And I always thought that my first talk would be on some amazing bug
they found, but all my bus are under MDA unfortunately, so I'm here
to talk about something else that I discovered
not even working if info sec, but it stuck with me
for several years and now we're here to talk about its security implications.
And how many of you were at the talk with Jen Savage talked
about having a toy bunny that's a webcam?
That reminded me of something that happened when I was
6 or 7 years old.
My father had gotten a radio scanner for listening
to the emergency radio, the police and the fire and he was messing
around with it and he accidently tuned
in to something that was not the police or
at least you hope it wasn't the police because it was
a woman screaming for mercy and a man threatening to kill her.
He had tuned into a baby monitor and he called the cops and
they came and they saved her and there was a happy ending.
[APPLAUSE]
The thing is a baby monitor is an intentional emission.
It's really easy to forget that it's broadcasting
to the entire neighborhood.
I bet you a dollar that man never thought
for a moment that was a bug broadcasting
to that neighborhood in the room as he threatened to kill his wife.
It's a good thing he didn't remember that.
But it's a good thing for all of us to remember in general.
So we are here to talk about unintentional radio emissions.
The one that it doesn't say on the box it is doing.
And the spoiler alert?
Every device that you own is screaming its name
into the infinite void on the magical waves.
And the whole slide show doesn't have an animated background.
I promise.
My name is Melissa.
I do binary analysis.
I'm accused of destroying info sec
because I bring too much pink and glitter.
I don't have pink hair in real life.
Some people have told me should remedy this.
So what are we actually talking about?
We're talking about how you without about formal training
or expensive equipment can learn how to check what sort
of noise your devices are generating.
Radio emissions, they're magic.
If you actually need to know how they work, talk to a physicist.
I'm an engineer.
But all of your electronics are naturally generating them.
They're everywhere.
They are filling the air.
There are people who believe that they infiltrate their head and tell them
to do bad things.
That's an open question of science.
Fortunately, we have an area in West Virginia reserved for them.
There's no cell phone towers and no FM music stations.
There is nothing.
It's a horrible place for a teenage girl to be.
That's where I went to learn about radio astronomy.
I will talk about that later.
48 hours straight with no access to the internet at all.
And these are the devices we're going to be using.
You can get these for as little as $10 and yes it runs
on Linux and yes it runs on raspberry pie.
There are radios that have a wide tuning range and dump
the raw signal to software processing so you can
process it.
You really don't need ton anything about radio engineering.
I had become a radio engineering script kitty.
It's like wow.
I don't anything well, I know a little bit about radio science.
But you have ten bucks and you want to order from China
if you're not you have 20 bucks.
There are python bindings.
I wrote a script that's really easy and anyone
with basic technical knowledge can get into it.
The chip set they would recommend is called the RTL 2832 U.
And they are mass produced forward tuning into television
and various countries, which is why they have such
a broad tuning range.
They have no intelligence on the chip, which is why they're $10.
And if there's anyone who has
a problem with the word radio dongel, I am sorry I am going
to be saying dongel several times.
[APPLAUSE]
These what are they look like on the inside.
They're very simple.
They're very easy to fry.
May my first one rest in peace.
It met its demise when I plugged it in.
So there are different models and they have different ranges,
but on general, they go from around 50, 60 megahertz all the way
up to 2.2 gigahertz.
So, this is a huge range and a huge value for a $10 radio.
A couple of years ago, it would not have been accessible
with quite an investment.
You can bulk order them from ally express.
It's a little bit shady, but I have gotten
all my packages so far.
They have a pal female connector, by the way, not very common
in the states, but your Radio Shack should carry
connectors and plug in bunny ears like grandma used to have.
And why do we care?
I think the MSA might care.
You heard of tempest?
That's real.
They've been doing this for decades.
This is courtesy one Mr. Snowden.
It says communications and other information that's not
communication such as equipment emanations.
Maybe they have a secret meaning, but I think that sounds
like radio emissions of devices.
Sounds like they're storing them.
If anyone in the MSA would like to tell me different,
I would be glad to discuss that with them.
[INAUDIBLE]
MELISSA ELLIOTT: Another common misconception
is that tempest only applies to CRT.
The first example of tempest was a tele typewriter.
A typewriter that could recover the letters that was being where I went
from across the street.
You can still do this.
In 2009, I can not pronounce French names.
Please forgive me.
They released a paper eavesdropping
on normal USB keyboards getting full plain text recovery
from across the office building.
So, this is real.
This is an actual problem.
It's not purely theoretical.
And you deserve to know that.
You deserve to be able to evaluate your devices
for how susceptible they are to it and this is a lot of fun for $10.
And you probably aren't break anything laws, maybe.
So about that, there are a lot of laws about radio tuners.
They vary from place to place.
They are basically arbitrary limitations on certain frequencies if you want
to check them out.
Just tuning in to things that is mostly passive and mostly difficult
to detect.
You want to check out the slides goes
to graduate students detecting passive tuners.
So they're not entirely passive at all.
But play it safe.
Obey all laws.
For example, one that applies here in America, scanning receivers
and frequency converters marked for use with scanning receivers shall
be incapable.
And it goes on to say do not tune into areas reserved
for cell phones unless you are an actual cell phone.
So don't do this.
Do not type the number 824 and hit enter.
You have a lot of fans.
So wind it's your first time speak at DEF CON.
MELISSA ELLIOTT: This is true.
How would you like your Jack Daniels?
MELISSA ELLIOTT: I'm afraid I cannot drink, sir.
Is your husband in the audience?
MELISSA ELLIOTT: Right there.
Do you drink, sir?
Yes, I do.
Get your butt up here then.
Has he been to DEF CON before?
MELISSA ELLIOTT: No.
Your first DEF CON?
Yes.
You have to do a double because you're both Oh, that's fine.
[Laughter]
[APPLAUSE]
By the way, we have decided to brand this little exercise.
You heard of spot the fed.
This is shot the n00b.
There will be t shirts next year.
To everybody that's new at DEF CON, cheers.
Cheers.
[APPLAUSE]
Have a nice talk.
MELISSA ELLIOTT: Thank you, sir.
I was afraid I was going to get van there for a second.
I swear that's just as gift.
I drew it by hand.
I never actually typed that number in.
But no one's ever gone to jail for incrementing an integer.
We're safe.
So, I manage to go most of my life not knowing that
all my electronics were leaking all of the signal that details what they're
getting up to in their private electronic lives.
The reason I found out is because I went to play with this.
[APPLAUSE]
[Cheering]
This is the green bank telescope.
It is considered the largest mobile object in the world.
Ships don't count because they get to float.
It is the size of a football field that tilts from horizon.
They use it to listen to outer space.
So they only let me play with the 40 foot dish, but I bet none
of you have a 40 foot dish.Y is what I learned while I was there
is their biggest challenge to gettings science done
is the very electronics that they need to measure and process
the signal because those same electronics blast
the signal out of the sky.
Just to give you an idea, they had to get a special budget approval
to have a micro wave oven.
They have a microwave oven.
Inside another faraday cage and inside the room, another faraday cage.
That's how much they had to shield things to heat up their pizza
at 2:00 a.m.
I was with a girl who had a panic attack because it feels
like you're being locked away forever.
You go in and there's another door and you are sealed in this copper room.
Everything is self contained and then, yeah.
I couldn't blame her.
And speaking of noisy electronics, I have brought my little friend.
If you follow me on Twitter, you might have seen it before.
This is the $50 network from China which I caught on fire.
We will not discuss how it caught fire.
It's not relevant.
However, what's relevant is that it has no shielding.
I'm pretty sure this violates FCC from rule 1 to the last.
They have a conniption if they knew I imported it.
This is the part where we get to the live demo.
And in the front row, he's not going to turn on his hack RF.
So I'm going to tune to an FM radio station.
Let's see what's here in Vegas.
I don't want that too loud on you.
So that's what music looks like.
I have no idea what I just tuned into.
[ Music ]
oh, no.
What are those blue lines?
So, do you see those little spikes that weren't there like a minute ago?
I was afraid that the contrast might not be very good,
but there are lots of spikes that weren't there
until I turned this on.
And there.
How's that?
Those, if you zoom in, there's lots of natural jitter, but they are
between 32 and 33 kilohertz apart.
Does anyone know about anything that has
a clock speed about a natural clock.
So a natural clock sorry.
A realtime clock has a freak wins usually of about 32.7 68.
I had to screen shot all of this because I was convinced I was going
to set it on fire again, which didn't happen.
I am afraid the charger isn't working anymore
as of an hour ago when I plugged it into a strip I found lying
around at DEF CON.
So this may be the terrible laptops last stand.
So there's
[INAUDIBLE]
and not dancing around.
So the realtime clock that's probably what I'm picking
up and it just blasts its existence all over my radio FM radio stations.
So okay.
It has a realtime clock.
That's amazing.
Everything does.
How about something a little more interesting.
How do you look for interesting things your electronics
are giving off?
It's mostly guess work.
And a good place to start is by randomly multiplying numbers
together, which worked out really well.
So, the screen on this little thing is a stunning 800 by 480.
Pixels, they're three bytes, 24 bits per pixel.
They're being given a ribbon cable inside.
If you add all those numbers up, you get about nine megahertz.
That's a little bit below what my radio can tune
into and there's another factor and that's the refresh rate.
I don't actually know the things refresh rate.
It does not report the refresh rate.
It is pirated.
But I haven't seen an LCD lower than 75.
That gives a range of 150 megahertz to SIFT through.
There are several places I can pick up the signal, but I will show you
the one that I think is best.
Does that look like something?
I'm logging in.
I'm sure it's really secure.
Oh, did it change?
You will have to trust me.
It was a very bland log in screen and now it has
a very lovely Pokeymon wallpaper.
You will see the color change because I have a very,
very small antenna.
It's the free one that came with my radio.
So, ah, I'm sure the people you actually need
to worry about do not have the free 4 inch antenna that came
with their $10 radio.
I think I will go to some word processing.
And the signal went actually very flat.
It's mostly gone.
I will go to pirate PowerPoint.
So, thank you.
I do have other antennas.
[Laughter]
You gave me a loose connector.
All the pal female connectors don't stay together.
Good enough.
But I have the word processor open.
It's not very exciting.
Mostly white screen.
And this thing is slow as heck.
So office presentations.
Yes, I would like to restore this.
I may have cut the power.
And, gee, that looks different.
I have a nice checkerboard affect going on my Powerpoint.
It goes ah way and the presentation.
You cheated me.
So the touch pad on this thing is very treacherous,
so treacherous it ruined one of my demos.
I found a frequencies that when you touch
the touch bad, you hear buzz, buzz, buzz.
I come here to Las Vegas and it's gone.
I have no idea.
I will talk it up to it being so dry.
That's what seems to be the excuse for everything.
So now the full screen has
a checkerboard pattern and my signal has broken down to very discrete lines.
Now, you can recover the screen from this?
I'm pretty sure you K.
unfortunately, my radio sample rate is not very high.
But again, I have a $10 radio.
So there's my back up.
What we're seeing is the signal transitions
on the cable that feeds the screen.
I took this to one of my engineer co workers at home.
You say how would you explain there?
Oh, you're seeing when you get zeros and ones.
That's why when the signal is sail one color,
your signal goes away especially like black, it is zero, zero, zero,
zero, zero.
Very exciting.
So very specific patterns will create very noticeable
signal patterns.
It is there when the screen is off as long as the security
is off because I'm reading the cable that runs into the LCD.
Does that look like a checkerboard?
I think it looks like a checkerboard.
So that was the best I could manage
with my toy radio.
Wrote a python script, wrote out to their clotting API.
Maybe I'm doing it all wrong.
So if
the
[INAUDIBLE]
would like to file a request for their alga rhythms
of reconstructing screens, I'm sure they figured all this out.
So as I said, it's not just screens.
It's I picked up touch screen capacitive fields,
which they decided to stop working in vision.
As you can pick up buttons like the keyboards that
the gentlemen were scanning earlier.
The color of lights.
So you have green light, red light on your secret machine that's
locked away.
Yeah.
I don't do that.
Micro phones obviously especially wireless ones, ah,
[INAUDIBLE]
at the source box in conference.
I was running around recording people
from across the building and then surprising them.
You weren't in my talk.
How did you get that?
You can sometimes 56 up RAM.
So when I figured out I could see RAM, I hooked the antenna
around my neck and went around the office.
Popped into offices with all this equipment hanging
off my neck and said excuse me, sir.
You can tell me what model book that is?
Be like thank you.
What is she doing.
Basically you can pick up everything to some extent.
So like this tablet that I'm presenting on, it has 1600 megahertz RAM
and I couldn't find it at 1600 megahertz and then I found it
at 800 megahertz and I thought maybe that's because it is dual channel.
I've had people explain what that means.
I had I think 2003 was the last time I actually put RAM
into a computer.
All of the ones I bought since then have been tablets.
I know, right?
So this one is interesting because I don't actually know what's
being picked up.
This is my Mac book error opening Chrome from which it hasn't already
been owned and has in RAM.
I get the very interesting sports from across the room.
Sports being the technical term.
So across the room with my little 4 inch antenna I can pick it
up that it was open in Chrome.
It must be the processor and I ran
a benchmark distressed test in the processor.
It must be the hard drive loading all the cache files.
So I don't actually know what's causing it.
But it's there.
This is a like phone.
I don't remember who this is T.
might be in this test now.
But this was someone talking at source Boston.
When I say there was informed consent, I mean everyone knew I was
up to something.
[Laughter]
I maintained I was not violating Massachusetts wiretapping laws.
When I accidently tuned into the Blue Man Group,
that was an accident.
This is my iPhone when I'm connecting to Twitter.
I was able to find this tell tale signal.
The network here is really unstable.
A few megahertz up from my phone.
I turned off the wireless.
It is 3G.
Connect to Twitter and then for exactly
the duration that little spinning icon was on my phone, this was on the air.
I can see when an iPhone was actually
downloading data.
Now, hopefully my 3G connection with Verizon is encrypted.
If not, we need to talk.
But even if it's encrypted, I can still see what's happening.
Can I still see there's someone connecting over from Verizon
on a cell phone.
So different types of devices can be profiled
for their activity and after you know exactly what they do,
you can detect them.
You can see them through walls and tri annual them
through outer space.
Almost like transmitters because they are.
So it's trivial to distinguish when one of the machines is idle and
about it is active.
If you study it, you can distinguish it
through all kinds of active states.
So what aye been carrying around the convention, an iPhone 4S,
a nexus 7, a Nintendo 3D S.
Do you know if anybody else has that combination
of gadgets?
If you do, we should probably be friends.
So, if someone knew exactly what my brand preferences are and
they could pinpoint me in the crowd if they had all the equipment set
up ahead of time, which is again we're talking
about the adversary, the NSA I mean China.
[Laughter]
So even if I turn off Wi Fi and blue tooth, this is still possible.
They say turn off blue tooth so they can't see your phone.
It helps.
You're no longer screaming at top of your lungs that your phone is there,
but you're saying my phone is here.
My phone is definitely here.
And this has been proven to work in the real world.
Now, this uses Wi Fi because that's the same across all guys.
It is loud and reliable.
The screen shot is of a system tracking people following
the Wi Fi beacons that their phones are giving off.
The phone can core laid to the person
by the phone's Wi Fi signal.
You supply heard that Nordstrom trialed this and people found it creepy
and they stopped.
It is implemented and it works.
They said they stopped.
Gosh.
That's what I get for trusting them.
So, this is why the paranoid types are like take
out the battery.
Don't just turn off the phone.
Take out the battery because they're worried
about this sort of thing.
So I'm going to take out the battery on my IM.
Oh, wait.
My iPhone doesn't have a removable battery.
So what I can do is make like a shop lifter
and get some booster gags.
Not suspicious at all.
You can find them on the internet labeled
as cell phone blockers or some blue column
like cell phone etiquette wrappers because your cell phone won't ring
during dinner.
You can use tin foil, but I found that grocery store tin foil
I had to wrap around like 6 or 7 times
before my iPhone even lost its wireless signal.
I would recommend getting this stuff advertised for blocking this stuff
and you can get the radios to test if it's working and
they didn't sell you shiny cloth.
So what can you do?
You need have a completely private talk.
Empty everyone's pockets and put everything
in your microwave oven.
Do not run it.
And close the door.
A microwave oven is not 100% effective,
but it makes a pretty good difference considering it
is 40 bucks and you already have one or two or three.
But they're only rated to shield you
from certain frequencies enough so it's not dangerous; however,
it works pretty well if you put an FM radio and then close the door.
You should lose your signal and not hear whatever music that was
we were hearing.
And snips off the cable off the back of a microwave should include it's
faraday page.
I did not test this, but it should work.
But I did learn if you want to put a device in a faraday cage
and then run either for power or internet, keep that cable
as short as possible.
So which I first hear I want to go test my like wave to make sure
if works, I put my radio in there and closed door and
the signal barely drops a little bit.
I finally realized I had a 6 foot USB cable dangling
out of the microwave oven.
It's a shielded cable.
It says so on the wrapper, but I could still pick
up my local radio stations loud and clear inside a faraday cage
because I had a six foot cable on the outside feeding into it.
I wrapped it all up and moved the microwave closer
to my computer so it was now six inches
outside and suddenly I lost the signal.
Yeah.
Those wires hanging out of the cage, they're antennas.
And also when something says it is shielded, it means it
is shielded enough not to break, not shielded enough to not pick
up your local radio station.
So you can use the $10 SDRs to check.
Okay.
Is this faraday wrapper for my phone actually working?
Is my phone giving off weird signals?
I wrote a python script to scan and look through signals
like when it was in the faraday cage.
I, I can improve it quite a bit.
How am I doing on time?
Okay.
Great.
And in the process, you will learn that there are trillions
of devices broadcasting weird things in your neighborhood.
You will start to lose sleep over them.
What is that thing that goes beep, beep every three minutes.
I don't know.
So, this is what my highly scientific set up looks like.
It says it's legit.
A microwave oven and as little USB cable as possible.
I recommend you use SDR sharp for this for MacIntosh and Linux.
GQRX, I don't know what that stands for anyway.
The first one is probability GANU.
After that, I'm lost.
And these are based on the command line utilities,
the RTL US library and you can use this directly or write things that uses them
and they have pretty simple python bindings.
I assume they are and I don't own a computer
of a CD drive for about five years now.
You can find them on WIKI media.
There's also the French and the German that have their
own guidelines.
But their key take away is core laid emissions are bad.
Core laid emissions means it changes when something
on the machine changes that leaks information you don't want that.
So, ask your landlady about copper plates for your bedroom.
I'm sure it will go over really well.
So my co worker said I had to throw in the store relating to LEDs.
List play.
Come on.
No.
Go back.
It shows the lights changing at work.
We have a rainbow tree.
It goes through the patterns and I like under it at work because it
is like your own private discode.
Shortly after I got my radio and I was delighting and discovering
things around the office, I sat under that tree and my signal is just
like (make noises) oh, cool.
I can hear what color is on the tree playing.
So I am sitting there thinking whoa.
Somebody walks by and say what are you doing?
I'm listening to the tree.
I can hear the colors.
[Laughter]
[APPLAUSE]
She's finally cracked.
We always knew she would.
She's cracked.
And so, ah, if this hasn't left you feeling a little more paranoid,
I don't know what else I can say to scare you.
So, ah, if security research all seems a bit twitchy, this
is why because we think of this stuff at 3:00 in the morning.
Oh, no, what if they come for me?
I accidently tuned in to the Blue Man Group's radio
and it slightly violated Massachusetts law enforcement that was creepy when
I tuned into their walkie talkies.
All I insure all right, Nancy.
Stand there, get down on your knees
and hold that position.
I'm like what I did just hear?
And then I figured out I was hearing their lighting group
practices, you know, like when we need dramatic lighting
at this spot.
It is like oh, okay.
Okay.
And I'm not even positive it was the Blue Man Group.
But I could see their sign from the window.
So that's probably who I tuned into.
Walkie talkies, radios, wireless phones, baby monitors, those are
all in the clear.
Please radio usually in the clear.
I heard some interests things here the other night.
It's not surprising at all.
But those are all intentional emissions.
They're supposed to do that and people don't even
remember they're doing that.
So people are not going to remember their device are leaking
all this information.
Journalists should take note.
Whistle blowers should take note.
All of you innocent people who never do anything legal should take note.
And you can take steps, very simple steps, wrap it in the foil,
take the $10 radios and give it a spin.
See what you can find and you might even find something really interesting
on a really good device that's effective less zero day.
You know?
Someone down the street can get information
and reach out to this device.
Do we see
[INAUDIBLE]
for that device?
I don't know.
And, ah, I have brought with me a few of these radios
because I got a whole crate of them
from China and I don't plan finding all of them.
I will give one to the first person who comes
up to me and tells me what my favorite color is and I hear
all of you shouting the wrong one.
(shouts).
MELISSA ELLIOTT: Who said orange?
[Laughter]
Larry cached dollar, I know that's you.
That's cheating.
Boring!
MELISSA ELLIOTT:
[Laughter]
But I'm probably going to head across to the Q&A room
if I can figure out where that is.
I almost didn't find the speaker room earlier.
I'm really good with maps.
Maybe you can come say something intelligent and thought provoking, I
will give you one of my radios.
Thank you.
[APPLAUSE]
So we actually don't have a Q&A room.
MELISSA ELLIOTT: What?
That's what I was told.
I was told a lot of things too, but they're still not true.
So anyway, just letting you know that.
MELISSA ELLIOTT: I was apparently lied to just like the Easter bunny.
I can't believe I tell my mother that.
Thank you, everyone, for coming.
[APPLAUSE]
I forgot to show you the Nintendo 3D S.
It makes a certain signal so you can detect
all the Nintendos DSs.
It is very, very dangerous.
Even a very accurate counted of how many 9 year olds in the area,
even my husband.
You're funny.
MELISSA ELLIOTT: Thank you.