[Music]
way to go way to go way to know these uh
who wants to hear a cow
joke okay there's less people so I'll
only say one uh what do you call a cow
with one leg
steak all right should we just
start we good awesome hey everybody my
name is Eric Escobar uh I am a wireless
consultant at secure works I do all
types of pen testing uh I think half of
this track talk is probably secure Works
employees so thanks everybody for
showing up um this talk I'm going to
talk about not just how to break
Wireless stuff not just you know things
that are vulnerable and exploitable um
but how to actually make use of it uh
and so that's why I'm calling it void
your warranty it's taking you know cheap
Products off the shelf hacking them
reworking them so they're actually more
useful than when you initially purchased
them uh and then I also have a a fun
story after this too because my talk got
extended by an additional 30 minutes so
we'll talk about uh another fun way that
you can hack things so um the reason
that I kind of started thinking about
this topic and this track is because
when uh I got started in cyber security
I was basically an analyst I worked as a
blue teamer as a you know security
person for a company and when I told
them hey I'm going to go leave and be a
pentester well they said Eric we always
considered you to be a builder and a
Creator not a destroyer and a breaker
and I was like wow you're really like
tugging at my heartstrings here like I I
like got a degree in engine engineering
I like to build things I don't think of
myself as a destroyer and a breaker and
so they're trying to you know pull at
this and say no Eric like you should
stay with us help fix things don't just
go break things um so that always kind
of stuck with me as a like no I think uh
at my base I'm still an engineer I'm
still a creator also there's some weird
feedback in here I can hear myself talk
so if I'm talking a little bit slower
than I normally do that's why um so
basically when I started becoming a
pentester uh that's a hacker right we
get paid to do the really fun things
that normally would be illegal but
really why does it say just sitting on a
park bench that's a Taylor Swift lyric
did one of you guys mess with my
slides somebody definitely added a
Taylor Swift lyric to my slides so
Kudos uh also that is me out there
behind you that is in the wireless
Village playing T Swift song so if you
want to go try and break that and change
change the playlist by all means please
do um so so going back to what I was
talking about before I got Taylor
swifted uh you can buy tons of cheap
Hardware off of eBay Alibaba all these
sites all this Hardware typically runs
on you know one of a couple frequencies
typically it's going to be around
433.92 mahz that number doesn't really
matter because I'll show you why in a
little bit um but this this uh this
frequency is used for tons of different
things you can have thermometers motion
sensors door sensors
Outlets it's because uh this frequency
range you don't really need um any
specific uh license given by the by the
government right anybody can basically
broadcast on this as long as it has FCC
approval um and so because of that all
of these cheap device manufacturers they
don't want to have to go through you
know all the rigma roll to get that
finality to broadcast on some weird
frequency that's where they use 433 same
thing with why you would use 2.4 GHz um
there's a handful of different
frequencies out there but but all that
you need to keep in mind is that cheap
plastic Hardware uh typically transmits
on this if it's wireless so in this
picture right here you can see a little
cheap motion sensor that I brought with
me and then I have some of these little
smart Outlets where you literally just
press the button and it clicks the
outlet on and off um now if you were to
flip this device over you can see what's
called an fcci ID this is basically the
stamp of approval that the FCC gives to
every wireless device that says hey you
are allowed to transmit within the
United States now you're probably
wondering like okay why do I care about
this random looking serial number thing
and the reason why is because if you do
anything with RF uh it is a hacker's
best friend and because you can take
that ID and you can go use it on the FCC
website to go pull down user manuals
setup photos schematics uh basically the
full breakdown of what is inside of that
device um and so sometimes you'll find
you know chipsets you'll find you know
um what frequencies they broadcast on
sometimes they broadcast on multiple
frequencies uh you'll find that they uh
you know use different chips the way
that they're phased potentially just
tons and tons of information um and so
without getting into it you have the
amplitude modulation frequency
modulation and these are basically just
ways that signals are carried in the air
for what we're doing that doesn't matter
at all you don't have to worry about any
of that because all the hardware that
you're going to be using this is like
super 101 stuff you don't have to go
down into the theory you don't have to
worry about tuning your software to find
radio uh because all this will basically
self-tune on this type of frequency and
a lot of these cheap electronics they
use a type of modulation called onoff ke
basically just uh you know High signal
low signal and that represents um some
zeros and ones that have a signal that
is sent with
it um and so if you were just interested
in hacking this kind of stuff if you
were just like oh I just want to do a
replay attack you could easily take
something like a portter pack um which
is just a hack RF with a a fancy little
screen on it or the everybody's favorite
flipper zero right you could take one of
these devices clone the signal just read
wait wait wait press the button and you
would see some data come across and
you'd hit save and then you could just
replay that signal over and over and
over and over again now if you're in any
type of security field you can probably
see the problem there if you can just
listen and then replay over and over and
over and over again then that signal is
not secure at all all right especially
when you think about what some of these
things are like a motion sensor door
open door closed sensor if you can
Replay that then you can just make that
sensor trip and think that something is
happening when it's actually not right
so that's not super great that's not
awesome that's not something that you
would um you know normally want in the
security world and that's why for like
my home security system I make sure that
my door sensors and my motion sensors
they don't use something like this
however if you have some fun home
projects that you're just like hey I
have an idea to try and get something
something to work using the cheap
electronics that do just send that one
signal out over and over and over again
they're great for prototyping and
getting like kind of like a working
concept um up and up and running and so
like again the the code that's on here
on the screen just literal on liners for
how you can read and save to a file and
then replay that file right back if
you're just on a computer but now people
have flippers all the time so you can
just use those as well
um so this is where
like that's the end of like hey you
could just hack it right that would be
really awesome great done but really
when you look at it hackers are more
than just Breakers right they're more
than just destroyers of something it's
like hey let's make this more useful
right let's let's take this and do
something with it that's like more
interesting and more capable than
anything that you could potentially buy
off the shelf plus then it's customized
to you and then if you've hacked it if
you've built it and if you know how it
works then you can tailor it to exact
exactly your design and exactly what you
want um so there is a GitHub repo RTL
433 and it takes everything that I just
said all the amplitude modulation
frequency modulation all of that stuff
and it allows you to plug in a simple
little USB card like this into a
Raspberry Pi into your computer into
your whatever um and it takes all that
information and it spits it out into a
nice really like pretty picture like
that so you can see via command line
like all the different information that
pops out and it has all the the major
different types of encodings um a bunch
of different schemes of devices that are
out there uh when I was actually running
this at home I would just let it run for
a couple minutes and I was like whoa
what's that hey that's my fireplace I
can turn my fireplace on and on on and
off with this this is awesome I could
you know what could you use that for
right um and then I also found I was
like as I was barbecuing one night that
hey my meat thermometer actually
broadcasts on that fre frequency too and
I can see the temperature of my meat
from my laptop and so it's one of these
things you just let this go and you just
think what else could you possibly do
with this uh and so it's like okay cool
um you know that's great that there's
this repo where you can just like read
all this information out and then maybe
if you know you're a a python programmer
or chat GP you could pull that together
and say oh I'll try and extract some
data and then write a script to perform
an action and that's when I found node
red how many of you guys know what node
red is okay I found out about this
fairly recently it's pretty awesome
basically it's like home automation on
steroids um you can install this thing
on Raspberry Pi any different platforms
Cloud platforms what whatever you name
it's really lightweight install but
where the game Cher is is that it's like
uh click and drag like programming and
so you can have all your workflows make
sense within something like node red uh
and one of the plugins that they have is
RTL 3
433 and so what that means is that you
can take all the cheap Wireless signals
all those cheap wireless devices your
meat themometer
your uh you know what was the other
thing your fireplace and you can say hey
I want to import all of that information
into node red now and so you take that
all that information you import it into
node red and you can draw up some crazy
diagrams of what's possible and much to
the shagrin of my wife all of the
different random devices that I
purchased now now monitor pretty much
all the temperature sensors everywhere
in the house cuz again they're cheap
they're like $3 you know off of Alibaba
and you can just take these things and
place them anywhere and now you can do
anything you want with the data and and
really this is less of a like this is
exactly how to do this and more of the
like hear the key wordss to Google to
take and enact in your life uh because
you can do some awesome things with them
and what I want to do is probably not at
all important to what many of you want
to do like for me I want to see what the
temperature of my chicken Coupe is you
probably don't care what the temperature
of my chicken Coupe is but with this you
can do you can do pretty much anything
customized to you for a fraction of the
cost if there even is a solution that
you could buy on online or you know from
anywhere and so if you look at this flow
diagram this is just some random one
that I made a while ago and so you can
see that you can collect data from you
know different Wireless sensors you can
log that data you can write functions
with that data you can log it you can uh
node red also has the capability to
graph it have dials buttons pretty much
everything that you could hope for and
imagine there's some people that have
done some crazy stuff with home brewing
setups with this um because again you
can log temperature you can turn motors
on and off um this is really just meant
to Spur that imagination of like what
can you actually do with
this um so just to give you a little bit
more of the capability I just took some
screenshots of the different slides so
if you just look at this it has full
mqtt capability HTP requests TCP in out
uh you know you have your UDP requests
you can write to files there's switches
functions that you can write you can get
statuses debugs you know Json XML like
whatever you want to do it has this
capability right and so where we started
with this is like oh I bought some janky
you know uh Chinese Wireless items that
normally you would never even hope to
purchase or never even want to purchase
because why why would you right they're
they're not secure they're not great but
for something if you know what you're
going to do with it and you know the
right way to to break it apart and kind
of mold it now think of all the
capability that this gives you we went
from $2 Wireless motion sensor to now
you can have it send you a text message
through twio when somebody's in your
driveway you can't buy something like
that off the internet and now you just
made it for a fraction of the
cost so okay that was my that was my
like not not a not an what do I say uh
not just a breaker right part of a
builder but sometimes security is just
for fun so I'm going to uh now kind of
change gears a little bit and talk about
building something that is really not at
all practical it's not practical it's
not necessary the world doesn't need
this but I needed this um so this is so
here's the story about this uh I really
like laser tag anybody else play laser
tag here okay that's far too few hands
there needs to be more people that play
laser tag so with laser tag uh does
anybody know how it
works just raise a hand just what what
frequency do you use you got to yell
really
loud so that's how the devices typically
communicate back but the way the guns
actually work is infrared like your TV
remote right um and so I went to I
haven't play laser tag in a while I went
with my younger cousin and I was just
like hey do you guys want to play laser
tag and they're like oh sure my cousin
they want to go play um and then we got
destroyed because I guess now when I was
a kid it was like everybody got the same
gun everybody got the same whatever uh
but now you can buy upgrades you can buy
buy level UPS you can buy armor like all
this random stuff and there's like club
nights for laser tag which is a little
insane so needless to say when I just
roll in thinking that hey I'm just going
to play a game of laser tag got
destroyed absolutely destroyed and I
thought hey I can find a way around this
I'm a little bit smarter than this uh
it's just a blinky light how hard could
this be um so like I said uh laser tag
works on infrared uh and so the same way
that you hit transmit you know you hit
the power button on your phone or your
flipper or your uh or your TV remote it
just transmits an infrared signal and so
when you shoot that out of your gun it
gets received right there on wonder
wherever your tagger spot is and that's
how it indicates that hey you made a
shot shot well if it's just light that's
blinking out of the front of an LED uh
you could probably clone that couldn't
you and now with a flipper you can super
easily um so I won't go into like how
ultraviolet infrared work basically if
you have a camera that infrared you just
can't see with your eyes typically you
might be a little bit you might see a
little bit of the red um and but cameras
can pick it up and there are very cheap
LEDs that can emit it and receive it uh
so basically if you were to take a
picture of this this is I think I
actually took this picture oh maybe not
um but basically if you take a picture
uh with something with a camera that
doesn't have an infrared filter you'll
actually see the light blink so if you
take a picture with your phone um you
might see an infrared light blink when
you press your TV remote shoot your
laser gun you name it um and so that's
how these sensors work they just emit
they go from there and uh that's how it
indicates you've been tagged and this is
how small these little lights are and
how they're little receivers are they're
very cheap and when I say very cheap I
mean like cents per like dozen um I had
to buy like a hundred of them minimum
when I was buying them in bulk um and so
now what happens is once you've been
tagged that information gets sent out uh
over who knows the the fancier ones now
get sent out over Wi-Fi so good luck
trying to compromise something like that
while you're in the heat Battle of laser
tag um really all I care about is I just
want a better gun and I don't have to to
pay for
it so what's nice is infrared is oneway
communication and just about the uh
other type of you know frequency you're
talking about 433 megahertz that same
code is repeated over and over and over
and over again so there's no rolling
code it's just a replay attack because
who would be crazy enough to spend a
bunch a Time building a device just to
hack laser tag surely nobody would do
that right surely nobody would go and
use their engineering mind to go do this
um so I saw you know first what do you
do before you're going to go build
something you look at the
state-ofthe-art you see who has done
what out there uh and somebody built
something very similar to what I was
thinking of basically this little device
is hooked up to a 9volt battery um and
it lets you just repeat over and over
and over again the same frequency pretty
cool pretty cool I wanted more though um
I wanted multiple LEDs I didn't just
want to walk in with a better gun I
wanted to walk in there with a you know
180° Claymore that went off every 10 you
know 10 times a second I wanted high
power I wanted a user interface and I
wanted to do some data logging so that I
could see what other guns other people
had potentially in the field um again
this is totally not necessary but this
is what happens uh and then thank you to
Michael Howard oh look at him I should
have got a picture of he's right there
everybody Michael Howard uh that's a
picture in his old car not his new car
he's probably mad I don't have a picture
of him in his new
car uh anyways I do not know electrical
engineering and Michael Howard knows
more electrical engineering that I'll
ever forget um is that how the phrase
goes I don't know electrical engineering
Michael Howard does so he helped me out
so I didn't blow myself out or let the
magic smoke out so the design
considerations here were to make it
concealable easy to use ultra bright
LEDs and have a decent amount of power
so I used the Raspberry Pi zero uh super
small a little Wi-Fi board um and I just
wanted to run basically a web server and
drive the
LEDs so I didn't find just the super
cheap LEDs I found one that did super
bright 1 amp pulses uh and they you know
did a super wide cone of 20° now when
you're playing laser tag you probably
realize that hey your your gun is only
going to shoot and only hit a small
Target because they are narrow field and
that's how you know the simulation of
laser tag actually should work is hey
you don't want it to just be scattered
you wanted to be hey like you're
actually trying to you know hit somebody
uh whereas this is 20° cone I'm like
okay cool 20 Dees is pretty good but we
need to do better and so that's why I
said okay I'm going to get five of them
overlap them and again make it totally
unnecessary so of course I wired it all
up 3D printed it all out uh and then did
a whole bunch of really janky soldering
and hot glue to make it all fit and then
I 3D printed a box and an enclosure for
it uh so you can see basically just fits
top down and I was making it so the the
design of this is so I could hold it
underneath the gun so that way uh you
know while I'm while I'm playing it's
not like I'm holding a SE a second
secondary device it's you know I'm
holding it right underneath the laser
tagger um so it it Blends in and it was
not printed in uh uh red it was in all
black um so then for the power
management I used Adafruit power boost
uh and basically it it just uses the
tiny little LiPo battery convert to 5vt
super
easy um and then to power the LEDs
because they took a lot of power um I
used the buck converter to um to take
the voltage down to 1.2 volts um and
make efficient use of the power and just
that way I can directly connect it to
the battery uh now for connectivity I
had a hot spot in my pocket and I could
run all the commands from my phone so
I'll show you the UI here in a second so
this is what it looks like just like
kind of the flat board aspect of it all
the little messy wiring in
there uh and you can see again it gets
Messier and Messier with all the wires
in there and all the hot
glue and now so basically I'm not a web
developer I am not an electrical
engineer so I had a PHP web end I no
idea what I was doing this was before
Chad GPT so I took uh the you know the
rxtx pins to basically hook it up to the
infrared and then I had a that it would
basically just read to and write from so
this is horrible horrible PHP you should
never do this but hey I'm the only one
connecting to it so uh I wasn't that
worried about it then I used uh the
software called
IRP um basically what this does is this
takes care of uh me having to understand
how infrared actually works right I know
that there are timing sequences that
there are spaces that there are you know
uh x amount of repetitions I don't want
to learn how any of that works I just
want my laser gun to shoot so what I did
is I just utilized this library and just
said hey capture the signal send the
signal it does that
awesome so then what I did is I
basically just said okay here's how I
want this to work if I'm In the Heat of
battle I want to be able to listen to a
signal clone it real quick and then I
want it saved to the Raspberry Pi super
simple and then I want to be able to
recall that and then play it back as
many times as I want so basically Al you
go you select the signal you want to
transmit you tap fire and it'll do 20
rounds a second Now the default is about
one round every half second so it only
takes three shots to you know to tag you
out so when you look at that immediately
the going at 70 70 Dees roughly uh then
another 30° you know in in horizontal
positioning at 20 rounds a second I was
the Juggernaut there's no way you could
stop me even with a standard
gun so this is the user face again very
janky uh dark mode by changing the
background to Black um no bootstrap or
anything to make this look pretty uh but
hey you know what it worked oh is that
it I don't have the I lost the last
slide in there anyway so the moral of
the story is what we were able to do
with this device is we took it in the
next couple weeks after I built it with
my cousin and I and now we could clone
any gun that we wanted to but the best
part and this is the one that I did not
anticipate is that I could also clone
the healing frequency that was used and
so then what I was able to do is I
basically just made it so that my
younger cousin was uh omnipotent he
could not be destroyed he is that the
right word omnipotent he was he
indestructible right uh everybody all
these college students would start
trying to tag him out trying to tag him
out and he'd just run to the other side
of the base no problem and would never
die because I would always heal him um
anyways so the moral of this story and
the moral of this talk is that hacking
is not just to break things it's not
just to destroy things it's to basically
Bend things that you want to work the
way that you want to work and to still
create but understand how they work and
to reverse engineer things does anybody
have any questions because I went really
fast uh but I can talk about a lot of
things going once going twice oh way in
the
back you know it it already was a
complete blood bath like it it was one
of those things of like all right this
isn't fun anymore because uh I mean the
the other thing that I didn't take into
account is um how IR you know reflects
off of things especially when it's super
bright and so it was like literally
shooting around walls and stuff so it
was like people would be in their base
and it was like all right well nobody
can even play so like like did I
demonstrate that I won yes but like at
the same time at what
cost anybody else anybody
else cuz Doom is not a game that I ever
played my first my first first person
shooter was 007 so I should have named
it the Golden Gun it's repainted at Gold
anybody else anybody
else going once going twice sold thank
you drew for the last
question