>> The basic topic of my talk is the bruner phone DDoS. It was a two dollar a day experiment with
on of the Verizon plans that I, uh, found, so.. It makes about 70 calls per minute depending on
the actual towers that it's on, so.. And the I I have it migrating, and I'll go through
that pretty quick here so. Okay, who am I? And what is this talk about? I don't like this part.
It's a little bit about me, I've done pen testing for ten years. I went through geoscience in
geophysics. Got tons of certs. Nobody cares. ‑ ‑ ‑ ‑ Reservation buzzing. About nine
years of pen testing as I said. Tons of compliance. Tools of the trade, I'm going to go over some
actual devices that are really nice compared to a rubber ducky. So, creation of call bombing.
That's what I'm going to go over with here. And I'm going to do a demonstration here and here's
the ‑ ‑ does anybody use rubber duckies on any sort of pen testing audits or things like
that? Anybody play around with ten (indiscernible) 3.0? Yeah. If you combine the two in an
iPhone SXISHGS do have plans if you guys want to use one. And all it tacks is a HAET gun. It
works a lot better than the plastic USB. This is an R[F]D badger. It's a (indiscernible)
center to it. When they move in the chair, right now it beeps. Every time they scan their card.
It's not cog knee toe, but it definitely gets the job done. Okay, right at security
convention, I'm just going to go over these quickly also. Denial service is when legitimate
services of any kind are denied to people sending false or over flow of information. Telephone
denial service is ‑ ‑ I haven't seen as much of it on the wild as I thought I would. Especially
the incidents we've seen throughout the years and a lot of the activism type stuff. And
basically calls up, there's a [P]RI. A lot of people don't have telephone service for the
most part anymore. Most of it's getting switched (indiscernible) and computerized services.
That's something that is definitely in the wake now that's it's more on the
internet. Instances of [T] dots that I have seen in the wild is bank fraud. Present theft. For
example if my card was being used in Texas at some gas station of some choice, Wells
Fargo will actually try to call me. And the current reasons I've seen that is they actually TDOS
people's phones on some of the (indiscernible) port parts. Let's see, bank transfer mule
scams, that's going on in LA and California a lot. Where they tie up the phone [lines on the call
center for the actual banks. And unintentional spooked caller ID scamming. That's one of the
biggest ones. That's the reason I'm here is because a couple years back, I came across using
three calls in the morning right before I moveed to Minneapolis. It was a new phone number so I
was assumed it was a call of the previous owner put themselves in some sort of system, but when I
called back, it had a spoofed caller ID. So there was this old man in I think Delaware that was
getting probably, close to a hundred forty calls a day. I did call him later in the even and
he said he was changing his number. There are government facilities ‑ ‑ ‑ ‑ that are
getting tons of actual illegitimate calls and it's tieing up their lines of
service. So political motivated act VICHL. I have seen a little bit about it in the wild and I
hear about it in the news all the time. Here's the current methods of TDOS. The caller ID
redirections. That's one that I'm going to go over in some brief detail. There's actual
mall ware on phones. ‑ ‑ ‑ ‑ umm, the most of the methods right now. (Audio stopped.) That
are being used are actually hijacked [P]RI and (indiscernible) services.
Provided sip services. So script loaded. That's the last one I'm going to go over actually, it
basically loads phone numbers into pregenerated web pages, and it's pretty decent. And as far
as actually. (Audio stopped.) Very little work. So the first one I'm going to go over is the
caller ID reflection attack. There's spoof caller IDs, apps on the phone that is call the
servers, things like that. I'm sure everyone's got a blocked number or a friend that's
messing with you one day. Basically, with this one [P]RI server you can make 23 calls
second to people. You can cycle through lists depending on what the actual software running on
your computer would be, and it would IE tie into a soft phone situation. And call literally
hundreds of people and they'll call whoever the spoof caller ID person. And they'll believe
that's the actual person who called them. A lot of them won't, I don't call back a
number if they don't leave a voice mail. And (indiscernible) TDOS for you. So what this does
is an actual script that hold several thousand ‑ ‑ I think it was 46 or 4800 actual Realtor
web pages. (Indiscernible) captions. (Indiscernible) V[S][P] exact of the lot of the
same stuff in them. Very easy to generate. You put the information into your text
fields and as you can see, right here, it'll actually put a name, phone number, things like that.
So, that's one of the instances of getting TDOS in. And here's a list of the header. They're a
little bit larger. So people can see it. And yeah, like I was saying about 76 of the web pages
out there have ‑ ‑ they use pretty much the same template or a pretty close version of the
actual. And I just wrote a box of the web pages searching for key words. Anything with
millions numbers. That's why I chose Realtors. It's specific to them so. So yeah, bot nets are
infected smart phones. There are a couple out there. This is just kind of natural. The next is
smart devices. So, if there is an increase on the (indiscernible) phones you all
know. That's one of the risk, we gladly take. I want to go into now how I weaponized the OAM
cell phone. The prepaid cell phone we're talking about is actually a Sam sung U 365. I'm
sure everyone at some point in their life has actually owned one of them. They're very common
phone. So if they're running the brew 3.1 operating system digital service. It's a really,
really nice phone, I think they cost about $eight for Verizon, and you can buy them for $12.
And the actual chips that's in it, that's one of the reasons I was able to do the exploit. Most
of the smart phones out there have application processes. These have one single 100 mega
hertz processer. And the actual attack would work on any value chip set. So any of the U[S]C
6050 and 6055. So. Here's a little bit of personal research I've got here. So yeah. Yeah so,
they have other nefarious uses aside from [T] dots. And D dots. And there were three security
features that were built into the the device. And umm, the developer editions of these
models support American unlocked. Feature sets and I think thises like that. So what
I basically did is wrote custom firmware for the device. And I will talk about the way I was
able to bypass and get sort of a pseudodoe signature at least the device (indiscernible) movement.
And loading the actual recompiled operating system. Because every single phone
vendor has their own operating system. So I wrote my own, not my own, it was a modified
version of grew. And I will go into detail for that in a little bit. So yeah once again, there's
no application process sorries, is anybody in the room looking at getting into cell phone
hacking? And don't? This is the perfect phone for doing it. I know you can buy these things in
bulk for $8 a piece. And the (indiscernible) have [P][S][N] numbers you cannot activate with
regular service. But if you guys wanted try them out, you can get locked ones. That's a Verizon
account or burner phone for maybe about six months or a year, you can pull them in the
normal [line of service. It was written in C++. We got any C++ guys in the house? Anybody
program that? Okay, awesome. That definitely, if you feel right at home, so, and umm,
that's very like I said, it was very, very easy. I have no experience. I've root add couple
phones, but it was always else's tool and I was interested in. So you guys will be able to pick up
one of these phones and start dabbling, it's amazing. I thought it had to be in a table.
Something to get that little gap over or something like that. So that's what it took. I think it
took like 15, 1620 people in a whole community to break some of the other phones out there. So
that's what I'm saying. This is an amazing phone if you want to get into cell phone hacking. And
there's actual features that are built into it. When I saw it was I ringer, I thought it was an
iPhone type deal. But it's definitely not. It's an actual, the way it boot it is actual
ringtones in the computer, (indiscernible) the actual phone. Sorry about that. I'm
able to actually interact with the (indiscernible) speaker. So that's, it's the way they had
them built. They had them built for a lot of extra stuff for a lot of expansion. And ways you
can push ‑ ‑ for example, if you want to save your battery time, you push to a screen that
doesn't exist. And the screen doesn't light up during calls. ‑ ‑ justideling though, this
phone is amazingly FIFRNLT I've literally left one set of my DEF CON talks and speeches I was at
before, and it's been going for seven days and the battery still has three bars. Very, very
efficient phone. And it's ‑ ‑ I'll show you some ways to (indiscernible) to it. Where you
can get it to go through an entire five‑ day cycle. You buy these phones for 12 to $14, and
it comes with $10 prepared. And $2 a day for unlimited calling. That plan in itself is pretty
amazing. Yup, and clam type phones. Everybody familiar with those. They have some features
where they can tell if the clam is open. And the developer, an OE edition operators on it, the
type one I [compiled, you're able to bypass anything. Imagine everything on that phone and you
can for the most part interact with it. When the phone is actually closed, I did run into
some problems, the ones that have extra screens you can push it into and things like that.
Yeah, became a lot simpler. I would go to sleep and be thinking about it. Like
ringtone. Because that's how the actual payloads are developed. You can develop your own, which
are basically mall form ringtone packets. It's not something they would have to rewrite. There's a
lot that you can interact with. Mall form ringtone generator. And you can actually load them
in that way also, so. And here's a modified executable was the way that I actually loaded the
actual firmware into the phone. And the certificate expired in I think it was 2012. So a
certificate from 2006 to 2012. This phone's been out for quite a few years. So yes, basically
the expiration process is the way I was able to load what looked like would have been
vendor sign specific. All I had to do ‑ ‑ it was a simple work around, I can't go into too much
detail I guess. I haven't heard about from call come on it. So this error is exploited by
modify executable. It'll open up a couple of the other interfaces, the way I recompile
it had loader of the firmware, with any valid certificate. So quite literally ‑ ‑ ‑ ‑ it
was made to be easy. For you know, quite literally anybody can just. (Audio stopped.) Takes
about eight‑ minute, the first time I've been loading the last few ideas, they were right
around that eight‑ minute range. So. It allows for one second, the entire full attack surface
of the computer. So ‑ ‑ or the actual phone. So, and it's amazing. You can enter, you can
actually do a lot of the bluetooth functionality that I'm totally excited to have some
time again when I get home. I thought of a couple things and people have talked to me about
some things that would be really, really nice to have as a payload on this phone. So yup as
you can see, the driver device information are now supported by expired certificates. And that's
the main reason (inaudible) by pass. And that's what I'm saying A community on the focal, keep
these types of things up and not use. It was a value chip set. From what I could see, a hard
time to get people to develop applications for it. That was one of the reasons I was able to
get quite literally any information out there. You know, I did sign up for a couple
things here and there, but as far as I was able to find most of the stuff online. So. And as
you can see, it expired in 2012. And yeah. I did, like I said, the work around was a modified.
Executable and it was on the Sam sung side. So it was very, very out dated. And there was no bad
on their part. I wouldn't ‑ ‑ this phone is very, very ‑ ‑ they don't make them a lot of
money off of them. So I would understand from their aspects so. But umm, yeah, with a simple
host files work around with custom filed executable. So. You can quite literally modify
everything on machine level with some of the drivers and just the way it was blocked. It was
extremely simple. I couldn't believe how simple it was actually for, I'm not much for
cell phone acting. I've never been part of any communities and I developed a couple apps here
and there. But it was very, very minute back in the day. And here's one of the favorite parts
of the phone. One of the feature sets (indiscernible) roaming. And basically what it'll do is
pull down (indiscernible) towers. So you guys we'll triangulate your your house. You
can lock it and do a random stand off on three of the tours. So for the most part, it would
be impossible to triANG late depending on how randomly (indiscernible). That's also the
vulnerabilities where it's able to ‑ ‑ the way it was able to interact with the towers, I was
able to make 70 calls a minute. So there's no no reason at all why it should be able to make 70
call AS minute. That's another thing, the GPS functionality was very easy to turn off. I found
out it doesn't turn on fully until you make a 911 emergency call. It looks like some kind of
interaction with towers on regular basis. But the GPS information I was getting was
very far off. So, as you can develop applications for the attack platform by
(indiscernible) software written on the phone. You can try it out. I've wrecked several of
these devices. And one OFLT actual ways I wrote one of my ringtone packet's was, one of
them was, that would be cool to be able to break the phone. By putting the ringtone in there.
And I'll go over that one in a bit so. But I'm saying, you can try them out, (indiscernible) 65
them. And yeah. It's pretty amazing to be able to play with them before you get them loaded
on the actual system. Okay, so now you have an unlocked platform. What now? And umm,
that's what I'm saying, the attack platform is full control of the devices on the phones.
And this is some of the payloads that I actually did. The call bombs was obviously one of them.
Some of them are default ring tones left in there. I sent my number on a number of another
phone that I want to actually have, do the ‑ ‑ it'll call whatever number in the text
message 70 time AS minute until the battery dies in the phone. That's an extreme amount of
calls in a short amount of time and practically untraceable. And the other one was if I ended the
five‑ day cycle, I set an alarm. So it'll actually break the phone. And if somebody was a
little bit better and had a little bit more time in programming stuff like that, it
would probably turn off the flash types scenarios on the phone. So there'd be ways to
make it unrecoverable. So you do have full access to the actual phone and all the devices and
interfaces on the phone. Everybody know what a cheese box is? Cheese box is what bookies
used to use. Where people would call in and would anonymousize their phone number on the back.
It wrote a ringtone packet which helped me to deliver the ring tones. They bluetooth to one
another. And able to pass the phone call through. So I call in one number or have friends call
in one number, and after a random am amount of time, you could put 155 seconds on ‑ ‑
‑ ‑ be on different towers. You could have two phones but be on separate towers. So it would
make it entirely anonymous. I know there are services that do form forwarding and proxying.
And things like that. But this would be something you could set it up in 1520 minutes at your
house. I could think of many reasons ‑ ‑ this is one of the ones that. (Audio stopped.) And
maybe back in the day they used it for, I'm sure people would have other reasons for doing it.
But there's other reasons (indiscernible) iPhone numbers and things like that. So this
goes to show here, you can connect up to three devices so you could have random call out
numbers even. And basically I was trying to do a commanding control thing with an actual
smart phone. I didn't have time to complete it. And let's see. Call time is passed. Okay. And
that's basically, like I said, an untraceable proxy. Yup, this is another one that I think a
lot of people would have interest with, a lot of people are familiar with war demand
back in the day where they would be able to find modem numbers. This one's basically for finding
voice mailboxes. You can turn the U 365 platform into an actual crawling platform where
you could go through entire phone (indiscernible). Or do actual voice mailboxes and
businesses. And it'll (indiscernible) [P]C. It'll pull ‑ ‑ it'll pull twice so it
get AS voice mail. And then on the third one, it'll actually record the voice mail with an
actual program I wrote for my computer. And the on the next page you'll see, you can ‑ ‑ it
comes up to 900 ringtones, or 900 of the actual numbers that you called. So you can put
ranges in. The portion of the script on the bottom is for that one, stuff installed wrong, I
apologize for that. It was just comment stuff. I know the original version looked like an
Nigerian e‑ mail F. You guys look on your disks, if you wanted a updated slide
presentation, feel free to e‑ mail me. And basically, the program that I added two things,
it would horde MP3 to crawl mailboxes anonymously. And the second one is for actually
programming the phone I attached to five of these to my computer at once. And just hit the go
button. And it gave me California prefaxed phone numbersment once in a while,
this kind of thing would be easily mitigated by people actually changing the options
once in a while not just so people can just SPAM through them. So. Yup, and umm, here's
the prepaid cell phone and in its glory. I just love it when I have a cellular USB attached to
it. There's actually low energy mode where I can (indiscernible) have the thing calling. A little
over 30 calls a minute. Stably with a USB charger. And just toss it into a lamp fixture.
Anyway, that's like a public facility. It stayed stably charged ‑ ‑ I tried it out with
the, what was it? A 60 or something like that. And it went about a day and a half still. I
was very impressed. That USB cellular charger was $6. I didn't know they've gotten it
cheeper. I would have bought it a lot earlier. With these phone, with the way I write my ringtone
packets, there's a couple options like you compile them or do really energy efficient. And
you could do so much time basically where you could just pseudoturn the phone off. That
was another ringtone packets that that I generated. And like I said, these are anonymous
purchases I bought. They wouldn't let me buy more than two of them per day for some
reason. (Laughing) I don't know if they called and that was (indiscernible) fulfilled
(inaudible). So. They wouldn't let me buy more than two of them a day. They're basically
untraceable ‑ ‑ I just love the idea of the pure REL (inaudible). When I perfected it
finally, pulling it down and actuallying jumping through random towers, it was, I don't
know, it's a very good ‑ ‑ it would be nice for even something like this or you could do tower
locking. I showed up ‑ ‑ I've been in L LASHGS since the first. I've DN ‑ ‑ there's son
of (indiscernible) cells and fake cell towers in the hotels. This is one of the only
conferences I would expect (indiscernible) deal of that kind of stuff. Total investment
for a five die DDOS. ‑ ‑ ‑ ‑ unget grandfathered D[S][N]. (Indiscernible) 65 still
(inaudible) pulse. The $2 a day plan. These things are cheep. It has a newer version of brew,
it's 1.151. Which is pretty close to the same, it has an updated certificate. This would
have to be other methods found. This is an amazing hand set to be able to play with if you're
getting into cell phone hacking. And the phone being turned (indiscernible) monitor. And
like I said, the firmware push, it's just using a special U[S]B cable. You don't need to crack
it open and do a bunch of other stuff do it. It's quite literally where anybody can
practically do it. So, that's when it becomes scary. You know, it's one thing like, how many
people in here if they wanted to could hijack [P]RRI lines and ZIP code? Yeah. That's what I'm
saying. How many people in here can go spend $12 at their favorite box stores? There would
be a larger majority I would imagine. And that's when stuff gets scary. That's why I want to
bring this to people's attention. I know there's like advanced methods out there.
They're not that advanced once you understand and experience with those systems. But, it's
just something I would not like to have with some of the DDOS methods. It's something where,
it brings it a little more real world, a little more personal. It's one thing when your web
page dose down, but another when your coal manager gets locked up on a situation. It's just on a
different level. It's something where ‑ ‑ I've worked on mitigation method where is
there's a plug in for pall manager and pall manager express. Where it'll have a cap
show up on the actual DWAS and system, and you know, their time a caller ID information that's
plugged in, it'll send a challenge. So it's something that people will be able to load
into the actual pole manager software. And another one is an an DRAD app. Like third time
challenges. Something I know eventually will be used in the wild more. Yeah, it's near that
kind of stuff. It's something that a lot of people, I think a lot of people aren't focussing
on it as much as they should be. I've been seeing how much it's used in some of the bank
(indiscernible)s and stuff so. So I was going to do a full blown demonstration of the TDOS,
but there's something really weird about the cell phone towers that I was picking up in
the hotel. (Laughing) so umm, that is the reason that I could not do my demonstrations to the
fullest extent. And umm, yeah. It was amazing 'cause as I was actually booting it up, two of
my phones didn't kick on to the actual tower. So as you can see at the beginning here, I had two
phones kicked on, and it peeked it up and ‑ ‑ it'd be running for probably about five, 15
minutes something like that. And then I had a little bit of peaks when I went from the four phone.
When I went from the eight phone to the ten phone, it locked the BM one. It wasn't one gig
running some older operating system. This thing was beefy. I think it was eight and change.
For a life calling operating system, that is amazingly grade actually. But you put it ‑ ‑
could have been an actual, like, think of the scenarios where you could actually crash a call
center. Some of the biggest ones I think about is blocking a 911 emergency system. I could quite
lit literally, I wouldn't do the call 911. The one that's a 911 basically translated into, and
it could literally take down, I live in a smaller state, there's 600 something thousand people.
It's growing a little bit with the oil boom, but it literally could take down 15 of these
phones. That's scary. That could deny service ‑ ‑ if used in conjunction with other federal
agencies would be entirely wrapped up. They'd be looking for hints. If it was used in
conjunction with some sort of terrorist attack, it would be unimaginable. And that's what
I'm saying ‑ ‑ as far as skill set goes, if somebody was to release this kind of
(indiscernible) tool to the wild, it would be ‑ ‑ like somebody could get fired from a
pizza delivery place and for an hour later deny service for ten days for $10. That is just.
(Audio stopped.) Crazy. And yeah, pretty much any organization, a person is
disliked, it's just, stores during holiday seasons. There's lots of IRS around tax system.
That would actually do financial damage to the actual infrastructure of the United
States. And it's amazing how like a cheep, a little good phone, cheep phones, but
(indiscernible) over the last few months and. I'm sad to see it go. Because they literally
came out with the gusto free where they (indiscernible) into the mainstream. And I'm going to
open it up to questions a little bit. And I'm going to do some talking if you don't like
questions. I always like to give thanks to my wife and family and big guy for giving me computer
(inaudible). And Tim for final (indiscernible)s and spellings. But I'd like to open it up for
questions if anybody has questions. Do you have any mitigation (inaudible)
perspective. >> Yup, I have an actual ‑ ‑ ‑ ‑ call manager. SPS (indiscernible) specific
right now. But that's just the world I came from. But it actually has, the third time it
come calls in, it has its own (indiscernible) phone. Where it picks up and challenges you with
the cap cha. There's 15 cap chas I developed at this point. Does that answer your question?
>> Yes thanks. >> We should talk. >> Awesome. >> I actually spoke yesterday in sky talks on
common ‑ ‑ ‑ ‑ I guess the only TDOS scenario you didn't cover, which by the way your
coverage of how they're generating this was excellent. I saw a couple I hadn't seen
before. But the one scheme that's used is actually extortion. So they'll get
somebody's information, you know, usually like loan that they're behind on or maybe some
sort of criminal history and call them at work and say hay, you got to pay us 50 bucks or
we're going to let your employer know. And they will just, you know, say the best thing we can
do is take down your place of work. >> Yup. Exactly. Yeah. I'll be out in the chain smoking
area after this talk. So. Anybody else have any other questions? Quite literally any
question questions. >> Sure, have you looked into any of the newer smart phones
(indiscernible) phones? >> (Audio stopped.) The reason I went for this platform because
of this deep dollars. I have no problem leaving ten of them in a library charging. That's scary
with the platform. Even if it was my older android phone, I finally got my two‑ year
(indiscernible) phone or whatever. I would feel bad leaving one of those devices in
places where so much information is kept. That's why I did it on the smaller platform. It's
literally a burner phone. It is very, very DIZ posable that's what I love about it. It's
energy efficient. 15 days idle. That's with the actual ‑ ‑ if it wasn't doing phone DO[S].
That answer your question. >> I was actually thinking about looking at the newer ones. The
smart phones. >> That would be very, very awesome. Rooted phones are pretty hard core out
there. Pretty much it's understand lying on some of the operating systems is a basic
LINUX description. That would be amazing to see what that could grow into. So thank you. >> Have
you tried connecting the towers on on and off as fast as possible? >> I have actually.
That's one of the ways when I do a couple [T]RL[S]s, (indiscernible) roaming. I
haven't lost the 12 hours OERSZ ‑ ‑ (inaudible) phone up when I do the full 15 for some
reason. I've tried connecting and disconnecting to powers and pulling off of other towers and
hopping mid tower. So. Does that answer your question? >> I was just wondering if you melted a
cell phone tower (inaudible). >> If I melted? What do you mean? >> Well like
(indiscernible) idle active or negotiate with the tower (inaudible) disconnect. >> It
takes a little bit long especially on these devices to do something to the tower that
would be harmful. But that would be awesome. But yeah, you guy KS get one of these phones.
>> (Inaudible) use more phones. >> (Laughing) . >> Mine's actually (inaudible) kind of
(inaudible). Why is there nothing in the background? SDP why is Verizon hay not 70 calls
in two minutes what the hell? >> I would love to talk to Verizon about that. Because it
was lopping towers and (inaudible) actually I know for the most part the towers aren't
talking to each other. Or they're not talking the way they should. Is what I mean. >> Is
there something like can Verizon eventually audit why are we seeing 10,000 percent more
calls on these four towers. >> That's the exact reason I did this. To get it out there, that
could of stuff shouldn't be possible. Especially ‑ ‑ ‑ ‑ even if they want to designate
burner phones, this phone in general, there's no legitimate reason for it. And that's what
I'm saying we're ‑ ‑ that's kind of the point I wanted to bring it out. There are things,
there are very easy ways we can begin with. They could limit the amount of calls with the burner
phones. >> (Inaudible) they do none of that. >> Yeah. I have ‑ ‑ >> I am so surprised.
(Laughing) . >> Yeah no, they're doing a good job of other things, but it seems like
something ‑ ‑ I would like to see what they would be able to do with it. So yeah. Does that
answer your question? >> Yeah. Really well. Thanks. >> Does anybody have any questions?
Quite literally no dumb questions. So. There's a gentleman in the back here.
>> Have you tried this with text message? >> Yes I actually did fully unlock the [S]M[S]
functionality. I didn't do any text bombing because I think there's [S]M[S] service is easy
to do it with. But this would be entirely anonymous. It's a very cheep [S]M[S] gait way if you
want to hack into a computer and send text messages for any reason. This thing is not only
an attack platform, but quite anything you want to do on a phone. A couple of these you can
do load balancing. And pretty interesting. I would love to see what the community could do with
it. Does that answer your question? >> Absolutely. >> Awesome. What was your
question sir. >> Have you looked at whether or not this can deal with a tower? >> Yeah that
that's kind of what my next step was. But I don't know a good legal way I could do it without
(inaudible) issues. (Inaudible). The company I do work for for a an engineering (inaudible).
Actual stuff. I would like to disclaim on that also, this was done all on my free time. My
work had nothing to do with it. Aside from, you know, having I guess a job. What's your
question ma'am? >> So it seems more, I don't know useful, I guess, to tacking a call center.
But I'm just curious like did you weaponize this against your home phone line or your cell?
Just to like ‑ ‑ what does it look like from the receiving end? Did would I get 70 empty
voice mails from you or what would happen? >> About the seventh or eighth call, the your
phone would deauthenticate from the tower. And literally, you would pretty much get calls for
the next quite literally until the battery died in the other phone. I'm positive (inaudible).
It just rings. It quite literally just rings. And then it has a computer behind it. A
lot of it is getting through the actual cell. I didn't go to the point where I would block
anything up. I wanted to keep this legal. Because I do have a job to keep and stuff. That's a
good idea. Like I was say, the cell phone was the one that through me off and sometimes
when it was (indiscernible) in towers, it would quit sending calling ID info. I would love to
dive into it because ‑ ‑ ‑ ‑ does that answer your question? Thank you. >> I have a question,
how is anonymity achieved? Purchasing on Ebay or walking into a store. >> Anonymity on my
part? I have literally bought most of them. The ones I was tinkering with, I didn't pay a
homeless man. I'm not that paranoid. I didn't pay cash for them, but I didn't ‑ ‑
(inaudible). No, I just wanted pick them up. I don't know why they do a two (inaudible). One
of my HOER research materials I came up with. >> (Inaudible) walking into Wal‑ Mart and
purchasing phones (inaudible). >> Yup. They have a couple, a bit of the information outside
(inaudible). So you could, they could tell what Wal‑ Mart it was bought at. That's what I'm
saying, I'm sure there'll be a web page (indiscernible) buy (inaudible) does that answer
your question? Yup. Okay. What's your question? >> You mentioned a little bit about the
inaccuracy of GPS. How inaccurate was it? >> I think it was 6070 feet from the actual
‑ ‑ unless my phone was off too, but it looked like it was quite literally pretty ‑ ‑ (Audio
stopped.) You would have been able to tell the building someone called 911 from or where
their truck went in the river or whatever that situation. But (inaudible) lock. You can change
the functionality of, I think it was a star 228 function. There's another star functioning and you
could adapt to them. They have a like a little bit more interaction with the system than
the actual deviced did. That's what Amy sighing, you could reactually plug in, you know,
your actual ‑ ‑ you could lock in a location to the exact same GPS. As long as it's within the
URL. I did find some ‑ ‑ I tried to spoof Montana or everything like that where I
went pretty far away. There were some towers I couldn't authenticate to. Does that
answer your question? >> Sure. >> Sure. >> Could you DOS a net work (inaudible). >> You're
talking within (indiscernible) cell DOS a net work? >> Yeah. >> I guess in what way would it
be generating traffic. >> Yeah. >> On the (indiscernible) cell. Yeah, you could white list it
out with the phones. You could have 50 phones and nobody else would be able to talk to
(indiscernible) cell. You could do it with 25 phones actuallies. I think it handles fender cells
a little bit different, that's why I couldn't do the demonstration of it crashing.
(Indiscernible) [P][S]A (indiscernible). The 23 times five. Over 200 phone numbers. So
yeah. Definitely. Does that answer your question? >> Yeah. >> Does anybody else have any
other questions? Sweet. Awesome. I have ‑ ‑ I hope I'm doing good on time. I want to thank
you you guys for coming to see me speak. I don't want this gentleman to kick me off stage
so. (Applause.)