Tip:
Highlight text to annotate it
X
Hi Everybody, first time talk and I always thought that my first talk would be on some amazing bug they found, but all
my bus are under MDA unfortunately, so I'm here to talk about something else that I discovered
not even working if info sec, but it stuck with me for several years and now we're here
to talk about its security implications. And how many of you were at the talk with Jen
Savage talked about having a toy bunny that's a webcam? That reminded me of something that
happened when I was 6 or 7 years old. My father had gotten a radio scanner for listening to
the emergency radio, the police and the fire and he was messing around with it and he accidently
tuned in to something that was not the police or at least you hope it wasn't the police
because it was a woman screaming for mercy and a man threatening to kill her. He had
tuned into a baby monitor and he called the cops and they came and they saved her and
there was a happy ending. [APPLAUSE]
The thing is a baby monitor is an intentional emission. It's really easy to forget that
it's broadcasting to the entire neighborhood. I bet you a dollar that man never thought
for a moment that was a bug broadcasting to that neighborhood in the room as he threatened
to kill his wife. It's a good thing he didn't remember that. But it's a good thing for all
of us to remember in general. So we are here to talk about unintentional radio emissions.
The one that it doesn't say on the box it is doing. And the spoiler alert? Every device
that you own is screaming its name into the infinite void on the magical waves. And the
whole slide show doesn't have an animated background. I promise. My name is Melissa.
I do binary analysis. I'm accused of destroying info sec because I bring too much pink and
glitter. I don't have pink hair in real life. Some people have told me should remedy this.
So what are we actually talking about? We're talking about how you without about formal
training or expensive equipment can learn how to check what sort of noise your devices
are generating. Radio emissions, they're magic. If you actually need to know how they work,
talk to a physicist. I'm an engineer. But all of your electronics are naturally generating
them. They're everywhere. They are filling the air. There are people who believe that
science. Fortunately, we have an area in West Virginia reserved for them. There's no cell
phone towers and no FM music stations. There is nothing. It's a horrible place for a teenage
girl to be. That's where I went to learn about radio astronomy. I will talk about that later.
48 hours straight with no access to the internet at all. And these are the devices we're going
to be using. You can get these for as little as $10 and yes it runs on Linux and yes it
runs on raspberry pie. There are radios that have a wide tuning range and dump the raw
signal to software processing so you can process it. You really don't need ton anything about
radio engineering. I had become a radio engineering script kitty. It's like wow. I don't anything ‑‑
well, I know a little bit about radio science. But you have ten bucks and you want to order
from China if you're not ‑‑ you have 20 bucks. There are python bindings. I wrote
a script that's really easy and anyone with basic technical knowledge can get into it.
The chip set they would recommend is called the RTL 2832 U. And they are mass produced
forward tuning into television and various countries, which is why they have such a broad
tuning range. They have no intelligence on the chip, which is why they're $10. And if
there's anyone who has a problem with the word radio dongel, I am sorry I am going to
be saying dongel several times. [APPLAUSE]
These what are they look like on the inside. They're very simple. They're very easy to
fry. May my first one rest in peace. It met its demise when I plugged it in. So there are different models and they
have different ranges, but on general, they go from around 50, 60 megahertz all the way
up to 2.2 gigahertz. So, this is a huge range and a huge value for a $10 radio. A couple
of years ago, it would not have been accessible with quite an investment. You can bulk order
them from ally express. It's a little bit shady, but I have gotten all my packages so
far. They have a pal female connector, by the way, not very common in the states, but
your Radio Shack should carry connectors and plug in bunny ears like grandma used to have.
And why do we care? I think the MSA might care. You heard of tempest? That's real. They've
been doing this for decades. This is courtesy one Mr. Snowden. It says communications and
other information that's not communication such as equipment emanations. Maybe they have
a secret meaning, but I think that sounds like radio emissions of devices. Sounds like
they're storing them. If anyone in the MSA would like to tell me different, I would be glad
to discuss that with them. >> [INAUDIBLE]
>> MELISSA ELLIOTT: Another common misconception is that tempest only applies to CRT. The first
example of tempest was a tele‑typewriter. A typewriter that could recover the letters
that was being where I went from across the street. You can still do this. In 2009, I
can not pronounce French names. Please forgive me. They released a paper eavesdropping on
normal USB keyboards getting full plain text recovery from across the office building.
So, this is real. This is an actual problem. It's not purely theoretical. And you deserve
to know that. You deserve to be able to evaluate your devices for how susceptible they are
to it and this is a lot of fun for $10. And you probably aren't break anything laws, maybe.
So about that, there are a lot of laws about radio tuners. They vary from place to place.
They are basically arbitrary limitations on certain frequencies if you want to check them
out. Just tuning in to things that is mostly passive and mostly difficult to detect. You
want to check out the slides goes to graduate students detecting passive tuners. So they're
not entirely passive at all. But play it safe. Obey all laws. For example, one that applies
here in America, scanning receivers and frequency converters marked for use with scanning receivers
shall be incapable. And it goes on to say do not tune into areas reserved for cell phones
unless you are an actual cell phone. So don't do this. Do not type the number 824 and hit
enter. >> You have a lot of fans. So wind it's your
first time speak at DEF CON. >> MELISSA ELLIOTT: This is true.
>> How would you like your Jack Daniels? >> MELISSA ELLIOTT: I'm afraid I cannot drink,
sir. >> Is your husband in the audience?
>> MELISSA ELLIOTT: Right there. >> Do you drink, sir?
>> Yes, I do. >> Get your butt up here then. Has he been
to DEF CON before? >> MELISSA ELLIOTT: No.
>> Your first DEF CON? >> Yes.
>> You have to do a double because you're both ‑‑
>> Oh, that's fine. [Laughter]
[APPLAUSE] >> By the way, we have decided to brand this
little exercise. You heard of spot the fed. This is shot the n00b. There will be t‑shirts
next year. To everybody that's new at DEF CON, cheers.
>> Cheers. [APPLAUSE]
>> Have a nice talk. >> MELISSA ELLIOTT: Thank you, sir. I was
afraid I was going to get van there for a second. I swear that's just as gift. I drew
it by hand. I never actually typed that number in. But no one's ever gone to jail for incrementing
an integer. We're safe. So, I manage to go most of my life not knowing that all my electronics
were leaking all of the signal that details what they're getting up to in their private
electronic lives. The reason I found out is because I went to play with this.
[APPLAUSE] [Cheering]
This is the green bank telescope. It is considered the largest mobile object in the world. Ships
don't count because they get to float. It is the size of a football field that tilts
from horizon. They use it to listen to outer space. So they only let me play with the 40‑foot
dish, but I bet none of you have a 40‑foot dish.Y is what I learned while I was there
is their biggest challenge to gettings science done is the very electronics that they need
to measure and process the signal because those same electronics blast the signal out
of the sky. Just to give you an idea, they had to get a special budget approval to have
a micro wave oven. They have a microwave oven. Inside another faraday cage and inside the
room, another faraday cage. That's how much they had to shield things to heat up their
pizza at 2:00 a.m. I was with a girl who had a panic attack because it feels like you're
being locked away forever. You go in and there's another door and you are sealed in this copper
room. Everything is self‑contained and then, yeah. I couldn't blame her. And speaking of
noisy electronics, I have brought my little friend. If you follow me on Twitter, you might
have seen it before. This is the $50 network from China which I caught on fire. We will
not discuss how it caught fire. It's not relevant. However, what's relevant is that it has no
shielding. I'm pretty sure this violates FCC from rule 1 to the last. They have a conniption
if they knew I imported it. This is the part where we get to the live demo. And in the
front row, he's not going to turn on his hack RF. So I'm going to tune to an FM radio station.
Let's see what's here in Vegas. I don't want that too loud on you. So that's what music
looks like. I have no idea what I just tuned into. [ Music ] oh, no. What are those blue
lines? So, do you see those little spikes that weren't there like a minute ago? I was
afraid that the contrast might not be very good, but there are lots of spikes that weren't
there until I turned this on. And ‑‑ there. How's that? Those, if you zoom in,
there's lots of natural jitter, but they are between 32 and 33 kilohertz apart. Does anyone
know about anything that has a clock speed about a natural clock. So a natural clock ‑‑
sorry. A realtime clock has a freak wins usually of about 32.7 68. I had to screen shot all
of this because I was convinced I was going to set it on fire again, which didn't happen.
I am afraid the charger isn't working anymore as of an hour ago when I plugged it into a
strip I found lying around at DEF CON. So this may be the terrible laptops last stand.
So there's [INAUDIBLE] and not dancing around. So the realtime clock that's probably what
I'm picking up and it just blasts its existence all over my radio FM radio stations. So okay.
It has a realtime clock. That's amazing. Everything does. How about something a little more interesting.
How do you look for interesting things your electronics are giving off? It's mostly guess
work. And a good place to start is by randomly multiplying numbers together, which worked
out really well. So, the screen on this little thing is a stunning 800 by 480. Pixels, they're
three bytes, 24 bits per pixel. They're being given a ribbon cable inside. If you add all
those numbers up, you get about nine megahertz. That's a little bit below what my radio can
tune into and there's another factor and that's the refresh rate. I don't actually know the
things refresh rate. It does not report the refresh rate. It is pirated. But I haven't
seen an LCD lower than 75. That gives a range of 150 megahertz to SIFT through. There are
several places I can pick up the signal, but I will show you the one that I think is best.
Does that look like something? I'm logging in. I'm sure it's really secure. Oh, did it
change? You will have to trust me. It was a very bland log in screen and now it has
a very lovely Pokeymon wallpaper. You will see the color change because I have a very,
very small antenna. It's the free one that came with my radio.
So, ah, I'm sure the people you actually need to worry about do not have the free 4‑inch
antenna that came with their $10 radio. I think I will go to some word processing. And
the signal went actually very flat. It's mostly gone. I will go to pirate PowerPoint. So,
thank you. I do have other antennas. [Laughter]
You gave me a loose connector. All the pal female connectors don't stay together. Good
enough. But I have the word processor open. It's not very exciting. Mostly white screen.
And this thing is slow as heck. So office presentations. Yes, I would like to restore
this. I may have cut the power. And, gee, that looks different. I have a nice checkerboard
affect going on my Powerpoint. It goes ah way and the presentation. You cheated me.
So the touch pad on this thing is very treacherous, so treacherous it ruined one of my demos.
I found a frequencies that when you touch the touch bad, you hear buzz, buzz, buzz.
I come here to Las Vegas and it's gone. I have no idea. I will talk it up to it being
so dry. That's what seems to be the excuse for everything. So now the full screen has
a checkerboard pattern and my signal has broken down to very discrete lines. Now, you can
recover the screen from this? I'm pretty sure you K. unfortunately, my radio sample rate
is not very high. But again, I have a $10 radio. So there's my back up. What we're seeing
is the signal transitions on the cable that feeds the screen. I took this to one of my
engineer co‑workers at home. You say how would you explain there? Oh, you're seeing
when you get zeros and ones. That's why when the signal is sail one color, your signal
goes away especially like black, it is zero, zero, zero, zero, zero. Very exciting. So
very specific patterns will create very noticeable signal patterns. It is there when the screen
is off as long as the security is off because I'm reading the cable that runs into the LCD.
Does that look like a checkerboard? I think it looks like a checkerboard. So that was
the best I could manage with my toy radio. Wrote a python script, wrote out to their
clotting API. Maybe I'm doing it all wrong. So if the [INAUDIBLE] would like to file a
request for their alga rhythms of reconstructing screens, I'm sure they figured all this out.
So as I said, it's not just screens. It's ‑‑ I picked up touch screen capacitive fields,
which they decided to stop working in vision. As you can pick up buttons like the keyboards
that the gentlemen were scanning earlier. The color of lights. So you have green light,
red light on your secret machine that's locked away. Yeah. I don't do that. Micro phones
obviously especially wireless ones, ah, [INAUDIBLE] at the source box in conference. I was running
around recording people from across the building and then surprising them. You weren't in my
talk. How did you get that? You can sometimes 56 up RAM. So when I figured out I could see
RAM, I hooked the antenna around my neck and went around the office. Popped into offices
with all this equipment hanging off my neck and said excuse me, sir. You can tell me what model book that is? Be like thank
you. What is she doing. Basically you can pick up everything to some extent. So like
this tablet that I'm presenting on, it has 1600 megahertz RAM and I couldn't find it
at 1600 megahertz and then I found it at 800 megahertz and I thought maybe that's because
it is dual channel. I've had people explain what that means. I had I think 2003 was the
last time I actually put RAM into a computer. All of the ones I bought since then have been
tablets. I know, right? So this one is interesting because I don't actually know what's being
picked up. This is my Mac book error opening Chrome from which it hasn't already been owned
and has in RAM. I get the very interesting sports from across the room. Sports being
the technical term. So across the room with my little 4‑inch antenna I can pick it up
that it was open in Chrome. It must be the processor and I ran a benchmark distressed
test in the processor. It must be the hard drive loading all the cache files. So I don't
actually know what's causing it. But it's there. This is a like phone. I don't remember
who this is T. might be in this test now. But this was someone talking at source Boston.
When I say there was informed consent, I mean everyone knew I was up to something.
[Laughter] I maintained I was not violating Massachusetts
wiretapping laws. When I accidently tuned into the Blue Man Group, that was an accident.
This is my iPhone when I'm connecting to Twitter. I was able to find this tell tale signal.
The network here is really unstable. A few megahertz up from my phone. I turned off the
wireless. It is 3G. Connect to Twitter and then for exactly the duration that little
spinning icon was on my phone, this was on the air. I can see when an iPhone was actually
downloading data. Now, hopefully my 3G connection with Verizon is encrypted. If not, we need
to talk. But even if it's encrypted, I can still see what's happening. Can I still see
there's someone connecting over from Verizon on a cell phone. So different types of devices
can be profiled for their activity and after you know exactly what they do, you can detect
them. You can see them through walls and tri‑annual them through outer space. Almost like transmitters
because they are. So it's trivial to distinguish when one of the machines is idle and about
it is active. If you study it, you can distinguish it through all kinds of active states. So
what aye been carrying around the convention, an iPhone 4S, a nexus 7, a Nintendo 3D S.
Do you know if anybody else has that combination of gadgets? If you do, we should probably
be friends. So, if someone knew exactly what my brand preferences are and they could pinpoint
me in the crowd if they had all the equipment set up ahead of time, which is again we're
talking about the adversary, the NSA ‑‑ I mean China.
[Laughter] So even if I turn off Wi‑Fi and blue tooth,
this is still possible. They say turn off blue tooth so they can't see your phone. It
helps. You're no longer screaming at top of your lungs that your phone is there, but you're
saying my phone is here. My phone is definitely here. And this has been proven to work in
the real world. Now, this uses Wi‑Fi because that's the same across all guys. It is loud
and reliable. The screen shot is of a system tracking people following the Wi‑Fi beacons
that their phones are giving off. The phone can core laid to the person by the phone's
Wi‑Fi signal. You supply heard that Nordstrom trialed this and people found it creepy and
they stopped. It is implemented and it works. They said they stopped. Gosh. That's what
I get for trusting them. So, this is why the paranoid types are like take out the battery.
Don't just turn off the phone. Take out the battery because they're worried about this
sort of thing. So I'm going to take out the battery on my IM. Oh, wait. My iPhone doesn't
have a removable battery. So what I can do is make like a shop lifter and get some booster
gags. Not suspicious at all. You can find them on the internet labeled as cell phone
blockers or some blue column like cell phone etiquette wrappers because your cell phone
won't ring during dinner. You can use tin foil, but I found that grocery store tin foil
I had to wrap around like 6 or 7 times before my iPhone even lost its wireless signal. I
would recommend getting this stuff advertised for blocking this stuff and you can get the
radios to test if it's working and they didn't sell you shiny cloth. So what can you do?
You need have a completely private talk. Empty everyone's pockets and put everything in your
microwave oven. Do not run it. And close the door. A microwave oven is not 100% effective,
but it makes a pretty good difference considering it is 40 bucks and you already have one or
two or three. But they're only rated to shield you from certain frequencies enough so it's
not dangerous; however, it works pretty well if you put an FM radio and then close the
door. You should lose your signal and not hear whatever music that was we were hearing.
And snips off the cable off the back of a microwave should include it's faraday page.
I did not test this, but it should work. But I did learn if you want to put a device in
a faraday cage and then run either for power or internet, keep that cable as short as possible.
So which I first hear I want to go test my like wave to make sure if works, I put my
radio in there and closed door and the signal barely drops a little bit. I finally realized
I had a 6‑foot USB cable dangling out of the microwave oven. It's a shielded cable.
It says so on the wrapper, but I could still pick up my local radio stations loud and clear
inside a faraday cage because I had a six‑foot cable on the outside feeding into it. I wrapped
it all up and moved the microwave closer to my computer so it was now six inches outside
and suddenly I lost the signal. Yeah. Those wires hanging out of the cage, they're antennas.
And also when something says it is shielded, it means it is shielded enough not to break,
not shielded enough to not pick up your local radio station. So you can use the $10 SDRs
to check. Okay. Is this faraday wrapper for my phone actually working? Is my phone giving
off weird signals? I wrote a python script to scan and look through signals like when
it was in the faraday cage. I, I can improve it quite a bit. How am I doing on time? Okay.
Great. And in the process, you will learn that there are trillions of devices broadcasting
weird things in your neighborhood. You will start to lose sleep over them. What is that
thing that goes beep, beep every three minutes. I don't know. So, this is what my highly scientific
set up looks like. It says it's legit. A microwave oven and as little USB cable as possible.
I recommend you use SDR sharp for this for MacIntosh and Linux. GQRX, I don't know what
that stands for anyway. The first one is probability GANU. After that, I'm lost. And these are
based on the command line utilities, the RTL US library and you can use this directly or write things
that uses them and they have pretty simple python bindings. I assume they are and I don't
own a computer of a CD drive for about five years now. You can find them on WIKI media. There's also
the French and the German that have their own guidelines. But their key take away is
core laid emissions are bad. Core laid emissions means it changes when
something on the machine changes that leaks information you don't want that. So, ask your
landlady about copper plates for your bedroom. I'm sure it will go over really well. So my
co‑worker said I had to throw in the store relating to LEDs. List play. Come on. No.
Go back. It shows the lights changing at work. We have a rainbow tree. It goes through the
patterns and I like under it at work because it is like your own private discode. Shortly
after I got my radio and I was delighting and discovering things around the office,
I sat under that tree and my signal is just like (make noises) oh, cool. I can hear what
color is on the tree playing. So I am sitting there thinking whoa. Somebody walks by and
say what are you doing? I'm listening to the tree. I can hear the colors.
[Laughter] [APPLAUSE]
She's finally cracked. We always knew she would. She's cracked. And so, ah, if this
hasn't left you feeling a little more paranoid, I don't know what else I can say to scare
you. So, ah, if security research all seems a bit twitchy, this is why because we think
of this stuff at 3:00 in the morning. Oh, no, what if they come for me? I accidently
tuned in to the Blue Man Group's radio and it slightly violated Massachusetts law enforcement
that was creepy when I tuned into their walkie‑talkies. All I insure all right, Nancy. Stand there,
get down on your knees and hold that position. I'm like what I did just hear? And then I
figured out I was hearing their lighting group practices, you know, like when we need dramatic
lighting at this spot. It is like oh, okay. Okay. And I'm not even positive it was the
Blue Man Group. But I could see their sign from the window. So that's probably who I
tuned into. Walkie‑talkies, radios, wireless phones, baby monitors, those are all in the
clear. Please radio usually in the clear. I heard some interests things here the other
night. It's not surprising at all. But those are all intentional emissions. They're supposed
to do that and people don't even remember they're doing that. So people are not going
to remember their device are leaking all this information. Journalists should take note.
Whistle blowers should take note. All of you innocent people who never do anything legal
should take note. And you can take steps, very simple steps, wrap it in the foil, take
the $10 radios and give it a spin. See what you can find and you might even find something
really interesting on a really good device that's effective less zero day. You know?
Someone down the street can get information and reach out to this device. Do we see [INAUDIBLE]
for that device? I don't know. And, ah, I have brought with me a few of these radios
because I got a whole crate of them from China and I don't plan finding all of them. I will
give one to the first person who comes up to me and tells me what my favorite color
is and I hear all of you shouting the wrong one.
>> (shouts). >> MELISSA ELLIOTT: Who said orange?
[Laughter] Larry cached dollar, I know that's you. That's
cheating. >> Boring!
>> MELISSA ELLIOTT: [Laughter]
But I'm probably going to head across to the Q&A room if I can figure out where that is.
I almost didn't find the speaker room earlier. I'm really good with maps. Maybe you can come
say something intelligent and thought provoking, I will give you one of my radios. Thank you.
[APPLAUSE] >> So we actually don't have a Q&A room.
>> MELISSA ELLIOTT: What? That's what I was told.
>> I was told a lot of things too, but they're still not true. So anyway, just letting you
know that. >> MELISSA ELLIOTT: I was apparently lied
to just like the Easter bunny. I can't believe I tell my mother that. Thank you, everyone,
for coming. [APPLAUSE]
I forgot to show you the Nintendo 3D S. It makes a certain signal so you can detect all
the Nintendos DSs. It is very, very dangerous. Even a very accurate counted of how many 9‑year‑olds
in the area, even my husband. >> You're funny.
>> MELISSA ELLIOTT: Thank you.