samples there they have on one of their data sheets. 04:43.200 --> 04:45.560 40, 20, 10, 5, and 3. 04:45.600 --> 04:47.380 We didn't have to deal with 3. 04:47.400 --> 04:50.600 We had 5, 10, and 15 megahertz. 04:50.600 --> 04:53.300 By default, it was delivered to us at 15. 04:53.720 --> 05:07.700 You can't see those with 99% of the Wi-Fi chips out there because although the Linux kernel allows it, they have logic for it, the chips don't have the interface that will allow you to access those capabilities. 05:08.020 --> 05:10.280 Atheros does, but we'll get to that in a second. 05:11.800 --> 05:22.720 So some actually had, because I'm a little slow sometimes, had a colleague point out to me this stupid menu feature right here and said, you know, have you played with this? 05:22.720 --> 05:25.800 And that's where we started getting, finally getting a little handle on it. 05:25.800 --> 05:29.820 Because when we change it up to 20 megahertz, of course, boom, instant SSID. 05:29.820 --> 05:30.660 We see it. 05:30.660 --> 05:31.560 We connect to it. 05:31.560 --> 05:33.220 It's just normal 802.11. 05:33.980 --> 05:38.540 And it's just those lower ones that we had to kind of figure out how to get access to. 05:40.240 --> 05:53.860 So doing other forms of hackery, this one was mostly involving u-boot, modifying the boot up parameters and getting shell on the box, which allowed us in turn to secure shell into the radio. 05:54.060 --> 06:02.140 We were able to fingerprint the actual chips that they were using, the QCA9533 and the AR9531 there. 06:02.140 --> 06:05.040 And those looked vaguely familiar to me. 06:05.740 --> 06:10.560 And that's because OpenWrt supports those. 06:10.880 --> 06:19.160 And while I didn't realize it at the time, I had a whole Wi-Fi kit full of them. 06:20.160 --> 06:24.180 That is the GL-iNet-RM300M-Lite. 06:24.180 --> 06:30.820 And what that is, is a tiny little travel router that cost, well, at the time 20 bucks, today 35 bucks. 06:30.980 --> 06:36.820 And I used them to build a Wi-Fi range so I could practice Wi-Fi attacks. 06:36.820 --> 06:40.540 So I could bring them here and actually execute on the CTF well. 06:40.540 --> 06:43.580 That part of the plan didn't work, but I was able to repurpose these for this. 06:44.220 --> 06:46.800 The board there is not actually quite the same board. 06:46.840 --> 06:48.180 That's not the Lite. 06:48.260 --> 06:52.440 And it has two Ethernet connections as opposed to the Lite, which only has one. 06:52.440 --> 07:03.260 Not a big problem here, but you do have to be aware of that when you try to connect and boot up because there's a little bit of extra work to get it on the right, on the LAN interface instead of the WAN. 07:05.660 --> 07:09.080 So once we did that, we had the same chipset. 07:09.080 --> 07:11.200 We were running OpenWrt. 07:11.420 --> 07:16.180 How do you actually go find those narrow channel bandwidths, at least the 5 and the 10? 07:16.660 --> 07:19.020 And the answer is, there's a couple different ways. 07:19.020 --> 07:21.340 I mean, it supports it, but not through the web GUI. 07:21.340 --> 07:27.360 While I showed you a web interface that did, that was especially modified by Doodle to support their customers. 07:27.360 --> 07:43.920 So to get it on the access, there's a whole UCI configuration command set, REPL basic, well not a REPL, but that allows you to pretty much modify anything you need in the radio set. 07:43.920 --> 07:51.440 So you're able to do the channel bandwidth right there, wireless.radio 0, channel bandwidth 5 or 10, and apply it that way. 07:51.440 --> 07:59.600 Or you can go to etsy.config.wireless if you're better at VI than you are at UCI, and modify things there and reboot them, restart them. 08:00.120 --> 08:08.060 So once we did that, we were able to then see the hotspot of interest. 08:08.200 --> 08:21.900 And so we were able to scan to them, and we were able to then actually connect into the mesh network, so that we then can continue further attacks. 08:21.900 --> 08:31.060 Secure shell, or sniffing the communications traffic, or if we wanted to, we could run jam attacks. 08:31.060 --> 08:41.560 Of course we don't actually need that, just do it from raw frequency, but jam attacks against the mavelink comms that are running over that, so at a higher network layer. 08:43.420 --> 08:44.440 So that was great. 08:44.440 --> 08:52.920 That got me to 5 megahertz and 10 megahertz, supported by a Linux kernel, out of the box, with the right chip set. 08:53.380 --> 08:58.840 OpenWRT had the right hardware, the GLI net travel router had the right hardware. 08:59.520 --> 09:01.360 OpenWRT had the right software. 09:01.540 --> 09:02.880 I'm in, I'm connected. 09:02.880 --> 09:08.600 But what about that freaking 15 megahertz, which I will remind you was the default it was delivered to us at. 09:08.600 --> 09:17.060 So pretty proud that we were able to understand this, because I don't come from a strong radio background, but I wanted to get to the 15. 09:17.700 --> 09:27.340 Side note, had I waited a year, or had my integrator, drone integrator, updated their firmware, I wouldn't have been following it this far, because 10 is the new default. 09:27.960 --> 09:40.120 So I'm in the atheros driver source code, and I at least got to the point where I was able to convert the 5 megahertz to 10 megahertz. 09:40.120 --> 09:54.760 And that was an important touchstone for me, because it allowed me to know that I was on the right, had my hands on the right controls, the right knobs, in order to modify the megahertz within the driver. 09:54.960 --> 10:03.520 And the attempt here was to place a 15 megahertz option and build that into the kernel. 10:04.900 --> 10:08.660 But it just got too hard. 10:08.660 --> 10:09.640 I'm not saying you can't do it. 10:09.640 --> 10:12.800 Matter of fact, I'm 100% confident you can at this point. 10:12.800 --> 10:21.900 But given the limited time and resources, I wanted to go explore other modes, though this is still there to be done. 10:22.380 --> 10:24.300 So other modes. 10:25.000 --> 10:43.460 Microtech is another router OS that advertised that they had, sexy voice, the ability to go down to 500 megahertz at 500 megahertz step size. 10:43.600 --> 10:49.960 So it would get that 3, it would get that 10, it would get that 15, it would get the 20, it would get all of those. 10:49.960 --> 10:51.900 And that was great. 10:51.900 --> 10:56.960 So it wasn't all that hard to scramble up, though this is all obsolete hardware now. 10:57.040 --> 11:02.940 So the router board, I don't know, cost I think 40 bucks on eBay, and the chip costs like 10. 11:03.520 --> 11:06.440 For some reason they got a bunch of those over in Czechoslovakia. 11:07.000 --> 11:22.640 And again, you can't really go in the GUI directly to do this because you're off the normal paths, but you can define your own frequency set and channel width and that will then pop into the GUI allowing you to select it. 11:22.640 --> 11:28.080 And if you do that, you're actually able to connect to the radio. 11:28.080 --> 11:33.100 So here's example, here's at 5, 10, and 15. 11:33.100 --> 11:38.560 I'm able to, although only at this point, connect to the SSIDs. 11:38.860 --> 11:47.080 And I'm only able to establish an actual working connection if it's unencrypted. 11:47.100 --> 11:49.620 It was failing on the encryption. 11:49.680 --> 11:54.760 I was looking at packets for that, but once again we're running into a resource issue. 11:54.920 --> 12:02.460 How much time was going to take for me to figure out the encryption problems I was having on a radio I didn't have source code for. 12:02.460 --> 12:14.740 I did reach out to MicroTik for some support, but they started throwing are you in the right country code kind of issues at me, which wasn't the issue and I doubted I was talking to the right techs. 12:15.900 --> 12:24.100 So, have a radio, can't find shit at first, that's my own problem, my ignorance. 12:24.400 --> 12:36.880 Figuring out the 5 and 10, available in the Atheros chipset, figuring out OpenWRT supports that I had routers that could do that, OpenWRT and stood those up and was able to connect clean, except for 15. 12:38.060 --> 12:46.680 Looked at Linux kernel, suspect that that will work, but it was too hard of a nut for me to crack within the time I had, so I shifted over to MicroTik. 12:47.140 --> 12:52.120 Slightly better solution, but again tripped up on the crypto. 12:52.660 --> 12:59.260 So, we're coming to my last gasp, which actually worked better than I expected, but still not a full success. 12:59.540 --> 13:08.740 This is kind of a flattened version of these graphs, but they were intended to make sure that 15 wasn't something special. 13:08.740 --> 13:20.860 I didn't really think it would be, but I also heard you can't do 15 megahertz, so I just wanted to take a quick peek to make sure I understood the channel width and bandwidth for those guys. 13:21.540 --> 13:36.840 And once I did that, I spun up the GREIE80211 and I was able to connect to it using the sample rate matching the channel width. 13:36.840 --> 13:40.320 So, 15 megahertz, not a problem for them. 13:42.980 --> 13:56.400 And just proof of that, I was able to catch that SSID and you can see it there at six megabits, a very slow, the bottom, the slowest rate available is the rate that this thing defaults to. 13:57.280 --> 14:06.060 So, once again I connect to it, but can I actually access the mesh radio network with it? 14:07.080 --> 14:09.240 Potentially, I might. 14:09.280 --> 14:11.020 But again, I have a crypto problem. 14:11.700 --> 14:17.220 I haven't had time yet to go back to the author who is available on Discord, so I'll be hitting him up. 14:17.420 --> 14:24.100 But currently, this is only really effective with open networks, at least in my setup. 14:25.140 --> 14:37.440 So, getting to that last part where I'm the mesh network is TBD, but this GREIE80211 open source project does support that concept. 14:37.600 --> 14:43.080 So, I made progress, but didn't get quite to the goalpost. 14:43.240 --> 14:51.620 This is kind of a repeat of that earlier checkmark where OpenWrt works great on 5 and 10, doesn't give me 15. 14:51.620 --> 14:55.220 Microtix gave me 15, but in a very limited sense. 14:56.120 --> 15:01.160 The Linux kernel modules, I know you can get to there, but I didn't. 15:01.280 --> 15:14.380 And then the GRE is slightly not as good as Microtix, because while it also requires unencrypted, I haven't actually established entry into the mesh network itself, the Ethernet connection. 15:15.200 --> 15:20.620 So, that was fun hack around. 15:20.620 --> 15:23.060 I really enjoyed doing that. 15:23.420 --> 15:29.140 It pushed my typical network enterprise cyber background a lot. 15:30.040 --> 15:33.680 And I had a colleague who was telling me, why are you even bothering with this? 15:33.680 --> 15:35.360 Just buy another doodle radio. 15:35.360 --> 15:36.420 Problem solved. 15:36.420 --> 15:47.220 Not understanding the flexibility, once you're able to do this, how you're freed up from the hardware and now you can pursue them in other avenues. 15:47.220 --> 15:50.720 Once you master this, maybe they push it somewhere else. 15:50.720 --> 15:52.820 But what was the point? 15:52.820 --> 15:54.100 Where's the hack? 15:54.380 --> 15:58.920 Well, the hack here was nothing to do with the radio per se. 15:59.320 --> 16:10.180 Almost all the hacks that come in drones that I'm looking at, $1,000 to $50,000 range, are just crappy security configuration. 16:10.180 --> 16:24.020 Default passwords, no passwords, encryption options not enabled, things that look like they're 128 or 256 bit encryption, until you're realizing they don't take all the bits you need to feed them in the web interface. 16:24.020 --> 16:26.960 So, they have a much smaller entropy space. 16:27.980 --> 16:35.900 So, in this case, this was literally out of their manual. 16:35.900 --> 16:45.260 So, once I'm able to prove I can connect to these networks, I was able to then establish that they were vulnerable to different kinds of attacks. 16:45.460 --> 16:54.120 The odd thing here, the SSID for this drone was wireless hotspot. 16:54.120 --> 16:58.920 The manual says it's due to labs Wi-Fi. 17:00.100 --> 17:08.460 So, either the manual is wrong, or the integrator, the system designer for this, went in and changed the SSID and never changed the password. 17:08.460 --> 17:10.100 So, don't know which it was. 17:11.400 --> 17:15.420 What kind of attacks can you do once you have access to a drone over the air? 17:15.500 --> 17:17.200 Well, you can sniff the traffic. 17:17.260 --> 17:21.780 So, that includes command and control channels, and that includes payload data. 17:21.780 --> 17:28.020 So, you may be seeing what they're saying, which might be an important thing if you're trying to avoid getting attacked by missiles. 17:29.780 --> 17:31.560 You can spoof. 17:32.020 --> 17:39.880 One of the engagements that we had this year was actually not the security assessments with the drones, but security of a counter drone system. 17:39.960 --> 17:45.600 And we were able to go in and lay down false tracks on their system through their radio network. 17:45.600 --> 17:52.120 So, spoofing data, hiding where things are, and then the denial of service, of course. 17:52.120 --> 17:55.780 While frequency jamming is available, that's always very noisy. 17:55.780 --> 18:08.780 But if you can actually jam the protocol they're using, but for overflows or other mistakes in the protocol implementation, then you've got a much more subtle attack than just loudly announcing yourself. 18:09.900 --> 18:16.860 So, once again, Doodle would like you to know this is not their current model. 18:16.860 --> 18:24.680 This is not their current encryption standard, and we should not be able to do that with their current radios. 18:25.360 --> 18:35.700 In addition to all the problems I've already had, they have a frequency shifting capability of taking the whole 802.11 Center Freak and moving it up or down the spectrum. 18:35.700 --> 18:47.020 So, you can stick it down at 1800 megahertz, for instance, or you can push it up to whatever non-standard military frequency range you might want. 18:47.360 --> 19:05.940 They state they have better encryption, and they have vaguely mentioned, without going into details, they have some different waveform components, different modulations that they put in place that should make it impossible for me just to drop an 802.11 decoder on it. 19:06.540 --> 19:10.420 So, that's pretty much the end of the talk. 19:10.960 --> 19:16.040 I've been hacking drones, applying things I learned here at the CTF. 19:16.800 --> 19:21.920 One of the important components of that drone is the radio communication. 19:22.580 --> 19:30.680 A lot of the security assessments are just focusing on that physical, but of course the comms is really the more important component because that's over-air the attacks. 19:30.740 --> 19:39.320 So, once you can achieve that, then you have the ability to affect mission capabilities at a distance, and that's really the goal, to prevent that. 19:39.680 --> 19:43.520 And our job as security assessors is to expose the vulnerability. 19:44.060 --> 19:46.020 So, any questions? 19:53.600 --> 19:55.820 I did interface with GNU Radio. 19:55.820 --> 20:04.600 So, the GR IEE 811-2 project allowed me to connect to the SSID. 20:05.220 --> 20:12.040 The next step after that is you have to build a transceiver that allows you to build an Ethernet tunnel. 20:12.500 --> 20:24.780 And I started that work and I've had some access, but again, I'm doing it on an open version of the wireless network, not one that has encryption enabled. 20:27.940 --> 20:29.520 I was a little shocked. 20:29.520 --> 20:31.300 I was seriously shocked. 20:31.300 --> 20:38.620 I mean, the nameplate SDR this project uses is the Edis B210. 20:38.620 --> 20:42.960 But I pulled up the HackRF1 and I was in. 20:42.960 --> 20:46.120 I'm now working on the transceiver with the two of them. 20:46.420 --> 20:56.460 If you've been following drones and RF, you will probably aware of the Doodle radio decoder, excuse me, the DGI radio decoders. 20:56.460 --> 21:03.300 So, DGA, DGI squawks information about the drone, drone ID. 21:03.500 --> 21:06.480 And they've built some decoders now for that. 21:06.560 --> 21:09.380 And the backend of those things are using MATLAB modules. 21:09.380 --> 21:13.560 So, when I went through this thing and I found there were no MATLAB modules, I was a little surprised. 21:13.560 --> 21:18.980 But that lack there might be an issue for like the encryption components. 21:19.320 --> 21:29.960 So, there may be, if I get familiar enough with it, there may be some work there about bringing in some backend optionally that might be able to handle encryption. 21:34.760 --> 21:35.800 All right. 21:35.800 --> 21:39.380 Well, I appreciate your attention and thank you very much.