BRENDAN: my name is Brendan O'Connor.
There are three take aways
the things we carry
at every single level.
We as a community have forgotten that
to be a goal.
Whoops, the Goons are noticed.
Always!
(Cheers and applause!
) Raise your hand if this
(Laughter.) You, the man knows how
I got to get somebody tall to do that.
The last guy
so cool your jets.
I want to introduce you to 2500
(Applause.) So please, welcome
first time speaker, congratulations!
(Applause.) Up yours!
Oh my God we have
all afternoon!
BRENDAN: God, I love DEF CON.
Now the gentleman
We have forgotten to protect ourselves,
many on the stage saying we have
the evil hackers and they're using
we have forgotten, it's important
of our users and it's become
Data into encrypted streams in order
and we will show you examples later.
Final take away,
into the crowd.
Everyone has seen
in which hooking up a cell phone
and someone going, oh my God
into a mall we'll never find him there are
That doesn't work and it doesn't work
going to work for everybody
If you can put together
everyone in the mall,
out important information
and use it against them.
We need fundamental changes
to request too much data and then
as someone who has worked
of transactions, we can't leak
because our clients are
If we don't do this we have lost
adversaries and there
a software developer.
Why are we doing this?
These guys have tons of information
through Rio and there are hundreds
And I was recently told
is the government's area,
This means two things.
One, a lot
is terrifying and, two, I am
Not just because I told you this
my sister well enough and
and it's too late!
Those of us in the room know that
at securing things other than throwing
But the government has no mop reply
The good guys have it.
But that's not true.
We may look
in a bunch of countries that are not
repressive governments and
I'm hearing "the NSA needs that"
as only the government can spy on us.
We hear that sunlight
A recent study showed that cops
less likely
in complaints, and 60% les likely
When they did use force those officers
in using the least amount
This affect was not duplicated,
and their forces refusing to wear
If we can see what's going
at our government and make sure it
and safely as possible.
If not, we are subject to blackmail,
See, for example, Aaron Schwartz.
So we need sunlight,
We don't have time to wait
Anyone know what this photo is?
AUDIENCE MEMBER: A nuclear test.
BRENDAN O'CONNOR: It's
Tsar Bomba!
We need to blow up this situation
to every single developer
is no longer an acceptable use
So I get called a stalker, not this stalker,
an adorable kitten that
I get called this kind of stalker.
We all do creepy work in this room,
to raise the issue
of privacy
not just the "good guys," such
for good or evil.
CreepyDOL
combines wireless sniffing,
visualization and grenade style
to do realtime personnel tracking
on a major urban area in realtime
It is stalking as a service.
That's what we're here today to see.
There is one complication thought,
or Andrew Auernheimer.
The United States government has
against legitimate security research,
of us think that's probably not
A lot of people in this room don't
because he's a "troll" and
things about nice people.
But it doesn't matter.
The thing about criminal law
at this apple.
Mighty Casey gets three strikes,
We get one in the 3rd Circuit,
We need to take action
researchers even when they seem
but for all of us.
If everyone in this room isn't going
by this time next year we need
Otherwise, hey that was only
Except that Weev was in Arkansas.
They dragged him
because they thought
a more favorable hearing, and
Every internet connection goes
in the United States, so
up in prison we better protect Weev.
This affects
First, this side note: I wrote this
with all the people on this list,
a great, hacker lawyer,
of people in this room, or
Matthew Green, professor at Hopkins,
Jericho "Space Rogan" Mudge.
These are people you have heard
be supporting even
This affects everyone one of us,
professors or itinerant hackers.
And in the meantime we have
because we cannot trust legal actions
Therefore, CreepyDOL has not been
because even though every court
is A okay, same as sitting
the guy next to you talk too loudly
about raising his next
which happens way too often,
on the government not prosecuting
I leave the next step
to a braver researcher.
Since I'm
a serious disclaimer.
(Laughter.) "This is not intended
Let's talk
CreepyDOL is not CFT work.
I had to make this extremely clear
DARPA tries real hard not
out because they have had a bit
in the last couple decades.
But two CFT contracts did let me build
system, which
and the visualization system,
clear at the moment called NAUM.
So thanks, Mudge, if he's here,
with his face on 'em with pride.
And this is a brief roadmap.
First let's talk
for this project.
First we want
from wireless,
in the middle" partially
to the "bad" kind of federal prison
because design constraints help us
And it turns out that doing
like the Pineapple Jasager attack,
We can do this without them.
As you turn on a wireless device,
of all known networks,
As soon as a device thinks it
all of its sync services will kick
That means Drop Box, iMessage
A lot of those
get cool data from and
that have public wifi,
of cool data pretty often.
Over unencrypted wifi
that's what we mean
can see everything they're talking
Sometimes they're talking over SSL,
is in theory encrypted, but it turns
is "us" have been leaking this cool data
and I don't know why.
As they set it up or as we look
to see neat data and the cool part
an awesome primary key we can just sit
So maybe you make one small identity
maybe halfway around the world
with little boxes you drop another
up a profile of who you are,
is not that long range so
on top of me.
Once we get one to ten
over an area we have time
I know your patterns and practice
to you and if I want to blackmail you,
and that you most don't want exposed.
This
knowledge is power, right?
Our second goal
without communications.
It's easy to say I will go to Verizon
The problem is that is expensive
a lawsuit student and when you go
I would like to apply for a grant
oh I'm doing Distributed sensor
they back away slowly and then call
(Laughter.) My Dean
will not mention her name on stage
to fund my work anytime soon.
The other reason we're not going
the other cell provider is it provides
out who I am.
They pick up the box, read the ID
Who has this device, we would
the United States government.
The tele come providers have
in their offices just created
Finally we have a third goal which
the slides make tough "D" cry it's
When one has
to people this is a problem.
It's the difference
and writing a zero day and
When every script kitty sitting
the entire city, maybe we
In the meantime we are not.
Let's talk about background, couple
One, I would like to pour one
people everywhere.
This works kind of like one
because mostly they're this ultra low
they he work well,
and they sacrifice everything else
He they work in horrible language
But they sacrifice cost,
of $600 apiece each.
That's not good.
I want something that I can write
in Linux and an order
And large scale surveillance,
assume that
all of the problems in CreepyDOL
they will be happy to do as soon
so thank Mr. Snowden, pour one
because this stuff is really hard!
Let's talk about the keep architecture.
First, hardware 37 this
a terribly tortured acronym
and they love acronyms.
The same thing that
decided they could sell it if they put it
When those failed I could buy it
like to thank them for my research.
The other thing is it fits
how many of you checked theirs
for me?
(Applause.) This is the old version
for the F bomb version 1 as it is for two.
If you can look at my hand and see it,
of good hardware.
It holds a Raspberry Pi, model A,
because every hacker needs
I would like to apologize
I bought 10% of the U.S.
supply of the first round of Model As,
they were only going to bring 100
so I'm sorry I think I screwed
There is a cheap plastic case,
adapters that occasionally electric cute
(Laughter.) It just happened last week,
"only buy original Apple" so thanks,
and hey I plugged it
That's the idea.
(Laughter.) So why two wifi?
I don't want to bring
so instead I'm going
centralized communications.
And we connect to local wifi.
Brendan,
is there municipal wifi that actually
No, there is wifi that doesn't work,
is a lot of coffee shops and bars.
Every random dive bar has wifi now
A lot
agreements, though,
your imbedded code sad.
So I wrote
It clicks on buttons so you don't have
Available in GitHub right now,
And again, thank you DARPA.
(Applause.) Now we're going
building from the bottom up.
We talked about hardware,
about the middle layer,
REDDI CLE
and control software, designed
This is the first
I mentioned.
I made a whole presentation last year,
There has been a whole rewrite.
It still works the same,
and occasionally it doesn't break
on my keyboard.
Each radical node runs Couch TV,
nicely, plus Engine X, Torr,
software, a couple of Ruby Scripts,
is Open Source it let's notes combine
to every other node and we can do data
in the hope that we can get the data
with guns shoot the box.
To make reverse engineering radically
you boot a node
a full description key, reads it,
the pin out and you throw it
at their head.
Once you've done that,
Boot on it, you're good.
If you pull it
the encryption keys.
As for Cold Boot, here is the thing.
How many people dump liquid nitrogen
in their house?
There's two people who dump liquid
I would love your house!
For the rest of you, as soon
to dump liquid nitrogen
we have all won and we can go
CreepyDOL is just
they all do the network thing so
to one place it's as good as home.
Let's talk about the design
It's a creepy doll, right?
It's going to do as much as possible
They have 256 RAM we don't need that
the reason we do that is to be nice
donate money
We don't want to send them home
to TOR and no one will track him
at us so Distributed query
all the data, on the PCaps we save
we never send the PCaps home.
We do centralized query
types of questions,
for coffee at 8:00 in the morning
in the afternoon once you drag your
We do these things
because even though Distributed nodes
they don't have hard drive storage,
to do these data mining queries back
out of the grid as fast as possible,
and then we have a centralized point
It's not command and control networks,
And I'm serious about the X Box,
We call this NAUM.
Let's talk about the observation filters,
they are per application and they take
is for drop box, okay
good to know.
There is another filter that's processed
Look at the last line this is a screen
is more data than
I know exactly what version
but if you didn't that would be useful.
I know what version
to exploit it remotely and I have
In addition
There is a lot of data and media,
Observation filters are per service,
is that we build up tiny bits
and co less them
We get a little bit
from the feed reader, how many
after Google reader collapsed?
About a quarter of you.
How many you watch the stuff
Nobody.
Turns out the ones that I switched
in the clear.
Weirdly they transmit my real name
an authentication cookie
of Fire Sheep because a lot
with Google Reader,
out of your online dating profile
and you are disgusting!
(Laughter.) Back to the NAUM filters.
There are the nosiness filters and
Nosiness takes a little bit of data
with user names, email addresses,
it checks
and even though we have been
about the forgot password
they have that system.
I could then before break
things and be more or less
Finally there is mining nodes
and do pattern and practice.
I mentioned before where do they go
that's one thing,
For instance,
around a city, I see it everywhere,
What if I see another device that only
every time it exists it's
as the first device that I saw.
So what happens
and a second device turns o works
off and I don't see it again
That's what we call a laptop.
Once I've seen that for a while,
instead of two.
So even if you thought, hey,
but I only do my creepy stuff
because Brandon will never see me,
the shops that you go to,
I didn't know you could buy them that
is the CreepyDOL architecture,
they're connected to every other node.
They go to a sync node and the idea
for information propagation
of these boxes I run it
It's job is to send
in another storage mechanism.
I have two different storage that I use
and it's an all in memory
if I had big data I could throw them
in another one and it allows me
Then I have translation
into a saner format.
Finally I run them
down in parenthesis there it's running
and my people are real,
I'm getting GPS data so I might
You the Unity game engine it's free
The second note, Java Script
by a proprietary games manufacturer
into the dot net Lang beige
and it's a horrible debugging platform,
Java script errors
by four other language
is it works well the guys
If you have ever tried to write utilization,
say put this here and it works well you
between latitude and longitude
or Windows, Linux, Android, Wii
Part of the side affect is you said wait,
how do you hold that?
I don't.
That's why we have the servers,
run it on an iPad and don't have
They talk to each other
over unencrypted HCPD (Laughter.)
and see this take place.
Before we do that we have test
how we're all terrified?
If you're not terrified you're not paying
on everybody in the city, which I hate.
This doesn't mean we can't do valid
to see me so you are going to see
in different places and I have tested
of nodes and it works incredibly well
So we never collected any random
because even though it's apparently
of anything anymore
down the third circuit.
Let's watch it, Unity, it's not running
Is it running?
You are going to see a few things
to see them exactly in time.
First you will see the dot move
load, and I will zoom in and out,
and it zooms the data and the map in.
You can hover over nodes,
or how many are in a room
and they're Mac addresses.
At the end,
click on one node and then you see
(Applause.) See,
from a Google feed it's not Google
from an online dating sight whose
because I've heard
even though they haven't heard
You can see that they used log
for every screen sharing site
We have
in the clear exactly what location
is so I can make sure my sensors are
calibrate my own network it's awesome.
Let's talk about future work.
What other applications can we do
Well, one,
Those of you who participated
about "Occupy Wall Street"
movements, have noticed a lot
a mysterious stranger slips
and the mysterious stranger is gone.
It's amazing how this works.
You can use counter infiltration though,
hey, if anybody new shows
scream "bloody murder" so when
bloody murder" alarm goes off,
with the Blackberry.
He's the Fed.
(Laughter.) (Applause.) You can also
for operational securities training.
You can say if I throw this
for devices that I know my agents are
they leaking?
How terrified should I be?
Here's a hint: Really terrified.
You don't need
If you are a huge corporation
who wants
home
spread these over the town where
Every time one of them connects
to send your trade secrets
will know it, so we
through the complete and total invasion
(Laughter.) This is the trade
with and I'm not sure why.
We have accepted that we have no
that our devices are going
to leak increasing amounts of data,
on CNN and say "I don't know why
Here is why.
I don't want you going
doesn't know not
on your wife
let's say I live 6 blocks
around that,
to do something wrong,
to do something wrong and I get maybe
People have been doing this
Here is the difference.
I would have to pay a whole team
to watch senator so and so
So for the cost
in Vegas I can throw 10 or if we want
the person with a weak wallet,
they don't want everyone in the world
Except for Anthony Wiener
and rallies, there is a problem
of evidence during crack downs.
It's hard to know who was
in and take you off, it's hard
they should save in the jails.
You can have it scan your friends
you're offloading your data so that you
which maybe
in jail than they need
an adversary knows what this
they're probably going to unplug it
to happen how to use it doing
on random protesters, even
a kid for walking while drunk which
in college" we're safe
for a long time and that means we get
Let's talk about improvements.
We can scale up,
and because they're not connected
but over the local coffee shop's wifi we
and have five or six overlaid networks
to each other
can do geographical distribution
to delete it off fast enough,
up the networks.
Each network then has one data sig
all into the visualization.
Visualization is good to a couple
if you've got better RAM.
As I mentioned, scaling
especially because there
for Shark that lets you run
This means that, yes,
It's from the cloud so it must be here
(Laughter.) There is other servers,
The visualization is harder
to how many nodes
simultaneously
of books by game developers
they don't check your cred
If you saw the black nodes versus white
nodes but they also do limited distance
in every FPS game you can't see
this allows us to scale visualization
goes everywhere in the world
for 10, 20, $50,000,
is not that big of an investment.
Won't someone think of the children?
(Laughter.) And everything they're
(Laughter.) If you are, you're
(Laughter.) Finally, we can add a lot
How many
with software to find radio
Quite a few people.
There are $10
to find software defined radio
of gigahertz for not a lot
to anything, stalk the Goons for fun
with restaurant pagers or anything else
We can work
to do with tools like Refer
on wireless security and at the end
in a city you don't really need it
We could do active attacks
to make sure devices connect to us
We don't have to, and
a weird address and you're A 6,000
you're connected to,
and then be more subtle.
Finally, mitigation.
The problem is we have to sacrifice
to mitigate this (Laughter.) Yes,
The leaks are at every level
I do mean every, single level.
The bottom layer,
of networks is an acceptable way
that's a terrible idea, right?
That's in the protocol,
the protocol that would be
out engineering thugs to hurt us!
They have to fix this
convenient to walk
to wifi without every having to turn
to iMessage and download them
from Anthony Wiener, I'm sure
to be promulgate a few protocol
Hey it's going to be less convenient
but you should use this
There is also a problem
A lot of mobile operating systems,
because that's what I use,
so when I connect to get a new wifi
on the VPN
That is not possible to do on ios.
You always have those first few
with data
and they're transmitting everything else
To the o/s 2 has to be protected.
I found an online shopping application
It's not Groupon right?
It's not something that involves my
they can send me targeted ads.
No one should have unencrypted
to how much that new Manolo Blahnik
but for some reason everyone
access to what os I'm running where
That's a pretty weird trade off.
It's our fault,
to protect our users,
This is everyone's fault, so no one
for us, right?
It's just status quo, right?
The status is not quo, for those
Horrible: "We cannot tolerate this level
Horrible fan!
As consumers we need to do better
to the world to do better.
One final digression.
At Smu Con 2013 there was
about academics and researchers.
I have split both in my career.
I have an academic degree
an academic degree in law these days,
without any academic support most
We need to be able to have a way
to work together, and part
to find a way, any way
the same mistakes over and over.
Everybody who has done
project knows that you spend
of months you do something
of months you say, oh, God,
Couple days ago,
a new hacker archive that you can
Tweets, blog post,
We will have mentors that
to the next level, or the next level
the next "Woot Conference" which
We want to be able to promote
to have a permanent archive so people
it will live beyond their own time,
if we start losing hackers left and right,
We need to "fail" better.
In order to do that, we need your help.
It's at HARK.net.
where you can contribute to.
Finally to those who have asked
the CFT and for my law school
to make me work on law school most
And I'm finishing law school
If you have an idea that you would
an email, it's on the slide.
Seriously, we want to be able
not just academics' work, live forever.
If you want to live in immortality, go
Thanks very much.
(Applause.) I have two minutes
AUDIENCE MEMBER: (Away
IP cameras?
You could do that that's
Repeat the question?
The question was why don't I integrate
and stalk from that.
That would work you need
of the O parsers,
into the device which would be cool
to bring a Raspberry Pi aboard.
AUDIENCE MEMBER: Have you
about using Unity ID (Away
So the question was have I used Unity's
the networking
I haven't, because it's not flexible
the way to do that would be to go
by everybody dumping
and tagging.
So that capability is built in,
Everybody else grab me,
off stage in about 30 seconds.
Thanks very much.