All right. Thanks for having us. So today's talk is snoop unto them as they snoop unto you.
I'm Alan Meekins. I go by NullAgent on most social media, Twitter,
Mastodon, all that good stuff. You'll find me on 7-Bit Byte on GitHub. And my personal website
is actually kind of blank, so I'll try to fix that this week. And I've got a co-speaker,
Rekadam, who couldn't be here today. He's stuck in Tokyo without a passport.
And we've got Savage, our apprentice, here today. So just quick background, big robotics nerd,
embedded systems, been playing with Linux since I built my first computer,
really love digital communications, which this talk is going to touch on a lot today.
And I occasionally do, I guess, grown-up work, but these days I am recklessly unemployed and
founder of Data Party. So we're basically a hacker collective looking at
all kinds of things. And I'm a hacker. I'm a hacker. I'm a hacker. I'm a hacker. I'm a hacker.
And it's about the intersection of just media and all the things that hackers love.
So today, the thing that got me started thinking about this was actually a lot of police
interaction that my co-founder and I had over the years. He grew up going through
high school getting pulled over by the cops basically every day.
And growing up, we were hearing a lot about No-Knock Raids. And, you know, coming from
a hacker's perspective, and seeing things like No-Knock Raids,
you kind of start wondering, WWL&D, what would Lord Nikon do?
So Lord Nikon would probably take a closer look at the boys in blue and, you know,
maybe what they carry and how they operate.
To give you some idea of kind of what the landscape is like on the digital world of a cop,
they have on the left the things that they carry, typically tasers and body cams,
so smartphone, pistol, things in the middle that certain companies wish they might carry maybe,
flying drones with tasers on them.
And then on the right, we have all the things that are in their vehicle,
Wi-Fi hotspots, surveillance systems that can actually do license plate reading.
So they actually do ALPR coming soon on their dash cams.
And, of course, they've got a laptop.
And they have these weird little boxes called Axon Signal.
So if you remember the movie Hackers, one of the big things that they talk a lot about is reading the manuals.
So first step was just see what was out in the open.
And so if you start reading through the manuals for all of these types of equipment,
you'll see a whole bunch of terms like Cradle Point and NetCloud mentioned.
You'll see things like Bluetooth pairing, and you'll see brand names like Axon Signal.
And then occasionally you'll find some really cool things like, hey, this is exactly what an air station,
this is exactly what a police car looks like, and here's an exact network map of what a police car looks like inside.
And, you know, you keep reading.
And before you know it, you'll find all sorts of URLs that look tasty and delicious and could be interesting.
So if you ever talk to public defenders and those sorts of people,
they hear about this thing called Evidence.com.
And a lot of them don't realize that that's actually built by the same folks who make the body cams themselves
and all the digital tech.
It all just funnels up to this cloud.
So they've...
They typically access it through, you know, their agency name or their city or state or something,
.evidence.com, and consume content.
And then if you keep reading, you'll start seeing some interesting things that might get a hacker's eyebrows open a little bit.
But at the end of the day, the thing that really caught my eye is that the boys in blue are actually...
Oh, actually, just kept a couple of things, so Wi-Fi access points and fleets and so on.
But the boys in blue are actually the boys in BLE.
.
So there's a term that keeps happening a lot called Axon Signal.
And I keep seeing the word BLE co-occurring with that in the documentation.
So just kind of a quick trip down memory lane from DEF CON is when we're talking about hacking the planet on the terms of BLE,
there's been a great talk by Freaky at DEF CON 29,
1989, where she explained a lot of the basics of BLE, how BLE pairs, how it interacts with
the host and so on.
It's a great starting point to understand what might be going on under the hood of some
of these products.
If you keep reading further, you might see some things like hand off all your privacy,
which deals with how Apple has a BLE protocol called Apple Continuity.
You might also see some things called you better secure your BLE devices, which has
a lot of parallels to what we're seeing today.
Then lastly, Mike Spicer did a talk called I Know What You Did Last Summer.
Just a quick refresher on BLE, I'm not going to go crazy deep on BLE fundamentals, but
a BLE device needs to allow the other devices that it wants to pair with to know that it's
around.
They send out these broadcasts, these beacons, a lot like how Wi-Fi access points also beacon
out.
Typically, you'll find these types of parameters inside of there, at least a MAC address, and
then basically everything else is optional, so manufacturer data, services, product, company,
local name, RSSI, possibly URLs, and additional what are called gap fields, so additional
fields just like this.
Of course, you start thinking about...
If you were to reverse engineer or to fingerprint devices that you haven't seen before, say
like a cop device, there might be a whole spectrum of ways that you might approach that
problem.
For instance, sometimes gap fields come in different orders, so even two devices from
different manufacturers might have identical data, but they might put those fields in different
orders.
That might be a thing that fingerprints, or you might go and try to see if you can find
things on Wiggle.net.
Wiggle's a big network.
It's a big network.
It's a big network of war driving that a lot of people who are participating in the worldwide
war drive right now, they're currently constantly feeding Wi-Fi and BLE data into Wiggle.net.
Then also, I built an app called RF Party, which is basically like Wiggle in your pocket
without a cloud so that you can be entirely off grid.
You could also go down the decompiled apps route, so how can we figure out what these
police devices are actually doing?
Just as a note, most of the apps needed to manage these police devices are actually currently
in the Google Play Store, so you can go download those and decompile them right now.
Without doing all of that crazy stuff, how do I do this without violating any kind of
permissions or laws or anything?
Go back to reading the manual.
I keep seeing this thing called Axon Signal.
What is that, and what does it do?
Well, let's see.
Well, it turns out that the devices highlighted in blue here are actually all Bluetooth enabled.
Body cams and tasers are designed to basically interact with one another, and when a taser
is fired, certain models can actually send out a Bluetooth beacon that will notify the
body cams and the surveillance in cars to start recording, or rather, start retaining
their recording.
Okay.
So body cams also have basically ShotSpotter technology built into them after the third
generation or the second generation of those, and they can also detect a gunfire and trigger
a Bluetooth transmission.
And then third to all of this, the pistol holster itself, there's attachments that
can detect when a pistol's unholstered and, again, sends out a Bluetooth beacon that is
designed to trigger the gunfire.
The body cam.
And the same thing happens on the car side as well.
So again, the blue circles here are things that are Bluetooth enabled, so the documentation
indicates that the same Axon Signal technology is built into dash cams.
And how are those dash cams triggered?
They can be triggered, of course, by everything on the left here, but they can also be triggered
by this little tiny box at the bottom that detects when your police lights are falling
off of your van there.
Okay.
And that will actually detect when you turn on your siren, when you turn on your flashing
lights, and send a signal to the recorder as well.
And then finally, they have a laptop in the mix that also takes a Bluetooth dongle.
I actually never fully figured out exactly why that is, because it doesn't seem to actually
trigger much on there.
And then finally, things that I didn't even feel like digging into, but they have cradle
point Wi-Fi hotspots in there that have all kinds of interesting things in the documentation
that I don't even feel like touching today.
So yeah.
So overall, that's the general architecture of how Axon Signal works.
And we went through the list of devices it's deployed on.
And so yeah.
So where is it used?
It's also used...
Axon has basically their fingers in every part of police life, from how do you charge
these devices at home or in the office, and also things like interrogation rooms, all
of the systems inside of there.
And again, that documentation was a little bit more locked down.
So I don't think that's a problem.
I don't have as much to share directly on entry points under those systems.
So again, with all this in hand, how do you do analysis on this without having to interact
too closely?
And it turns out, go back to reading the manual, and there's this thing called an OUI.
And there's an OUI for the company Axon, which was initially Taser International, called
0025DF.
0025DF.
And that is the first three octets of most MAC addresses in the Bluetooth spectrum.
So if you registered an OUI and you want other people to recognize your device over Bluetooth,
you're gonna use these in places like potentially in the MAC address itself or in the manufacturer
data.
You can also have a fingerprint in there.
So for my app, RF Party, I actually built a database of over 4,000 device identifiers,
simply by looking at OUI databases.
0025DF.
And additionally, Wireshark and their database, and of course, looking at manufacturer data.
And just kind of from my own, analyzing my own devices, discovered that there's a lot
of kind of like, I'm not sure if things are always on spec as far as like how manufacturer
data gets formatted, but there's a lot of interesting ways to fingerprint your devices
just looking at those.
So looking at the Taser OUI, you find out that they have a particular block size.
So they've basically allocated 16 million MAC addresses.
That will be prefixed by this OUI.
So since we're talking about broadcast protocols in Bluetooth, a lot of people are very accustomed
to when devices are paired.
And when devices are paired, the broadcast will stop.
But there's a growing number of protocols being released lately, which rely entirely
on the broadcast capability and basically none at all on the direct connection.
0026DF.
So the COVID exposure tracking has a fairly cryptographically secure approach to fingerprinting
a person and then fingerprinting or having a secure database of exposures that's managed
by your local authorities.
And then you go and prove it.
And eventually, the other people who basically have been around you are essentially war driving
when it comes to COVID exposure tracking.
They're slurping up all these BLE broadcasts, and they're saving the ones that have the
correct fingerprinting.
And they're remembering all the public keys of the people around them.
So COVID exposure tracking is another great example.
It's one of the most pervasive Bluetooth broadcast protocols.
But now it's kind of winding down.
So if you look at Wiggle data, and if you do your own stumbling and whatnot, you'll
see that the COVID broadcast have reduced substantially over time.
But Apple continuity, on the other hand, is basically second, as far as from my personal
ranking.
It's like total traffic that I see.
And Apple continuity has a lot of interesting things that it does.
Again, the app that we built called RF Party, we parse all the sorts of things that hand
off all your privacy discovered.
So things like AirPlay IP addresses.
Yeah, your iPhones are currently beaconing your IP address in BLE constantly.
You can get information like whether or not the person's on the phone, whether or not
they're looking at a video, if it's their primary iCloud device.
So these broadcast protocols have a pretty pervasive impact on your personal privacy
and how trackable you are in public, in public spaces, and governmental spaces.
And then finally, we have a really new broadcast protocol that's coming online next month
called Drone ID.
So Drone ID will also operate primarily in Wi-Fi.
But there's capabilities to do it in BLE as well, Bluetooth.
And I suspect part of the reason is that the BLE hardware might be more lightweight, more
ready to be embedded than some of the Wi-Fi equipment to put on smaller drones.
And so again, on RF Party, we're expecting to be able to parse that type of data.
And so finally, Axon Signal.
So Axon Signal kind of fits into this patchwork of prevailing and existing broadcast protocols.
So kind of taking our understanding of broadcast protocols and everything we found in the manual,
let's see what we can find.
So if you go to Wiggle right now and type in 0025DF, you will find on the left, we have
the locations of police departments, say, in the San Francisco region.
And on the right, we have the Wiggle map of where 0025DF returns have been heard.
And it corresponds pretty closely.
And of course, like, it's clustered.
It's clustered along highways that cops probably patrol.
So there's a decade or more data in Wiggle.
If you run these queries, you're going to see that there's a worldwide footprint that
you guys in this audience have been collecting and putting on Wiggle.
So that's pretty dope.
So what can we do with this?
And what are the other ways that we can detect this?
So RF Party could hypothetically, allegedly detect this.
I can't demo that sort of thing.
Unfortunately, I haven't been contracted by any police departments to actually do any
pin testing on them.
So if you know any, let us know.
We'd be happy to help you figure out how to improve this.
But for demonstration purposes, it also turns out that GoPro video cameras have a broadcast
protocol that they implement.
So I took my GoPro and essentially assumed, hey, let's treat the GoPro like a body cam
and see what that might look like in RF Party.
So here we have RF Party in a public space.
I've verified that my wireless connections are enabled on the GoPro.
And at this point forward, the GoPro will actually beacon so that my phone can manage
it.
The other interesting thing to know about GoPros and their broadcast protocol is that
the protocol does not stop when the GoPro has been turned off.
The screen is off, but the packets continue to be emitted, and that MAC address, as I've
observed on my GoPro, never changes over the course of years.
So when I put in my GoPro into Wiggle, I didn't see anything lately, but that's probably
changed this weekend if I accidentally turned on my wireless connections.
And so if you had a continuous monitor running, and when you searched, and if you searched
for the right parameters, so in RF Party, you were looking for the name of a GoPro,
the GoPro, what we will find is the first ping that we receive will show up on the
map as a dot.
And if you click on that dot, you can see all of the packet information, all the service
information.
I've blurred mine out because, of course, this is all my actual personal MAC addresses
here.
And we're able to then see where we've crossed paths with that particular device.
And so here I am walking through a park.
These are my GPS pings in this ghostly white.
And then at the end, I'm going to run the query again.
And boom.
I've discovered that, hey, I initially saw the GoPro somewhere around here.
And then its final location was somewhere over here.
And there's a number of queries that we support, like duration and triggers that are coming
soon and alerts and that sort of thing.
But you could imagine that if this were, say, a body cam, so this is more of like a simulation
of if I were wearing a body cam.
And we actually have more.
More data points along the way.
It just doesn't render it on the screen.
But you could imagine that you yourself could monitor for your own devices.
Or in the case of cop detectors, in the terms of Axon Signal, this essentially demonstrates
an idea that there might be a way to detect cops.
And so if we switch back, what does this enable?
So specifically at Axon Signal.
Apps like RF Party and Wiggle enable us to potentially do things like proof of body
cam.
So what's proof of body cam?
If you read back on some of those no knocks that I mentioned, and if you read the news
in the last couple of years, you'll find out that sometimes police departments can
be cagey to release potentially damaging body cam footage, right?
And it's kind of hard to compel them.
Because they kind of like to beat around the bush of like, hey, we're not sure if anyone
was there with a body cam.
We've got to check our records.
They can really slow walk things.
So if you had a way to say, hey, I know this MAC address was in the vicinity.
I know this MAC address was at a particular event or a particular occurrence of a potential
police misconduct, you can more directly kind of light a fire under their butts.
And more legally, be able to specifically inquire about that information in court.
Other things that hackers probably think about.
Yeah.
There was a competition, I think, at Black Hat and DEF CON many years ago, it was like
over a decade ago, where people were competing to make kill switches, computer kill switches.
So you hit a button and it thermites your hard drive, or hit a button and the hard
drive catches on fire, or various things, right?
So you can imagine if you're a very enterprising hacker, you might have a cop alert in the
Bluetooth spectrum that could trigger those sorts of things.
And of course, knowing things like RSSI and the received signal strength that correlated
with these devices, you can very tightly detect the distance that a cop is to your
computer, and the computer could self-destruct automagically.
Poof.
You could do things like identifying specific cops.
So a lot of cities, activists will file cases that will eventually put cops on something
called the Brady list, so basically a list of unknown police misconduct and bad behavior,
bad apples, if you will.
And then you can do things like, hey, I'm going to do this, I'm going to do this, I'm going to do this, I'm going to do this, I'm going to do this, I'm going to do this, I'm going to do this, I'm going to do this, I'm going to do this.
And you might want to get an alert if you're dealing with a bad apple, or you might want
to know, hey, I didn't catch that guy's badge number, but turns out I had Wiggle running.
And now you can go dig through that database, dig through your own logs, and now you know
their MAC address, and you might be able to subpoena for the rest of the information.
And then the other interesting thing that organizations like ACLU and EFF currently
monitor are things like surveillance.
So where does Axon Signal factor in all of this?
If all of these body cams start doing facial recognition, for instance, so these body
cams actually have 4G LTE connections, and they actually can live stream video at any
moment, and that's, you know, I'm not even talking about the cloud this year.
But there's a huge question about what's the prevalence of this technology, especially
as we understand more and more about these features, especially like the license plate
reader being embedded directly into the dash cam.
What if that license plate reader technology gets embedded into body cams?
You know, there's kind of a...
Not even a slippery slope.
It is a Homer Simpson falling down a ski mountain worth of interesting problems here that we
might want to understand as civilians and for our civil liberties how prevalent these
technologies are.
So finally, tools like RFParty, we were absolutely inspired by these types of questions, and
we really want to enable other people to be able to experiment and learn about these devices.
And of course, you know, if cops are trackable, we're very...
We're very trackable as well with things like our GoPros, our Apple continuity.
How do we verify that any of those devices are actually in airplane mode when the main...
If you read the instructions for, you know, iPhone, it says, you know, turn off the Bluetooth
connection, turn off airplane mode.
There's not really a great way for an ordinary person to verify that.
And kind of what we're also pointing out here is that every device, not just AirTags, every
device is an AirTag, right?
So...
So we actually need a way to detect all Bluetooth devices.
We don't need one-off solutions that only work on iPhones and then take three years
for Android to catch up and then leaves everyone who runs Linux completely in the lurch.
We actually need a solution for everyone, right?
And for every possible device.
So that's kind of...
That's the talk.
And here are some tools.
So the biggest tools used here were the PDF viewer.
The second most used tool was...
This is an OUI database.
And then finally, Wiggle.net.
And then some other super handy tool is NRF Connect.
NRF Connect kind of is the only multi-platform Bluetooth scanner right now that's allowed...
Because they're actually allowed on the Apple store.
Apple doesn't really allow hacker tools in their app store.
However, they do use the Nordic semiconductor Bluetooth chips.
So somehow Nordic got an app in their store.
Yeah.
And then so, yeah.
So we're building this thing called RF Party.
It runs on Android.
And then it's on Mac, Linux, and Windows coming soon.
And then finally, we have some open hardware as well.
And then all of this is open source.
You can get it on the app store and help us get home.
And party on, everybody.