RICKY HILL: So my name is Ricky Hill.
I'm a wireless and SCADA security
I work in the D.C.
metro area, specifically my office
I have done previous DEF CON talks.
On a similar vain,
with other wireless equipment
I have done (inaudible) eight years ago
a wireless access point and collected
It was good, but you can't get
in urban areas.
The other talk I did here that I have
They banned us.
They didn't give us permission
We had a balloon
he we were going to fly
That was five years ago.
Unfortunately the city banned us
So we went to church ten miles
Hey, Rick.
How's it going?
RICKY HILL: What's up?
So we have this tradition
You all know the drill.
RICKY HILL: No, no, no.
However, we have it
is a liar and he, in fact,
And, by the way, pull the drone one.
RICKY HILL: I changed my mind,
Raise your hand if this
You, the blond.
You raised your hand, didn't you?
I can barely see under these lights.
I hope your hair is blond.
Come on up.
(applause).
First time attendee, all right.
RICKY HILL: Good stuff.
Did you I'm telling you Thank you.
The drone gets one.
I told you to pour one for the drone.
RICKY HILL: It's already been
It is fairly waterproof.
Everybody, this is Crystal.
Crystal, this is everybody.
(applause).
Let's hear it for the drones,
at DEF CON.
(applause).
As you were.
Give it to Ricky.
Have another shot.
It's yours.
(applause).
RICKY HILL: Don't blame
Where was I?
All right.
So what is (speaker
me a bit.
Yeah, he's got a good point.
I don't want to cut anybody up,
So what is this talk about?
It's about network surveillance.
It is not about I don't know
about a month ago but cleaners
And they are delivering their dry
Guess which drone?
That's the Phantom drone right there.
This thing, believe it or not,
400 grams, whatever that works out to.
I hear beer works.
So I haven't tried a six pack.
I understand some guys have.
So here on the screen is what I plan
First, we will look at the advantages
from the air.
You've got line of sight to everything.
It's a real easy way to get
in a large area
Next, I
technologies have made this
Two years ago
on this drone would not have been
and the size of the microelectronics
In particular, we talk
the Hak5 software improvements
on it called
basically, an USB stick which runs full
I will cover how I built and flew
I think you would like the video.
You will witness some
of our oops moments encountered
We flew a lot of missions in June
All right.
So the talk is really
of aerial wireless surveillance.
My previous attempts have been
As I mentioned,
because the whole flight was, like,
Even from 10,000 feet you are not going
in that amount of time.
The balloon suffered
When you launch a balloon
to capture the Luxor
to ten miles.
It is not a real good platform.
It tends to do this.
The video from that venture looked
It was pretty sickening.
Next we will talk
what you see on the screen here.
There was a contest how I got
DARPA UAVForge was
a small drone that would fit
on his back which is why
It was supposed to go out and land
whatever and conduct visual
It would have been very useful,
if you could have had surveillance
That was the military's purpose in this.
The top picture
above the competition course.
The other attempts
of you rather the Blackhat WASP,
It cost about $6,000.
The problem
now want to fly them continuously
When you are flying you are using
You don't have fuel tanks like a 747.
You are burning up battery power
The advantage of this one, of course,
off the motors.
The UAVForge contest, as I mentioned,
and progressive idea and that
If you can land on something,
down and conserve your battery power
whatever other operations you want
in the payload will use a lot less power,
to program network surveillance
How many of you guys
How many of you have used
Excellent, excellent.
Keep in mind
is a proof of concept
the military wanted.
I'm not encouraging anybody to go
or terrorize your neighbors.
What you learn in this talk is up to you.
Teams competed from 153 countries.
Guess what?
Nobody won.
Nobody met the criteria for perching
and coming back.
They did require some autonomous
but not full autonomous operation.
Anybody know what
or UAS a drone is?
Go ahead.
Really?
RICKY HILL: Yeah, well.
Pilot on the loop.
Pilot in the loop.
RICKY HILL: Yeah, exactly.
The keyword is autonomy.
The Phantom
in the fact that it will return
without any pilot intervention.
Otherwise, it's just like an UAV.
It will fly with pilot control.
Full drones autonomous operation was
of UAVForge because things
that weren't on Google Maps.
Okay, well, guess what?
It doesn't do trees well.
So here's a review of UAVForge.
As you can see, it
A lot of crashes.
Out of all these teams,
in the final competition,
and crash was three minutes.
(laughter).
It's just ludicrous and it was only two
That's how much I want to impress,
That's not good
of $10,000.
I don't think even the Army wants
All right.
So the Phantom just came
I found out about it because a friend
with was doing some Grand Canyon
she said her cousin or whatever ran
and other drones
films people going down.
The Phantom also comes
Excellent pictures from the air.
So that's how I got
out and I was addicted once I saw
I'm like, this thing is really cool.
Look what I can do with it.
It flies really good.
I can't tell you how many
I suck as a pilot.
But you know what?
GPS and all the guts
They are great.
It also has other safety features built
What that means
if you accidentally turn on it
like fly up inside indoors.
One stick is easy to get out of the way.
As you can see here, it
It requires both hands to take off.
Very nice feature.
I also the return to home capability
If for any reason your flight gets
You can just turn off the transmitter,
I lost communication or even
to come back to where I took off from.
The technological improvements
the cotton candy computer was one.
Let me show you that.
I have got one right here.
So the cotton candy
It debuted
in Las Vegas.
This thing runs full Ubuntu
It makes an excellent platform
this wispy spectrum analyzer.
It also does ZigBee connection.
Move around RO, there are payloads
Let me put my drone back up.
I can't emphasis how many
It is just incredible when it
Anybody fly helicopters?
RC?
Okay.
We got a few people.
How many crashes have you had?
(laughter).
Okay.
That says it all right there.
So this is a look at the two payloads.
Sorry the pictures are fuzzy.
Again, the main payload reviews
is the Hak5 Pineapple which you can
the other one
The Pineapple required quite a bit
of work to get going
a custom power supply.
For instance,
mats instead of regular mats.
It literally took me a month
and I finally got it configured
because all the other ones,
The CDMA,
suck power.
So my opinion cotton candy
for an aerial payload.
The trick with it
from its USB port, once you connect
on the helicopter,
But there is a work around for that.
You supply it with a LiPo battery,
you can now detach your Bluetooth
to go on the helicopter.
Whatever you got running
In my case, it's (inaudible).
It's wispy spectrum analyzer and
about before.
Basically, any USB device you can run,
You can fly
Let me show you what
It actually will also act
into a laptop.
So let's do that.
I did pray to the demo gods.
(speaker
but I took two shots.
Okay.
Installing device driver software.
Here we go.
Okay.
The goat will happen next time.
Sorry.
Come on.
I will know next time.
Do you have goats for sale?
This is our first flight
This is a neighborhood overlooking
It is a cool place to fly copters
on lakefront property.
It is easy
This is the collection off that.
Approximately we flew
This particular subdivision only had
a 10 minute overflight.
There is a lot of stuff on channel 9.
Plenty of data there.
Okay.
So we found a lot of wireless sources.
So now what?
Well, the "now what" is well,
Wait a minute.
I want to make sure I'm not skipping
We found 9211 sources.
Big deal, right?
That's when I got the idea to do
The Hak5 Pineapple provides numerous
and exploitation packages.
You can even do Metasploit
Pineapple is basically
in the middle
If you connect Android phones,
of Android and Apple phones that
I'm the man in the middle
do anything I want.
Again, this the payload objective
the same as for DARPA, that
That could be a cell tower,
It could be, you know,
of that's hard to get to, right?
Conduct your operations and return
So I'm lazy.
I didn't want to construct
stole Hak5's.
Thank you, Darren and Robin.
This is episode 1112.
How this works
a wireless exploitation team
through the GSM modem
and conduct operations
That's how it works.
There is a relay server that's
Here is a short list
As you see, URL, DNS spoofing,
Aerial dumping runs great
because it doesn't transmit anything.
The only other thing I would caution
this is 2.4 gigahertz, okay?
You are running that with receiver
wireless ops with the payload,
You're in the same band.
You may not be looking so good.
Theoretically it is supposed to work.
I have seen numerous blogs
You just crashed your $700 Phantom.
So monitor mode only in flight
And that works.
That sucks, sorry.
I'm going to skip here.
I forgot to show you this video.
This is pretty cool.
Watch this.
This is the return to home feature
(Video playing).
RICKY HILL: Basically, what I did
This is my last test that I did,
I turned off the transmitter
near my gym bag like three feet
That's the GPS and
All right.
So the next mission we did was we
and we decided the next place
was on the beach.
This was at Lake Hannah.
No, we were not looking for bikinis.
We were just looking
Androids and other wireless devices
Notice the pylons added to the drone.
Worked quite well
I know one will support me
really cool.
We are flying out here about like one
at, you know, Virginia Beach.
And we just buzzed
is probably
see right here.
So down at the other end, you know,
Thank goodness
Probably an altitude
And we're collecting
I'm running low on time here so I
Here's the landing.
The battery went dead.
Watch this.
(laughter).
It died.
I actually had no control at that point.
My friend, Mr.
Nick Hopler did helicopter search
He jumped in, held the thing
to the boat.
Incredible.
Actually 100 feet.
Thank you, Nick.
All right.
I had bragged to one
the Phantom yet and we had been
And unfortunately there were some "oh,
will find these interesting.
We now have moved
aerial collection and we want to do
to land and do collection
The first thought let's perform
And the second thought is let's land
We can land on the Marriott
out somebody's room and do
Okay.
We'll see how that looks.
This is test flight number 1.
Pan right.
This was a stormy evening, fairly windy.
I had only had two beers at that point,
Oh, no!
Oh!
RICKY HILL: Yeah, that's
So not so good.
What you see here on stage
(laughter).
One more clip here.
This is our balcony shot where we are
to see if can be done.
(Buzzing).
Oh, no!
RICKY HILL: About an inch short
Damn, you are a good man.
(laughter).
RICKY HILL: Also Mr. Nick Hopler.
(Video playing.) RICKY HILL: This
of the Phantom.
What you see in the center there,
very sophisticated.
Uses GPS accelerometer and even uses
to orient itself in space.
I have seen advertised GPS that it's no
to 9 feet or something.
This thing actually does better than
It does a space about this wide
with that controller.
The Phantom has no moving parts
What you see on the end are
They're on each thing.
The only damage this thing had was
you can see the end when it did that full
so the propellor was bent.
The hard shell is about 60 bucks
So mission number 3 is the attempt
That's to do a rooftop landing.
We did quite a few rooftop landings.
We ran Airmon ng before and
We did some URL sniffs.
I can tell you by virtue
vantage points.
When you land on somebody's roof,
You're there.
(Video playing).
RICKY HILL: So the thing is, this
This thing is pretty far away.
The problem is if you
on a roof, you lose the farther
the more depth perception you lose,
So there is an onboard camera.
I can show you guys after.
It is about the size of a postage stamp.
First person view camera was I looking
if you wonder why I'm hanging up there,
on the platform in front
on it that I'm wondering
That doesn't look so good.
Let's back up a hair here.
So decided to abort
for the actual platform there.
There is the chopper going down.
This is a clubhouse on the lake,
There you can see their lawn chair,
There were no people here thankfully
Now we all held our breaths
a few ops before this.
The video has been clipped together.
But we held our breaths and did
(Music).
(applause).
RICKY HILL: Thanks.
So we did encounter a couple of places.
And what you have to worry
or you are doing surveillance is,
if you're doing private property
the people might be pissed
to collect their wireless
outside their window, right?
It's natural.
I personally have shotguns
Watch this.
Oops.
We're not going to stay here.
Let's get the hell out of there.
That thing will do 35 miles an hour,
(Video playing).
RICKY HILL: These are just a few
I know they're hard to see.
But SSL Strip, I actually hacked
with SSL Strip.
Basically what it does it collects.
As man in the middle,
Urlsnarf, the same way,
you're going to.
That's results there.
We did compare ourselves
I know they're hard to see,
All the teams failed.
Nobody even made
Let's go down one here.
One team, Team Halo, made 47 points.
The Phantom, if we score it
out of 12 helicopters two years ago
avoiding obstacles and other baselines.
If you want to see more want
and UAVForge, go look at uavforge.net.
It is a very interesting contest,
a lot more crashes there.
We proved perch and gauge
It is a highly effective site survey tool.
The take away from this is drones
or bad, right?
They can be used to peer
They can be used
other important places.
Or they can be used
They're sort of, you know it
basically, right,
We hope they're used for good.
So keep that in mind
or keeping drones flying
is evaluating who's going to be able
in the United States and where.
That's due out, I believe, mid 2014
Right now I flew
entity sponsored me, I'm flying
wherein I have to maintain an altitude
If any of you guys fly, I implore you,
the disclaimers is not fly this
If you don't have experience flying
with a $700 helicopter, right?
Also, don't fly anywhere
is not a lot.
I was going to do before we decided
near the Potomac river which
and thought this was a cool resort.
Let's do some drone operations here.
Bad idea.
Went out there.
A bunch of golfers were in my balcony.
You saw the balcony crash.
Well, that would have been
Think about it.
The other thing over the Potomac,
to Reagan National Airport which
I thought there couldn't be any airplane.
They will be thousands feet out.
No, they are 800, a thousand feet,
So bad idea.
If you are going to fly anywhere,
in a local RC club or whatever
the right thing and you're not
It is all fun.
We had a great time doing this.
This is one tip I have
guys afterwards.
It is an altimeter.
It is just an USB stick, basically.
You get on the elevator, punch
until how high you got.
It fits well in about any copter you want
What's 400 feet?
For the Phantom, it's about as far
When it starts to get
you know, you're too high.
You're in aircraft space now.
Again, that's about it.
Let's see what I got here.
Some shoutouts
out with operations, Nick Hopler, Mr.
Search and rescue right here.
Thank you very much, Nick.
(applause).
And the hobby hangar in Chantilly,
I have the advantage of being able
and get parts for the Phantom.
I will leave you here
(applause).
RICKY HILL: Thank you very much.
We might fly this in the parking lot
if we can pull that off.
So I will try to let everybody know.
After the scenes you have seen,