[00:25.300 --> 00:27.520]  Remember the message.
[00:27.860 --> 00:30.100]  The future is not set.
[00:55.690 --> 00:58.050]  Anybody here from Milwaukee?
[00:58.970 --> 01:00.250]  All right.
[01:00.250 --> 01:01.390]  Favorite tool brand.
[01:01.810 --> 01:04.450]  You guys get the packout system?
[01:04.550 --> 01:06.910]  Holy crap, what a way to spend a lot of money.
[01:06.950 --> 01:08.850]  But they're really cool.
[01:10.690 --> 01:14.310]  You know, you must work there.
[01:14.690 --> 01:16.250]  Snap-on.
[01:16.490 --> 01:18.470]  I'm sorry, you said strap-on?
[01:18.470 --> 01:19.510]  Yeah.
[01:20.670 --> 01:21.970]  Same thing.
[01:22.550 --> 01:23.750]  Okay.
[01:25.230 --> 01:29.550]  Yeah, it's... the guy behind you said something.
[01:29.550 --> 01:32.670]  He doesn't know how to project his voice.
[01:33.390 --> 01:37.790]  Oh, by the way, I do encourage heckling, but you will receive something in return.
[01:38.450 --> 01:39.610]  All right.
[01:39.830 --> 01:40.670]  What?
[01:41.230 --> 01:41.970]  Money?
[01:41.970 --> 01:42.870]  No, sir.
[01:42.870 --> 01:44.370]  The complete opposite.
[01:44.930 --> 01:45.950]  Hey, guys.
[01:45.950 --> 01:46.350]  All right.
[01:46.350 --> 01:49.370]  Welcome to Mesh-tastic, Attack-tastic.
[01:49.370 --> 01:55.830]  I kind of got introduced to Mesh-tastic last August at DEF CON.
[01:55.830 --> 01:57.950]  I don't claim to be any expert.
[01:57.950 --> 02:01.350]  I'm a very enthusiastic hobbyist.
[02:01.870 --> 02:05.210]  And while... Nope.
[02:05.810 --> 02:07.030]  Nope, nope, nope.
[02:07.030 --> 02:08.190]  No such thing.
[02:08.510 --> 02:11.590]  I was told I started too early by Robert Wagner.
[02:11.590 --> 02:16.270]  You can put him on the ban list for CypherCon for going forward.
[02:22.050 --> 02:24.650]  You should move up if you want to heckle the presenter.
[02:24.810 --> 02:27.030]  Because I can't understand what you're saying.
[02:29.270 --> 02:29.890]  All right.
[02:29.890 --> 02:31.550]  So I got introduced to this.
[02:31.550 --> 02:33.450]  I became a very enthusiastic hobbyist.
[02:33.870 --> 02:36.810]  Really started to use some of the more advanced features.
[02:36.810 --> 02:42.770]  Me personally, I really like being able to create the custom builds, try out different things.
[02:42.990 --> 02:46.850]  So for example, like my main one here is this Nano G2 Ultra.
[02:46.990 --> 02:51.430]  And Johnny Christmas printed a nice 3D case for me and just swapped it out.
[02:51.430 --> 02:54.370]  I didn't realize that the screws were also 3D printed .
[02:54.370 --> 02:55.630]  So when it fell, they broke.
[02:55.630 --> 02:57.150]  And I got to go get real metal screws.
[02:57.370 --> 03:05.170]  Or even just going online and finding other types of cases and then using any other tool like Tinkercad or Blender or whatever.
[03:05.170 --> 03:07.670]  And if you want to change it and customize it to your own stuff.
[03:07.670 --> 03:09.570]  This is kind of the part that I like the most.
[03:09.670 --> 03:11.530]  A little background on myself.
[03:12.630 --> 03:15.530]  Been in the industry probably close to 30 years now.
[03:15.530 --> 03:18.270]  I do a lot of different things even outside the industry.
[03:18.270 --> 03:21.850]  You could see there I'm wearing some scouting clothes.
[03:21.850 --> 03:25.470]  I'm very active in what's called now Scouting America.
[03:25.890 --> 03:34.630]  I do stuff with Cub Scouts from like leadership and training their leaders and into Scout BSA, formerly known as Boy Scouts.
[03:34.630 --> 03:37.390]  That was my silver beaver picture.
[03:37.390 --> 03:40.270]  I thought it looked funny wearing the hat and some other things.
[03:40.610 --> 03:43.710]  Been at Cisco Systems for seven years now.
[03:44.330 --> 03:49.910]  And in 2014, founded Hack for Kids with Mr.
[03:49.910 --> 03:50.650]  Wagner over there.
[03:50.650 --> 03:52.090]  Yeah, the one person.
[03:52.090 --> 03:53.270]  Oh, hey, thank you guys.
[03:53.490 --> 04:00.510]  And several other folks in here have volunteered and thank all of you again for giving up your time to help out with Hack for Kids.
[04:00.890 --> 04:07.130]  Started D-Sides 312 in 2023 with Robert also.
[04:08.230 --> 04:11.250]  Kind of bring some more of the community back.
[04:11.250 --> 04:12.370]  Yeah, come on up here.
[04:12.650 --> 04:15.770]  Bring back some more of the community in the Chicago area.
[04:15.870 --> 04:17.630]  I've done a lot in the industry.
[04:17.630 --> 04:20.610]  Anything from like some malware research.
[04:20.610 --> 04:24.530]  I'm an architect at Cisco, security architect, maybe be specific about that.
[04:24.530 --> 04:34.670]  Things around email hygiene, encryption, endpoint protection, edge protection, threat handling, malware research, building custom electronics as a Badge Life community member.
[04:34.910 --> 04:36.410]  Done a whole bunch of different things.
[04:36.410 --> 04:41.170]  I just... one of those people that have that problem, they just kind of can't settle on one hobby.
[04:41.170 --> 04:45.190]  So I like to do other things such as barbecue.
[04:46.550 --> 04:49.530]  I like the way you said that.
[04:49.850 --> 04:51.870]  I also made the coleslaw, too.
[04:51.870 --> 04:57.530]  And then I learned how to make ketchup because I got tired of all the other ingredients these companies are putting in there.
[04:57.530 --> 05:02.570]  And then I just made some chipotle ketchup about a little more than a month ago.
[05:02.670 --> 05:04.230]  It's fucking amazing.
[05:04.230 --> 05:05.210]  It's so good.
[05:05.210 --> 05:07.230]  And it's like literally healthy.
[05:07.230 --> 05:11.490]  So ketchup is not healthy, but when you make it yourself, and it's not hard.
[05:11.610 --> 05:16.010]  If you want, I could share my recipes with you later, but it's good stuff.
[05:16.330 --> 05:18.190]  And then you could see the Gundam Morty.
[05:18.190 --> 05:19.770]  Again, I like to create these custom things.
[05:19.770 --> 05:21.170]  That's like an SAO for Badge Life.
[05:21.170 --> 05:22.530]  I'm working on some other stuff.
[05:23.270 --> 05:27.490]  Dad, three kids, one Eagle Scout, one on the way, and the other one working through the program.
[05:27.590 --> 05:29.310]  So I got a lot going on.
[05:29.550 --> 05:33.230]  I don't even know how I have time to be up here, but thank you for coming to this talk.
[05:34.010 --> 05:35.210]  Quick intro, right?
[05:35.310 --> 05:37.170]  We're going to go through what Meshtastic is.
[05:37.170 --> 05:45.490]  Who here doesn't really know much about Meshtastic other than it's kind of like the new hotness and wants to learn more about it?
[05:45.490 --> 05:46.750]  You can put your hand high in the air.
[05:46.750 --> 05:47.450]  It's fine.
[05:47.450 --> 05:48.310]  Doesn't matter.
[05:48.310 --> 05:49.310]  You can go like this.
[05:49.310 --> 05:50.070]  You go like that.
[05:50.130 --> 05:57.310]  Who's like an avid hobbyist in Meshtastic and is here to make me look stupid?
[05:58.610 --> 06:00.070]  You can leave, sir.
[06:00.130 --> 06:01.430]  There's always one.
[06:01.430 --> 06:02.430]  You can go.
[06:02.430 --> 06:03.430]  No, I'm just kidding.
[06:04.030 --> 06:05.550]  No, challenge me.
[06:05.550 --> 06:07.310]  But I tell you, I don't know everything about it.
[06:07.310 --> 06:08.170]  I know what I know.
[06:08.170 --> 06:09.430]  I really enjoy it.
[06:09.550 --> 06:14.510]  And what I kind of went through, like what would the security implications be?
[06:14.510 --> 06:16.470]  What are things that we need to be concerned about?
[06:16.470 --> 06:18.610]  It's a tool written by IT people.
[06:18.610 --> 06:24.190]  They put some security in there, but they don't think like us and they need our help.
[06:24.190 --> 06:31.250]  And that's kind of really the big message behind this talk is for you guys to get interested, to get excited, and support the Mesh.
[06:31.770 --> 06:33.110]  And I'll go through some more stuff.
[06:33.110 --> 06:34.350]  I'll build up to it.
[06:34.350 --> 06:39.290]  But the really fun part, if I start sucking and you're like, I'm leaving.
[06:39.290 --> 06:40.670]  I got something better to do.
[06:40.810 --> 06:42.850]  Just stay through the POC.
[06:43.190 --> 06:46.610]  Somebody in the Burbsec community, he goes by Varks.
[06:46.850 --> 06:49.710]  He came up with a really cool POC.
[06:49.710 --> 06:55.810]  I have a video recording of it on how you can use Meshtastic to take control of a remote PC.
[06:56.230 --> 06:57.830]  And then after that, you can go.
[06:57.830 --> 06:58.490]  I don't care.
[06:59.190 --> 07:01.670]  So let's talk a little bit more about Meshtastic.
[07:01.670 --> 07:08.330]  So kind of in plain language, it's open source, decentralized communication platform.
[07:08.650 --> 07:15.090]  It gives users the ability to communicate off-grid with long-range networks, right?
[07:15.190 --> 07:20.590]  What you see in the video is my T-deck and I had a 3D printed case.
[07:20.590 --> 07:23.050]  And again, that's the part I like, the customization of it.
[07:23.050 --> 07:25.410]  The built-in keyboard was kind of cool.
[07:25.450 --> 07:28.610]  You could still manage it from different devices, which I'll get into.
[07:28.870 --> 07:38.350]  But kind of the real primary uses is things that are related to the devices being low-powered and inexpensive.
[07:38.350 --> 07:43.750]  And kind of referring back to the POC, it's literally like $90 POC to break into a company.
[07:44.050 --> 07:45.350]  That's cheap.
[07:46.310 --> 07:50.610]  For LoRa, like L-O-R-A, that just stands for long-range.
[07:50.610 --> 07:51.950]  So it's long-range radios.
[07:52.270 --> 08:00.510]  The devices can handle usually text messaging through some other device like a smartphone or a browser.
[08:01.130 --> 08:07.270]  And some have GPS, which will also kind of go into those security implications as well.
[08:07.270 --> 08:10.510]  But it's all done without cellular or internet.
[08:10.510 --> 08:19.610]  And that's one of the challenges I have is whenever I start to explain this to people that even if they're technical, they're like, wait, but how do you get the message to the other device?
[08:19.610 --> 08:20.630]  Well, it's node-to-node.
[08:20.630 --> 08:21.550]  It's a mesh.
[08:21.590 --> 08:23.950]  But how much does it cost a month?
[08:24.290 --> 08:25.510]  There's no cost.
[08:25.510 --> 08:27.950]  It's like your device is the cost.
[08:28.130 --> 08:30.230]  And then I'm still thinking about it.
[08:30.230 --> 08:32.530]  So batteries.
[08:32.850 --> 08:34.130]  Yeah, batteries.
[08:34.130 --> 08:35.390]  There's always batteries.
[08:35.890 --> 08:41.130]  So some of the other things, too, is depending upon the terrain, like cities obviously could be problematic.
[08:41.130 --> 08:48.470]  But if you're kind of in an area that's like backcountry or wilderness or even camping someplace that doesn't really have good carrier signals.
[08:48.770 --> 08:54.630]  So depending upon that terrain, you can definitely go further distances because you have less attenuation.
[08:54.630 --> 08:58.310]  But also if you have a nice antenna, you're going to reach even further.
[08:58.430 --> 09:10.870]  Some of the cool things in the Chicago area, some folks have really powerful antennas and they're using regular power versus a battery for power, AC power or power line or whatever you want to call it.
[09:10.870 --> 09:12.790]  So you could see them beaconing out.
[09:12.790 --> 09:18.230]  And I'm going to show you some pictures of a guy in Iowa who could see some people in Chicago.
[09:19.190 --> 09:20.450]  Holy shit.
[09:21.010 --> 09:25.210]  But he can't transmit to them because he doesn't have the setup.
[09:25.450 --> 09:26.650]  So that's a big part of it.
[09:26.650 --> 09:27.850]  Like your rig.
[09:27.850 --> 09:30.470]  And to me, that's the other fun thing is building the rig.
[09:30.470 --> 09:36.930]  Like, you know, I've got a station and I worked with Johnny Christmas where he put one on the roof of his building.
[09:36.930 --> 09:38.290]  I got some fun photos of that.
[09:38.450 --> 09:44.110]  And, you know, so you want to build this network and all these different nodes could be a little different.
[09:44.190 --> 09:50.030]  And I think that's kind of the fun part is because it helps kind of broaden your experiences and you kind of get to learn more.
[09:50.410 --> 10:02.130]  But one really kind of cool thing, speaking about distance, the furthest recorded distance between two LORIN nodes using Meshtastic is 331 kilometers.
[10:02.130 --> 10:03.830]  Quick math, how many miles?
[10:04.930 --> 10:05.650]  Yes.
[10:05.650 --> 10:06.210]  Whatever.
[10:06.210 --> 10:07.550]  Nobody said anything.
[10:08.190 --> 10:09.210]  How much?
[10:09.390 --> 10:10.810]  It's not seven.
[10:11.410 --> 10:12.950]  It's like, yeah, more than seven.
[10:12.950 --> 10:13.830]  It's like over a hundred.
[10:13.870 --> 10:15.670]  But that's pretty damn far.
[10:17.030 --> 10:18.650]  So here's the architecture.
[10:20.370 --> 10:25.170]  Well, the two radios in the middle, they're just going to talk using LORA, long range radio.
[10:25.570 --> 10:31.250]  The other phones could be used either management through like BLE or Wi-Fi.
[10:31.370 --> 10:33.890]  So that's a great way you just fire up your app.
[10:33.890 --> 10:35.550]  You connect through Bluetooth.
[10:36.110 --> 10:41.910]  Usually the device could either have a hard-coded pin for your Bluetooth if you don't have a display.
[10:42.110 --> 10:44.230]  Otherwise, it'll just pick a random number.
[10:44.230 --> 10:44.730]  That's cool.
[10:44.730 --> 10:45.410]  We're used to that.
[10:45.410 --> 10:46.270]  That's easy.
[10:46.410 --> 10:52.790]  Once you get your device paired, you then can configure it.
[10:53.510 --> 10:57.890]  We're not going to go into all the configurations, but then you're going to want to also use the messaging app.
[10:57.890 --> 11:01.970]  You could send some messages, you can have the default primary channel.
[11:01.970 --> 11:06.030]  So basically here, anybody using it, they've just been kind of communicating with each other.
[11:06.730 --> 11:09.010]  Otherwise, you could create private channels.
[11:09.210 --> 11:10.570]  And the private channels are cool.
[11:10.570 --> 11:12.390]  We have one here, HackerComms.
[11:12.390 --> 11:20.730]  And as long as you know the key, you could get on that channel as well and talk to everybody at any hacker conference using Meshtastic with HackerComms.
[11:20.910 --> 11:22.150]  That's kind of cool.
[11:22.510 --> 11:23.890]  It's not really private.
[11:23.990 --> 11:25.610]  It's publicly available.
[11:25.610 --> 11:26.630]  Anybody can get on it.
[11:26.710 --> 11:28.290]  That might not be cool.
[11:29.370 --> 11:41.970]  The other piece is as the devices or the nodes talk to one another once they've subscribed to the mesh, the bottom one kind of talking to the PC or the laptop, that one, you could do a couple of things there.
[11:41.970 --> 11:45.790]  You can go direct serial with serial flash firmware.
[11:45.830 --> 12:01.030]  So either you put the device in DFU mode, or however the device receives the firmware, you just go to flasher.meshtastic.org, download the latest client, update the device, put whatever version.
[12:01.030 --> 12:10.350]  You could go alpha, YOLO, or you can go one of the more stable beta, kind of a contradiction in terms, but that's what they call them, stable beta.
[12:10.350 --> 12:12.370]  And for the most part, they've been pretty good.
[12:12.370 --> 12:16.930]  Once in a while, something wonky happens, but they've been actually pretty good about that.
[12:17.270 --> 12:23.250]  You can also manage your node using Wi-Fi, which is pretty cool.
[12:23.290 --> 12:28.410]  So then your device doesn't necessarily need to be within the Bluetooth range.
[12:28.410 --> 12:31.010]  And you could still manage and configure it.
[12:31.010 --> 12:48.810]  There's even a feature called remote admin, where you can use one device that you have direct connection to, and then using just some keys, the key exchange, like the typical PKI key exchange, but it's manual, you can then manage a remote device that's far,
[12:48.810 --> 12:57.030]  far away, as long as they could talk over LoRa, which I think is cool, because if it's on the top of a building and you can't always get there, that's convenient, right?
[12:57.030 --> 12:59.930]  You can just stand at the bottom of the building and manage it.
[13:02.110 --> 13:03.990]  So key features.
[13:07.890 --> 13:14.330]  Oh, there's a picture of Johnny and Jaku attaching a node on top of his building.
[13:15.070 --> 13:18.490]  So the mesh network is pretty much the primary feature.
[13:18.830 --> 13:25.170]  Just the different LoRa devices, they connect, they subscribe, and they're going to be just relaying the messages through the nodes.
[13:25.270 --> 13:28.110]  There's some other settings on controlling that, like hop counts.
[13:28.530 --> 13:34.330]  Usually, the default is three, and the recommended is usually not more than seven.
[13:34.550 --> 13:37.310]  But again, this is not a security tool.
[13:37.370 --> 13:44.930]  I was talking to somebody the other day, they said you can go in there, if you know how to modify the configuration the right way, you can go up to 99.
[13:45.690 --> 13:49.290]  Now, your message is going to be sent across the nodes.
[13:49.290 --> 13:53.290]  The nodes are not validating, do you have more than seven hops?
[13:53.290 --> 13:59.390]  It's just going to say, this is your hop value, minus one, rewrite the new value and send it off.
[13:59.390 --> 14:00.710]  There's no real control.
[14:00.710 --> 14:05.050]  So again, that might be fine, but if you want to flood the network, that ain't no good.
[14:05.130 --> 14:09.070]  So you can see there's some security concerns here.
[14:10.610 --> 14:21.910]  The other real main use case, so the mesh is the main primary feature, the feature that is used for the use case is the off-grid or off-network communication.
[14:21.910 --> 14:39.010]  So think like all the different like weather disasters and catastrophes that are happening in the south, like these folks have really no way to communicate, but if they had a mesh network set up, or something that's just somebody can get like an antenna,
[14:39.010 --> 14:52.810]  hopefully get some power, even battery, and then they can actually literally start communicating with these nodes and say, okay, go over here for water, we got food over here, anybody that needs first aid, go over there, and now people's lives could be potentially saved.
[14:52.810 --> 14:54.410]  I think that's a fantastic use case.
[14:54.430 --> 15:00.410]  The fun use case that when this got introduced to me was more like backpacking.
[15:00.410 --> 15:09.610]  So, you know, we're in the northern Midwest, you probably heard of the Porcupine Mountains, they're usually just like a little south of Lake Superior.
[15:09.790 --> 15:14.110]  I've been there, it's really cool, but you have no cell service.
[15:14.110 --> 15:26.810]  So if you're a bunch of different crews kind of going on different trails, well, there was one stretch of like five miles on our trail where we had no water, no clean water, so we had to make sure we rationed properly.
[15:27.170 --> 15:34.830]  But if somebody was like, hey, by the way, just go this way, you know, for a mile, there's clean water, great, you know, you could do that with Meshtastic.
[15:34.830 --> 15:38.890]  I think that's another fantastic use case, but everybody has to come prepared.
[15:39.430 --> 15:42.090]  And the battery, you might be thinking, well, what about battery life?
[15:42.450 --> 15:46.490]  This guy can go a good day or more, just using LoRa.
[15:46.610 --> 15:53.030]  If you use MQTT, which I'm not really going to get into, it's going to consume a lot more power, but that also needs internet.
[15:53.730 --> 15:55.950]  And this one goes, for some reason, two days.
[15:55.950 --> 16:03.730]  I think I put a bigger battery in here, because with the nice thing with the case, right, you can get a case that can handle a bigger battery if you want longer life.
[16:05.490 --> 16:12.870]  So yeah, low power consumption, another valuable feature of these devices, because then you can just kind of wander around for a few days.
[16:12.870 --> 16:23.270]  I guess if, you know, in a busy area, your battery will go down a little quicker, but if you're in an area where there's fewer nodes or out like in backcountry, you have a longer life.
[16:24.910 --> 16:28.490]  The project is also fully open sourced.
[16:28.670 --> 16:30.150]  So in some ways, that's cool, right?
[16:30.150 --> 16:47.430]  We all love open source, but now what if somebody takes the code, finds a vulnerability, is able to have their version of the firmware with a way to now take advantage of other people's devices over the lower radio to deliver their payload?
[16:47.750 --> 16:49.170]  Not so cool.
[16:49.170 --> 16:50.570]  How would they even know?
[16:50.570 --> 16:51.930]  They probably wouldn't.
[16:51.930 --> 16:53.430]  But what could they do?
[16:53.530 --> 16:54.030]  I don't know.
[16:54.030 --> 16:54.850]  I don't think like that.
[16:54.850 --> 16:59.310]  I'm not a bad guy-ish, but there are people that think like that.
[16:59.610 --> 17:01.250]  Oh, that reminds me of something.
[17:01.250 --> 17:05.070]  So each of these devices, the radio has like a MAC address.
[17:05.650 --> 17:12.910]  When you first fire it up, the last four digits of the MAC address is a part of the device name.
[17:13.170 --> 17:14.390]  You could change that.
[17:14.390 --> 17:31.210]  You can just completely eradicate it and replace it with something else, but there's also somebody wrote a script as a way to completely kind of change your MAC address, because there's been some rumors that these things are being used for people to do like terrorist activity,
[17:31.210 --> 17:32.830]  and it's traceable.
[17:33.170 --> 17:42.050]  So they're cleaning up the device's traceability so that they can go and do their bad things and communicate, not through traditional carrier methods.
[17:42.150 --> 17:47.570]  So again, we need more security people who can write good code to control this kind of stuff.
[17:49.790 --> 18:07.570]  Oh, um, the one on the left, if you're a ham radio, a licensed ham radio operator, you could put your call sign into your config, but you lose the ability to encrypt the communications, but you do gain more power if that's important to you.
[18:07.570 --> 18:12.790]  So that guy on the left is my ham radio one, which you can see is off.
[18:12.790 --> 18:14.290]  I don't use it that often.
[18:14.430 --> 18:17.450]  Use others, but, um, the one here that's on the roof.
[18:17.490 --> 18:27.670]  So when you saw Johnny kind of mounting, uh, that node, that's a solar node on top of his building near the California CTA stop in Chicago.
[18:27.670 --> 18:28.770]  And it's kind of cool, right?
[18:28.770 --> 18:31.330]  I mean, I got to tell you, I'm afraid of heights.
[18:31.330 --> 18:38.750]  I didn't, I couldn't go up the ladder, but, um, that, that mounting is reaching several people throughout the Chicago area.
[18:38.750 --> 18:44.870]  So when we're over visiting through like BIRBSEC East, we're able to hit that node because of that antenna.
[18:44.870 --> 18:46.170]  It's an eight DB antenna.
[18:46.450 --> 18:49.190]  The top picture is the inside of the box.
[18:50.010 --> 18:56.370]  And then the bottom is just like, you know, the fun stuff you could do with these things with the 3d printing and all that good stuff.
[18:57.490 --> 18:59.390]  So let me explain how Laura works.
[19:00.030 --> 19:14.510]  So on the left, you may have some desired use case, whether it's your track and your kitten, or, you know, is your garbage emptied and, you know, you need to bring it in the house, all that communication has to go through something.
[19:14.510 --> 19:21.390]  And in this case, if it's something that's like, um, not necessarily a mesh tastic node, it's got to go through some kind of gateway.
[19:21.390 --> 19:29.150]  You've heard of Laura WAN that usually goes through a gateway because it's got to go out to the internet and that WAN gateway is the enabler.
[19:29.510 --> 19:32.590]  And then you send your data off to some app somewhere, right?
[19:34.110 --> 19:44.250]  It's using the ISM radio bands, which is the industrial scientific and medical bands that are out there in the U S it's using a 915 megahertz.
[19:44.250 --> 19:46.230]  So I'm going to get a little technical, hope you enjoy it.
[19:46.230 --> 19:47.890]  A 915 megahertz.
[19:47.890 --> 19:52.170]  And in the EU, anybody know what the frequency is?
[19:53.510 --> 19:55.330]  I heard someone say, who cares?
[19:55.330 --> 19:56.250]  No.
[19:56.810 --> 20:02.050]  Um, 686 megahertz.
[20:02.650 --> 20:06.710]  At least this is using that and 433 megahertz.
[20:07.370 --> 20:08.750]  You didn't like that joke.
[20:08.750 --> 20:09.410]  Who cares?
[20:09.410 --> 20:09.910]  Okay.
[20:09.910 --> 20:11.030]  Any euros in here?
[20:11.030 --> 20:20.250]  The, the data rates are fairly low to like 0.09 kilobits up to 21.88 kilobits.
[20:20.250 --> 20:27.370]  So not very high speed, but for sending small messages, things like that, GPS information, it's, it's adequate.
[20:28.250 --> 20:33.770]  And it does have some encryption for the channels, but, and it's, it's not a lot.
[20:33.770 --> 20:39.910]  It's usually about one 28 bits, uh, up to 256 in some cases, but you have to set it at that.
[20:40.250 --> 20:43.990]  The, the primary channel, eight bits.
[20:43.990 --> 20:46.810]  And some people may say, well, who cares?
[20:46.810 --> 20:48.690]  It's the public channel.
[20:48.690 --> 20:50.170]  Anybody could go there.
[20:50.170 --> 20:51.970]  Then I say, why even use encryption?
[20:51.970 --> 20:52.850]  Who cares?
[20:52.850 --> 20:53.770]  It's eight bits.
[20:53.770 --> 20:55.390]  It's kind of, kind of weird.
[20:55.670 --> 20:58.730]  And, um, you use a PSK to join the mesh.
[20:59.630 --> 21:00.970]  So that's kind of Laura.
[21:00.970 --> 21:03.050]  Now let's look at the security stuff.
[21:03.310 --> 21:17.070]  So when first researching the idea of doing this talk, like who hates it when somebody goes out there and present something to you and somebody already did it three years ago and it's basically the same stuff.
[21:17.070 --> 21:18.010]  There's nothing new.
[21:18.010 --> 21:26.010]  I hate that they should do some of their homework, figure out what else has been done and maybe build on that preexisting knowledge.
[21:26.190 --> 21:30.110]  There was no preexisting knowledge when it came to mesh tastic.
[21:30.150 --> 21:38.610]  It's, it's relatively new, but the thing is there might be some people researching, but they haven't published anything.
[21:39.410 --> 21:45.190]  Um, so I kind of felt that drive where I needed to get out there and start talking about this.
[21:45.690 --> 21:49.470]  So some of these attacks, there's stuff we already know today.
[21:49.890 --> 21:52.010]  It's not anything really profound.
[21:52.770 --> 21:58.070]  We could go into great depth of why one would be a better attack than another.
[21:58.130 --> 22:08.490]  Why want that attack may be completely false, that it's not a real attack, but we'll, we'll save that for beer or something, some brats.
[22:08.490 --> 22:11.570]  And I also want to just focus on a couple of things here.
[22:11.810 --> 22:14.550]  Um, these are pretty simple, low hanging fruit.
[22:14.550 --> 22:17.970]  Almost, I think anybody can do them and should know about them.
[22:18.190 --> 22:31.010]  Specifically things related to physical access to the node, any information about yourself that you might be leaking, especially if you're one of those people that kind of want to have a small footprint and then just key management.
[22:33.170 --> 22:36.350]  So let's talk about physical attacks.
[22:36.870 --> 22:43.870]  So kind of referencing back to the solar node that's on, on the roof, there is a ladder you have to climb.
[22:43.870 --> 22:54.750]  There is a trap door and there is a lock and you need to have the key or be able to pick a lock while standing on a ladder and try not to fall off the ladder.
[22:55.730 --> 23:07.470]  I'm not that adept or I don't have that kind of dexterity, but if you have the key and let's just say in this building three people may have the key, one of those three may go up there and tamper with the device, right?
[23:07.730 --> 23:14.090]  And then who knows who did it really, because people are so always so genuinely honest these days.
[23:14.450 --> 23:30.630]  Um, so now you've got a physical access problem, but that's a small one, but what if it's your garbage can that you want some sensor data or what if it's something that you have in your environment because you, you manufacture things like drywall or sheetrock,
[23:30.630 --> 23:46.030]  you know, and you need to get some OT data to some other control system and you may have some stuff, but you want to try this new technology, it sounds pretty cool, but now somebody who may have physical access to this device could possibly tamper with it.
[23:46.030 --> 23:47.970]  So that becomes to me a bigger concern.
[23:48.670 --> 24:00.810]  And the one on the top left, I was having fun, had an old coffee cup and I didn't have a case, so I just mounted the antenna inside the hole in the lid of the coffee cup and it's like, here we go.
[24:00.910 --> 24:05.590]  And then, uh, uh, the LilyGo TECO is actually kind of cool.
[24:05.730 --> 24:09.970]  It's got a nice antenna and it's got that nice, um, e-paper display.
[24:09.970 --> 24:15.650]  So if you're looking for buying one, you know, I could make a recommendation on different ones, but I thought that one was a nice one.
[24:15.650 --> 24:20.650]  If you want to get into like a fancy node with some cool features, that's not too pricey.
[24:21.870 --> 24:24.430]  So back, I mean, continuing on physical security.
[24:24.430 --> 24:30.310]  So coworker of mine, he has this, uh, shed, he put his antenna up, he put his node up.
[24:30.770 --> 24:39.270]  And then when he saw how active the Chicago Meshtastic community is becoming, he kind of wanted to see if he could become a part of that.
[24:40.270 --> 24:44.550]  And, uh, cause you know, where he's in, in Des Moines, so, so, so, so busy.
[24:45.070 --> 24:49.950]  But, uh, I guess in, in Iowa, you can just walk down the street and there's a giant grain silo.
[24:50.030 --> 24:55.490]  So he climbed up that thing and fricking mounted the solar node.
[24:56.430 --> 24:59.450]  If you recall, I have archophobia.
[24:59.450 --> 25:02.850]  You could tell me there's a dozen delicious cookies up there.
[25:02.850 --> 25:04.390]  I ain't going up that fricking thing.
[25:06.090 --> 25:07.710]  They could stay there.
[25:07.930 --> 25:08.930]  Or maybe Mr.
[25:08.930 --> 25:10.630]  Wagner can get them for me.
[25:11.650 --> 25:18.870]  Uh, so the other kind of thing I felt was a bit of a concern cause I, you know, I like privacy.
[25:19.070 --> 25:20.050]  Who likes privacy?
[25:20.050 --> 25:21.470]  Who doesn't like privacy?
[25:22.070 --> 25:23.850]  You fucking, I knew you did.
[25:23.850 --> 25:25.090]  I knew you hated privacy.
[25:26.130 --> 25:28.230]  So look, look, look where everybody is.
[25:28.230 --> 25:34.570]  You know, whether you're going to go through your phone, it's going to reveal your location or whether the device has a built in GPS.
[25:35.110 --> 25:38.250]  We can kind of see where people were at some point in time.
[25:38.750 --> 25:41.970]  The middle one, and actually you can see it a little bit on the left one.
[25:43.050 --> 25:44.170]  There's Jaku.
[25:44.450 --> 25:49.270]  Do you see a tree that looks like it would be during a certain holiday in December?
[25:49.490 --> 25:51.550]  You could guess who that is.
[25:51.870 --> 25:56.430]  Um, so right there, you now know Jaku is on the mesh.
[25:56.430 --> 25:58.610]  You know some other people on the mesh.
[25:58.730 --> 25:59.970]  Somebody is a mushroom.
[25:59.970 --> 26:01.250]  Somebody is a ladybug.
[26:01.270 --> 26:05.730]  I think that's pretty clever, but you could also see these little dashed lines.
[26:05.730 --> 26:10.390]  So when I went downtown, I turned on the feature to show my route lines.
[26:10.770 --> 26:24.130]  And it literally, it's like, if you remember those family circus kind of cartoon where there's the kid in the playground, I got one head nodding, and you see like the dashed lines and the kid's talking to the mom, I'm bored, but yet he kind of went on everything and had a good old time.
[26:24.130 --> 26:25.450]  You could see what I did.
[26:26.010 --> 26:30.170]  Now that's my particular node, but let's go back to the modified firmware.
[26:30.190 --> 26:40.150]  Let's go to another paradigm where I might be some kind of, somebody like, I might be the CEO of a healthcare company or an insurance company, and you want to know where my location is.
[26:40.230 --> 26:48.350]  Well, that was a very evil, yes, Carl, very evil.
[26:48.850 --> 26:50.430]  And you're not evil Mog.
[26:51.310 --> 26:54.430]  So yeah, so let's create all these paradigms.
[26:54.430 --> 27:00.070]  If somebody really wants to go after somebody, they can, and they can see where they are at that moment in time.
[27:00.070 --> 27:06.050]  And it's usually, you know, the updates vary, but they're fairly real time.
[27:06.050 --> 27:08.630]  Like they may be maybe a hundred feet away from you.
[27:09.070 --> 27:13.450]  You could, yeah, the far right one shows my traversing.
[27:13.930 --> 27:16.570]  So big privacy concern, right?
[27:17.610 --> 27:19.330]  What do we do about it?
[27:19.330 --> 27:20.710]  Turn the GPS off.
[27:21.430 --> 27:23.330]  Seriously, that's my recommendation.
[27:23.970 --> 27:26.290]  Let's go into some of the keys.
[27:26.350 --> 27:34.850]  So in order to get on the mesh, you need the PSK to get on, like into the primary channel that I mentioned.
[27:34.850 --> 27:37.790]  There is some encryption between the nodes.
[27:37.790 --> 27:41.670]  It's fairly lightweight because remember, these are very small, low power devices.
[27:41.670 --> 27:45.750]  They can't really handle like heavy duty cryptologic algorithms.
[27:45.790 --> 28:08.130]  So I'm thinking like, if we want better keys, especially maybe to have something that's used in a more private or professional or say enterprise, why not integrate it with some kind of web-based or like some PKI that's just a quick API call or a URL.
[28:08.390 --> 28:09.730]  Hey, give me a new key.
[28:09.730 --> 28:14.030]  And this is while you're on your machine, setting it up, like on your computer.
[28:14.950 --> 28:19.570]  And then you pull down the key, but they also have the validation authority behind it.
[28:19.570 --> 28:23.990]  Maybe somebody said, you know, we're going to do key rotations, you know, or, hey, you know what?
[28:23.990 --> 28:25.690]  We found somebody was really problematic.
[28:26.110 --> 28:34.350]  We're going to rekey it, but we're only going to rekey it for certain people, or we're only going to make it available to certain people because we got to get the troublemakers off the network.
[28:34.510 --> 28:37.810]  Like that'd be pretty cool, but it doesn't exist.
[28:38.650 --> 28:42.730]  Some of these other things too is like, you guys know what ephemeral keys are?
[28:42.810 --> 28:53.630]  Maybe when you're just setting up your initial connection, have that ephemeral key created again outside of the main configuration software, but it comes down and then it's used.
[28:53.630 --> 28:57.610]  You connect, discard it, you don't need it anymore.
[28:58.770 --> 29:04.130]  Key rotation, it doesn't really exist unless you want to manually do it yourself.
[29:04.710 --> 29:07.710]  It should be forced, but again, not in there.
[29:07.770 --> 29:11.750]  And it should be periodic, and again, not in there.
[29:12.230 --> 29:14.470]  I kind of mentioned a little bit about the hardware platform.
[29:14.470 --> 29:20.170]  They're really not the most powerful systems for creating keys.
[29:20.170 --> 29:22.770]  So again, why not just do it on some other platform that is?
[29:22.770 --> 29:23.970]  There's tons of them out there.
[29:25.550 --> 29:29.550]  The other thing is, I noticed it's very usability focused.
[29:29.550 --> 29:34.530]  I mentioned before, this was written by IT people that wanted to kind of put something together that's fun.
[29:34.650 --> 29:37.430]  Not knocking them in any way if they're watching this.
[29:37.430 --> 29:43.030]  Very impressed upon what they did, but they need the help from a community like ours.
[29:43.110 --> 29:58.690]  They need to switch to having the usability as the primary reason for writing code and integrate more security controls that we've been trying to get people to do for years, and in some cases it works, and in other cases we just have to keep trying, right?
[29:59.050 --> 30:07.430]  The QR codes are a way to get into channels that you want to join, like the hacker comms I mentioned earlier, but that's shared publicly.
[30:07.430 --> 30:12.190]  You can go into the Discord server for CypherCon, and it's there.
[30:12.870 --> 30:14.470]  So what do we need to change it?
[30:14.470 --> 30:15.590]  How do we control that?
[30:15.590 --> 30:19.090]  Do we just create a new channel, lose all the history, plus everybody that joined it?
[30:19.210 --> 30:21.030]  Is that the right thing to do?
[30:23.170 --> 30:25.610]  And we just need to also educate the users.
[30:25.610 --> 30:34.710]  So people using Meshtastic, I strongly encourage you using it, but learn a little bit more about how to protect yourself with some of the things that I mentioned earlier.
[30:35.490 --> 30:37.530]  Now we're going to get into the sexy part.
[30:40.330 --> 30:42.950]  All credit for this ghost of ARX.
[30:43.090 --> 30:46.250]  Real name is Dan Beard.
[30:46.710 --> 30:49.490]  Not to dox him, he's fine with it.
[30:49.630 --> 30:50.990]  Let me explain how this works.
[30:50.990 --> 31:15.270]  Oh, this came about... he works in the medical industry protecting medical systems, and he proposed, I guess during tabletop exercises, he wasn't very clear about that, but what if somebody used Meshtastic as a way to gain access to their medical systems?
[31:15.390 --> 31:24.190]  Some people might think, well, yeah, you know, I got a little device, and it puts insulin in my body, but it only affects me.
[31:24.190 --> 31:25.230]  So what?
[31:25.350 --> 31:32.650]  No, I'm thinking like things that are doing heart and lung monitoring during critical surgery, right?
[31:32.650 --> 31:34.930]  And it's not just the one person on the table.
[31:34.930 --> 31:38.730]  It's those lives associated with that one person.
[31:38.730 --> 31:42.890]  It's the careers of the physicians performing the procedure.
[31:42.890 --> 31:44.230]  It's a ripple effect.
[31:44.550 --> 31:51.990]  So his point was people can get in using this, and somebody said, it's not possible.
[31:52.490 --> 31:55.390]  Oops, wrong thing to say to a hacker.
[31:57.750 --> 31:59.950]  So the architecture is pretty straightforward.
[31:59.950 --> 32:04.850]  If you look at the laptop, it's got that gigantic bad USB plugged into it.
[32:04.850 --> 32:06.470]  That is a Liligo T-dongle.
[32:07.070 --> 32:13.190]  You could get one from Shenzhen off of like AliExpress for about $10.
[32:13.630 --> 32:22.010]  In the US, it's $200 today, or maybe $20, but they're kind of harder to get.
[32:22.010 --> 32:22.870]  He has some.
[32:22.870 --> 32:25.670]  He was actually given away to some people, which I thought was really nice.
[32:25.670 --> 32:27.510]  He gave me the one that I have.
[32:27.750 --> 32:28.430]  Nice guy.
[32:31.130 --> 32:36.030]  He's using the Arduino IDE, and that code just kind of sits there on the device.
[32:36.030 --> 32:38.530]  Once you plug it in, the code executes.
[32:38.530 --> 32:41.910]  And it just kind of sits there dormantly waiting for you.
[32:41.910 --> 32:49.790]  Now granted, you don't want a USB device that's clear, and the display is a skull with its mouth going like this.
[32:49.930 --> 32:54.090]  You might kind of give away what your intent are if you're doing pen testing.
[32:54.290 --> 32:56.750]  Maybe go with something with an opaque case.
[32:56.750 --> 32:58.290]  I think that'd be a good move.
[32:58.730 --> 33:04.330]  The bad USB is also an access point.
[33:04.330 --> 33:10.630]  So it's pre-configured with the SSID and the PSK and the LoRa device.
[33:10.630 --> 33:11.990]  So it takes two nodes.
[33:12.290 --> 33:16.050]  Actually, this is my victim one right here.
[33:16.070 --> 33:18.350]  This is managed by Wi-Fi.
[33:18.350 --> 33:23.130]  So when this fires up, it's going to connect to the bad USB over Wi-Fi.
[33:23.130 --> 33:31.170]  Now the bad USB is going to go back and forth communicating with this device over communications channel, which is pretty cool.
[33:31.610 --> 33:34.510]  The other device would be my device.
[33:34.510 --> 33:36.850]  It could be this one.
[33:36.850 --> 33:41.310]  And this one is being managed by BLE and my smartphone.
[33:41.410 --> 33:45.510]  So I'll sit on my phone, and I could type commands.
[33:45.550 --> 33:51.270]  Keep in mind the range that I told you before how far LoRa can go.
[33:51.790 --> 33:54.270]  Be miles, seven miles.
[33:54.270 --> 34:02.570]  You could be miles and miles away again, depending upon your terrain, actually getting into somebody's environment and taking over a PC.
[34:02.990 --> 34:05.270]  You might not even be in the same zip code.
[34:05.350 --> 34:06.830]  That's pretty cool shit.
[34:07.710 --> 34:09.330]  Now let's see how it works.
[34:11.070 --> 34:15.470]  So to kind of set the stage, this is not my computer.
[34:15.930 --> 34:17.690]  It's my youngest kid's computer.
[34:17.690 --> 34:18.550]  He's a teenager.
[34:18.550 --> 34:19.750]  He's 13.
[34:20.110 --> 34:24.630]  And I wanted to use his computer because his is kind of like the most vanilla.
[34:24.750 --> 34:29.750]  It does have some security controls, and it was kind of messing with me when I was running PowerShell.
[34:29.750 --> 34:34.390]  But for the most part, everything kind of seemed to work just with a generic system.
[34:34.850 --> 34:37.850]  On the left, that is my phone.
[34:38.050 --> 34:38.710]  All right?
[34:38.710 --> 34:47.370]  Just using some app to just paint the screens up, and so you could see what I'm doing on my phone, and then you could see what happens on his computer.
[34:47.610 --> 34:50.350]  They are not connected.
[34:50.350 --> 34:53.910]  The only thing bringing them together is Meshtastic.
[34:54.310 --> 35:11.750]  What you're looking at in the Meshtastic app, the primary channel that I mentioned before, there's a Wi-Fi chat, which is just something that was there being used during his testing, and then the last one is the RadioJack actual channel where the command and control goes and where I'm going to interact with it.
[35:14.840 --> 35:18.280]  So we went into the RadioJack channel.
[35:18.820 --> 35:23.860]  I'm going to type the menu command, so you could see the different commands that are coming up.
[35:23.940 --> 35:25.760]  So those are your different options.
[35:26.320 --> 35:31.700]  You drop the payload, so the payload is a PowerShell script that's going to execute on the PC.
[35:32.520 --> 35:36.400]  Once we've gotten that, we get feedback, which is great, so we know things are happening.
[35:36.700 --> 35:39.620]  So now let's try a quick command like an echo command.
[35:39.620 --> 35:47.060]  So the echo command sent, but we're going to get the menu back and not actually something like echo hello world.
[35:47.380 --> 35:52.780]  I didn't establish a serial connection, so that's a great way to test if you have a serial connection or something working.
[35:52.780 --> 36:04.300]  Now that we have a serial connection, I'm going to paste in the echo command and then the response back will be echo hello world and my son's home directory.
[36:05.200 --> 36:07.200]  So let's just see if we can launch something.
[36:07.820 --> 36:08.960]  Let's run a command.
[36:09.680 --> 36:11.300]  Okay, great.
[36:11.380 --> 36:13.500]  We're executing applications.
[36:13.780 --> 36:16.060]  Let's try something a little bit more dangerous.
[36:20.060 --> 36:22.840]  All right, so we got notepad running.
[36:22.840 --> 36:24.500]  Well, we could put some commands in there.
[36:24.500 --> 36:28.960]  We can type some keyboard commands, but Varks also has a sense of humor.
[36:29.000 --> 36:35.560]  He named his tool RadioJack, but to disable it, it's RadioJack off.
[36:36.540 --> 36:37.800]  Funny guy.
[36:38.260 --> 36:40.900]  So now we're going to flip to the keyboard command
[36:48.100 --> 36:54.360]  so now we can actually start to send keystroke commands remotely to that machine using LoRa and Meshtastic.
[36:54.700 --> 37:03.520]  Now, it's not going to work because while I was recording this, I accidentally clicked off of notepad and it was no longer in focus.
[37:03.740 --> 37:08.040]  Something that you wouldn't do because you would not physically be at the keyboard.
[37:08.600 --> 37:12.780]  Also, you can notice that little message underneath every command that says acknowledged.
[37:12.780 --> 37:21.200]  When you are sending between the devices, it's going to make an attempt to send your packets or your payload from one LoRa device to the other.
[37:21.200 --> 37:22.920]  And if it's successful, you get acknowledged.
[37:22.920 --> 37:25.580]  Otherwise, you get an error, you know, to retry again.
[37:26.400 --> 37:28.880]  So there's the keyboard commands and we're done.
[37:28.940 --> 37:42.020]  Now, you know, this can be used for dropping malware or if you've got some byte code that you want to put on there to kind of start a service or be creative, you know, open up Outlook and send a message to everybody.
[37:42.720 --> 37:45.940]  Like, it's really that easy.
[37:46.020 --> 37:48.060]  So hope you enjoyed it.
[37:49.180 --> 37:51.220]  Let's get into some best practices.
[37:53.660 --> 38:01.600]  So kind of just quick review of what the potential security issues are and what can we do to stop them.
[38:02.080 --> 38:07.780]  Again, can't stand those talks where somebody goes, well, here's a problem, have a nice day, good luck figuring it out.
[38:07.780 --> 38:10.040]  Let's kind of talk about some possible solutions.
[38:10.040 --> 38:16.700]  So physical issues, we'll secure them, use tamper evident devices, cameras, I think we know this stuff, right?
[38:16.700 --> 38:20.200]  Just whatever you got to do to secure a physical device, you should be doing.
[38:21.560 --> 38:27.280]  Let's work with using stronger encryption, even on public channels, why not?
[38:27.580 --> 38:31.580]  Just always good if it can handle it, if it can process it, let's just do that.
[38:31.600 --> 38:43.860]  And if the tool does not support stronger levels of encryption, put in a feature request, get them to do it or go to the, I mean, it's open source, go to the GitHub and open an issue.
[38:43.860 --> 38:49.820]  Hey, I need you guys to start doing AES-256 when you're creating your keys for your communications.
[38:49.980 --> 38:53.200]  It's something that we've been doing a long time.
[38:54.960 --> 39:11.000]  Let's start enforcing rotations and maybe keeping some keys private because, you know, if you got to have like a hacker comms channel and somebody wants to get in there, they may not have the same intentions that we have, like, hey, good morning, I could use some coffee,
[39:11.000 --> 39:13.100]  shut the hell up, let's go to the event.
[39:13.100 --> 39:18.880]  No, they might actually be trying to figure out who are people on the mesh and how they could do something to them.
[39:18.880 --> 39:22.580]  So maybe let's come up with a better way to kind of keep these things a little bit more private.
[39:24.260 --> 39:27.000]  Avoid using GPS if you can.
[39:27.160 --> 39:28.420]  When would you want to use it?
[39:29.460 --> 39:44.200]  When you have a real need, say you're trapped in a building and somebody needs to find you or, you know, it's a mass emergency situation or you just happen to be backpacking in the Porky Mountains and you need to find water and you got another crew somewhere else.
[39:44.380 --> 39:47.340]  But then when you're done, turn it off.
[39:47.380 --> 39:49.520]  You don't need to keep it running all the time.
[39:51.680 --> 40:04.040]  In your network, in your environment, like one of the things I was talking to Varks and some other people who do purple teaming was how can we control this radio jack attack?
[40:04.280 --> 40:06.440]  So only two kinds of things we came up with.
[40:06.440 --> 40:10.200]  One is using whips, so something like an air marshal.
[40:10.480 --> 40:15.720]  When that device is found on your network, it's stopped from being able to communicate with anything.
[40:16.500 --> 40:27.640]  Or some kind of endpoint device control where, you know, you might not know what kind of device that's going to be used to be plugged into your system, but you could just say, hey, you know, we're going to block everything.
[40:28.380 --> 40:37.240]  And the only, the admins can then open it up and use something when they're physically there, if they have to do recovery or forensics acquisition or whatever the reason may be.
[40:37.620 --> 40:42.800]  Or, you know what, if you got a reason to use a USB stick, here's the one you can use.
[40:42.800 --> 40:47.960]  And it's something that is pretty ubiquitous and something that can't be used like a bad USB.
[40:50.420 --> 40:52.340]  Keep your firmware up to date.
[40:52.980 --> 41:08.400]  So if somebody does do something in that one other kind of example where they mess with your firmware, as long as you're patching and overwriting it, you potentially, and again, depends upon that vulnerability, but you could potentially then just overwrite whatever they did and kind of put yourself back into a safe state.
[41:08.400 --> 41:09.360]  But we know that, right?
[41:09.360 --> 41:10.620]  We've been patching for years.
[41:10.640 --> 41:12.160]  Does it really help?
[41:15.800 --> 41:17.680]  Yeah, that's the answer I got.
[41:17.760 --> 41:18.540]  No?
[41:21.300 --> 41:22.580]  There's always more, right?
[41:22.580 --> 41:25.300]  It's against that one vulnerability and there's always more.
[41:26.380 --> 41:28.420]  And then I already said this one.
[41:30.140 --> 41:31.520]  Here's my big asks.
[41:31.520 --> 41:33.020]  I started this earlier.
[41:33.180 --> 41:34.280]  Support the mesh.
[41:34.280 --> 41:35.580]  What does that mean?
[41:35.700 --> 41:42.540]  Get a node, get familiar with how it works, learn how to use the tool and go as nuts as you want to go with it.
[41:42.540 --> 41:46.060]  If you just want to have a node just be like, I'm curious how this works.
[41:46.060 --> 41:49.700]  I want to play with this because I'm a curious technophile .
[41:49.700 --> 41:50.480]  Cool.
[41:50.480 --> 42:05.840]  But if you have the ability to write code, like good quality security code or secure code, excuse me, you should participate in the open source project to add some of those features that we've talked about because we need more people doing that.
[42:07.000 --> 42:12.740]  Two, if you, again, are somebody that does code review, just vet the code.
[42:12.740 --> 42:19.020]  I'm not asking you to write code, but at least if you could vet the code and say, um, you see this little area right here?
[42:19.020 --> 42:27.280]  Yeah, that could be like a buffer overflow or here's a way that somebody can then do some kind of impersonation or whatever.
[42:28.160 --> 42:29.340]  Tell them to fix it.
[42:29.340 --> 42:30.400]  Open up a case.
[42:30.480 --> 42:32.720]  Or they may say, we don't know how to fix that.
[42:32.720 --> 42:33.620]  You know anyone?
[42:33.620 --> 42:35.600]  You say, yeah, Steve McGrath.
[42:37.300 --> 42:38.560]  I love you.
[42:39.200 --> 42:41.400]  Um, and then just stay safe out there.
[42:41.400 --> 42:41.780]  Right?
[42:41.820 --> 42:44.480]  We know the best practices and I get it.
[42:44.500 --> 42:48.180]  Sometimes we just get a little lazy, but we really should not be.
[42:48.180 --> 42:49.620]  So just stay safe out there.
[42:49.820 --> 42:58.280]  Do all the best practices we've all learned how to do and just, again, avoid being in a bad situation.
[42:58.280 --> 42:59.460]  Here's some resources.
[42:59.460 --> 43:01.120]  Feel free to take a picture of that.
[43:01.200 --> 43:08.600]  This can get you not only started with Meshtastic, there's also a lot of real great information to get you a lot smarter with Meshtastic.
[43:08.960 --> 43:09.980]  Thank you.
[43:10.500 --> 43:12.320]  Oh, we have time for questions.
[43:12.320 --> 43:13.260]  Oh, sorry.
[43:13.260 --> 43:14.200]  I shut you down.
[43:16.060 --> 43:17.060]  Thanks, Phil.
[43:21.660 --> 43:22.460]  Yes, sir.
[43:27.470 --> 43:27.990]  I'm sorry.
[43:27.990 --> 43:29.650]  We've run out of time for questions.
[43:30.750 --> 43:31.370]  Uh, yeah.
[43:31.370 --> 43:33.050]  I'm not going to throw it up on here.
[43:33.050 --> 43:35.110]  I've got it in like Evernote, but I'm happy to share it.
[43:35.110 --> 43:38.770]  So if you want to meet me outside and give me your, your info, I can give it to you.
[43:38.770 --> 43:39.250]  Yes.
[43:39.370 --> 43:40.370]  Gentleman in the back.
[43:42.330 --> 43:42.890]  No.
[43:43.630 --> 43:44.890]  He asked if I'd put it on my GitHub.
[43:44.890 --> 43:45.730]  I said, no.
[43:46.130 --> 43:47.390]  Eric, is that Eric?
[43:47.390 --> 43:48.090]  No, that's not Eric.
[43:48.090 --> 43:48.590]  You raise your hand.
[43:48.590 --> 43:48.810]  Sorry.
[43:48.810 --> 43:49.570]  I'm now blind.
[43:49.570 --> 43:50.910]  I can't really see very well.
[44:05.140 --> 44:05.720]  No.
[44:05.720 --> 44:07.300]  So, um, are you a ham?
[44:07.580 --> 44:08.180]  Yeah.
[44:08.180 --> 44:08.500]  So right.
[44:08.500 --> 44:11.060]  We're not allowed to encrypt our communications.
[44:11.260 --> 44:15.600]  Um, that does not necessarily mean we cannot receive encrypted communications, right?
[44:15.780 --> 44:19.280]  So if you do receive encrypted communications, that is beyond your control.
[44:19.840 --> 44:24.040]  But the way the tool works is if you do receive, it's going to decrypt it for you.
[44:24.040 --> 44:30.800]  And then you can then reply, but your reply will be in plain text, which I was actually working on a PO before Varks.
[44:30.800 --> 44:33.160]  I was working on a POC using a flipper zero.
[44:33.420 --> 44:41.920]  And there's some folks in Mexico called electronic cats that made an add on to the flipper zero that sniffs Laura traffic.
[44:42.160 --> 44:43.900]  And I was trying to get it to work.
[44:43.900 --> 44:44.400]  Yeah.
[44:44.400 --> 44:54.420]  Trying to get it to work with, um, mesh tastic, but they only had, um, support for like a certain Laura chip that none of the devices I have used.
[44:54.420 --> 44:58.560]  So they're now working on ESP 32 development, which is more like this guy here.
[44:58.700 --> 45:01.680]  So I'm like really excited because I want to help them get it to work.
[45:01.680 --> 45:07.720]  But if we could start sniffing the plain text traffic, me, you know, Oh, well, hammies, um, question.
[45:28.800 --> 45:30.000]  Well, you're, you're okay.
[45:30.000 --> 45:32.160]  So you're configuring your power to be your power.
[45:32.160 --> 45:36.000]  So whatever they're transmitting at, you really don't have any control over that.
[45:36.000 --> 45:42.960]  But if they're sending something to you and you're like just routing it for them, that's not a violation of your license.
[45:42.960 --> 45:45.100]  Cause you're not originating the message.
[45:46.620 --> 45:47.300]  Oh, it is.
[45:47.300 --> 45:52.360]  Even if you're relaying, Oh, what the fuck do I know?
[45:52.780 --> 45:54.240]  Um, okay.
[45:54.240 --> 46:01.900]  I, if I, I understood if you were just using it as like a router or just passing, well, if you're a router, I think that's a little different, but if you're these devices automatically forward.
[46:02.680 --> 46:03.100]  Yeah.
[46:03.100 --> 46:05.060]  But not as a router, I think as a router.
[46:05.060 --> 46:05.660]  Yes.
[46:05.660 --> 46:06.200]  Yeah.
[46:10.670 --> 46:16.270]  So then you're, so if you receive an encrypted message and you forward it, you're you won't get it.
[46:16.610 --> 46:17.410]  Okay.
[46:17.790 --> 46:18.270]  All right.
[46:18.270 --> 46:18.610]  There we go.
[46:18.610 --> 46:20.210]  He said, you're not going to get it at all.
[46:20.210 --> 46:20.330]  All right.
[46:20.330 --> 46:21.710]  We got a question way in the back.
[46:21.710 --> 46:23.010]  Project your voice, please.
[46:28.280 --> 46:31.040]  This one or the one that was 3d printed case.
[46:35.260 --> 46:40.640]  Oh, um, it's just a regular health tech, um, like a V3 or B V3.
[46:40.640 --> 46:41.440]  Yeah.
[46:45.710 --> 46:46.310]  Yeah.
[46:46.310 --> 46:52.370]  Any one of these devices I've been showing you have Laura on them, but not Laura Wan, but there are some that will do purpose.
[46:52.770 --> 46:54.390]  We're just talking Laura.
[46:58.710 --> 46:59.430]  Yeah.
[46:59.430 --> 47:00.350]  Okay.
[47:13.840 --> 47:15.660]  This is called a nerd fight.
[47:17.060 --> 47:18.200]  Any other questions?
[47:18.200 --> 47:20.240]  Uh, we're good on time or no.
[47:20.740 --> 47:31.220]  Larry, I got some five minutes more on questions, but, uh, it was the worst grown ever.
[47:32.120 --> 47:33.100]  All right, cool.
[47:33.100 --> 47:33.720]  Thanks guys.
[47:33.720 --> 47:34.640]  See you later.
[47:37.120 --> 47:39.140]  Well, fuck you, Phil.
[47:39.140 --> 47:40.260]  Fuck you.