So we're talking about attacking wireless devices with software-defined radio today. So a little bit about about myself. I've been programming for about 18 years. Mostly hacky and mathy kind of stuff. So machine learning, AI, and security stuff. Ontologically, I call myself like a Christian mystic. It's kind of a weird description, but I think it fits pretty well. I like arts, weird, mostly weird stuff. My day job, I work at FireEye slash Mandiant. And I was trying to think how to describe what I do. And so Mandiant consultants are like incident response. So someone gets hacked, they come in, fix it up. So if this is the Mandiant consultants, this is kind of what my team does. So we're basically cyber weapons makers to help combat the people who hack in, pretty much. And so this talk, it was kind of hard to title this talk very well. One of the titles I thought about was how digital data is transmitted wirelessly. We're gonna be talking about that. We're gonna be talking about how how data is transmitted. And this is it's kind of cool if you like computers, if you like the Internet, because this is how it works everywhere. So it's pretty pretty interesting to know. So another way to put it is we're gonna be at the OSI physical, like layer one, the physical layer. So you know you got TCP IP up on like what layer three and four or five or something like that. And then below, you know, like layer two, you've got the data layer like 802.11. And then below that, how the data is actually represented through physics, kind of. And of course the other title is attacking wireless devices with SDR, which sounds a little more sexy maybe, and more than like how data is transmitted. So I I kind of came in to this topic from three different directions. So just kind of kind of give you guys some background on that. So you know I've kind of been into like the IOT stuff before I knew it was called IOT. I did like a home security system with Raspberry Pi a few years ago. You know, basically had these wireless outlets, broke them open, broke open the transmitter, and like soldered in some some transistors and then connected that with the Raspberry Pi. It's a really simple home controller. The other, so so basically the IOT stuff was kind of one direction I came in from. Another direction was was music theory. So I I remember looking at a keyboard and being like, why in the world are the black keys not evenly spaced? It really annoyed me. Like I remember it was like over Thanksgiving, so I had some time to like think about it. I was like, why in the world? Like cuz cuz it's like every every key is like a half step. So you could just have six black keys and six white keys. So why are there like, why is it there seven and five? It looks very disorganized. Anyway, so it's like this whole foray into like music theory and analyzing sound with, you know, like things like the Fourier transform and stuff like that. So you can convert to the frequency domain and look at stuff. So like this is this is me singing Do-Re-Mi-Fa-So-La-Ti-Do. So music theory was kind of another area. And then the last area was wireless hacking in general. So I found wireless hacking to be a pretty cool topic for a while. I was just talking to someone earlier today and they were like, yeah the security thing is kind of annoying because you find, you know, you find oh there's this cool vulnerability but it's been patched three years ago. One cool thing that I found with wireless security is typically typically bugs in in wireless stuff are systemic and they're not easy to patch. So it's kind of cool because you learn you learn about how it works and then you can exploit it and that knowledge kind of sticks around pretty well. So you know I've done I've done you know back in the day stuff you know with TCP IP. Recently I've been doing some stuff with like 802.11 monitor mode where you can basically just open your Wi-Fi adapter up in a way where it receives every packet from every access point and device. I recently wrote a program called tracker jacker that's that exploits that. So if you see me at a coffee shop I might look like this picture that a friend took of me with a bunch of antennas to scare people. So yeah again you know TCP IP is up up here 802.11 is here. We're talking about physical layer down here today. So I think that it's it's one cool thing about wireless hacking also is that it feels kind of magical. Like there's all like even in this room right now you know it sounds kind of like very Jedi. There's like this invisible energy all around us. Penetrates us. Things like that and but it carries interesting information. You have to know how to tune into it to harness that information. And if you write these like spells into a computer you can make things in the physical world do your bidding through the air. It feels very magical to me. It feels like you know back when I played Diablo 2 Lord of Destruction. I spent a lot of my life on that game. But it feels kind of like that. It's like you know building my wireless hacking skill tree. And so hopefully today you'll come away with a couple you know maybe another point or two into your wireless hacking skill tree. And this is an interesting time right now. Because obviously IOT stuff, the Internet of Things, is blowing up. There's all these new devices that communicate wirelessly. So this is kind of like in Diablo 2. Probably none of you played that. But you get a rune and it would like increase all your attack damage by some percentage. Well it's like that kind of with IOT. Like these skills, they're kind of dangerous. And you know you need to be careful if you're doing this kind of stuff too. Obviously be responsible. Because everything works through radio. I mean almost every type of wireless communication is radio. So virtually all wireless communication happens through waves. So you know like a sine wave. But a lot of them are radio specifically. So what we call radio, AM FM radio, TV, cell phones, Wi-Fi, Bluetooth, GPS, all kinds of things are wireless. Are wireless radio waves. You know I remember scanning Milwaukee and I could see these big industrial control SCADA systems with their frequencies just publicly available. So the the tool that we use that that's the current modern tool for playing with a lot of these wireless devices is called software-defined radio. Now if you're doing Wi-Fi hacking, you know 802.11, well you probably use a Wi-Fi adapter. Or if you're doing Bluetooth hacking, you probably use a Bluetooth adapter. But for a lot of other devices, a lot of IOT devices, a lot of sometimes some big industrial control systems down to really small, you know like wireless outlets are controlled not through Wi-Fi 802.11 or Bluetooth but through other sometimes proprietary protocols. Another thing would be like keyless entry on your car. So software defined radio is basically a radio where a lot of the a lot of the parts of the radio that would have been implemented in hardware are now implemented in software. Which makes it where it's a lot more flexible. So for instance the hack RF can transmit on like a huge, it can actually transmit and receive on a huge range of frequencies. Something from like I think a few megahertz up to six gigahertz. Which covers pretty much everything. Almost everything is in that range. So there's like the hack RF, I think it costs around $300 and you can transmit and receive. The RTL-SCR is I think around $20. The downside of that is that it is receive only. So that's kind of the, you know, think of it almost like the magic wand if you're doing this wireless hacking. So two demos. I wanted to show you this demo. I'm not gonna do it live because I couldn't bring my Jeep here. But like, so I got, I got like this, I got my hack RF, you know, I got it out of the box. And like the first thing I wanted to do it, I was like, you know, keyless entry, you know, that's radio. Okay, what's the frequency? 315 megahertz. So I looked it up and I ended up trying to do a simple replay attack. So this is a very common attack with wireless stuff, with SDR especially. You can basically just record the signal and replay it. That, that simple. One of the, one of the, one of the Capture the Flag things today, actually a couple of them that I did, it took like literally 10 seconds. You know, you just are recording it and then replaying the same thing. Nothing super difficult or anything like that. So I'm gonna play this video. Hey, Caleb here. No, I'm gonna be demoing. I'll skip ahead. I already told you that. I'll skip ahead to where it's like. All right, let's see. So let's see if that works. Ready, go. This is unlocking. There we are. And then, and then lock one. It'll make it, it'll make it a toot the horn as well. Good job, Caleb. There we are. So we just, that's enough, that's enough. So what happened was the first script. Yeah, so yeah, so you know, really simple replay attack, but very powerful, right? A lot of things are susceptible to that. Basically, now a lot of modern cars, this won't work on every vehicle. A lot of modern cars have a rolling code. And so if you try to, the whole point of that is simply to deter this type of a very simple attack. But it works on some, but the same idea work, can work even with rolling codes. You simply have to jam the receiver so it doesn't receive that code. That's, that's the workaround to the rolling codes. So it's, it's almost as simple to do it even, so this will work on almost any vehicle, in other words. The next one, so I was gonna demo a lot of jamming attack, except that jamming is illegal. So we can't do that. But we can maybe do something similar. So I've got, I've got some ham radios that I am licensed to operate on the frequencies that they transmit on. So let's say you're at like a bar or restaurant and there's some music that you know, you don't, you don't like, you don't love, you know, maybe you don't love Nickelback and you're like, man, if only I could somehow silence that noise. So what we're gonna do here, let's see if this works. So I'm gonna play this, I'm gonna run this new radio script. Oh, hey, there we go. What do you know? Now this looks like, this looks a lot like jamming. I understand it looks a lot like jamming. Let's go ahead and close that. Anyway, but it wasn't jamming. Like that was just, I wanted to transmit a sine wave at that particular frequency. It happened to coincide with frequency that the radios were operating on. But it wasn't technically jamming. You, what you heard was some noise, a sine wave at 400 megahertz. So anyway, but that's, but it's really interesting though. Theoretically you could do jamming attacks. And so, you know, I've got a, I've got a wireless security system. And I was wondering, well what if, you know, so you got like the the door, the door sensor, right? And then you got the hub. And if the door is opened, it sends a signal to the hub. And then if it's armed, it'll sound the alarms, kind of idea. So well what if it doesn't receive that signal? Well, nothing happens, theoretically. And then the last, last little demo I wanted to show you, let me just go ahead and, so I have, so it's actually the same outlets that I was using for my home security system a while back. So I'll show you, I got this remote. It, you know, on off switch, there's a little receiver back here. So that's, the little bulb there is plugged into that. So I can turn it off and on with this remote. So let's see, now I could do a jamming attack. Sorry, not a jamming attack. I could do a replay attack for this. I could potentially record it and replay the signal. But what if I didn't know the signal initially? You know, what if I think that it's a, you know, it's a pretty simple signal and I think maybe I could brute force attack it. Maybe I could, you know, maybe I've seen some signals to similar devices and I know the key space is 10 bits. And I'm like, well, I want to generate those, that signal from scratch. So let me do that really quick here. So I have a script I'm gonna run here. That's really small, one second. Try to make this a little more readable for you guys. So it's, so you're, this is like, this is not using GNU radio or anything like that. It's just a simple Python script I'll show you in a few minutes. And we're gonna run that in a pipe. It's out, converted its output to another format. And then let's see if this turns on, this should turn on the outlet. No. See here. Oh, because my hack RF is not plugged in. It would be a reason. All right, let's try it now. There we are. And actually I want to show you guys another thing real quick. So the signal that was generated looks very similar to the signal that I, that I was looking at prior. But one cool thing with these radio signals, you can actually open them in programs like Audacity. So probably a lot of you are familiar with Audacity. It's a sound, it's a free sound editing program. And so let me show you what it sounds like. This is actually, this is actually the signal that was generated. It's not coming out of the sound. Let's see. Let me just, I'm gonna unplug this cable and then play it through my speaker. Actually, built-in output. Yeah, I'm gonna just do that. Just because it's kind of cool to hear. I know you can't see this anymore, but let's see if you can hopefully hear it. And it's just, it's just a repeating signal. Stop that. Fully plugging it back in works. And I didn't ruin the rest of the presentation. Yes. So and again, you can look at this up close. And you know, so ultimately when I did this, when I was trying to do this signal generation, I cheated a bit. You know, I'll be honest. I looked at this or I looked at the similar, at the signal that I captured. And I was like, well I can look at it and I can see the bits. Right? So this is, we're gonna look at different types of modulation, but this is what's called ASK or OK modulation. It's simply varying the amplitude. And so a short pulse means it's a zero. And a long pulse means it's a one, basically. And that's it. And it's so cool because you can intercept the signal and you guys can see very clearly the bits there. Which is, to me, really cool. You know, I don't know if you guys, like when you were a kid and like you heard him hear the modem connecting to the internet back in the modem days. And you're like, you hear this sound. You're like, what is going on? You know? So it's cool to see it. To me it's really cool to see it. Sweet. So yeah, that's what, that's what the signals look like. So I want to, I want to try to quickly here go into what, you know, kind of a bit more of how this works. So if you understand the fundamentals of how, how like radio waves work, that's a really good foundation for doing any of this kind of hacking. So what are waves? So we're gonna get into a little bit of, hopefully some pretty light math. I'm not like really a math major. I like it. But I found that I like it when there's something useful that I can do with it. You know, I control things in the physical world through radio. So I'm, I'm gonna try not to get too deep into any of the math and just try to keep it very practical, you know, application driven. So waves, you know, they're simply these, these forms that, like a sine wave, right, goes up and down. You know, a sine, if you, if you spin around a circle, you know, if you look at just the y-direction or just the x-direction, well that's the shape of a sine wave. And they're really interesting for a variety of reasons. You know, as I already said, they're found everywhere. But I would, you know, try to think of one form of wireless communication that does not happen over waves. So I'm speaking to you and you're hearing, you're hearing sound waves, which are vibrations in the air, which can be represented as waves. All wireless communication is radio waves. So they're everywhere. I mean, they're, it's just crazy. They're everywhere. You know, if you look at temperature over time, it looks like a sine wave because of the rotation of the earth. Patterns of breathing, you know, breathing in and out, the all-zen. It's all over modern physics, if you think physics and stuff is cool. You know, quantum field theory, there's theories that basically model all particles as some form of waves. You know, with the string theory, they think maybe all matter is made of vibrating strings. There's probably some of you guys have heard of the uncertainty principle, like the Heisenberg uncertainty principle. A cool thing happened when I was doing some audio hacking. I kind of, like, discovered it for myself accidentally. So, like, I had the same slide I showed before. This is basically a spectrogram. So the x-axis is time. The y-axis is frequency. So lower frequencies are lower. And then the intensity, like the color, is the amplitude, basically, of that component. And one thing with things like audio is there's all these harmonics. That's why you see not just a single thing, but you see a bunch of them, right? Like here, you can see a bunch of... basically, it's multiple. So if this is 100 Hertz, this would be 200, 300, 400, 500. But when you're analyzing waves like this, basically, the longer period of time you analyze it, the longer period of time, the more precise you can be in how in the frequency that it is. So if you monitor a wave that's like this, and you only get the first part of it, that could be a variety of different waves. You don't have enough data to know for sure what wave it is. So it's... you can't be as sure. But the more you spread out your time, the less sure of exactly where in time you are. So let me show you what spreading out time looks like with that. Basically, it's increasing the size of the spectrogram. So this is 256 by 12. You'll see it's spreading out horizontally. And, you know, you get to something like this, and it's like, you can see we're very precise on what the frequency is, but we are much less precise on what the time is. So I think it's kind of cool. It's kind of a cool, like, rediscovery of, like, the uncertainty principle. So it's cool because it helps... waves are cool because they help you understand the universe overall. They're also the epitome of change. I don't want to go into this too much, but the derivative of a sine wave is itself another sine wave, which is pretty cool. Let's not get into that too much. So here's a really cool thing, all right? It's called the superposition principle. So I'm talking to you right now, and if I'm also, like, knocking on the table at the same time, you can hear both things at the same time, right? But what's actually happening... imagine you cover one ear. You could still pick up my voice and the knocking on the table, but what's happening is your ears are essentially pressure sensors. And so those... the waves of the vibrations in my voice are actually getting added to the waves of the sound of me knocking on the table. And it's called convolution. You're just adding these waves together, and your ears and your brain are able to basically deconvolute those sounds. It's amazing when you think about all these sounds. You can hear people talking in the hallway and all these things, and you're able to deconvolute those really complicated waves. What that looks like is, you know, like, let's say you have these simple waves, the sine wave, a few of these. You add them together and it looks like this. So it's a more complicated thing. Well, you're able to basically break that out into each component wave. But the same thing is true in the radio world, right? If there's... if there's data being transmitted at 900... at 2.4 megahertz for Wi-Fi. Well, there's also Bluetooth being transmitted around that frequency. Maybe off a little bit. There is also, in this air right now, FM radio waves and all... many other types of radio waves. And these are all being added into this really complex electromagnetic radiation. But you're able... your radio is able to deconvolute that by tuning into a specific frequency, basically. And that's how that works. And the reason that works is because the waves are orthogonal, which is kind of a confusing idea. But basically any wave of differing frequency is orthogonal. I won't go into that too much right now. Anyway, a simple view of this is like a time domain or time domain. This is like me saying the ah sound. This is what it looks like. Convert it to a frequency domain. You can see these peaks. Much like this spectrogram we saw before. And I won't go into the orthogonality much. There's another cool thing, how they're related to e and stuff like that. And so basically with Euler's formula, you relate e, raising e to the i pi. And that that basically produces rotation around a unit circle. This was interesting because to get this, to get this radio hacking thing to work, what happened was, and I'll show you a Python notebook in a minute. First I tried creating a sine wave, a simple sine wave. It's just going up and down like this. But the way that most radio devices work is they actually use a two-dimensional electromagnetic radiation signal. So instead of it simply pulsating in one dimension up and down, it actually is like this. It's like a corkscrew kind of shape. And the way you produce that kind of rotation is instead of going sine to the X, you do e to the i X. It was super cool because like for me it was like, I remember back in like high school here learning of like imaginary numbers and that kind of stuff. And it was like, whoa, this suddenly became actually useful. Raising e to this power. I needed that to actually get this freaking outlet to turn on. It was really, like, wow, this math. Like imaginary numbers is one of the classic things you think. They're imaginary numbers. How are they ever gonna be useful? So I thought that was pretty cool. So here's just a visualization of, you know, the simple sine wave versus the complex two-dimensional. Okay, that's that's enough of the math. So just to touch a little bit more on how digital communication happens over waves. So modems. Obviously we all know modems and we have, you know, back in the 56k days, you know, you actually heard them and I think modems were more at the forefront of people's minds. But we saw modems today. Everything, you know, ultimately it's whether it's Wi-Fi on your phone or if it's a cable modem, it's ultimately kind of the same principles at play. So modem stands for modulator or and demodulator. It's kind of like a combination. And there's a few types of modulation. So modulation is basically where you have a some kind of carrier wave and you're changing it to carry information or modulating it. So the some of the main types, this this is not exhaustive, but you've got amplitude shift keying. So you're changing what we'll go through these but amplitude, frequency, phase, and then quadrature amplitude modulation. So ASK amplitude, this is what it looks like. So you have a lower signal and then you increase the amplitude. And that's it. This outlet is ASK modulated. And you could you could make it where when it's really loud it represents a one and where it's really quiet it represents a zero. Or you might do actually it's called on-off keying where it's the length of the time where it's loud. The length of the time where the pulse is high. And that's that's more common. And again you know this signal again you can see clearly the amplitude increasing for longer and shorter periods of time. Another type is frequency shift keying where you're changing the frequency. So this is this is kind of the representation of zero one in FSK. So you know one frequency you know this is a lower frequency maybe it's a thousand Hertz that represents a zero. And when it's at 2,000 Hertz it represents a one or something like that. Someone's gonna do the math and say that's not a thousand Hertz anyway. Or this is another what another signal zero one zero one one zero. And it's just cool it's just cool to see this is what data looks like when it's transmitted in the air or on the wire. And by the way this isn't just wireless wireless communication. Wired communication it's actually the same stuff. It's actually waves as well. Phase shift keying is a little you know maybe a little more complex complicated to understand. You know you're basically changing if you think of the unit circle where you're at on that it's jumping that around. It's a quadrature amplitude where you're basically you basically are changing the phase and the amplitude at the same time. Actually I have a visualization I think for that which is kind of cool. Let's see if I have that. Let's make that bigger. I think it's just from Wikipedia. So you can see it's changing the phase and it's changing the amplitude. And with that you know in this case you're able to represent 16 different values in a short period of time. This is actually what a lot of Wi-Fi uses by the way. Like your 802.11 Wi-Fi. Most of the time it uses this called QAM. Now if it's more noisy you could you could probably tell by looking at this. I mean it's almost amazing it works at all. So if it's really noisy Wi-Fi can like go to maybe like binary FSK if it's really noisy or something like that. Something easier to differentiate between the values. But I think ideally it's using QAM. And there's various you know this is QAM 16. There could be QAM 64 where you have 64 different values. You can imagine noise is going to be more damaging in those situations. But that's how it's modulated. So really quickly I want to go through what it looked like to actually generate this signal from from scratch. How many of you guys and gals are familiar with Jupiter notebook? Could you raise your hands? Okay. Pretty small percentage. We're not gonna go through all this in detail. I do have at the last slide I'll give you a link to this if you want it. This is kind of think of it as like a scientific notebook. This is how I kind of research this. So I was like okay I've got this signal. I kind of just eyed it up honestly. I was like okay it looks like roughly this frequency you know and stuff like that. And I was like okay I need some way to do ASK. So I just wrote some basic code to like modulate you know basically do basic amplitude modulation. And all this code is self-contained in this notebook by the way. We're not gonna go through the code line by line though. And then I was like well okay I've got a I've got a call you know convert a bit of strings you know 1 0 1 1 0 blah blah blah to that. So I tried to do that and I was like oh I need spacing. It's actually on off keying. Tried that. I was like okay that looks really close. I put it in. I outputted that and ended up failing. And you know I open both of them in in Audacity side by side. The recorded signal and then the generated signal. And they look almost identical. I was like and I tried it and it didn't work. And this is that that complex number thing I mentioned. I realized oh yes okay I see. Radios use complex signals. The two-dimensional. So it was it was like one line of code to change it. It was like subbing out sine to the X to e to the iX. It was really cool and it worked. I was like whoa that was sweet. I was because like when I ran into I was like oh man it's gonna be a horrible. But now it worked. Actually no there is I think there's one other issue where I had to like there was like a carry there's like some kind of complicated thing where you had to modulate. There was like you couldn't just you couldn't just keep the signal high. You had to mod you had to like have it going back and forth for the radio to transmit it or something like that. It was a little bit confusing. Anyway it ended up working and you know the signals look you know this is like the generated signal zoomed in and the recorded signal and it look you know they're not exact. You can see that but they were close enough where the radio would actually listen to it and do what it said. So kind of a few conclusions. Like I said it's it's kind of interesting because almost all wireless communication happens over electromagnetic radiation which is really cool. And hopefully now you know some of the foundations of how radio communication works and that can be really helpful in doing all kinds of interesting things with it. It's also just cool to understand because waves are like I said the more I learn about them and I have my eyes open I'm like wow these are popping up everywhere. From a security perspective though I think it's really helpful to be aware of the types of radio attacks that are possible. So jamming attacks are very simple. We didn't actually demo one today but you know it's very simple conceptually. So you know you could think about that like if if you know it's kind of a threat model thing right? Like if you have a if you've got a store full of a lot of merchandise and you try to protect that with a security system that's wireless well it's not that hard to do a simple jamming attack and break that. Replay attacks again you know very very simple to do. I mean you can someone could pull it off in literally like 10 seconds and they work in a variety of places so that's good to be aware of. You know this is kind of more of a it's almost more of physical security than like software security I guess but I think it's helpful for any security professional to be aware of that this kind of thing is this simple to do. Brute force attacks so you know I didn't I did like I said I cheated a little bit I actually like had the signal that this thing transmitted and I I just kind of eyed it up try to reproduce it but in theory I could have found a similar model like let's say there was something really valuable that that outlet controlled right and I'm like okay I see it's that outlet and I can look I can just go and get one at the store and I can see what maybe I get a couple of them and I see okay this is what the key space looks like well it wouldn't be a ton of work to just do a brute force attack against that kind of thing so that's interesting to be aware of you could even have some combination of like brute force and replay attacks right so maybe maybe there's like an 8-bit rolling code you know everything So you can replay that part, but you need to generate the combinations for the rolling code. You know, maybe the total signal is 32 bits, but maybe you only have to tweak, you know, 8 bits or something. Well, that's interesting to be aware of. So be wary of wireless communication. I mean, I'm not like, you know, Tin Hatter, where, like, nothing wireless. You can't ever use wireless. But it's kind of a threat model thing, you know. I have wireless security in my house. I'm not, I'm not expecting, hopefully, many of you or any of you to come try to break in. And I'm hoping that people who try to, if they do, don't know this kind of stuff. I have backups in place, though, in case any of you guys are thinking about that. Anyway, but if I had a store with a ton of merchandise, I'd probably not use a wireless security system. And that's, that's all I've got. You know, I have my website here, GitHub, ham radio call sign for any of you. And then I got a link to this, actually, I think it's an old version of this presentation, but very close up to date. And then I have, I'm gonna make this bigger, and then I have, this, this is the scripts that were involved today that I was working with. This is a link to them at the bottom. So with that, I think we have a few minutes for questions, if anyone has any questions. Yes, I actually haven't used it. It seems really cool, though. I like the HackRF because it's just, it covers almost every frequency you might want to do. It's 300 bucks, which I know is a decent amount of money. In my experience, I would say, for me personally, getting, paying at $300 was like a great investment. So are there any other questions, or is that it? All right, thank you for your attention.