WEBVTT 00:00.000 --> 00:02.800 Our first presenter today is Paz Miller. 00:02.960 --> 00:07.960 Paz started his professional career by hacking games and developing tools for his teams. 00:07.960 --> 00:13.320 He has led multidisciplinary systems development as a systems engineer for the aerospace industry. 00:13.500 --> 00:17.620 Today, he will be speaking about what is a little radiotron, and how to operate it. 00:17.620 --> 00:20.680 Let's start today off with a round of applause for Paz. 00:22.420 --> 00:23.720 Thank you. 00:24.560 --> 00:25.940 Thank you. 00:27.560 --> 00:33.360 Hi everyone, my name is Paz Miller and I will talk about the problem of the weather. 00:35.120 --> 00:41.360 There is no need for the initial introduction since I was just right now introduced. 00:42.240 --> 00:54.100 The work I did was about attacking the channel between the weather balloons that are being sent every day and their reception stations. 00:54.420 --> 00:57.180 And I will go over the work. 00:58.620 --> 01:02.600 First thing that needs to be done is to introduce the weather balloon. 01:02.600 --> 01:11.900 And you can see here on the right, on the upper side of the photo, you can see the partially filled balloon. 01:11.900 --> 01:14.200 It's partially filled with helium. 01:14.200 --> 01:27.260 On the lower side you can see the payload, which is an instrumentation box that samples the data from the air and transmits it to a ground station. 01:27.260 --> 01:44.500 And in the middle you can see a small parachute because when the balloon pops, everything falls down and you don't want to get hit by your head by something that fell from 100,000 feet up high. 01:47.260 --> 01:53.840 Oh, I forgot to mention in the last line of the slide, the payload is called Radiosonde. 01:53.840 --> 01:58.980 And from here on, now I will speak only about the Radiosonde. 01:58.980 --> 02:09.440 Here you can see several quotes from a senior meteorologist at Vandenberg Space Force Base, where they are doing satellite launches. 02:09.680 --> 02:19.800 And he is saying that the data from the weather balloons go directly into the databases and to the national weather model. 02:19.880 --> 02:28.400 Which is great for me as a hacker to know that if I succeed disrupting the data, it will go directly into the databases and into the models. 02:29.140 --> 02:39.180 Next thing he is mentioning that they are doing a lot of launches while doing the launch count, doing a lot of releases of weather balloons during the launch count. 02:39.180 --> 02:45.360 They really need updated information to take the decision if to do a satellite launch or not. 02:45.600 --> 03:01.900 And the last thing he is emphasizing how critical it is for the launch mission, because as we have all seen in movies, eventually there is a bunch of guys who are sitting in a room and each one needs to raise his thumb and say, I'm okay, we are all good to go. 03:01.900 --> 03:10.520 And there is an officer there, a weather officer, and he examines the data from the weather balloon, the last weather balloon that was released. 03:10.640 --> 03:14.560 And he needs to decide if the weather is good, he is going to approve the launch. 03:14.560 --> 03:17.220 If the weather is bad, he will delay the launch. 03:17.580 --> 03:32.480 And for me as a hacker it is very important to understand that, because if I can falsify the data that he is looking at, then I can make him cancel launch in good weather, or in the worst case, approve a launch in bad weather. 03:35.080 --> 03:53.680 I might be intimidated to attack an army base, but NASA is helping here and saying that they not only demand that the weather about the launch site will be great, but they also demand that the weather on the down range will be great. 03:53.720 --> 04:02.680 And it means that there are a lot of civil stations, weather balloons, launching stations, that need to approve the launch. 04:02.680 --> 04:10.460 And if I'm intimidated to attack an army base, I might not be intimidated to attack a simple civil station. 04:12.060 --> 04:15.680 Okay, so I have my malicious intentions. 04:16.040 --> 04:19.600 And now I need to choose my path to attack. 04:19.600 --> 04:24.760 And you can see here the list of the most common radiosounds that are being launched. 04:25.020 --> 04:30.720 And leading the market is the Vaisela RS-41, so I focused my work on that model. 04:32.460 --> 04:38.100 Here you can see the major properties of the transmission frame. 04:38.100 --> 04:41.940 There are two common models of the RS-41 submodels. 04:42.000 --> 04:45.080 One is the SG and the other one is the SGP. 04:45.080 --> 04:49.120 The SGP comprises a pressure sensor and the SG does not. 04:49.120 --> 04:51.340 That's the only difference between the two. 04:51.900 --> 04:55.460 The basic frame is 320 bytes divided into blocks. 04:55.460 --> 04:57.320 We'll see the blocks in the next slide. 04:57.900 --> 05:00.760 And there are two layers of error detection and correction. 05:01.700 --> 05:05.740 One is CRC-16, which is applied on each block. 05:05.740 --> 05:11.880 And RIG-Solomon, which is applied on the whole frame for forward error correction. 05:13.020 --> 05:17.600 Here you can see the blocks in the frame. 05:17.600 --> 05:19.640 The first bytes are header bytes. 05:19.640 --> 05:23.000 The next are forward error correction bytes. 05:23.000 --> 05:26.100 Then comes the frame type, which is a very simple byte. 05:26.100 --> 05:28.240 And then comes the blocks. 05:28.240 --> 05:38.200 Block 79 comprises all of the general purpose data, ID, serial numbers, calibration data, battery voltage, and so on. 05:38.200 --> 05:45.220 It also has subframes, which I will go over in the next slide. 05:45.860 --> 05:48.040 The next block is block 7A. 05:48.040 --> 05:53.040 That comprises all of the data measurements, all of the error data measurements. 05:53.040 --> 05:59.200 And then 7C, 7D, 7B are three GPS information blocks. 05:59.660 --> 06:02.660 A lot of information is in there. 06:02.660 --> 06:06.420 And the last block is an empty block, 76. 06:08.760 --> 06:14.180 In the subframes, there are 51 subframes, 16 bytes each. 06:14.180 --> 06:23.370 There's a lot of additional information, serial numbers, path numbers, diagnostic data, calibration data, and so on. 06:25.010 --> 06:28.180 Here are the RS41 RF properties. 06:28.180 --> 06:34.020 It works between 400 MHz and 406 MHz. 06:34.020 --> 06:36.060 It outputs 18 dBm. 06:36.060 --> 06:46.160 And the modulation GFSK is very, very easy to pick up the signals with a simple RTL-SDR receiver and a good antenna. 06:46.280 --> 06:55.280 And you can set up your own station at home and start picking up the signals from the radio sound that goes over your house. 06:55.360 --> 07:00.840 And there are thousands of people doing it all over the world right now. 07:00.840 --> 07:06.700 All have stations like this installed in their houses, very simple, very cheap ones. 07:06.700 --> 07:12.920 And they are all communicating with each other and passing the data that they are getting into public databases. 07:12.920 --> 07:19.500 And they develop tools for decoding and to give people access to the data. 07:19.500 --> 07:26.640 And there are several websites where you can go and view different flights right now, live in the air. 07:28.480 --> 07:33.560 Okay, so I have malicious intentions and I have my RF link to attack. 07:33.560 --> 07:37.600 So the most basic attack would be to do a jamming attack. 07:37.600 --> 07:38.660 And how do you jam? 07:38.660 --> 07:43.540 You take a strong, powerful transmitter and you transmit jamming signals. 07:44.000 --> 07:48.720 My weapon of choice was the Heltech Automation Laurel Node 151. 07:48.720 --> 07:56.760 I just searched for a certain type of transmitter on eBay and I saw the name Heltech and I said, Oh God, this is a sign. 07:56.760 --> 07:58.880 So I immediately grabbed it. 07:58.920 --> 08:00.980 It has a very good Laurel chip. 08:00.980 --> 08:03.160 It has a very good microcontroller. 08:03.400 --> 08:05.380 It transmits 20 dBm. 08:05.380 --> 08:08.500 It carries its own lithium battery, which is great. 08:08.500 --> 08:09.820 You will see it in a minute. 08:10.240 --> 08:14.280 And it costs 20 bucks on eBay and it weighs close to nothing. 08:16.660 --> 08:19.480 So, let's see a jamming attack. 08:20.260 --> 08:27.560 On the right side, you can see the computer and a transmitter that is emulating the RS-41 transmissions. 08:27.780 --> 08:32.440 On the left side, you can see a simple reception station, as I explained earlier. 08:32.880 --> 08:38.660 And in the middle, you can see the small jamming equipment, which is a board and a battery. 08:40.200 --> 08:42.700 Now I'll start the Radiosound emulation. 08:42.700 --> 08:44.520 The emulation is very simple. 08:44.520 --> 08:49.000 I have a log file of all transmissions for RS-41. 08:49.000 --> 08:54.800 And the script takes a message, transmits it, takes another message, transmits it in a cyclic manner. 08:56.120 --> 09:02.780 And here you can see the transmission being received by the RTL-SDR software. 09:05.420 --> 09:07.360 And this is the decoding software. 09:07.360 --> 09:09.140 This is what the operator sees. 09:12.180 --> 09:15.420 In the middle, you can see the Radiosound position and velocity. 09:16.980 --> 09:21.080 Here you can see some general information, such as sound ID. 09:22.640 --> 09:28.460 Here is the GPS time and the quality of reception of the space vehicles. 09:28.760 --> 09:31.380 And this is the subframe status. 09:32.620 --> 09:36.540 Here you can see the measurements that are being taken by the Radiosound. 09:37.820 --> 09:42.820 And this is the GPS navigation data that the Radiosound is sending down. 09:42.820 --> 09:50.160 The link between the decoding software and the RTL software is over the computer's audio channel. 09:50.160 --> 09:56.920 And here you can see that you can record this audio channel and look at the raw data. 09:57.100 --> 10:05.920 If I zoom in, you can see here the preamble bits, followed by the data bits inside the message. 10:05.920 --> 10:06.420 Okay 10:14.130 --> 10:22.250 , so I have a working link, I'm doing decoding, everything is great, so let's add some jamming. 10:27.750 --> 10:30.710 And you can see the immediate effect. 10:32.790 --> 10:41.510 You can see on the left the original broadcast, and on the right interfering the jamming signal. 10:41.510 --> 10:44.850 And if you look at the audio, you see it's a mess. 10:50.440 --> 10:55.640 You see here the jamming signal, it's a very simple signal, broadcasted half of the time. 10:56.180 --> 11:01.800 And when it is mixed with the message here, it totally ruins it. 11:03.680 --> 11:05.440 And there's no decoding. 11:13.700 --> 11:17.460 So remember that I talked about the weight of the transmitter? 11:17.460 --> 11:24.540 Well, you can take a birthday balloon, tie the transmitter to the birthday balloon, and release it. 11:24.540 --> 11:30.320 After the radio song, they will both fly together, so happy with each other. 11:30.860 --> 11:47.440 And what it means is that in this case, you don't only attack the local reception station, but now you are attacking all of the stations along the path of the radio song, and it means that you are doing serious damage. 11:48.520 --> 11:50.660 How serious? 11:51.060 --> 11:52.280 Well, the U.S. 11:52.280 --> 12:00.840 National Weather Service is supporting 102 sites nationwide, each launching at regular hours, twice a day. 12:01.200 --> 12:08.120 And what will happen if 50 people will decide to jam the signal from 50 radio songs? 12:08.120 --> 12:18.240 Well, it will cause serious errors in the weather models and the forecasts, which is good for me as a hacker, but bad for the nation. 12:21.200 --> 12:25.540 I developed a simulation framework for my work. 12:26.760 --> 12:29.240 This is the simulation development environment. 12:29.240 --> 12:31.080 On the right, you can see the transmission part. 12:31.080 --> 12:33.800 On the left, you can see the reception part. 12:34.060 --> 12:50.860 The main block in the transmission part is the Python script, where the attacker can generate messages, generate frames, generate blocks, or change blocks or messages that he reads from log files. 12:51.000 --> 12:57.140 This is connected to a GPS satellite file in case the attacker will choose to falsify GPS data. 12:57.140 --> 13:03.940 For example, take a year-old file and transmit the data as if it was transmitted right now in the air. 13:04.500 --> 13:16.420 He can manipulate messages from an R41 log file, and he has the simulation framework that enables him to have a very big library of functions to work with. 13:16.940 --> 13:34.980 The data that the script is building can be either sent to the decoding software over the audio, if the decoding software is installed on the same computer, or it can be sent to a radio transmitter to transmit the messages over the air to an RTL-SDR receiver and from there to the decoding software. 13:36.460 --> 13:43.760 When you are generating messages or frames, you can take one of two paths. 13:43.760 --> 13:49.360 One is to synthesize frames and subframes all by yourself. 13:49.360 --> 14:00.480 It's very hard because you need to build a behavioral model for each measurement, and you have to remember that many of the measurements have links to other measurements. 14:00.480 --> 14:08.680 So, practically, if you want to create a very good simulation, you have to build a weather simulation on your own computer. 14:10.540 --> 14:12.960 The other approach is much more easier. 14:12.960 --> 14:18.300 This is the approach that I took, was to take all the log files that I have and retransmit it. 14:18.500 --> 14:34.420 Change the serial numbers, change the ID, so no one will be able to detect that this is old data, and retransmit it with falsified GPS data that makes it look as if it was actual flight right now. 14:36.220 --> 14:41.040 So, I have the malicious intentions and now I have the means. 14:41.320 --> 14:43.800 So, let's talk about spoofing data. 14:44.120 --> 14:49.120 Again, I need a powerful transmitter and I need a technique. 14:49.120 --> 14:51.040 And the technique goes like this. 14:51.040 --> 15:07.080 I choose the radio sound that I would like to spoof, and then I receive all the subframes because I need all of the general data from it, because I want to use the same ID, serial numbers, and so on. 15:07.080 --> 15:10.980 And then I'm preparing myself for spoofing, and then I'm jamming the signal. 15:10.980 --> 15:24.240 And this is important because I'm going to use a set of messages that are changing in a certain rate but the radio sound might have a set of messages that are changing in another rate. 15:24.240 --> 15:39.760 And you don't want the operator to easily distinguish between the different types of messages, so if you jam the data, the operator will look and see that the data freezes, and then it returns and it will seem reasonable. 15:39.760 --> 15:42.040 So, it will say, okay, I lost a few packets. 15:42.040 --> 15:43.500 No harm was done. 15:43.540 --> 15:46.600 But then I'm transmitting my spoofed messages. 15:46.600 --> 15:50.400 And this is the data that I'm inserting into the system. 15:50.700 --> 16:07.860 And after I'm finishing spoofing the radio sound, I'm again transmitting jamming signals, and this is a very important part because I have no control over what the radio sound is doing while I'm spoofing. 16:07.860 --> 16:16.080 So it might drift with the wind to a different location from where I'm emulating the position of the radio sound right now. 16:16.600 --> 16:20.360 So, with jamming, I'm creating the same effect. 16:20.360 --> 16:30.800 The operator will look at the data, sees that it freezes for a few seconds, and then the original radio sound will return, and if it sees a small jump, it will say, okay, I lost a few packets. 16:30.800 --> 16:31.500 It drifted. 16:31.500 --> 16:32.380 It's fine. 16:34.580 --> 16:37.260 It works on the signal-to-noise ratio. 16:37.760 --> 16:51.000 You want to make the receiver believe that the strong, healthy signal from the spoofing transmitter is the leading signal, while the weak radio sound signal is just noise. 16:51.100 --> 17:00.060 And here you can see some thumb rules regarding signal-to-noise ratio, and if you can get 25 dB margin, then you're on the horse. 17:01.080 --> 17:10.920 And how do you get 25 dB margin, or even better, it all depends on the distance of the transmitters from the receiver. 17:11.880 --> 17:37.160 Once the radio sound drifted away with the wind and is getting further and further away from the receiver, its transmission is received with lower and lower power, while if I'm an attacker placed close to the reception station, I can keep my own power and get my 25 dB margin between me and the radio sound and take over the transmission. 17:40.080 --> 17:42.360 So, let's see some spoofing examples. 17:42.380 --> 17:47.500 This is the RS-41 emulating transmitter. 17:49.980 --> 17:52.220 This is the spoofing transmitter. 17:54.820 --> 17:57.660 And again, this is the reception station. 18:03.820 --> 18:05.840 And let's start the emulation. 18:05.960 --> 18:12.620 The script goes to the log file, get the messages out and transmit it over here. 18:15.540 --> 18:20.100 After a long time, this is what you see in the decoding software. 18:20.100 --> 18:22.200 This is after a couple of hours. 18:22.660 --> 18:28.720 And the spoofing will start when the radio sound reaches 20 km height. 18:35.440 --> 18:38.340 And here you can see jamming, jamming, jamming. 18:40.300 --> 18:43.920 And while it is jamming, I'm adjusting the data. 18:43.920 --> 18:52.400 I get the last packet from the radio sound, the active radio sound in the air, and I offset all of my data to the last known good data from the radio sound. 18:52.400 --> 18:56.340 As you can see, now I'm spoofing and it's hard to detect. 19:06.420 --> 19:09.420 And now, jamming, jamming, jamming all over again. 19:09.940 --> 19:11.980 And everything freezes. 19:13.080 --> 19:18.240 Here I see the original radio sound transmitting to the receiver. 19:18.620 --> 19:22.280 And the operator looks at it and says, OK, I lost a few packets. 19:22.280 --> 19:23.640 No harm was done. 19:24.820 --> 19:27.320 But I got my data inside. 19:32.330 --> 19:36.370 This is another example at which I'm changing two things. 19:36.370 --> 19:39.210 One is the temperature and the pressure measurements. 19:39.370 --> 19:43.110 And the other thing, if you notice, it's an audio simulation. 19:43.110 --> 19:49.930 The entire simulation, the RS41 simulation, the spoofing simulation, and the decoding are all done on the same computer. 19:49.930 --> 19:53.530 I'm using the audio path instead of the RF path. 19:58.410 --> 20:00.530 So you see the numbers are changing. 20:02.050 --> 20:06.030 Don't worry, you'll see the impact in a minute. 20:08.890 --> 20:11.550 And now, jamming, jamming, jamming. 20:15.980 --> 20:18.140 And the spoofing is done. 20:20.620 --> 20:24.740 Here is a diagram, the pressure versus temperature diagram. 20:24.740 --> 20:27.180 And you can see here, I draw a small circle. 20:27.180 --> 20:30.880 And now the poor weather officer has to decide, what is it? 20:30.880 --> 20:32.040 What does it mean? 20:32.040 --> 20:32.840 Do I launch? 20:32.840 --> 20:33.800 Do I not launch? 20:34.080 --> 20:35.260 I don't know what to do with it. 20:35.260 --> 20:40.640 And I could have done much more meaner things, but this is only an example. 20:42.600 --> 20:47.580 You'll be happy to know that there's a model intended for military use. 20:47.800 --> 20:49.560 It's called the SGN. 20:49.560 --> 20:52.280 The manufacturer claims that it will do two things. 20:52.280 --> 21:03.560 One, it will keep radio silence until a certain height or time, so it will not reveal the launching site of the balloon. 21:04.080 --> 21:15.680 And the other one is that they encrypt the data and the measurements with 128-bit key, which is not so military, but OK, 128 is fine. 21:16.500 --> 21:19.600 But it's not the only thing that is suspicious about it. 21:19.600 --> 21:23.860 It's not really military, because they didn't change any other property. 21:24.280 --> 21:26.160 It's the same frequency, same framing. 21:26.160 --> 21:31.480 If you have your own home equipment, then you can see that the SGN is flying over your head. 21:31.480 --> 21:37.180 You can be aware of it, see the frame ID, and several other data items. 21:37.180 --> 21:40.440 What you won't be able to decode is the data. 21:42.200 --> 21:49.760 But sometimes they don't even operate the encryption, and then you see the whole SGN data, and it looks like the SG model data. 21:49.760 --> 22:00.640 Except for one thing, it identifies as SGN, so you are still able to understand that the army is operating right here. 22:00.640 --> 22:05.280 It's shouting it right out in the sky, which is not so really military. 22:05.780 --> 22:21.220 And it's very easy to position it once it starts transmitting, and the claim that you cannot detect the launch site is a bit funny, because there are a lot of software today that, using wind models, can estimate where the radio sound will fall. 22:21.220 --> 22:29.500 And if you can estimate where it will fall, you can also estimate where it was launched from, so it's not really working. 22:29.500 --> 22:48.640 And if you are placed near an army base, and you start seeing the SGNs go right one after the other, even if you cannot decode the data, the frequency will tell you that the army is about to launch something, which is very not military, as far as I understand. 22:49.900 --> 22:56.180 So, if you want to cope with spoofing, what you shouldn't do, personally, this is what I believe, you shouldn't encrypt. 22:56.180 --> 23:02.260 Most of the entities that are launching weather balloons are non-military. 23:02.740 --> 23:23.200 Keys are a headache, synchronizing different stations is a headache, they probably won't want it, it's bad for the radio sound community, and you have to remember that the information is not secret, and it is being read with public money, so the public should have the opportunity to enjoy it. 23:23.800 --> 23:27.280 What you should do is to authenticate the message. 23:28.220 --> 23:38.920 Modify the messages to add an authentication tag, and whoever is using the data right now will be able to keep on using the same data, and the authentication may be done offline. 23:39.040 --> 23:51.540 So, after a flight, if you suspect that the data was falsified, you can send it to the manufacturer, he will test the data, and give you a reply saying, okay, this is okay, or this was spoofed. 23:54.580 --> 24:11.480 When I developed the framework, I used it a lot to investigate the decoding software on different platforms, and different decoding software, and it was great, and so I decided to release the code, it will be uploaded in the next few days, and that's it. 24:11.480 --> 24:12.760 Thank you very much.