[00:00.000 --> 00:02.800]  Our first presenter today is Paz Miller.
[00:02.960 --> 00:07.960]  Paz started his professional career by hacking games and developing tools for his teams.
[00:07.960 --> 00:13.320]  He has led multidisciplinary systems development as a systems engineer for the aerospace industry.
[00:13.500 --> 00:17.620]  Today, he will be speaking about what is a little radiotron, and how to operate it.
[00:17.620 --> 00:20.680]  Let's start today off with a round of applause for Paz.
[00:22.420 --> 00:23.720]  Thank you.
[00:24.560 --> 00:25.940]  Thank you.
[00:27.560 --> 00:33.360]  Hi everyone, my name is Paz Miller and I will talk about the problem of the weather.
[00:35.120 --> 00:41.360]  There is no need for the initial introduction since I was just right now introduced.
[00:42.240 --> 00:54.100]  The work I did was about attacking the channel between the weather balloons that are being sent every day and their reception stations.
[00:54.420 --> 00:57.180]  And I will go over the work.
[00:58.620 --> 01:02.600]  First thing that needs to be done is to introduce the weather balloon.
[01:02.600 --> 01:11.900]  And you can see here on the right, on the upper side of the photo, you can see the partially filled balloon.
[01:11.900 --> 01:14.200]  It's partially filled with helium.
[01:14.200 --> 01:27.260]  On the lower side you can see the payload, which is an instrumentation box that samples the data from the air and transmits it to a ground station.
[01:27.260 --> 01:44.500]  And in the middle you can see a small parachute because when the balloon pops, everything falls down and you don't want to get hit by your head by something that fell from 100,000 feet up high.
[01:47.260 --> 01:53.840]  Oh, I forgot to mention in the last line of the slide, the payload is called Radiosonde.
[01:53.840 --> 01:58.980]  And from here on, now I will speak only about the Radiosonde.
[01:58.980 --> 02:09.440]  Here you can see several quotes from a senior meteorologist at Vandenberg Space Force Base, where they are doing satellite launches.
[02:09.680 --> 02:19.800]  And he is saying that the data from the weather balloons go directly into the databases and to the national weather model.
[02:19.880 --> 02:28.400]  Which is great for me as a hacker to know that if I succeed disrupting the data, it will go directly into the databases and into the models.
[02:29.140 --> 02:39.180]  Next thing he is mentioning that they are doing a lot of launches while doing the launch count, doing a lot of releases of weather balloons during the launch count.
[02:39.180 --> 02:45.360]  They really need updated information to take the decision if to do a satellite launch or not.
[02:45.600 --> 03:01.900]  And the last thing he is emphasizing how critical it is for the launch mission, because as we have all seen in movies, eventually there is a bunch of guys who are sitting in a room and each one needs to raise his thumb and say, I'm okay, we are all good to go.
[03:01.900 --> 03:10.520]  And there is an officer there, a weather officer, and he examines the data from the weather balloon, the last weather balloon that was released.
[03:10.640 --> 03:14.560]  And he needs to decide if the weather is good, he is going to approve the launch.
[03:14.560 --> 03:17.220]  If the weather is bad, he will delay the launch.
[03:17.580 --> 03:32.480]  And for me as a hacker it is very important to understand that, because if I can falsify the data that he is looking at, then I can make him cancel launch in good weather, or in the worst case, approve a launch in bad weather.
[03:35.080 --> 03:53.680]  I might be intimidated to attack an army base, but NASA is helping here and saying that they not only demand that the weather about the launch site will be great, but they also demand that the weather on the down range will be great.
[03:53.720 --> 04:02.680]  And it means that there are a lot of civil stations, weather balloons, launching stations, that need to approve the launch.
[04:02.680 --> 04:10.460]  And if I'm intimidated to attack an army base, I might not be intimidated to attack a simple civil station.
[04:12.060 --> 04:15.680]  Okay, so I have my malicious intentions.
[04:16.040 --> 04:19.600]  And now I need to choose my path to attack.
[04:19.600 --> 04:24.760]  And you can see here the list of the most common radiosounds that are being launched.
[04:25.020 --> 04:30.720]  And leading the market is the Vaisela RS-41, so I focused my work on that model.
[04:32.460 --> 04:38.100]  Here you can see the major properties of the transmission frame.
[04:38.100 --> 04:41.940]  There are two common models of the RS-41 submodels.
[04:42.000 --> 04:45.080]  One is the SG and the other one is the SGP.
[04:45.080 --> 04:49.120]  The SGP comprises a pressure sensor and the SG does not.
[04:49.120 --> 04:51.340]  That's the only difference between the two.
[04:51.900 --> 04:55.460]  The basic frame is 320 bytes divided into blocks.
[04:55.460 --> 04:57.320]  We'll see the blocks in the next slide.
[04:57.900 --> 05:00.760]  And there are two layers of error detection and correction.
[05:01.700 --> 05:05.740]  One is CRC-16, which is applied on each block.
[05:05.740 --> 05:11.880]  And RIG-Solomon, which is applied on the whole frame for forward error correction.
[05:13.020 --> 05:17.600]  Here you can see the blocks in the frame.
[05:17.600 --> 05:19.640]  The first bytes are header bytes.
[05:19.640 --> 05:23.000]  The next are forward error correction bytes.
[05:23.000 --> 05:26.100]  Then comes the frame type, which is a very simple byte.
[05:26.100 --> 05:28.240]  And then comes the blocks.
[05:28.240 --> 05:38.200]  Block 79 comprises all of the general purpose data, ID, serial numbers, calibration data, battery voltage, and so on.
[05:38.200 --> 05:45.220]  It also has subframes, which I will go over in the next slide.
[05:45.860 --> 05:48.040]  The next block is block 7A.
[05:48.040 --> 05:53.040]  That comprises all of the data measurements, all of the error data measurements.
[05:53.040 --> 05:59.200]  And then 7C, 7D, 7B are three GPS information blocks.
[05:59.660 --> 06:02.660]  A lot of information is in there.
[06:02.660 --> 06:06.420]  And the last block is an empty block, 76.
[06:08.760 --> 06:14.180]  In the subframes, there are 51 subframes, 16 bytes each.
[06:14.180 --> 06:23.370]  There's a lot of additional information, serial numbers, path numbers, diagnostic data, calibration data, and so on.
[06:25.010 --> 06:28.180]  Here are the RS41 RF properties.
[06:28.180 --> 06:34.020]  It works between 400 MHz and 406 MHz.
[06:34.020 --> 06:36.060]  It outputs 18 dBm.
[06:36.060 --> 06:46.160]  And the modulation GFSK is very, very easy to pick up the signals with a simple RTL-SDR receiver and a good antenna.
[06:46.280 --> 06:55.280]  And you can set up your own station at home and start picking up the signals from the radio sound that goes over your house.
[06:55.360 --> 07:00.840]  And there are thousands of people doing it all over the world right now.
[07:00.840 --> 07:06.700]  All have stations like this installed in their houses, very simple, very cheap ones.
[07:06.700 --> 07:12.920]  And they are all communicating with each other and passing the data that they are getting into public databases.
[07:12.920 --> 07:19.500]  And they develop tools for decoding and to give people access to the data.
[07:19.500 --> 07:26.640]  And there are several websites where you can go and view different flights right now, live in the air.
[07:28.480 --> 07:33.560]  Okay, so I have malicious intentions and I have my RF link to attack.
[07:33.560 --> 07:37.600]  So the most basic attack would be to do a jamming attack.
[07:37.600 --> 07:38.660]  And how do you jam?
[07:38.660 --> 07:43.540]  You take a strong, powerful transmitter and you transmit jamming signals.
[07:44.000 --> 07:48.720]  My weapon of choice was the Heltech Automation Laurel Node 151.
[07:48.720 --> 07:56.760]  I just searched for a certain type of transmitter on eBay and I saw the name Heltech and I said, Oh God, this is a sign.
[07:56.760 --> 07:58.880]  So I immediately grabbed it.
[07:58.920 --> 08:00.980]  It has a very good Laurel chip.
[08:00.980 --> 08:03.160]  It has a very good microcontroller.
[08:03.400 --> 08:05.380]  It transmits 20 dBm.
[08:05.380 --> 08:08.500]  It carries its own lithium battery, which is great.
[08:08.500 --> 08:09.820]  You will see it in a minute.
[08:10.240 --> 08:14.280]  And it costs 20 bucks on eBay and it weighs close to nothing.
[08:16.660 --> 08:19.480]  So, let's see a jamming attack.
[08:20.260 --> 08:27.560]  On the right side, you can see the computer and a transmitter that is emulating the RS-41 transmissions.
[08:27.780 --> 08:32.440]  On the left side, you can see a simple reception station, as I explained earlier.
[08:32.880 --> 08:38.660]  And in the middle, you can see the small jamming equipment, which is a board and a battery.
[08:40.200 --> 08:42.700]  Now I'll start the Radiosound emulation.
[08:42.700 --> 08:44.520]  The emulation is very simple.
[08:44.520 --> 08:49.000]  I have a log file of all transmissions for RS-41.
[08:49.000 --> 08:54.800]  And the script takes a message, transmits it, takes another message, transmits it in a cyclic manner.
[08:56.120 --> 09:02.780]  And here you can see the transmission being received by the RTL-SDR software.
[09:05.420 --> 09:07.360]  And this is the decoding software.
[09:07.360 --> 09:09.140]  This is what the operator sees.
[09:12.180 --> 09:15.420]  In the middle, you can see the Radiosound position and velocity.
[09:16.980 --> 09:21.080]  Here you can see some general information, such as sound ID.
[09:22.640 --> 09:28.460]  Here is the GPS time and the quality of reception of the space vehicles.
[09:28.760 --> 09:31.380]  And this is the subframe status.
[09:32.620 --> 09:36.540]  Here you can see the measurements that are being taken by the Radiosound.
[09:37.820 --> 09:42.820]  And this is the GPS navigation data that the Radiosound is sending down.
[09:42.820 --> 09:50.160]  The link between the decoding software and the RTL software is over the computer's audio channel.
[09:50.160 --> 09:56.920]  And here you can see that you can record this audio channel and look at the raw data.
[09:57.100 --> 10:05.920]  If I zoom in, you can see here the preamble bits, followed by the data bits inside the message.
[10:05.920 --> 10:06.420]  Okay
[10:14.130 --> 10:22.250]  , so I have a working link, I'm doing decoding, everything is great, so let's add some jamming.
[10:27.750 --> 10:30.710]  And you can see the immediate effect.
[10:32.790 --> 10:41.510]  You can see on the left the original broadcast, and on the right interfering the jamming signal.
[10:41.510 --> 10:44.850]  And if you look at the audio, you see it's a mess.
[10:50.440 --> 10:55.640]  You see here the jamming signal, it's a very simple signal, broadcasted half of the time.
[10:56.180 --> 11:01.800]  And when it is mixed with the message here, it totally ruins it.
[11:03.680 --> 11:05.440]  And there's no decoding.
[11:13.700 --> 11:17.460]  So remember that I talked about the weight of the transmitter?
[11:17.460 --> 11:24.540]  Well, you can take a birthday balloon, tie the transmitter to the birthday balloon, and release it.
[11:24.540 --> 11:30.320]  After the radio song, they will both fly together, so happy with each other.
[11:30.860 --> 11:47.440]  And what it means is that in this case, you don't only attack the local reception station, but now you are attacking all of the stations along the path of the radio song, and it means that you are doing serious damage.
[11:48.520 --> 11:50.660]  How serious?
[11:51.060 --> 11:52.280]  Well, the U.S.
[11:52.280 --> 12:00.840]  National Weather Service is supporting 102 sites nationwide, each launching at regular hours, twice a day.
[12:01.200 --> 12:08.120]  And what will happen if 50 people will decide to jam the signal from 50 radio songs?
[12:08.120 --> 12:18.240]  Well, it will cause serious errors in the weather models and the forecasts, which is good for me as a hacker, but bad for the nation.
[12:21.200 --> 12:25.540]  I developed a simulation framework for my work.
[12:26.760 --> 12:29.240]  This is the simulation development environment.
[12:29.240 --> 12:31.080]  On the right, you can see the transmission part.
[12:31.080 --> 12:33.800]  On the left, you can see the reception part.
[12:34.060 --> 12:50.860]  The main block in the transmission part is the Python script, where the attacker can generate messages, generate frames, generate blocks, or change blocks or messages that he reads from log files.
[12:51.000 --> 12:57.140]  This is connected to a GPS satellite file in case the attacker will choose to falsify GPS data.
[12:57.140 --> 13:03.940]  For example, take a year-old file and transmit the data as if it was transmitted right now in the air.
[13:04.500 --> 13:16.420]  He can manipulate messages from an R41 log file, and he has the simulation framework that enables him to have a very big library of functions to work with.
[13:16.940 --> 13:34.980]  The data that the script is building can be either sent to the decoding software over the audio, if the decoding software is installed on the same computer, or it can be sent to a radio transmitter to transmit the messages over the air to an RTL-SDR receiver and from there to the decoding software.
[13:36.460 --> 13:43.760]  When you are generating messages or frames, you can take one of two paths.
[13:43.760 --> 13:49.360]  One is to synthesize frames and subframes all by yourself.
[13:49.360 --> 14:00.480]  It's very hard because you need to build a behavioral model for each measurement, and you have to remember that many of the measurements have links to other measurements.
[14:00.480 --> 14:08.680]  So, practically, if you want to create a very good simulation, you have to build a weather simulation on your own computer.
[14:10.540 --> 14:12.960]  The other approach is much more easier.
[14:12.960 --> 14:18.300]  This is the approach that I took, was to take all the log files that I have and retransmit it.
[14:18.500 --> 14:34.420]  Change the serial numbers, change the ID, so no one will be able to detect that this is old data, and retransmit it with falsified GPS data that makes it look as if it was actual flight right now.
[14:36.220 --> 14:41.040]  So, I have the malicious intentions and now I have the means.
[14:41.320 --> 14:43.800]  So, let's talk about spoofing data.
[14:44.120 --> 14:49.120]  Again, I need a powerful transmitter and I need a technique.
[14:49.120 --> 14:51.040]  And the technique goes like this.
[14:51.040 --> 15:07.080]  I choose the radio sound that I would like to spoof, and then I receive all the subframes because I need all of the general data from it, because I want to use the same ID, serial numbers, and so on.
[15:07.080 --> 15:10.980]  And then I'm preparing myself for spoofing, and then I'm jamming the signal.
[15:10.980 --> 15:24.240]  And this is important because I'm going to use a set of messages that are changing in a certain rate but the radio sound might have a set of messages that are changing in another rate.
[15:24.240 --> 15:39.760]  And you don't want the operator to easily distinguish between the different types of messages, so if you jam the data, the operator will look and see that the data freezes, and then it returns and it will seem reasonable.
[15:39.760 --> 15:42.040]  So, it will say, okay, I lost a few packets.
[15:42.040 --> 15:43.500]  No harm was done.
[15:43.540 --> 15:46.600]  But then I'm transmitting my spoofed messages.
[15:46.600 --> 15:50.400]  And this is the data that I'm inserting into the system.
[15:50.700 --> 16:07.860]  And after I'm finishing spoofing the radio sound, I'm again transmitting jamming signals, and this is a very important part because I have no control over what the radio sound is doing while I'm spoofing.
[16:07.860 --> 16:16.080]  So it might drift with the wind to a different location from where I'm emulating the position of the radio sound right now.
[16:16.600 --> 16:20.360]  So, with jamming, I'm creating the same effect.
[16:20.360 --> 16:30.800]  The operator will look at the data, sees that it freezes for a few seconds, and then the original radio sound will return, and if it sees a small jump, it will say, okay, I lost a few packets.
[16:30.800 --> 16:31.500]  It drifted.
[16:31.500 --> 16:32.380]  It's fine.
[16:34.580 --> 16:37.260]  It works on the signal-to-noise ratio.
[16:37.760 --> 16:51.000]  You want to make the receiver believe that the strong, healthy signal from the spoofing transmitter is the leading signal, while the weak radio sound signal is just noise.
[16:51.100 --> 17:00.060]  And here you can see some thumb rules regarding signal-to-noise ratio, and if you can get 25 dB margin, then you're on the horse.
[17:01.080 --> 17:10.920]  And how do you get 25 dB margin, or even better, it all depends on the distance of the transmitters from the receiver.
[17:11.880 --> 17:37.160]  Once the radio sound drifted away with the wind and is getting further and further away from the receiver, its transmission is received with lower and lower power, while if I'm an attacker placed close to the reception station, I can keep my own power and get my 25 dB margin between me and the radio sound and take over the transmission.
[17:40.080 --> 17:42.360]  So, let's see some spoofing examples.
[17:42.380 --> 17:47.500]  This is the RS-41 emulating transmitter.
[17:49.980 --> 17:52.220]  This is the spoofing transmitter.
[17:54.820 --> 17:57.660]  And again, this is the reception station.
[18:03.820 --> 18:05.840]  And let's start the emulation.
[18:05.960 --> 18:12.620]  The script goes to the log file, get the messages out and transmit it over here.
[18:15.540 --> 18:20.100]  After a long time, this is what you see in the decoding software.
[18:20.100 --> 18:22.200]  This is after a couple of hours.
[18:22.660 --> 18:28.720]  And the spoofing will start when the radio sound reaches 20 km height.
[18:35.440 --> 18:38.340]  And here you can see jamming, jamming, jamming.
[18:40.300 --> 18:43.920]  And while it is jamming, I'm adjusting the data.
[18:43.920 --> 18:52.400]  I get the last packet from the radio sound, the active radio sound in the air, and I offset all of my data to the last known good data from the radio sound.
[18:52.400 --> 18:56.340]  As you can see, now I'm spoofing and it's hard to detect.
[19:06.420 --> 19:09.420]  And now, jamming, jamming, jamming all over again.
[19:09.940 --> 19:11.980]  And everything freezes.
[19:13.080 --> 19:18.240]  Here I see the original radio sound transmitting to the receiver.
[19:18.620 --> 19:22.280]  And the operator looks at it and says, OK, I lost a few packets.
[19:22.280 --> 19:23.640]  No harm was done.
[19:24.820 --> 19:27.320]  But I got my data inside.
[19:32.330 --> 19:36.370]  This is another example at which I'm changing two things.
[19:36.370 --> 19:39.210]  One is the temperature and the pressure measurements.
[19:39.370 --> 19:43.110]  And the other thing, if you notice, it's an audio simulation.
[19:43.110 --> 19:49.930]  The entire simulation, the RS41 simulation, the spoofing simulation, and the decoding are all done on the same computer.
[19:49.930 --> 19:53.530]  I'm using the audio path instead of the RF path.
[19:58.410 --> 20:00.530]  So you see the numbers are changing.
[20:02.050 --> 20:06.030]  Don't worry, you'll see the impact in a minute.
[20:08.890 --> 20:11.550]  And now, jamming, jamming, jamming.
[20:15.980 --> 20:18.140]  And the spoofing is done.
[20:20.620 --> 20:24.740]  Here is a diagram, the pressure versus temperature diagram.
[20:24.740 --> 20:27.180]  And you can see here, I draw a small circle.
[20:27.180 --> 20:30.880]  And now the poor weather officer has to decide, what is it?
[20:30.880 --> 20:32.040]  What does it mean?
[20:32.040 --> 20:32.840]  Do I launch?
[20:32.840 --> 20:33.800]  Do I not launch?
[20:34.080 --> 20:35.260]  I don't know what to do with it.
[20:35.260 --> 20:40.640]  And I could have done much more meaner things, but this is only an example.
[20:42.600 --> 20:47.580]  You'll be happy to know that there's a model intended for military use.
[20:47.800 --> 20:49.560]  It's called the SGN.
[20:49.560 --> 20:52.280]  The manufacturer claims that it will do two things.
[20:52.280 --> 21:03.560]  One, it will keep radio silence until a certain height or time, so it will not reveal the launching site of the balloon.
[21:04.080 --> 21:15.680]  And the other one is that they encrypt the data and the measurements with 128-bit key, which is not so military, but OK, 128 is fine.
[21:16.500 --> 21:19.600]  But it's not the only thing that is suspicious about it.
[21:19.600 --> 21:23.860]  It's not really military, because they didn't change any other property.
[21:24.280 --> 21:26.160]  It's the same frequency, same framing.
[21:26.160 --> 21:31.480]  If you have your own home equipment, then you can see that the SGN is flying over your head.
[21:31.480 --> 21:37.180]  You can be aware of it, see the frame ID, and several other data items.
[21:37.180 --> 21:40.440]  What you won't be able to decode is the data.
[21:42.200 --> 21:49.760]  But sometimes they don't even operate the encryption, and then you see the whole SGN data, and it looks like the SG model data.
[21:49.760 --> 22:00.640]  Except for one thing, it identifies as SGN, so you are still able to understand that the army is operating right here.
[22:00.640 --> 22:05.280]  It's shouting it right out in the sky, which is not so really military.
[22:05.780 --> 22:21.220]  And it's very easy to position it once it starts transmitting, and the claim that you cannot detect the launch site is a bit funny, because there are a lot of software today that, using wind models, can estimate where the radio sound will fall.
[22:21.220 --> 22:29.500]  And if you can estimate where it will fall, you can also estimate where it was launched from, so it's not really working.
[22:29.500 --> 22:48.640]  And if you are placed near an army base, and you start seeing the SGNs go right one after the other, even if you cannot decode the data, the frequency will tell you that the army is about to launch something, which is very not military, as far as I understand.
[22:49.900 --> 22:56.180]  So, if you want to cope with spoofing, what you shouldn't do, personally, this is what I believe, you shouldn't encrypt.
[22:56.180 --> 23:02.260]  Most of the entities that are launching weather balloons are non-military.
[23:02.740 --> 23:23.200]  Keys are a headache, synchronizing different stations is a headache, they probably won't want it, it's bad for the radio sound community, and you have to remember that the information is not secret, and it is being read with public money, so the public should have the opportunity to enjoy it.
[23:23.800 --> 23:27.280]  What you should do is to authenticate the message.
[23:28.220 --> 23:38.920]  Modify the messages to add an authentication tag, and whoever is using the data right now will be able to keep on using the same data, and the authentication may be done offline.
[23:39.040 --> 23:51.540]  So, after a flight, if you suspect that the data was falsified, you can send it to the manufacturer, he will test the data, and give you a reply saying, okay, this is okay, or this was spoofed.
[23:54.580 --> 24:11.480]  When I developed the framework, I used it a lot to investigate the decoding software on different platforms, and different decoding software, and it was great, and so I decided to release the code, it will be uploaded in the next few days, and that's it.
[24:11.480 --> 24:12.760]  Thank you very much.