So anyway, here you go.
Here's your speaker, enjoy.
(Applause) BALINT SEEBER: Good morning.
Thank you all very much for coming out on what I understand
is an early Defcon morning.
I would very much like to show you my slides,
but as you can see there might be a little of a technical glitch.
And I would really honestly, love to get started, but it's kind of crucial
to have the slides.
So, I thought maybe we could try the reverse and do a bit of Q&A.
(Laughter) BALINT SEEBER: How many people are into radio?
All right, cool.
How many people have-- who knows what a software defined radio is?
Okay.
And how many people have actually played around with one?
How many people own one?
How many people have USRB?
How many people have a Realtek T.V.
dongle?
And who knows GNU radio?
Excellent.
That's very encouraging.
Applause already.
(Applause) BALINT SEEBER: If I-- if you pardon the debugging
across the room.
Do you know where you are actually receiving the signal from my laptop?
(Off microphone) BALINT SEEBER: Would it be possible
to temporarily connect one projector or something?
It's actually the multiplexer back there.
BALINT SEEBER: All right.
Yeah, it's- no keep on going.
By the way, the Q&A.
Time has passed.
We used to have a Q&A where we'd get together go
to a room to a Q&A.
There's one big mess of Q&A room back there.
And if this gentleman wants to take beers and shots
and whatever and talk to him at the bar.
That's a Q&A area.
So, this year the Q&A area is pretty much going to be handled
out in the hallway or wherever else that you deem necessary.
So, at the end of the talk I'll (Off microphone)
BALINT SEEBER: I'm okay with that.
(Laughter) So, why don't you get this guy
up and running.
BALINT SEEBER: Well, I guess I should also add that my name
is Balint Seeber.
As you might gather, I'm not originally
from around these parts.
I moved to the states about middle of last year.
I had been sort of mucking around with software defined radio
in my own time.
I had been working on a Ph.D., but unfortunately, for that,
through a friend I discovered what software radio was
about and I let the Ph.D.
slide (Applause.) I would like to show you the things I did
during that time.
Since then go?
Keep on talking.
BALINT SEEBER: I joined EDIS Research so I'm
an applications engineer this, and I guess one bonus is I get
to play around with cool, new toys.
One of which I would like to sort of show you today.
Did you want to check the Change it down.
Okay, 1024.
BALINT SEEBER: I have a laptop, did you want me to try that one?
You can, won't hurt.
BALINT SEEBER: Okay.
(Laughter.) Anymore questions?
(Laughter.) AUDIENCE MEMBER: What's your drink of choice?
BALINT SEEBER: I'm actually not much of a drinker, you know?
AUDIENCE MEMBER: You will be after this?
BALINT SEEBER: I was thinking that might be the case.
I guess I don't know, do any of you recognize this
or anything like it?
It's a fast track tag that you normally affix to your car,
gets scanned when you go through the toll booths, this
is an antenna that you can read these with and I figured I can't remember how
I came across it but I came across I don't know
if you seen there was a Black Hat talk that dealt
with opening these up and reversing and decompiling
the firm wear and that was nice and you go into the chip
and extract the software.
But I figured I would implement the radio side of it, so I just did it
over two nights last week.
Simply it will read the ID as it's not an encrypted protocol out of one
of these tags, you hold it up there and it will read it out.
I would have nice images to demonstrate that later
on but I guess I can hand wave in the meantime!
I'm kinda giving you the summary of the entire thing.
How are we doing back there?
(Laughter.) This is not quite the start that I was expecting.
Is anybody doing any cool projects in SDR at the moment?
I had a question there?
AUDIENCE MEMBER: You mentioned
the BALINT SEEBER: Yes, I do.
Let me grab one.
(Applause.) I carry one around!
Thank you!
All right, then.
So thanks for coming!
Just wanted to tell you a little bit about me, otherwise obsessed
with electronics and wireless, I think this is in the kindergarten
or first grade, I don't know what the hell I was making
but it was a contained part of an old tape deck and it had
a blinking light with a VU meter, that was cool for me.
Contraptions, trying to build it, this is on top of a park back in Sidney
with a friend of mine.
We put together a long wire antenna
because we were trying to pick up the cherry ripe numbers station that
was broadcasting out of Guam run by MI6, I believe, and we tried
a couple of successive weekends and then realized that
the station has been shutdown (Laughter.) It was fun to get the images.
My journey into software radio shaped the talk.
How I originally got into decoding systems
with hospital pager systems, one of my favorites, tracking airplanes
and looking at how you can decode something that
you know nothing about, in this case coming
down from satellites with a little bit of direction and fast track.
Just to do a recap for those of you that aren't that experienced,
the idea behind radio is that you have a carrier wave,
a single frequency and if you were to view it like this on a graph
with time going from left to right, you would see your sign wave and
the amplitude on a wire access and the idea is you have information,
whether it be voice, digital bits can you hear me okay?
Is this a good distance?
AUDIENCE MEMBER: Yes!
BALINT SEEBER: It goes into a modulator and you mix that
with the carrier which puts it up to the frequency that you want
to from time to time it at, so if you want
to transmit FM radio then you would dial that in on the radio
at the radio station, put in your music and outcomes
the music on that frequency.
So the simple modulation is on and off keying, where you turn on and
off the carrier wave, and the simplest form of this
is Morse Code can you tell me what that means?
AUDIENCE MEMBER: DEF CON.
BALINT SEEBER: DEF CON, correct!
Which then it goes to more complicated stuff, RFD M
and it's used in a whole host of those we use pretty much every day.
So you have your carrier at the top, the signal just
below it and depending on the modulation you use you either
get a wave you can see how the carrier's amplitude is meshed
with that of the signal or the frequency, much later version,
the carrier maintains the same amplitude
but the frequency changes with the change in the signal.
So that's a basic difference in simple modulation games.
Here is an example of a spectrum, this is a recording that I made
of an automated broadcast from an airport regarding the state
of the runways.
I don't have any audio.
Can I have the laptop audio pack?
(Away from mic.) BALINT SEEBER:
Thank you.
So this is amplitude modulated, you have a carrier in the middle and
on the side you have identical side backs that contain this
voice information.
So the modulation will define what it will look
like on that spectrum so you are looking
at IM signals so that's symmetric with the carrier and FM you have
the notion of the carrier but because it's been modulated
and the frequency is moving around based
upon the signal it looks different and finally you have
a digital modulation scheme, C4 FM AUDIENCE MEMBER: (Away
from mic.) BALINT SEEBER: Yeah.
Of course that's not legal!
(Laughter.) I'll come back to more of that kind of thing later!
Does anyone know about P25?
It's a digital voice standard used by first responders
all around the world here in America and in Australia
and other various places.
AUDIENCE MEMBER: (Away from mic.) BALINT SEEBER:
It's maximum.
So because it's digital modulation this is sort of a variant
but it contains four states and because this is moving
through quickly you get a different look to it on the spectrum.
What I'm trying to emphasize to you is that originally there is sort
of hardware and the simple hardware
like crystal sets that were used and it was made
up with very simple components.
The point was that they're all sort of fixed, a fixed personality.
Nowadays they're more complicated with microchips and these other
equipment, they're also fixed personality.
So it's like a black box, you can't get in there and change it's not
recon figurable.
Here we have a satellite modem and keep this picture in mind
because I will come back to that.
The journey begins.
I had this set up on my balcony back in Sidney and I heard
a mysterious signal which will not play now.
I'll do it manually.
(Tone) Anybody recognize what that is?
(Laughter.) At the time I wasn't sure what it was
and I had tried to demode it with free software
out there available but none of it worked.
There we go!
(Laughter.) And this was my set up at the time,
I inherited these radios from my grandfather, a scanner
and other receivers and I interfaced it with that board there to any 286
and had it running and would stream it downstairs and this was my simple set
up to control the radio remotely.
I thought I would try looking at the signal and once again we have
the signal in the time domain and if you look
in the frequency domain you can see the two distinct levels coming out.
This introduces the idea just like in data transfer that you have
the preamble and the payload so you can see
the preamble is important because it establishes for data
the transmission, so that the receiver can lock
on to it so it's a repeating pattern of one's and zero's and then you have
the payload after that.
Because it's two level SFK you can draw the line through the middle
and slash it, anybody above will be 1, anything below, 0, so you have 1's
and 0's, great, now what?
The idea is to turn it into information.
This took on and off five years for me to actually figure out and
in the process I ended up writing this bit
of software that would take in this raw data and you could play
around with ways of lining, coding, and so forth.
I look at it every so often and come back
to it and it just happened that I was reading Wikipedia and there was
an article in there that mentioned these specific sync words and I thought,
hang on, I've seen them before and you can see
in the window they match up and it turned out to be pot sag
but it was weird because what I had tried previously
hadn't decoded, so this was an example of object security
because I changed the implementation but it turned
out to be the pages for the hospital network back in Sidney.
We confirmed this I have a friend that works
in the hospitals there and he called his friend and said can you
send a page out and you can see what that test page
is there, the one that's legible.
Bringing it up on this map that I created,
it was actually part of the hospital.
You can see we identified the frequency.
Once you have a look at where that site radiowise is linked to,
you can see it's connected to all the other hospital in the area.
So I let my decoder run for a little while and it turned
out to be some seriously sensitive information.
(Laughter.) And then finally (Laughter.) (Applause.) That was for one
of the secure systems, I believe.
A side note, I just showed you that map.
This is a more indirect call to the FCC to be open
about the data that they supposedly don't update their web
site but the Australian government has been good and strict
about maintaining all this data in one place.
So my mash up also has these map overlays
and this is a visualization of every registered radio transmitter
in Australia and the links between them so you can see where
the population concentrations are because that's where
the radio sites are.
And also I derived radiation information so these are mobile cell towers
in my neighborhood and if you look at various cell towers there you have
these sharp lines coming out and they're the microwave point
to point links between the towers.
AUDIENCE MEMBER: (Away from mic.) BALINT SEEBER: The
government's database that I sort of imported contains the information.
It's quite rough but it looks pretty, I guess.
Somebody posted it at one stage and it was interesting
to track what sites were popular, not sure that you can read that
but they're all the echelon sites in Australia, so a station at Gerald
to know and they're all covered with the radars, that's Pine Gap, there
is a bit of joint U.S./Australian action going on there, I think.
The first day I launched the sight I had visits from the U.S.
Department of Justice, federal parliament and my state's
Attorney General's department.
I have no idea how they happened upon it so quickly
but (Laughter.) People trying to get in and hack
the sight and scrape everything out and it's mostly coming
from a couple of IPs in Bolivia so I band the entire country!
(Laughter.) That was my journey to decoding things.
Let's move on to aviation now.
I have in the past liked to take a GPS receiver with me and stick it
to the window and what is the politically correct way
of AUDIENCE MEMBER: Flight attendant!
BALINT SEEBER: Flight attendant I'm old fashioned and she says
is that off?
And I said of course it is, it's just got the display
off but it's cool because as you take off into the air you get interesting stats
about how fast you're going and how high you are.
Maybe it's me "geeking out" but I like the numbers.
Once you get back home you can plug it into a GPS visualizer
and Google Earth and you get a trail of where you've been.
This was last year when I was going to Houston.
These are screen shots from the GPS receiver.
But if you're in the airplane and you're enjoying your ride,
how do the skies remain safe and planes get around?
I would like to tell you a little bit about primary and secondary radar.
You've seen these big rotating radars at airports and it's part
of the ATC radar being consistent.
The primary is the big one on the bottom and the secondary
is the one at the top.
The primary is the traditional radar where it sends
out a pulse and listens for returns off metallic objects,
because planes are flying tin cans.
The range is limited by the radar equation.
What's interesting, though, is that with the secondary system, the top
is directional radio so that will actually broadcast and ping
the transponders which are active on the airplane and ping back
themselves so that requires an active system whereas
the primary does not and because it's an active system and
the transponder replies you have only second modal loss there and this
is crucial because if you're sitting in front of the scope and you have
the big line going around you wouldn't be able
to ID individual planes but with the secondary system you
would have those anonymous blips now coded
with the score code that would have been assigned when
they would have taken to the skies in the first place.
How does the transponder system work?
This is a basic one here and there are different modes.
A will reply with a score code so when you take
off you will get a code like that one, and then every time your transponder
is interrogated it will send back a pulse.
There is another one which is C and that will reply with the code and
the current altitude which gives air traffic control more information
about the air space.
The cool one is Mode S.
Who has heard of Mode S?
All right, so Mode S is another system that runs on top
of this and there is something that runs on top of that,
which is ADB, which means the planes don't need
to be interrogated they will continually broadcast this
information out also part of that system is A cast and T cast
and the interesting thing is part of the secondary system and Mode S
is not part of it but it shares the same frequency which would
reduce cost but now the problem is there are so many planes
in the sky that the channel is becoming congested.
I think Frankfurt has this problem the most due simply to the amount
of planes in the sky there.
What does ADSB send out?
It's constantly sending out a plane's position, hitting altitude,
vertical rate, score code, quite a lot of things, those are the main ones.
If ATC has antennas on the ground there can be
transactions between ATC and the plane purely through the system.
So ATC might send out a broadcast which is called
the "all call" and all planes reply with the down link frame that identify
the craft by its ID.
Much like a mac address.
Each air frame address is assigned to a single airplane.
Then there is also ACAS and TCAS where the planes respond
to one another and this can be used to augment collision avoidance,
if they're traveling too close in one cockpit you may here
the automated voice say "traffic" and if they get really close there might be
a "pull off" and the other to do an avoidance maneuver and this
is called a resolution advisory, but there have been terrible incidents
in the past where the pilots have not followed
the RAs and the planes have collided.
The one I'm told in the past is the tragic one
over Germany, there was a Russian flight with a lot
of school children and they collide and had they all died and one
of the father's went and killed the controller.
So you got to pay attention to the resolution advisories!
(Laughter.) I like to put big props out to Brad and Nick,
they presented last year on looking to the vulnerabilities
of Next Gen which employs all this stuff and I don't know
whether Brad is here, but if you're here it would be great
to catch up.
The interesting thing is according to the 747,
they have 31 radios so localities of things and that makes me happy!
(Laughter.) When I was flying over here I took another photo
of an aircraft like the one I was on and you can see there are
a number of bumps coming out and don't quote me
because I mapped it from a 747 I think it's roughly right
but you've got the antenna, the transponder, high gain,
satellite communications on the top, low gain VHF in the tail you have
an HF antenna and on the bottom VHF things and radar,
Al Tim meter and the marker and measurement equipment, too.
Now with Mode S how is that encoded in the air?
I showed you before what frequency shift might look
like but this is called pulse position modulation
which is technically AM but they send out pulls
at precise times and when those pulses exist in a certain manner it might want
mean a 1 or a 0.
With Mode S there is a preamble sequence and
the pulses have to be in most positions and it indicates it
is a Mode S packet and that's used to distinguish it from Modi and
the payload is determined by the position of the chips.
So this is Manchester encoded, and you can see the chips and one
will relate to being a 1 and one to 0, and then the entire payload can be 56
or 112 bits long.
With pulse position modulation at those rates,
a pulse lasts incredibly short amount of time.
Now what this means is that you have to sample
a at a minimum of 2 megahertz and it requires a bit
of computing grunt to deal with that data rate and ideally you want
to sample fast so you can correct for any time errors.
So you couldn't be able to do this with your plain old radio so this
is where Software Defined Radio comes in and this is where I got
into it and this is my first play around with SDR because it's
the perfect platform for this.
SDR moves what was previously fixed in hardware, that sort of not
the unconfigureable hardware into the software domain.
Remember we had that simple crystal radio set?
The expression of the AMD modulation in code
is simply the magnitude of a complex vector.
It's elegant and simple.
FM is more complicated but as elegant.
So on the receive side instead of having everything done
in hardware, all you do is you pick the carrier frequency you want
to listen to, mix it with your incoming signal and
all the rest you end up doing in software.
So the purposes of SDR is to turn those values into digital
and comply the computer with the stream that you can process.
So the continuous turns into discrete.
Again you have your wave, the converter to take it
into the number stream and the converter going back
the other way if you're going to transmit a signal.
Naturally you're going to transmit legally
because you have a license to transmit in that band.
This is what I started playing with first, this is with the USRP1.
It is sort of I guess one of the first if not the first low cost SDR,
you hook it up by USB, depending on the data board you've got you had
an amazing range and the bandwidth is incredible, this is one that came
out later and the bandwidth here was narrow
because cleverly they put an audio card in there
because the left channel would be the right channel and
the right channel would be the queue channel and it would appear
as an audio card.
But you needed to have the software running on top of that
to demodulate whatever you wanted to listen to.
And then, of course, there is the Real Tech one,
anybody used it under Windows and ran it?
I guess most people use it on the Linux?
But for the price, it's pretty cool.
I don't know if you're looking into the history but one of the modes
in which it operates is that it can demodulate normal analog
FM and it was figured out that it's streaming 8 bit samples
to the computer and the community swarmed
and figured out how to make that available
to the mainstream.
Now, this thing here, this is not an official announcement so I haven't
put any text up there.
Pretty excited about this.
This is going to be very soon the new USB 3 radio.
It has quite a frequency range, 50 megahertz, 56 megahertz
of continuous bandwidth, it's pretty sweet and I've been having
adventures with it around the Bay Area they'll tell you
about in a little bit.
The point is you can hook it up to your computer and run
the radio and it as a GUI front end where you can
describe the flow graph that would do modulation and demodulation
in the graphic environment.
This here is a demodulator for AM, you can see that the U.S.
RP starts with the left hand side you have
an FFT so you can see graphically what your signal looks like,
an AMD modulate tore and it goes out to your sound card so it's simple.
Here if you run a water fall over 8 megahertz this is part
of the 2GSM band and you can see the channels and
the traffic channels there.
Then this is a pretty cool example of what you can do with this.
This is actually 56 megahertz so what you're looking
at in the middle are two wifi channels plus extra space
on the side so you could decode to wifi channels.
Over the years computers have become faster and smaller so it's cool how fast
it's come to enable you to suck up bandwidth.
This is another example, another program sorry, let me go back.
There we go, so I was talking about pages back in Sidney, this
is an example of pages in the states, uses Flex, this is the Flex version
of the page system and this is running
in a program called Board Line, you can zoom right in there.
I don't know if you can see but the line where the curse sore is,
that's a single frequency that pager transmissions are sent
on and you know how we saw the two levels
of the pager I showed you in Sidney this has four levels
and you can zoom down and if you don't know the properties
of the signal you can use this analysis to figure
out at a basic level what modulation they're using this is four level FSK.
I'm sure you're aware of smart meters and how
they had a mesh network in the megahertz ISM band you can see
how quickly and short the bursts are coming
from the meters but you can use Board Line to zoom
in on that and you might not be able to tell what they are
because the bursts are so short but if you zoom in you can see
a face shift key one, the blurry one, on the left and the right
of that there are narrow ones and although they're weak
and only appear for a short period of time you can still have a look
and identify that they're two level frequency shift key transmissions
as well.
Let's say you wanted to discover patents
or repeating components to a signal that otherwise looks
like noise, like, for example, anything CDMA.
The examples here are that we would be listening to the GPS constellation
or CDMA from the mobile phone network,
for example.
There is a sync called the fast auto correlation sync
and what it does is trickery to determine
whether FFTs are repeating in a signal.
With CDMA you have signals are that are sharing frequency space divided
by what code they use.
Here there is a distinct line that appears on the 10 millisecond grid line
and it's mostly black but there is a green line that appears
up there and that is the 10 millisecond repeating common
pilot channel and you can set a signal that you don't know
about and put it in here and oh, it must be CDMA.
If you look at the constellation, it's all noise, there
is no apparent signal like we saw before with the pager, for instance,
because the signal is coming from the constellation, which is very,
very far away and the signal is weak, however, there is CDMA in there
and there is a repeating patent there as well and it's able to draw
out the 1 millisecond repeating code in the GPS signal.
So some pretty powerful tools that you can download and start using for free,
Tetra is another land mobile radio digital standard
and it has a characteristic repeating pattern
at 14 milliseconds on an idle channel.
The cool thing is you can take it out and about, I've put this
in a used Bosch case of an electronic drill
because I didn't have a case and these are my amateur
friends back in Sidney, we set up a long wire and tried to listen
to the world and you can pretty much capture the entire radio band which
is what you're looking at there.
It's not quiet but if you wanted to use this you can capture it
and more and you can demodulate hands or weather fax transmissions
or clandestine military codes and so on.
These respect hands chatting in an allocated channel
and you can have Morse Code and all sorts of interesting things and
if you don't like that, you can video was supposed
to start playing there.
This is Citro Tower in San Francisco, and IDS is a popular carrier,
and that's the base spectrum that you get
and you have the decoder printing out all the information including traffic,
the state of traffic on the highways there which
is something that I'm very interested in and there you can see
the demodulated FM so on the left hand side you have
the mono audio, the backward compatible
with nonstereo receivers which is 19 kill low heaters and then you can
create the left and right channels and listen to the stereo and audio
and you can see the sub carrier which encodes
this information.
Now it peeves me that the location codes are not given to you,
and if you buy a car, that location system comes with it
and I have been looking into one way of finding out this information,
if you have any ideas, please, come and find me afterward.
But if you want to do the reverse, if you want
to make your own FM radio station and transmit your own information you
can do that.
I had my little iPod Nano with the FM radio in it that decodes
and it's printing out a string that was preprinted out.
I can't remember who I'm sorry to say
but there was somebody that tested IDS injection and navigation display
in a car and it was saying there was a terrorist threat of frogs falling
from the sky or something (Laughter.) But if you
like scanning around you can do that, too, I have a list of frequencies
down the bottom, it steps through each one, there
is a squelch block that monitors the channel and as soon
as it goes quiet it goes to the next channel but the beauty
of Software Defined Radio is you don't have to look at a channel,
one single one at a time, there is a list I created that you can give it
a spin and it will indicate that the channels that have become active
and you have one sound card so the green one become
the active one and the black ones are simultaneously
active so this is voice but you might be listening
to data codes and want to decode them all or
if you're listening to one trunked channel you can record
all of them.
SDR is cool because there is an Open Source project to set
up your own base station.
I've done it once before, I set it up using this and I had my phone here
and people can text me but I thought it might be distracting
plus late last night I was trying to find a "free" channel and
the spectrum is so unbelievably crowded that I gave
up (Laughter.) It's cool because it comes with a soft switch,
for example, I log on with my mobile phone and I can dial
the outside world and I allocated a number
with our main office switch and I'm able to receive calls
and it goes through using the SIP over the network.
So it had a big, popular debut at Burning Men and there was a bit
of a computation to be done so they put the laptop on an ice pack.
(Laughter.) Another cool thing you can do is there are blocks for decoding,
RFD M version wifi so I put it up, I set the gain and the frequency
and I made it so it will pass it through to Wire Shock and you can see
the frames coming from the AP so this is just
as if you had a dedicated wireless card running
in monitor mode except that it's being done
through an SDR and in that picture and picture there, another laptop
is connecting to the network and you can see
the association frame coming through and data frames coming
through there, you can see the colored ones.
Then actually last week a colleague of mine thought he would bring
in his fancy antenna and we would receive pictures sent
down from weather satellites, so they orbit
the earth and then take photos and send them down and you have
to track them manually but the B200, this guy is hanging
out by the USB cable and you get these pictures.
You see the interference there because doing
the tracking manually you can't see it so we were guesstimating where it
would be and I guessed we missed a spot!
(Laughter.) But it's cool this is the west coast up here
in fact United States and this is a big cloud formation,
these pictures are taken with different sent sores
and you can combine them into these false images, to get
an idea of what's happening, this is sea temperature and there
is a thermal one and they happen all the time and you can get
a program to tell you when the next pass will be and decode that.
Another one, if you're looking for positional stuff
on the water most large or medium size marine vessels contain their own
version of trance ponders so I went to the Bay in San Francisco and
the boat came around and there were three boats
with that large cargo ship and they're all, you know, sending
out their information and I guess the thing to bear in mind
during all of this is it's all unencrypted, it's a shared resource,
anybody can do anything with it.
It's only our legal system with jurisdiction that dictates,
apparently, how we're supposed to transmit or not
within those frequencies so security is obviously a very,
very big point that hasn't been addressed in a lot of these systems.
So radio astronomy, tracking people
with their mobile phones through shopping malls and so on.
Let's come back to aviation, there is radar turning,
Moffett Air Force Base in the Bay Area and every time it points
toward the camera, there is a massive spike
because it's directly in line with the pulse that is coming out.
On the left hand side you can see the other spikes coming out.
Theory flexes off large buildings so the radar signal
is hitting those buildings and hitting back into the radio.
The other thing is I couldn't figure out why I was seeing two peaks here,
this is showing the time in between the initial bang that
is sent out, the initial pulse that is sent out by the radar and this
is called the pulse repetition frequency and I couldn't figure
out why there were two, usually there is only one.
Before I had an SDR that went up this high, who knows the ubiquitous,
4C, to 11K wifi cards, yeah?
It's got in the chip set a radar detections capability so I was
using that to characterize the weather radar nearby
but here there were two and I did a little bit of research and these radars
apart from monitoring aircraft can be made to monitor weather and
in this mode there were papers written about how they can be used
to monitor reflectivity and moisture in the air.
That was kinda cool.
On the Water Fall display this is what modes transponders look like.
You can see wave the pay load and the FM, and what does that look like?
All those dots represent a frame and if you run it realtime you would
see that.
The amplitudes are different all the time
because you're seeing different planes that are different distances away
from your receiver.
Once you've done the decoding, what's next?
This is a project I've been working on now and then,
who has seen "Sneakers" ?
Thought so.
One of my favorite bits in the film I'm not doing to do
an American accent but the diagnostics, what's
in the black book and you can see on the screen a simple picture
of the Bay Area with air photographic control
and planes and I put together my own system that does it,
that's San Francisco airport right there and I left it running and these are
the planes that fly in and out of the air, San Francisco, San Jose and Oakland,
so they leave trails behind and you can see the flight paths.
This is the rainbow affect, this is a bad transponder
on an aircraft that is transmitting false information
and you can see how SFO is actually right in the center there
and the color code indicates altitude so the yellow is just before its
about to land.
This is the airport there with the various runways,
obviously we all know there was a bit of an accident down there recently.
I went up on top of a car park nearby, this is the runway and I had
the 800 receiving and you can see the parallel approaches, and this
is about to turn red once the wheels at this time the tarmac and
they will scoot across the screen as they taxi into the terminal.
So landings are cool, take offs are kinda cool, too.
Especially if you're just sitting there you can see the planes
at the holding point waiting to take off.
I think this is a Virgin flight.
There it goes.
Again, it's kinda neat, we have the GPS, watching the velocities increase
and eventually when the nose and wheel lifts up, turns green and
off it goes into the sky.
Wouldn't it be cool if you could do it in 3D as well?
That's the same plane now streaming in Google Earth
through the internet (Laughter.) You can see planes
in the background landing at Oakland there.
That's the Bay Area there.
Wouldn't it also be cool if you could actually have
a virtual cockpit mode so that you can be in the seat of the pilot,
imagine what it would be like taking off into the sky!
(Laughter.) (Applause.) So this is actually running permanently
on my web site for Sidney Australia and I've just set this up recently
for the Bay Area as well.
So if you would like to sort of help out with this project I would love
to hear from you.
This was actually when I had one of these tucked away
in the seat pocket in front of me without an antenna and I was receiving
the transponder from 10 meters below my butt, and it's a bit
of a hard landing, but it's kinda cool, because as you taxi in you can see
the burnt out fuselage of planes.
I don't know what Google Earth tried to do there!
(Laughter.) You know how it does the terrain exaggeration,
they must have automatic mechanisms to determine terrain elevation,
but it's weird when you're flying through like that.
If you do it in Google Earth, you get the same affect, here
the trails don't persist so it doesn't get as crowded
but you can kinda get a sense when there is a lot of traffic,
and you can see when see how it didn't come in on the direct path there,
around the ocean it does loops, see that loop there, that's when ATC
is backed up and I'm guessing they're asking
the planes to hold for a single loop to give them breathing room
before they vector them in.
So what's this one?
Oh, yeah, this is when the police came out!
(Laughter.) Hello there.
Are you really watching airplanes?
BALINT SEEBER: I am.
Do you have ID on you?
BALINT SEEBER: Die.
Is it for school or something?
(Laughter.) BALINT SEEBER: It wasn't quite for school
but she was very nice about it.
That's not the first time that I've had encounters with the cops
but usually they're pretty good.
So the software runs in a couple of different stages this
is the desktop application that does the tracking, you have
the decoding and then do the tracking.
This is the main runway at Sidney, you can see the trails and
the planes left behind, I have to thank my deer friend, Matt Robert,
he has worked on OP 25 and I was using his U.S.
RP 1 remotely and we would go up to the park and test it
out there because the airport was
within visible distance.
We went up a couple more times, progressively taking more equipment
and we were excited because that gray plane there isn't
actually a plane it's a vehicle equipped
with April transponder it's on a perimeter road and now they're
all equipped and you can see all the vehicles moving
around and I need to change the eye con to something more
like a car but we were happy that evening,
we had quite a bit of equipment up there as well.
But you see interesting things, that was the queen when she came
to visit, the call sign is RGL1, Regal 1, and I was in San Francisco
and I saw that, I don't know what that was about.
And this is when I without permission moved my
equipment to the roof of the apartment block
and had everything stuffed in this box I had gigabyte and ether net
in a box sprayed the same color of the building (Laughter.) And you can
extract information about the distribution
of the strengths of the packets coming
in and you build up these graphs to tell you how well your decoder
is doing, this is a graph of signal strength versus distance
and you can see the way that it drops off.
This is altitude versus distance
because I live close to the airport they all come to a single point
in the lot tomorrow left but you can see
out to the right where the planes will descend to.
And you can see them coming out on the right hand side there,
but on the other axis.
This one is Sidney, now, Australia has a greater roll out of ADSB.
In addition to listen to go their messages see how
the balloons are popping out these are aid car messages,
and there is another rainbow affect but the text messages can be
between the cockpit, air traffic control, messages back to Royals Royce,
I saw once a rowdy person had been on the plane and they asked
for an escort and most of it is clear text.
AUDIENCE MEMBER: (Away from mic.) BALINT SEEBER:
Generally no.
Once again this is looking down at Sidney airport and you can see
when a message is sent it deposits a little Marker
behind and most of the messages occur
at the airport it's the way that diagnostic symptoms work
and I've mentioned that already.
I listened to the two primary frequencies back
home and I'm set that go up here as well but this is how the message
is printed out, so the frequency, the content, the flight ID
and registration, so on.
What does it sound like, that's an aid car message, there.
(Hissing noise) And this is decoding the main channels in the Bay Area
and that can be fit into the main system to put spatially
on the map where the aircraft was when it transmitted that
information so it's interesting sort of a diagnostic tool
for airplane operations I guess or if you like to be a plane spotter.
So you can see a whole bunch of engineering messages which have
the H1 label were delivered as it was coming into land
or pass through the airport.
This is sped up, you say a big blue dot, and I'll explain that but you can see
the dots appearing as they take off which is when the plane sends
out a lot of information as it ascends into the sky.
So here are examples, this is a running joke.
I see probably just because I'm hypersensitive
to it now I see aid car messages regarding blocked toilets on aircraft.
So here we have one toilet that's inoperative and I'm guessing LAV hard
means it's failed and because I see them
all the time I thought I would make a Easter egg
in Google earth (Laughter.) Unfortunately I think
the white point that's been highlighted there is Prawn.
Now they send out flight paths over aid cars using white points
and actually it will draw in the flight paths that
the planes should fly through.
I'm only receiving a small portion but you would expect the plane
to fly through to Asia and Perth and also there are nice things I don't
know why these planes appear in Google Earth as models,
maybe Quantas is paying Google Earth, I don't know.
You saw I put all that stuff up on the roof without asking
and there was a message that several trades people
installed things on the roof and it was just little old me, which
is kind of a tin can thing and they made a big fuss about it.
But two nights before I left for the states I said "stuff them" I put
everything in a box, this was the night before I was supposed
to get on the plane installing it at a this is as I was taking
off in the plane I took a photo of the site and
with a little real tech dongle over here, I didn't have internet so I didn't have
maps and so forth but it was cool to pick up where the plane was,
that's more recently in LA, you can get good range when you're
nice and high and this is more recently when I'm sitting
up new antennas.
Instead of Mode S you can use HF, and we were able
to receive HF transmissions which work on a slightly different system extending
all the bay as you can see there into China and India, so
with HF you have for greater propagation so
the range is incredible.
So that's more or less aviation.
Remember it's all unencrypted so you can spoof, jam,
all that kind of stuff and I will talk more about that later.
AUDIENCE MEMBER: (Away from mic.) BALINT SEEBER:
I haven't looked into this.
AUDIENCE MEMBER: (Away from mic.) BALINT SEEBER: The
question was there is another part of this called TISBE, that
is broadcast over the same mechanism
and that's used to augment information that pilots can
see but it's a "next step" in the protocol and isn't widespread
but various sites are bringing it online but I haven't looked at that myself.
AUDIENCE MEMBER: (Away from mic.) BALINT SEEBER:
I haven't done that, but that's actually good
for potentially doing mach alliteration, in the absence of Mode S
and maybe SP.
Moving on, this is a blind spot here and you have no idea what you're doing
and I was looking at satellites, going to a friend's place and hooking my USB
up to his set top box connected to a satellite and there were two types
of two things to consider.
You got the purpose and the payload so we can have comms,
amateur radio satellites and the intelligent ones and the dumb ones.
The intelligent once you communicate with them from the ground
and instruct them to do things or there are
the dumb ones that relay information and it's
like a big RF mega phone so you send up your million TV channels
and it beams it back down to the ground so everyone
with satellite TV can watch without having cable run.
The satellite is just like that, it operates in these ranges and it's used
for television with other interesting things
and I thought, well, let's have a look at what's going on there.
These are the publically available frequencies,
how the transponders are broken up, the uplink power control frequencies,
and this is a constant power signal that comes down to inform the ground
of how much power it should send back up, depending on the amount
of moisture in the atmosphere, cloud cover and so on they have
to change the amount of power on the ground so that
the signal ends up hitting the satellite and that has security
implications, too.
This is the earth station where they send the signals up.
If you look on the map it contains the TV, media agencies, if you look
at the photo they took inside you can with a bit of research,
remember that modem I showed you at the beginning, that rack
is if you feel them so you can look at the manual.
They have various other sort of more or less well known antenna satellite
control systems so what do you need to decode these signals?
You need a satellite, a dish, you need a set top box, some sort
of down converter and an SDR.
If you're going to look at narrow band stuff you have
to get a down converter that has high stability.
Usually the ones for satellite TV are cheap
because they can drift bought that's okay
because the TV signals are broadband and it's not the case
with narrow band stuff.
If you do a search for the satellite the manufacturer
of the transponder lists them and you can look up what kind
of modulation would be used.
This is a telemetry analyses coming down and this is actually zooming
into the telemetry signals and you can do visualization.
I didn't look much further from this, but who can tell me what these
shapes indicate?
AUDIENCE MEMBER: Counters.
BALINT SEEBER: Exactly.
You can see something going on there and that might be
a starting point and there are other narrow band streams coming
down and you pick one and lock on to it and try and decode it.
The problem is because you're going in blind when you initially send
out the signal you have to specify these parameters so
if you are differentially encoding them, doing error correction,
you don't have any idea.
So doing it in reverse you have to go through all the permutations
and it can make your head explode.
So if you don't know, basically you try
the most common ones, try and automate and script it and
the idea is that you can sort of use some hints along the way
to determine how successful your being.
So most satellite signals are phase shift keyed, which means
instead of changing the frequency they change the phase for each 1
and 0 that's sent through, each symbol, technically and you need
to determine the order being used, and the symbol rate,
how they're sending the how quickly they're sending
the data through and I saw these transmissions
and I thought I would puck one of those and you can multiply
or raise the signal itself to the power, raise it to the fourth power and
as soon as you get the peaks, it's indicative
of the fact that you've hit the right order
of modulation so this was order 4.
So we have QPSQ which means in each symbol transmitted
through there are two binary bits.
Also we need to find out how quickly they're being sent
through and you can do this using what's called stationery analysis
and you multiply the natural by a lagged version of its and that
will reveal components and it turns out to be 9600 baud.
And it's error corrected and without figuring out what
the convolutional decoders are you're going to be left with noise so the idea
is you go through all of them until you find the error rate
from the decoder drops to 0.
So if it's designed to decode convolutional codes, there
is a metric count that it keeps inside, and when you hit
the parameters that will drop to 0 or close to and that's
the hint that you've been able to identify the parameters.
So you can see he there, that drops to 0 which means I've got
the right code.
This is a flow graph that emulates that process.
Going through the permutations, it's cool because it's Open Source
and you can extend it any way you wish and instead of me trying
all the buttons out I made a model that would go
through each permutation and find where it was locked
and I could proceed with the next stage so you have 1's
and 0's again, looks like there is structure in there, not,
but it looks like it's been probably scrambled,
which is a common thing to do to sort of widen the data
in case there are any pending patents, to keep it as pseudo
as you can once you find an RF link.
I found a couple of popular once and turns out it's still not quite right so
it's probably differentially encode and had if you decode it you can see
repeating patterns and headers and payloads.
So now you have that structure and you can go through and search
for the repeating patterns and I discovered this pattern that would
be established and the preamble would indicate what
looked like packets and it turned out to be ancient character oriented
packet assembly.
So you have synchronization, CIC, at the end, and a number
of fixed length messages within these packets coming
down from this satellite and each contains
an ID and I wrote a pauser for that, and I wrote a patent
between each successive transmission and what it looks like header,
you have varying codes, and basically they and I thought,
Hmmm what could that be?
Well I have no idea but if you graph them they look pretty!
(Laughter.) So I thought they're probably some sort
of measurement maybe that's proceeding, time, if you plot XY,
they might move around like this, they might be telemetry being
uploaded, I am sad that I wasn't able to record more data
because I only recorded 2 minutes worth but if you record it for a week
or month you could graph this and see how it would change related
to the time of day and if it's human activity or phenomenon.
This is a downlink and I think people are using a part
of a shared satellite spectrum there.
This is one I could not figure out, you see ha hump there,
there might be a signal moderator, I was running all sorts of tricks,
nothing came out of it and in the end I found satellite frequency
allocation for a U.S.
satellite and it turns out they put white noise channels
through the satellites to do presumably RF measurement
and test being so there is nothing encoded there it's purely
white noise.
(Laughter.) AUDIENCE MEMBER: (Away
from mic.) BALINT SEEBER: Well, if it was one time than it would be
digital so there would be a digital artifact there.
But this was well and truly as far as I could tell anyway, white.
Back coming down to earth again, signals to earth,
it's well documented and you can run an analysis that runs
at 2400 baud which is indicative of the baud rate again and if you run
the correlation it matches exactly with the detecting frame links and
if you have a blind signal and you have
a database you can look at them and ID them opinion if you create
the radio, you can see the 8 points coming
out on the constellation there that encode the data.
DRM is a cool digital mode for HF that sends
near CD quality audio over HF and you can get incredible
distances and have nice digital audio coming out on the other side.
It's RFD M, this is a code that I put together
from a paper and you can put obviously create pretty plots but looking
at the peaks will tell you information
about the OFDM parameters, so symbol direction is on.
Then what's kinda cool is that it matches
up with the class B encoding DRM because there are different classes,
A through E I think that are used for protection classes depending
on how far you want to send a signal or how good you want the quality
of your audio to be so it's a good way of figuring things out Instead
of writing that code though I realized I could write a simple flow graph
and run the auto correlation, you see a peak coming out there,
change the lag amount, remember there is a lag, you set that
as the lag and you see these additional peaks coming
out of the additional FFT and that matches
up with the exact values that we got through the other way of doing it.
That's sort of simple techniques you can use
with Open Source software to figure out what an open signal it.
Let's talk about Fast Track.
I told you what it was already, during the preintroduction.
But the interesting point is these tags do not actively
transmit back.
What happens is the tall radar will transmit an interrogation and it
will keep a carrier, basically unmodulated carrier hitting
the fast track tag and the microcontroller will change
the load on the internal antenna.
What that means is that the internal antenna will take
a little bit of that energy, then when it modulates a 1, say,
and then a 0, it won't actually absorb that energy
and it will be reflected back to the original tag reader.
So it's kinda weird that you have the situation where you might have
these antennas, pointed down, and these are both transmitting
and receiving at the same frequency at the same time.
I had not actually played around with this before but it's neat
and it makes some things easier because you're using the single signal,
you don't have to worry about transmitting back,
it takes more power from the fast track tag
because these contain lithium batteries and you don't have to worry
about synchronization because you don't have two different
clocks that are running in different clock domains.
So apart from the antennas at the toll reading booth there are
antennas that sit on the highway that give useful traffic
information and I thought, well, I will go along and see what I pick
up so that's the antenna, and that is the spectrum coming
out on the laptop and that is the pulse coming
from the system so I recorded that and had a look at it.
This is actually on the side of the Golden Gate Bridge,
on the toll booths and I realized that I parked in, like,
the authority's reserve parking spot but I was very quick!
So I nest he willed myself in this bus stop and was pointing
at the top to see what I could find.
This is the trick, this is the really cool key that makes it
all happen.
It's this device here that I managed to find eBay, and this
will circulate around to a port and the transmit energy
from the interrogation transmitter would go to 1, then 2 and go
out the antenna.
Anything coming back up from the antenna will come
into and exit 3 and go to the receive side of your radio.
Coming anything coming from the receive side doesn't matter
because it won't be transmitting but this is my test set up there,
you have the circulate tore connected there and the tag leaning
up against leaning up against the cup.
This is the interrogation signal and looking at what's coming back
in from the antenna.
Circulators aren't perfect, if you don't have a matched antenna,
for example, but here on the left hand side there are lines
jumping up and down, this is the payload identifying
with an ID who the interrogator is and sure enough it uses
the exact same modulation, pulse modulation and then you have
a slightly wavy line emanating out, imagine that was flat.
This is the constant carrier that should be back modulated by the tag.
You can see if I flip between the lines there
is additional activity, weak but definitely something there
and then my tall tag has come up.
So that's the response.
If you use the good 'ol way back machine you can
find the department of transport's machine and this
is the preamble and when it detects a peak in the filter, meaning that
a back scanned modulated response is being sent by the tag it activates here
and once again we were talking about slashing the signal,
we're slicing the top.
1 is at the top, 0 at the bottom and binary out and we have
a payload that we can check for validity and then completely
unencrypted, you have the tag ID.
And the flow graph is relatively simple.
(Laughter.) BALINT SEEBER: Okay I hit all the gruesome stuff but,
you know, I like big flow graphs.
You can do them hierarchal as well and I get crap
all the time that I should be using it but I never do.
I recommend Black Hat talk that was given I used quite a bit
of that talk that was given as an inspiration by Nate Wilson.
Okay let's cover direction finding quickly.
Up to now we have been talking about the contents of signals, trying
to figure out what's inside.
This is more about where they're coming from,
which can be used as a bit of a key as to what's going o where
somebody is.
It was originally radio navigation, radar, it can be emergency intelligence,
trying to find someone that might be lost and it was used
in World War 1 World War II, along the British coast line,
they were trying to find U Boats and apart from sort
of VHF and UHF signals you could have incredibly large arrays
like the ones here in Germany, those are cars that are parked
in the parking lot at the bottom of the image so that
is a huge installation, and this is used to pinpoint transmissions
from all over the globe that are transmitted on HF or long wave
around the globe.
Now you have the fox hunt where the transmitters are hidden
in the forest, and they have to try and find it.
It's a high directional antenna, so you can pinpoint where the signal
is coming from, and that's a crazy, serious, German ham!
(Laughter.) The first thing I played around with was pseudo Doppler
direction finding, and idea is you use a Doppler affect to cause
in the radio wave, and then exploit that to figure
out where the signal is actually coming from.
So I'm showing the Doppler affect.
As you move an object this changes the waves.
What you can do is have, and you can see my highly
and technical refined wave passing through the center of the circle.
The vertical line there on the circumference is the antenna.
So the idea is you rotate the antenna through the wave, there
by compress it go in frequency and as you come out the other way,
through D back to A it's moving the opposite direction and you expand
the wave and you end up with a Doppler shift and that
will change the frequency slightly of your signal.
The cool thing about it is FM, frequency modulation relies
on this fact.
It will change your carrier wave in frequency, depending
upon the signal.
So what you're doing is adding an extra tone, adding
a bit of modulation.
So this works well with ham signals and it means that you can use any old
FM radio or SDR to do determination of a direction.
So the problem is that once you take everything
into account, here we have microtuitous,
signal transduciton.
You would have to do it at a fast rate that would be
physically impossible.
(Laughter.) So what do you do instead?
Electronically you have a fixed array that don't move
but switch in between them electronically using
an antenna switch.
What it means is instead of having continuous motion
you do those secret steps and end up with the same response
and you can filter that a little bit to end up with the motion.
This is your classic, homemade IDF.
It's a box you would hook up to an FM receiver and
the LEDs would indicate the direction
the transmission was coming from and this
is the internal component or system diagram.
The stuff in green is all clocked together which means
that it's synchronous and it means that certain frequencies are introduced
into this signal and you need to focus in on the one to figure
out the direction.
This is the circuit diagram for reference and you're going
to look like maybe a little bit weird driving
around with all of this stuff hanging out of your roof,
but hey that's exactly what I did!
(Laughter.) I went color, I got an SDR, and I used mapping software
and I got the Dopplermobile happening, so I made an antenna there.
If you recall this diagram, all that is done in software and all that
is what remains after doing all this in software.
So this is what you use to transport windows with, I cutout
the tin, put elements on top, put it into an antenna switch that I got
as a free sample of from an RF company
and ran it through so the clock that was controlling
the SDR was controlling the antenna switch and
the beauty about that is the frequency that you get
out that reaches the computer is synced to the rate at which
the antennas are rotating so you can narrow in on one that is guaranteed
to be the signal of interest, the Doppler tone that you can
determine the phase from to determine direction.
This is the receiver, I had two laptops in the car, one doing the tracking,
one doing the mapping, flow graph, I won't go into details but you've got
the source coming in, you generate your reference sign wave
and the Doppler tone you extract from your incoming RF and the trick
is that you compare the phase between your reference sign wave
and the sign wave that comes in from the Doppler signal and
the difference between those phases will give you
the direction of your signal, that's the trick so it's
a phase comparison with a known reference.
So if you look at the FFT of your incoming signaling you see how
you have the peak there?
That's the Doppler tone.
So you take a reference, which might be the blue one and
the green one is the Doppler tone that you've been
able to filter out and determine the phase there and that literally
is your direction of arrival of your signal.
So I thought we would test it, we picked a big tower, drive around,
X marks the spot for reference and every time I drive
around and stop and take a measurement,
after a while it ends up roughly matching up on the red.
The thing is you have to be careful because RF
is black magic through and through.
The area highlighted in green was actually when I was
coming down from a hill into sort of a lower portion
before another hill and the RF waves would bounce
off the back of the hill behind me and creep up sneakily on top
of my array on top of the car so the direction was behind me,
because that's where the main wave front was coming from.
As soon as I came over the next hill, I ended up having
the direction coming from directly in front of me which was
the correct one because there were no obstructions so
reflexes are important to deal with and to filter
out from your measurements.
So I repeated it again, this time in Mountain View,
that's where work formerly was and you may know
of a big company based there and they have cars with all sorts
of stuff attached to their roof so I thought I would pay
them with a visit with a car with stuff attached
to its roof (Laughter.) So I went through a drive down Shoreline,
through Google to trying to pinpoint this particular
radio transmission.
That's the Doppler approach.
It has drawbacks, it's okay.
But you can use the four antennas again and
instead of doing this phase comparison you can get down and dirty
with math and the one of the popular algorithms,
and you use a modal and you have an array manifold which models your
antenna set up and the peaks will give you the direction of arrival,
so you can imagine those points there on the X axis, and
as your wave front comes in they will all hit each antenna
at a slightly different point in time, and then you can determine
the phase difference between the signals,
and you can durf I didn't say durf, did I?
(Laughing).
Maybe I've been talking too long, you can determine what?
This is pretty good!
(Laughter.) Thanks.
(Laughter.) BALINT SEEBER: You're welcome.
So this is finding that array response.
Here I think I had just four antennas in a row, you tell
the model that you have four antennas in a row, you express it as a matrix
and it will go through 360 degrees and simulate what
the array response would be and when you get
the incoming signal you run that through each
of the particular degrees and that goes from 0 to 360 across the bottom
and you have the peak that matches the array response and
the advantage is you get higher resolution
but you need as many radios as antenna is now.
This is sort of a higher end SDR that research has
that is called a quad radio but I had fun with it,
you get those missile launchings, and the idea is it acquires you
and locks on so if you look closely, I move the radio around it will track it.
(Laughter.) Wait for it!
I said "fire!"
But there was no audio, maybe it was turned down.
I said "fire" and when it detects that it shoots you!
(Laughter.) So I set it up there again.
This is not the cheapest SDR but I checked in the boot
with a big SLA battery to keep it powered while I was driving
around so here just to Testing BALINT SEEBER: You
can see as I walk around the car the compass traction my movement.
Testing, testing.
BALINT SEEBER: So if I go for a little drive here,
then once again I have repeated that route through Google's campus
but I picked some other frequency and I guess it's keeping good track of it,
except for the down below, but it will reflect that just as it would
from the primary direction and this is the radio and
if you have another set up you might connect two
of these together with a single reference
and you can create the same sort of thing.
All right, if you're going to be driving around like this, have
an amateur radio license, I had antenna structural redundancy
that I had a string, I can't drive more than 40 miles an hour
because I get serious vibrations and it's scary.
It's good to be clean shaven, I guess!
And if you have any radios that are used by the police like the Motorola,
it's good to hide them because unfortunately or some
of them don't know they can be used as legitimate ham radios so
they get suspicious when they see what are you listening to?
The cops?
What's going on?
And because I had the wires coming in through the window I couldn't open
the door so you have to turn around and disconnect the wires
in the back, take it from me!
(Laughter.) So more security stuff.
Do not try this wherever you are.
So pagers, like a doctor, I will read the first bit, and the you can read
the next bit.
Is your arch nemeses in the hospital?
"(Laughter.)" Need to distract security?
"All these were sent out I can't quite remember now
but it had to do with rotation of guards or shift changes.
So in Mode S" Do you want to reach cruising altitude quicker?
"(Laughter.) So as I said, all these things, they're all unencrypted,
it's illegal to transmit but the protocols are there,
and you can implement it with these sorts of ols."
Do you think the pilot made the wrong choice in deciding to land?
"(Laughter.)" Did you want to display a message
on everyone's radar screen?
"You know there is ASCII art.
If you send out enough transponders
with different IDs, then you could probably
spell something.
This is the aid car now, So this is the text messaging from the aircraft."
Do you not want to fly on a particular aircraft?
"These things are automatically sent.
They are incredibly complex and thorough in their self checks.
It's interesting to see the reports they send."
Was the flight you were on a little bumpy?
"
Do you want to message the cockpit privately?"
There are 4 assigned labels that address the cockpit printers.
I doubt they print anymore but the message might be set.
The uplink power control controls the amount of power sent
up by the ground, and it's usually kept
at a minimum because it's very costly.
Depends on the weather, as we established.
Heavy rain, costs more.
You can turn your signal a little bit higher than yours
and it actually says a malfunctioning uplink control system
can damage a satellite wave amplifier.
This is the signal from earth and sends it back down.
If you end up sending a higher signal than what it can take,
it could bust.
You can hot wire a complete transponder.
But you need serious equipment to dot hat.
FastTrak, you don't want to pay another toll in your life ...
You want traffic management to think there is some kind
of issue happening.
You could just stand there.
Do you want to keep tabs on someone?
Set up a reader and see if they drive past.
You drive up the highway, and you can be read.
You can get an amateur radio licenses
and do experimental stuff there but elsewhere it's not a good idea.
Thank you very much.
(Applause.) If you would like to know more information,
I put a lot of stuff on my Wiki, my main web site, documents, projects,
a lot of the things like direction finding and stuff I keep
on my GitHub, and if you want to email me, there are my e mails
and Twitter handle.
AUDIENCE MEMBER: (Away from mic.) BALINT SEEBER: I sent
a huge deck to DEF CON.
The deck that I showed you today has been significantly upgraded
but in time I'll post those as well as the videos and things like that.
AUDIENCE MEMBER: Thank you.
BALINT SEEBER: If you have questions come and find me
and talk to me.