and the beaconator here. So the beaconator is pretty fun, um, it's just put it together, there's basically ESP8266s, um, but instead of just one or two, it's about 57 of them. So I'll get to more about that later on in the talk. Um, but basically, I'm a programmer

and I've done a bunch of things, you could say sometimes they're potato and sometimes potahto things, but you know, we're not talking about, you know, low level stuff here at all. I'm much more of a, working at higher level languages, still getting into

more security stuff. Um, I know enough how to get myself into a lot of trouble, try not to do that. So, this is the basic agenda, um, so I'm gonna go over ESP8266s in general, then I'm gonna rickroll everybody and show you how to roll your own real quick, then I'll show you a survey of a bunch of stuff you can do with ESP8266s and

show off the beaconator towards the end. And the beaconator I've been working on for a while, it's germinated last year, but it took me a while to actually bring it to fruition. So, basically ESP8266s are a bit like a gateway drug to microcontrollers.

Chances are, some, for some of you, your first one was free with a badge. So, right now I'm firing it up, so if you have a Wi-Fi device, nothing I'm doing here is gonna

do anything bad to you guys, cause I'm more afraid of generic you than I am an asshole. So, overall, right now, pretty soon, this is gonna pop up on your Wi-Fi, um, and throughout the talk I'll turn on some more stuff in a little bit. I may not turn on the

whole top range cause it's a little bit powerful, but if you want a quick thing for just quick rolls, you know, and this is basically the impetus of me getting into the ESP8266s, because it's just fun. And, so basically to roll your own is pretty simple, I mean this is

like really broken down here, but you just need a ESP8266 unit, which is a Wi-Fi module. Um, the code for the roll, which I'll have posted Wednesday, but there's a bunch of people who do them on GitHub, if you just search for GitHub ESP8266 Rickroll, a bunch of people have Rickrolls up there, so feel free to use mine, somebody else's, whatever. And

basically to run it, you gotta have something that programs ESP8266, which I tend to use Arduino IDE, A, because I don't have experience with the other ones, they may be better. So, you know, your mileage may vary. Um, this, then you, if you want it portable, and not just stuck underneath somebody's desk, so whenever their computer on, they have all

these access points, you gotta have a little battery, cable, all that stuff. But once you get that set up, it's not too bad. If you've never set up Arduino IDE before, you may have to Google a few steps regarding ESP8266s, because you gotta add libraries to it, um,

to preferences for it to actually pull up and build and compile and push on there. I'm totally familiar with it, you know, it's for the new people. I, I was new too, not that long ago. So, this is the part where I have a villain exposition part, because I've got a

lot of stuff to get through and I didn't make enough slides here for this part, but, so the ESP8266 is basically a physical manifestation of a minimally viable Wi-Fi controller board. And I was first exposed to it, um, back in Cactus Con two years ago in

Phoenix. I was fascinated that a programmable Wi-Fi microcontroller system could be made so small and affordable. And like all good con-goers, I got home, I promptly put it in a bag, box, and forgot about it. Um, but I did do one cool thing after the convention, I got online and I ordered a few of them, because I wanted to do something

with RGB LEDs. I do lightbox photography on the side, so I wanted to have a field of these lightboxes set up and control it with a laptop, which is awesome, but unfortunately it turned out that life, everything kind of got in the way, so I never really had a chance

to do that. So last year, before Def Con, I was looking at all the stuff I had for the previous conventions and I saw the ESP8266 and I was like, dude, I wonder what I can do with this? So I looked up online projects on GitHub and within the top 20 projects at the time was Rickroll. So I looked up Rickrolls and found it and the guy I used was Mark Zazbo, um,

M-A-R-K-S-Z-A-B-O. He has a thing called Fake Beacon ESP8266. He's a security student over in Europe and I used his GitHub as a reference point for a lot of the stuff I was

doing, um, with this thing. So, you know, I have the, the GitHub download and everything and short order I got it working. Yay, Rickrolls! But honestly, it took me longer than I'd like to admit, professionally, that to get Arduino up and running because it was my first time with Arduino by myself, so you know, Google, YouTube, it wasn't too bad, it

was just your basic Google-fu of, hey, I've got an error message, what do I do? It's not too bad. And part of it, too, is I never really did experimenting with these things until I was really tired late at night because after doing all the other stuff, so I was like, you know, I'm not, I'm not always in the right mind when I do some of these

things. So, ESP8266 is themselves, they're made by a company called Expressive. I mean, they make the IP, the intellectual property and license it out to different companies to make it. So, overall, there's multiple different companies that produce different versions of this and with those different versions, some of them are optimized

for cost, memory size, um, some have more pinouts, like NodeMCU ones have 30 pins and Wiimos boards have like 16 pins. And some USB development boards, or some boards have a USB port on them. The one up here on the screen here, that doesn't have a USB

microcontroller part, so you've got to get, like a F, a CUASB to serial programmer to actually code that. Now, the flip side is, once you have that done, this is smaller and lower power, etc. So, you know, there's always kind of a ying and yang. Now, there's

also a really neat thing with these ESP8266 is, is that there's a lot of things called shields. If you're not familiar with the shield, because I assume someone watching this isn't, it's basically a little board that sits on top of it, or underneath, depending, that with that you can actually break out and do other stuff and attach cool

things to it. So like, there's relay boards, there's micro SD boards, there's soil temperature sensors, there's humidity sensors, um, the list kind of goes on. There's a lot of stuff out there. And this is a pretty common device, so if you look up a project with

ESP8266's, chances are somebody's done something, and you can learn from their mistakes or just riff off of what they did, which is not rip, but riff. So that's pretty cool. So with these pinouts, sorry, a few of the pinouts are reserved for programming, so you can't use all the pins if you want to be able to use it later. Um, and most of them

have an analog IO pin, which basically means it can read voltages between zero and one volts, so you can have like a rheostat or a trim pot hooked up to a voltage and step down so you can actually read a dial, which is kind of cool. But you have to write the code for that, which, you know, is always that. Now, I haven't done too much with the relays

and stuff yet, but you can do some pretty neat stuff with them. So, if you've gone to enough conventions, you probably have ESP8266's hanging around in your badge bag, on the badge. Um, alternatively, you can buy them on Amazon Prime for cheap, not too cheap, but

you know, under 10 bucks delivered, and eBay, you can get them on a slow boat from China for under 4 or 5 bucks, depending on what you want to do. Now, in quantity, like what I'm doing, it's having something cheap adds up when you're doing a bunch of it. So, depending on what you want to do with them, I don't have empirical proof, but the

nodeMCU boards tend to be less power hungry than the WEMOS chips. And later on, I can show you what they look like up here on the device. But, so what I got hooked on was that last year, I def, I rick rolled a bunch of people at the con, and I broadcasted some SSIDs,

which was pretty fun. So, with SSIDs, it's basically when you open up your phone and look at the available Wi-Fi networks, that's just the access points. So, what these are doing is just broadcasting just the beacon frame of the Wi-Fi access point, not actually responding to any other results. So, you see all these access points, but you can't

actually connect to them or do anything to them. So, that's pretty fun, cause there's nothing like having something that looks malicious that you can't connect to. But, that's just me. Um, and what I did is, I just basically had it in a little ziplock bag, put it together, and just with the USB powered, and I kept that in my backpack

the whole convention, and it was fun. People were like, have you checked the Wi-Fi? And I was like, yeah, I have. But that's me kind of bragging on myself there. But, so, technicalities, so, one thing I found with these ESP8266s, if you want to advertise a

persistent set of Wi-Fi, um, SSIDs with randomized MACs, I had to stick between 13 and 17 total access points per board to have it stable when you pull up your phone, because you have to broadcast the beacon frames often enough for a computer to pick it up. And my code's not perfectly optimized, cause I borrowed other people's, and honestly, I'm just

like a little gorilla with, um, the code sometimes, just going, poke, poke, poke, what happens? Um, so that was pretty funny, which led me to an idea I had, which is, well, if you have a couple of these things, what happens if you have a bunch of them in your broadcast? So, if you haven't heard of it, this Wi-Fi mapper, um, EkaHoo's Wi-Fi mapper,

they have, it's like a laptop based product, it's free, you can get it, download it, install it, and it generates really beautiful, pretty picture drafts and charts, which is pretty much the most important thing when you're talking to business, to say, hey, I

need three more access points over here, you can do the work with this mapper and show them that, yeah, this red part here, that's bad, we need to have more access points or change the channels, that type of thing. But, you know, for personal use, it's free, so that's pretty cool. So, what I did is, this is a baseline scan of my house, and some of

it's been redacted for obvious reasons, I mean, you know, but, so, basically, the line in the middle near the top, that's where I set in the scanner that I was walking around my house, so each of those is a point in my house, and that's just what the scanner looks like,

it actually was run on this laptop at the time, which is pretty cool, um, but I found out something fun, is that when I did with 14 early beaconators, a previous version of this, ones in the top here, I had those running, I ran the Wi-Fi scanner, and something fun

happened, tada, Windows slowed to a crawl, and the program crashed, it just didn't want to do anything, so, after that, I basically decided not to be a complete tool, and I restarted the computer fresh, so I don't have any memory issues, it's not a super vast computer here, so, going again, I was like, huh, well, I did the restart here, and then, boom, so

what happened was, you can't really see much here, but that little thing in the middle, was all the data I was able to collect, because it just wouldn't, it just slowed to a crawl, there's so many little things happening, as I was walking along, you can barely see it, but

there's, um, that green line has little striations, and each of those striations is an access point, so, in theory, you could use a bunch of beacons like this to mask other attacks, or to be a red team, and just kind of make a squip, squawker, and see if anybody

notices on the blue team that, hey, there's 24 access points, well, there used to be two, you go investigate, and you can do that based off of one little thing that fits in the palm of your hand, in a battery, it's, it's pretty cool, so, a close up, you know, it

took a long time, it literally took about 10 minutes from the time I turned off the beaconator, before it actually, the results were able to show up in here, and the application caught up to it, and it's Java based, which isn't bad, but, you know, Java memory, but it's multi-platform, so I zoomed in and enhanced it, but enhancing

doesn't work, because it's not the best resolution, but each of those striations is basically an access point, which is pretty cool, and that's just with basically a third of what's here on the top, if I had it fully running, which I haven't had a chance to test yet, that would be pretty fun. So, with ESP8266s, you can do things like a DAuth,

space hunt, developed the ESP8266 Wi-Fi D author, which is neat, but I just don't really feel like it's kind of a dick move, and it's not really something I want to do, um, but really cool stuff that you can build in terms of just craziness, uh,

is you can build, like, IoT relay devices, you can use these devices to hook up to, like, your garage door, so you get close to your house, connect to your Wi-Fi, hit a button, and pop your garage, you do hook them up to power strips, long garden sprinkler systems, one guy

did a tea kettle, so he's sitting in bed, has the tea kettle ready to go, pops open his phone, and just logs into his tea kettle, and hits button, and it starts up the tea kettle, so he can get his tea started without being out of bed. You can do the same thing with coffee, and with a soil sample, um, or soil sensors in there, you can also do, like,

hook up your own grow house for, you know, vegetables, um, that type of thing, I, you wouldn't want to use these to control it because they don't have a ton of power, but you could use it to monitor every plant for under, for every pot, for every, probably under 15 bucks total, if you didn't buy things in bulk, which per, you know, that's a pretty

reasonable price for tomatoes, but it's amazing the stuff you can do with it, like, if you wanted to build your own Christmas light display, you could have it Wi-Fi powered with these guys, with little, um, the mains power running the ESP-266's so it wouldn't lose

power, you don't have to worry about battery, just doing a little relay, I've got a board relay I can show you guys, well actually it's, I'm sorry, I have a board relay at home I can show you guys, but basically you see what a relay looks like, it just fits on a little shield that goes on it, or you can wire up it yourself to it, it's pretty cool. So, the limitations of ESP-266's is, well, it's single threaded, so it's limited to about a

mega program space, and then, on top of that, you have some flash memory you can access, but it's not stupid easy, you have to actually do, do a little bit of work, and then, the other thing with these is the reading and writing from the micro SD cards is a

bit slow, it's probably me, but I had the pin out, I had the, um, text coming from serving, like I had a web page serving from the micro SD card, and I was watching the text scroll and refresh, and it was just painful to watch the text show up on the screen, so that was kind of funny, now it could totally be me, and there may be ways to

serve it quickly from micro SD cards, but I think they're better suited for logging, so you could use it, like, for a logging system, but one thing I noticed, which is kind of interesting, is that something was missing, so when I was working on this, I could show things up in my phone, right, but I couldn't find anything in Wireshark, so

basically, what I had to do right here is, well, it's kind of small to see, but I had to set the time, when you turn the ESP-266 on, it has an internal timer from the time it turns on, I'm not familiar with how to actually change that timer, so you probably have to mod the, like, add the value to that to actually adjust the time, but with that timer, it

gives you a time stamp, which is awesome, because in the beacon frame, which is pretty long, one of the slots is for the time, and without that time stamp being populated, you're going to end up with, basically, it not showing up in Wireshark, at

this is the beaconator lit up, and with the beaconator, it's two sections, the big section

and the smaller section, so in the smaller section, it's got a rick roll unit, it's got a couple project trevor units, so in about 10-15 seconds, you can look at your wifi, you should see some interesting wifi access points available, when I say available, they're not

really available, they're just there, but one cool thing about them, is I do have four book servers on there, where they're connected to Def Con open right now, and because of that, you can find them and actually download Little Brother and some other books on there, um, but the reason I was able to do that, even though there's a meg program

limitation space and the files are bigger than a meg, is that there's a thing called SPIFFS, now not splif, but SPIFFS, it's called Fristerial Peripheral Interface Flash File System, which is a mouthful, but it basically allows you to put the, um, files in the leftover memory after you've programmed the device, you have to download, um, a tool from

GitHub to do this, but it's pretty cool, so, you're limited to about 3 megs of space on it, which is pretty neat, but overall, on this thing too, it's got an aluminum frame, the battery in here is AGM, um, gel lead acid, which is 110, and because of time and skill, I just

have it running at 110, dropping down to 12 volts through some anchor adapters, in perfect world, I would put lithium ion batteries in here, because this thing's heavy, but I did add, um, wheels, which is pretty cool, and overall, with this thing, um, the hardware

is pretty nice, but I got the hardware at the hardware store, so the frame is just some aluminum stuff, stock, and, uh, different things here, and it's ungainly, but I can wear it

if I have to, and the software for the beaconator is pretty basic, so what I did is I basically tinkered with a sample Arduino IDE, um, program that had, that could do exactly what I wanted it to do, and used Python to go through and basically tag on the body of

the, um, program, and just tag on, like, 2800 lines of beacons per sample, so to go through and create, uh, Arduino sketch for every, uh, 2800, uh, samples that it's running, which is pretty neat, and I'll be posting that here after the convention, and so with the

mobile book library, it's basically just electronic only, there's just four of them running right now, and thanks to the Gutenberg library for basically surprising, surprise, supplying free books for me to, uh, use, so the first book I put on there was Frankenstein, because, I mean, why not? And I also have to give a shout out to Phuong on

Twitter, because he wrote the Sierra death generator, which I used to generate these images, and the second one I put on there was Alice in Wonderland, and, um, because, you know, Alice and Bob, I, I had to, and for the fun of it, I put on Sherlock Holmes,

you know, now I could have put it, if I had enough time, I could have done some stegonography and messed with people a little bit, but I didn't have enough time, and of course I put on Little Brother, because, I mean, why not? So, overall here on the top part, um, I'm about to plug it all in here for a second, I'm, this hasn't been running

at all, each, it, it'll pump out, um, every six seconds it pumps out 130,000 beacon, uh, beacon IDs a second, or not every six seconds, and back in the napkin math it works out to be about a million, uh, beacons, wireless access points get advertised every minute,

and because each beacon consists of two frames, it's actually pumping about two million frames a minute, which is fun, and the reason I know this is because, is because every

six seconds or so, these suckers will light up, and let me just double check, the demo

gods are not smiling, one second, sorry, okay, so, now we're rocking and rolling, so pretty

soon you're gonna see a few wifi access points on your, um, phone, it's probably gonna take 30 seconds to a minute for all of them to spin up, right now if you're running

just 802.1b, you may have problems with the internet, it may be getting a little bit slow, it's not de-offing anything, it's basically a bunch of people in a room shouting really loud going, hey, I've got a wifi access point, I've got a wifi access point, 130,000 times every six seconds, um, just for the fun of it. Now, I don't run that thing everywhere

because I don't wanna be a complete, complete dick on it, but, so the way I know that, how many it's running, is because I have a list of about 2900 each one of these 44 units on the top here, and from that list, I turn the LED on at the start, and every time it

hits the start of it, it toggles LED light, so if you're running like, um, Wireshark right now, you might be seeing a few beacon frames if you have your beacons enabled, and what shows up on your phone isn't actually all the beacons available, it's just what your phone can actually capture at the moment, and there's also a bunch of RFID collision or

radio collision because of that, so this is much more of like a cool toy than it is actually something you could use overall, like in the package it is in, it's just more like a fun experiment, but for possible future uses, you know, I thought of maybe making a,

making this thing into a big open library, where have it broadcast all these access points, and each access point is a book that you can connect to, and have a whole bunch of books, like you just have like a mobile electronic book library, which you know, I thought was kind of fun, um, thought maybe of doing like a route map beaconator, so you have a load of route map, if you want to share with some friends that are just within a WiFi

range, so they can connect to it and see what's going on, um, and also I thought maybe a survival beaconator where you can hook up a solar cell to it and actually run a bunch of stuff, um, with like survival manuals and that type of thing, but it's a little impractical, it's kind of stretching there, but another fun thing I thought of is

basically what happens if you go to the Yankees game, broadcasting a whole bunch of times that the Red Sox are going to win, or Yankees suck, I mean, you know, take your way, or here, saying the VIM's better than Emacs, but anyways, you know, that's, you know, there's lots of ways to start stuff, and unfortunately with something like this,

eventually people are going to use it to basically broadcast spam, so this is maybe not right away, but eventually, so basically ESP8266's, um, are a gateway drug to

microcontrollers, and possibly some pretty bad decisions, depending on what you want to do, but right here is the GitHub, if you want to write it down, it'll be available Wednesday, and if anybody wants, has any questions, I'll be happy to answer them, and go over the code if you want to see any specific spots ahead of time, and I really thank you

guys for sticking through it, and enjoy the rest of the convention guys.