sounds good to me cool all right my name
is oh there's a bunch of people not
coming in all right all just are you
guys can listen along sup my name is
Eric Escobar I work for secure works and
today I'm gonna talk to you guys about
replay text with Software Defined radio
or SDR okay so what does replay tech
it's exactly what it sounds like an
attacker captures a signal and they can
play back at a later point in time and
you kind of wonder like how in this day
and age can this be a thing and it's
because it was like the Chinese crap
that's out there it's really really easy
to program this and you know they can
make a quick buck off of it and so
that's a lot of the 433 megahertz stuff
that's out there it's all replay attacks
or it's all susceptible to it so what a
software-defined radio its str and this
is a type of device where everything is
done in software you don't have to worry
about an embedded device you have to
tune anything it's generally just out of
the box plug it in plug and play and go
and it makes testing a lot easier and it
makes learning and hacking way easier
just because you have all these extra
frequencies at your disposal so it's
pretty easy and the other thing that I
really like about it it's a really small
form factor so you don't have to have
like a full ham closet you know just the
power something you do it straight off
of your laptop and it's pretty easy so
some of the things that I want to talk
about before we go into all of replay
tax is some of the verbiage he might
need to know first duplex see I don't
know if that's a word but I made it a
word so basically if you have a half
duplex that means you can only transmit
and receive on you know at a single time
so you think you're like a walkie-talkie
on a walkie-talkie you can only listen
at a given point in time or talk a given
point I'm you can't do both that's full
duplex if you have something is full
duplex you can transmit and receive at
the same time and so that's like a phone
conversation and that's probably what
the best example just visualize it next
is a sample so a lot of times you'll see
software-defined radios measured in
samples or MSPs so it's million samples
per second you know it's a double-edged
sword so you can have way too many
samples and your processors not going to
be able to handle it it's
a choke you know you're going to burn
through all your battery you get up to
view samples and you're just not going
to get a signal to come across just
because you can't really see what's
going on so you kind of want to get in
the Goldilocks zone you want to get
enough samples where your processor can
handle it just fine and you also want to
have you basically just eat you don't
want to overclock your processor and
you'd want to hurt it but you want to
get enough to actually get a good signal
to come across next up is frequency
ranges a lot of people probably remember
this from like high school physics but I
hurts is one cycle a second so that's
you know one one blip across the radar
the higher frequency the more cycles
that you get per second it's kind of
elementary stuff but there's a lot of
people that they don't they don't know
the basics and so when you start talking
vernacular to them they'll get kind of
confused so just as an FYI this is again
probably every high school science book
this is the the spectrum they kind of
dealing with what I marked out in red
here that's generally like what you
would see like a general SDR that you're
going to buy on the market today these
are the ranges that it's going to kind
of get you can get anywhere from in the
high kilohertz to the you know mid mid
gigahertz range and you have all your
ham frequencies you have your gps Wi-Fi
all that good stuff is in their midst up
man it's all pretty accessible so this
is kind of just a quick overview kind of
kind of going over the different things
that different software fine radios have
so if you're just getting into it and
you really just want to like I just want
to mess around i don't wanna have a high
cost users get the twenty dollar it's
actually TV tuner that you can buy off
amazon and I've so if you follow the
wireless CTF or cipher con I posted all
links to all of these so you don't to go
right in town or anything you just go
pull them up from there and see what I'm
talking about but basically the first
one again like I said it's a TV tuner so
its twenty dollars you know it can only
receive so you're not gonna be able to
transmit anything but it has a really
wide range in a pretty decent sample
rate so with this you can see a lot of
stuff so you can see pretty much all the
the signals that were going to talk
about in the replay text that I'm going
to show later on you can receive all of
those here and so it's a good real entry
if you just want to mess around it's
cheap and easy to use and there's a ton
of tutorials on how to plug it in
drivers all this stuff is really well
supported the next one on the list is
the yardstick the yardstick is you know
four hundred fifteen dollars
again another entry one and this will
allow you to transmit it doesn't have a
super stellar frequency range you know
282 962 megahertz it's only half duplex
so again you can only listen or talk at
a time you can't you know you can't do
both and then if you keep going down the
list the price keeps going up and
basically you're getting with this is a
wider sample set you more samples per
second you know full duplex and then if
you look at something like the blade RF
right now it's like 650 you get full
duplex you know you have a huge range of
things you can do and you can go crazy
and then they have temperature
stabilized one so what will happen is if
you have like say a blade RF and you're
you know looking at something and if as
it starts to heat up your signal start
to vary and so they have temperature
corrected one so pretty much the higher
you go up on the scale you get more
features there's a lot more stuff that's
not in here but this is just a good
general view to look at of some of the
features that they have I'm kind of how
to compare them one to one because
that's another hard thing that you get
into with scrs if you see one oh this is
like two grand this is three grand you
know and they go up and up and up and
sometimes you don't even need those
features or something really specialized
that it's like oh yeah I don't need it
shielded against you know X amount of
radiation I don't really care about that
I'm just you know trying to read my
water meter in my backyard so yeah just
it's kind of nice to know and kind of
nice to have this so okay you have a
device that you want to capture a signal
off of you know now what do you do so
the hard way you can do it is you know
you can look at this waterfall chart or
waterfall graph and you can see signals
as they come in and this is typically
the hard way of doing it you know you
can look at the spectrum you can try and
you know make sense of what the bleeps
and bloops look like there's full
websites dedicated to just like you know
what like I don't know the signal looks
like and people will just sit there all
day and ponder as to what they are but
really that's that's a pretty difficult
thing to do and if you have to you know
that's that's where you have to do and
you don't want to try and T something
you know T sub modulation out of this
it's going to be a pain and there's a
lot of trouble shooting that goes into
it so the easy way is you cheat and so
if you have a device if you own the
device you can look at the back of the
device and I'll have a typically an FCC
ID if it's something sold the United
States which is super nice because in
order to get a register with the FCC you
have to give out
all the specs and all the modulation and
pretty much everything that you could
ever want is a hacker to use so this for
example is a motion detector so just
look at the back of s of the of the
transmitter you look at the FCC ID write
it down and the FCC website is
absolutely terrible it's a horrible
thing to try and go search for a look
through all the menus so some hero I
should have put his name on here because
he definitely deserves credit he made
sec I oh and basically all it is you'd
go FCC io / whatever the FCC ideas and
it will forward you to the actual SEC
page so it saves you know like 30
different steps and trying to figure out
like how where is this what is this you
know who's the stakeholder and it you
not to worry about any of that it'll
just take you straight to the page it
also makes really easy if you're like in
a forum discussion with somebody or you
posting something in slack to just shoot
them this link instead of trying to go
dig up the FCC link that would normally
come up and so with this you can look at
the test reports you can see photos you
have the manuals and really what you're
looking here from this is the the
frequency and the modulation so this
this is where it kind of gets into the
more craftier part the part you kind of
have to know a little bit more your
physics for so there's you know the
people are probably most familiar with
AM and FM modulation or you know AM FM
frequencies right you have your you have
your radio and this is what it means you
can see the little gift that's kind of
spinning their amplitude modulation the
waves get bigger and smaller and
frequency modulation it kinda looks like
a slinky it'll get squished together and
that's how data is encoded in there now
the type of encoding that that they're
using here is the type of amplitude
modulation called on/off keen so
basically all it is is it's a it's a
digital way of transmitting data and
this is something that a lot of cheap
electronics use and you can see that as
a blip ty that's a one if it blips low
that's the zero and so you basically
could just do binary over this and kind
of just going into how all of these
electronics work the reason that they do
this is because you can have your radios
they can be really off they you know
they don't have to be tuned super
precise you're not really caring you
don't really care about interference
because it's one of these things where
you know you
retransmit the signal probably every
five or six times something gets
triggered like so for example for a
motion detector you wave your hand in
front of it and it will trigger six
times instead of just one time and
that's basically to do with interference
it's a really cheap easy dumb way it's
kind of like a UDP way of you know
dealing with something you're not
waiting for a transmission back you just
sending out in space and hoping that it
goes through and you send it a bunch of
times just on the off chance that one of
them gets through and then on the back
end the way that you deal with that is
you just say if I receive a signal
within X amount of milliseconds just
only choose one ignore the rest and so
that's again super easy way to code it
and so that's why they do it that way so
what's really awesome about this is that
you can tune your software defined radio
and export the signal to a WAV file this
wave file can be opened up so i like to
use audacity and if you tune it right
you can see the blips and bloops as they
come across the screen which is really
cool because then you can so the old
school way of doing this is what you
would normally have to do is print this
out with the time you get some graph
paper and you would mark out where the
ones are where the zeros are and then
you could generate that signal if you
knew the timing of it then you could
replay it back but that was a really
hard way of doing it and now there's a
ton of tools out there that do it and
and they make it a lot nicer and so this
is actually cleaned up WAV file now that
there's you know you make use of your
processor and basically what that does
is it'll go and clean up the waveform
for you to get these nice little blocks
instead of you might see you know some
Jake unisom waviness around it and it'd
be kind of hard to see your times from
there alright so talking about some of
the software that's out there so so
there's GQ Rx and good new radio those
are the two big you know unix platforms
if you're using that some of the other
nice tools if you're using windows or SD
are sharp scr sharp has a couple of
plugins and this is not on the slides
but i'm just gonna mention it because
it's super cool i'll just playing with
it earlier is you can actually snag
beacons off of aircraft that are flying
overhead they're not encrypted totally
plaintext and they'll give you altitude
you know the call sign of the plane
they'll give you all that information of
where it's going
it's really crazy because you you know
they're full on programs built out for
it that you can just have this running
on your desktop and you can see all the
planes in your airspace where they're
going where they're headed you know
completely free no internet required and
it's kind of terrifying that that
information is just out there and so
then then the other part of it too is if
you have a hack RF michael osman has
awesome awesome software he has an
awesome tutorial that i'll talk about
here in a little bit that basically is a
two-day class condensed you know to a
bunch of youtube videos they can
download for free i think it's like a
couple thousand dollar class but we'll
talk more about that then one of the
other things that had just got into
recently is a RS cat it's like netcat
but for RF stuff it's super easy to use
super simple everything's a Python
object so if you're writing you know
some you know software-defined radio
program and you know python super killer
super easy to use you can receive
transmitting code stuff however you want
to do it and then one of the other even
cheater tools that i use is this on-off
keying tool so okay tools basically what
this does is this will clean up your
wave files it will process your wave
file so you don't have to worry about
any of it you know it'll search for
frequencies it'll look for on/off keen
so if you don't know maybe exactly what
the frequency is of you know some device
are using if you're trying to black box
it you don't have an FCC ID to go off of
you can use this okay tools it'll scan
spectrum look for on/off keen it'll find
the baud rate for you all these things
that you would normally have to you know
get some graph paper out for you know
open up ms paint and you know try and
drag some lines on you don't have to do
that anymore this tool takes care of a
lot of it the only downside is that as
far as i know again and won't play with
a little bit that it only works for the
yardstick one but it's pretty killer and
if you're you know just just trying to
inspect some stuff it's a super nice way
to go so this is a really simplistic way
if you just want to get up off the
ground doing a replay signal if you have
a hack RF you can just type this line in
there and should be an underscore in the
hack RF transfer basically you use the
hack RF transfer and you can receive
dump it out to a WAV file which is your
dot raw and then the dash f that's a
that's the frequency that you're on and
so it's it's in hurts and so
should be 434 megahertz but it's 43 you
know million hurts that's just without
without any of the scientific notation
to kind of reduce the variable down but
so this all you have video is literally
write it out to one file and then you
replay that file at that frequency
what's nice is that they give you the
frequency as an option there that you
can pass in so if you're going to record
it in at a lower frequency and replayed
out on a higher one that that's you know
it'll definitely work and the reason why
you would want to do that is so say you
want to receive on a very narrow
frequency you can receive on a very
narrow one and transmit on a wideband
one and the reason why you might want to
do that is if somebody has some
protection in place like for like say
they have a rolling code well you can
use that for is you can receive on the
very narrow band but pretty much Doss
the rest of it and so what that i'll let
you do is accept a rolling code transmit
and das at the same time so just I mean
that that's above what we're going to go
over today but that's a reason why you
would want it and it's a really cool
feature that you have people like CM e
km car have used that to do their role
jam attack and break it into pretty much
any card that's on the market today okay
so what's vulnerable it's shocking
actually the the amount of cheap you
know 434 megahertz stuff that you can
get out there on the internet so let's
see if the demo gods are with me this
should play so if I so basically this is
a motion detector and you can see that
taking the battery out of it but you can
still get to play a tannery play tag so
I turned off the volume because it's a
really annoying sound but you can see
that the deal lit up it plays without
that and you can do the same thing with
a doorbell which is incredibly fun I've
never really grown up so go over my
in-laws house and I doorbell ditch them
from like half a house away and they
have no idea what's happening it feel
kind of bad and I really hope they never
watch this talk because we've done it
mercilessly so some other things that
you can do this is also a really fun one
so they've these there etech City
wireless outlets these things are great
just to have you know if you have
something you just want to like maybe
some backyard light you want to turn on
and off well one of the things I started
playing with was like well I'd like to
turn them off from like my raspberry pi
or my arduino like how am I going to do
that well if you have something that's
like some cheap 430
or megahertz module you can just do a
replay attack and turn them on and off
however you want so this is going to be
one of the challenges tomorrow so if you
guys are doing the wireless capture the
flag the goal is going to be to not to
turn on the last one and so since
they're all in a series you have to turn
them on in sequential order and if you
turn one off it'll mess you up so this
is what it should look like see see how
they all click on sequentially that's
the end goal of it so if you're doing
the wireless capture the flag tomorrow
that's that's when you may want to pay
attention to so this is my uncle's super
swanky neighborhood that he lives in and
you think that like this gated
subdivision where each house is like you
know three million dollars minimum that
they would have a better gate than this
but I can just basically sit here wait
for somebody to go by catch the signal
and replay the signal and the gate just
opens no problem at all this one was
really fun too because you could just
hold the gate open and so you get
somebody come out and say like what like
what's going on why you know why won't
this gate close and yet you can just
even really mess with people with this
stuff so this is a really fun one this
will also be in the wireless capture the
flags tomorrow if anybody's brave enough
to attempt this this is a dog shock
collar that doesn't have any rolling
code or any anything to make it not do
this so I'll kind of run it through its
paces I don't know if this one does so
it lights it up and I think it vibrates
there's no volley that you can see move
across the screen so one of the really
scary things about this one and I
haven't tried it out yet is that the way
that this is encoded is so is 255 value
that you could put so the shock collar
you can have a range of 1 to 100 to
shock someone with or you're shocked
your dog with right but there's a
possible value of 255 in there so I
don't know if it just Oh missed it after
100 or what's going to happen but
there's only one way to test it and I'm
definitely not brave enough that this
thing can put you know 100 pound German
Shepherd on its but it it would just
cook me so okay so if you want to learn
some more about you know
software-defined radio if you kind of
wanna get started with it or even if you
know a little bit about it you have your
software defined radio I'd really
suggest going over to Great Scott
gadgets calm / SDR so Michael Osman
teaches a 2
two day class that's like taught it like
black hat it's taught at I think DEFCON
but basically this class is he takes you
soup to nuts of like hey you don't know
anything about radio we're going to
teach you all about it how do you know
how to write decimal or decimal notation
we're going to show you how to use the
hack RF you no soup to nuts how to
perform the replay tax it's a really
really great class it's I mean it's very
very dense but it's completely free
online on the internet and this is again
it's a really expensive class you have
to go to and I kind of just googling
around I happen to find it and it's it's
a really really top-notch class the
other website that I really like is RTLS
dr this website you can go to people in
the forms are really responsive so if
you do have that hard use case scenario
of like oh my gosh like I don't know
this frequency is you know maybe you've
never seen like like some something new
like a Laura frequency out there and
you're like I don't know what this like
you know slanting pattern is across my
waterfall display these guys are all
super sharp and they'll be able to
answer pretty much all of your questions
there's definitely been a lot of times
rev like I have no idea what the signal
isn't there like oh you're really dumb
because it's you know the wrong encoding
scheme where you don't have enough
samples or you're not collecting enough
samples in order to you know demodulate
it and see what's actually out there so
before I go into any questions I just
want to talk a bit about the wireless
ETF tomorrow so there is a twitter
handle that you know i created it's the
cypher con w CTF it's followed by the
main site freak on a twitter account as
if you guys are interested in taking
part in it pretty much all the clues all
the hands all the challenges will all be
tweeted through out there and so if you
like say you find a flag you have a
question anything at all you can DM the
account we've multiple looking at it and
so you can kind of go from there with
all your questions and again a lot of
the things that I've talked about in
terms of like the training the hardware
and all that stuff that's all that
Twitter account too that you can just go
check out whatever you want so they
might have any questions so be really
tired I should know its cypher con
underscore w CTF and it's if I said that
wrong it's on the main sex rock on
Twitter account you can just look at it
something that they follow
if you don't have a hack RS I have one
that you can use I have a hacker i5 a
yardstick and I'm definitely willing to
show people how to use in all that stuff
if you don't know how or if you're just
like I need a loaner to do the challenge
because I didn't bring mine I have them
that you can use and I have a couple
other sdrs too if you want to mess with
some of the bigger ones i can tell visit
yeah yeah so that's that's going to like
the main base of operations so i'll be
up there tomorrow morning when it opens
up i think it opens up at nine I'm not
too sure I'll to go look at the schedule
but basically i'll be up there and we're
going to have stuff kind of spread out
depending on how the weather is tomorrow
it'll be spread out out and around
milwaukee there's you know sometimes
it's not something crazy a couple of
challenges there's going to be war
driving so basically what we've done is
we've pre-war driven a bunch of
milwaukee we have 7,500 points and so
that nobody can really brute force it
basically like say is that of 100 points
i'm not sure what the point values of it
yet but say you get you know 3,500
points then you're only going to get
around half of the points that are
totally possible so you're not just
going to look oh I'm just going to go
generate a gajillion BSS ids and you use
that as something like that will prevent
that but basically i'll be up there the
entire day you can tweet if you have
questions they'll be Wireless foxes
running around there's going to be
number stations on ham radio frequencies
and again all the hints will kind of
come out i'll probably i'm not going to
probably dumped everything all at once
all kind of see how things go but pretty
much all the SDR challenges will be up
in that building or it will be up in
that in that room I think there's room
for like 15 20 people from not mistaken
so we'll go with that and if you again
if you guys have questions you can you
tweet at me 2nite null or reply to a lot
of them but that's that's how all the
logistics are going to be thrown out
there anybody else any questions we good
all right well thank you guys yeah
thanks everybody actually showing up at
like midnight right now cos my bedside