Revolting Radios: Get it? It's a pun!

Video thumbnail (Frame 0) Video thumbnail (Frame 2942) Video thumbnail (Frame 4210) Video thumbnail (Frame 8201) Video thumbnail (Frame 9727) Video thumbnail (Frame 10854) Video thumbnail (Frame 13703) Video thumbnail (Frame 14672) Video thumbnail (Frame 16457) Video thumbnail (Frame 18022) Video thumbnail (Frame 19437) Video thumbnail (Frame 20327) Video thumbnail (Frame 28001) Video thumbnail (Frame 29438) Video thumbnail (Frame 37257) Video thumbnail (Frame 38979) Video thumbnail (Frame 41733) Video thumbnail (Frame 43357) Video thumbnail (Frame 45047) Video thumbnail (Frame 46649) Video thumbnail (Frame 48516) Video thumbnail (Frame 52360) Video thumbnail (Frame 53402) Video thumbnail (Frame 58032) Video thumbnail (Frame 59179) Video thumbnail (Frame 61182) Video thumbnail (Frame 62427) Video thumbnail (Frame 63492) Video thumbnail (Frame 66026) Video thumbnail (Frame 67273)
Video in TIB AV-Portal: Revolting Radios: Get it? It's a pun!

Formal Metadata

Revolting Radios: Get it? It's a pun!
Title of Series
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
There are many Software Defined Radios (SDRs) available, with a great deal of time and effort having gone in to their design. These are not those radios. We present four radios that we have designed using crude, novel, and sometimes ridiculous methods for transmitting and receiving signals. The arrival of SDR allowed more hackers than ever to experiment with radio protocols, but we're still using hardware built by other people. In the time honored hacker tradition of rolling our own tools, we'll demonstrate four simple radios that can be home-built using commonly available parts for little to no cost.
Connectivity (graph theory) Microcontroller Digital signal Software-defined radio Perspective (visual) Theory Uniform resource locator Software Very-high-bit-rate digital subscriber line Hacker (term) Analogy Computer hardware Data conversion Figurate number Software development kit Physical system
Demo (music) Connectivity (graph theory) Projective plane Sampling (statistics) Software-defined radio Microcontroller Software-defined radio Streaming media Computer Number Personal digital assistant Analogy Computer hardware Computing platform
Personal identification number Functional (mathematics) Digital electronics Key (cryptography) Demo (music) Motion capture Microcontroller Bit Function (mathematics) Mereology Data transmission Frequency Process (computing) Befehlsprozessor Peripheral Term (mathematics) Single-precision floating-point format Mixed reality Analogy Right angle Data conversion
Dataflow Computer file Software Analogy Multiplication sign Sampling (statistics) Software testing Data conversion Software-defined radio Musical ensemble Limit (category theory) Data transmission
Laptop Computer file Motion capture Volume (thermodynamics) Right angle
Digital electronics Demo (music) Connectivity (graph theory) Demo (music) Software-defined radio Microcontroller Software-defined radio Data transmission Power (physics) Software Computer hardware Software Computer hardware Musical ensemble
Personal identification number Shift operator Multiplication Email Key (cryptography) Bit Frequency Befehlsprozessor Different (Kate Ryan album) Computer configuration POKE Cuboid Hydraulic jump Physical system
Personal identification number Point (geometry) Game controller Functional (mathematics) Inheritance (object-oriented programming) Demo (music) Code Structural load Demo (music) Execution unit Set (mathematics) Microcontroller Bit Function (mathematics) Coprocessor Frequency Videoconferencing Firmware Spectrum (functional analysis) Probability density function Physical system
Greatest element Key (cryptography) Demo (music) Multiplication sign Demo (music) Moment (mathematics) Keyboard shortcut Range (statistics) Motion capture Bit Code Coefficient of determination Hacker (term) Single-precision floating-point format Firmware
Web page Point (geometry) Game controller Building Digital electronics Code Real number Connectivity (graph theory) Set (mathematics) Microcontroller Software-defined radio TV-Karte Mereology Power (physics) Oscillation Frequency Hacker (term) Term (mathematics) Analogy Videoconferencing Energy level Data conversion Analog-to-digital converter Dynamic range Personal identification number Standard deviation Shift operator Touchscreen Demo (music) Key (cryptography) Digitizing Range (statistics) Bit Digital signal Frequency Radio-frequency identification output Configuration space Right angle Routing
Point (geometry) State of matter Multiplication sign Plotter Decimal 1 (number) Microcontroller TV-Karte Function (mathematics) Streaming media Thresholding (image processing) Number Frequency Goodness of fit Insertion loss Average Analogy Bus (computing) Energy level Data conversion Dynamic range Personal identification number Domain name Simulation Multiplication Scaling (geometry) Touchscreen Key (cryptography) Demo (music) Sampling (statistics) Voltmeter Bit Logikanalysator Arithmetic mean Software Logic output Configuration space
Dataflow Graph (mathematics) Touchscreen Digital electronics Information Key (cryptography) Plotter Real number Sampling (statistics) Digital signal Menu (computing) Bit Microcontroller TV-Karte Frequency Software Codierung <Programmierung> Dynamic range
Doppler-Effekt Direction (geometry) Demo (music) Source code Authorization Software-defined radio Number
Rotation Slide rule Shift operator Information Direction (geometry) Direction (geometry) Set (mathematics) Doppler-Effekt Ring (mathematics) Computer hardware Phase transition Website Boiling point Row (database)
Filter <Stochastik> Slide rule Link (knot theory) Data transmission Number Pseudozufallszahlen Inclusion map Frequency Wave Loop (music) Hacker (term) Different (Kate Ryan album) Phase transition Order (biology) output Firmware
Open source Length Code Multiplication sign Sheaf (mathematics) Tracing (software) Hooking Different (Kate Ryan album) Hacker (term) Phase transition Computer hardware Software testing Physical system Covering space Source code Standard deviation Link (knot theory) Demo (music) Structural load Projective plane Instance (computer science) Wave Process (computing) output Video game Right angle Cycle (graph theory) Table (information) Communications protocol Software protection dongle Asynchronous Transfer Mode
Mathematics Different (Kate Ryan album) Length Direction (geometry) Demo (music) Function (mathematics)
Scripting language Laptop Game controller Demo (music) Code Length Multiplication sign Direction (geometry) Plotter Range (statistics) Doppler-Effekt Software Different (Kate Ryan album) Computer hardware Videoconferencing Right angle Table (information) Extension (kinesiology) Software protection dongle
Demo (music) Phase transition Demo (music) Source code Phase transition Musical ensemble Data transmission Window
Personal identification number Filter <Stochastik> Pulse (signal processing) Multiplication Demo (music) Matter wave Length Line (geometry) Microcontroller Function (mathematics) Frequency Phase transition Whiteboard Musical ensemble Spectrum (functional analysis) Software protection dongle
Slide rule Greatest element Touchscreen Link (knot theory) Demo (music) Multiplication sign Plotter Motion capture Digital signal Type theory Uniform resource locator Personal digital assistant Phase transition Hydraulic jump Spectrum (functional analysis) Physical system
Area Laptop Asynchronous Transfer Mode Demo (music) Binary code Computer network Bit Power (physics) Twitter Software Different (Kate Ryan album) Video game Office suite Musical ensemble Gamma function Row (database)
Email Wave Software repository Hacker (term) Computer hardware Charge carrier Software testing Data transmission Asynchronous Transfer Mode Twitter Speichermodell
I am really big on teaching software-defined radio to people in the hacker community and I think that today having kind of an SDR first approach makes a lot of sense that you can get software defined radio tools for a very low cost and get started playing around and exploring the radio spectrum and learning about radio technology from a software standpoint first and then learn about hardware if that interests you whereas back in 1983 you know when I was a kid I used to I I would start to work on electronics and like the first radio I ever built was a crystal radio that was a little kit that was super simple really very few components but very unsophisticated and not really able to interface with kind of the modern radio systems that that are more interesting maybe for kids to play with today and so I wanted to think I wanted to kind of figure out a way to for people today to kind of breadboard a very simple radio with few components and one of the things that we thought of is is that there are these microcontrollers in like high speed microcontrollers that are readily available to people and a lot of them have an analog to digital converter built in so putting this into the 1983 fictional perspective what if we're able to reprogram the microcontroller or repurpose the microcontroller from some legitimate piece of equipment something we're allowed to have can we can we take a general-purpose microcontroller that has a little analog to digital converter in it and build a radio receiver out of it you should be able to do in theory take anything with an ADC and build some kind of a software-defined radio out of it that we can use for general receiving purposes and so we came up with this
breadboard SDR idea what's the smallest simplest thing that we can make out of a microcontroller with an ADC and as few components as possible and we have this
circuit that we're about the demo has actually one diode and one resistor and we have it plugged into a great FET which is a hardware platform that we've been working on for a while as our kind of our preferred platform for doing kind of general microcontroller things and we're using it in a number of these projects but really all that matters is that at some microcontroller that has an ADC and in this case it has an ADC and it also has a USB port so we can stream samples from that analog to digital converter over to the computer that I'm
demoing from really simple there's an antenna which is just a piece of wire plugged into a diode and there's a clock signal now this is the tricky part is that we're using this diode as a mixer it's a single diode mixer and I wanted to pick up a signal that's at a very high frequency compared to the things that were in that I was able to pick up when I was a kid I want to be able to pick up things like Dominic's car keys or this handheld radio or things that are transmitting at hundreds of megahertz in some cases and and we should be able to do that if we have a way to mix or translate the frequency shift the frequency that comes in on the antenna down to a frequency that the analog to digital converter can tune to or can pick up and so we're doing that by mixing the signal between a clock and the and this antenna which is just a piece of wire and the clock is actually being generated by a clock generator on the microcontroller itself and and this is pretty common like almost every microcontroller has some method for generating an internal clock because it has to clock its CPU or its peripherals and most of them will allow you to attach that to an output pin and bring that out and we'll show you a bit more of that in a minute but right now we kind of bring it out feeding it back into the diode along with our signal and then tapping it with an ADC right and Dominic is fond of pointing out the fact that like when I first put this circuit together and I was testing it like well you know it transmits as much as it receives but it does receive so it's it's messy it's it's not not a really clean design but it does the job of showing you what the minimal circuit is that you need to build a mixer which accomplishes this this problem of shifting a frequency so I'm gonna do a little demo here I'm going to actually receive a signal there we go everybody's radio speaks Mandarin right I'm just gonna do a little narrowband FM transmission and one of the drawbacks of this design is that it has it terrible performance in terms of receive sensitivity but that doesn't really matter if you're transmitting from a fairly high powered device nearby and so you can still demonstrate a functional mixing circuit with a single diode as long as you have a relatively high signal strength nearby so I'm gonna do a
little capture here where I'm just
streaming samples from the analog to digital converter on that great fat and then I will once it's up and running I'm gonna do a little test transmission here we are testing from onstage breadboard SDR this is a d0 NR and you really should have a amateur radio license to do stuff like this I highly recommend it there are ham exams going on here at DEFCON and then I'm going to bring up a
little flow graphing a new radio I don't have time to go into it in detail but I'm taking this file that I just captured over the air and I'm going to see if I can recover audio from it and in software I should be able to do this [Music] can anyone else hear that other limits
I think yeah you could turn the volume
up on your lab so I could turn the volume up on my laptop I could I could also actually use the capture file I just made instead of the capture file that I did earlier because I cuz that that's kind of cheating right like right
let's see if if the new capture file actually works there we go we probably
should have told speaker UPS that we needed we needed audio out before I can write all of myself once this yeah we're
done we're done with or donated thank you very much sorry now is our demo so yeah when you
build a radio in software you really don't need much hardware and that's one of the cool things about software-defined radio technology you can actually use the power of software to overcome deficiencies in your hardware so you can demonstrate working working circuits with extremely few components all right so Mike what what will happen when we started the research versus we divided up our ideas and Mike took the receivers and I being the one without an amateur radio license took the transmitters yeah like a pro so so you won't be surprised to find we stuck to bands where we could transmit or I had Mike with me whenever I tested these things but what a scenario is that we've got inside an air-gapped Network we have an ally inside we want to build a transmitter but we can't just carry a radio in there Big Brother probably wouldn't like Aref so it's unlikely we can carry it into the bill I really wish I reread 1984 before this so I could get my references right but we couldn't carry it into the ministry and and so what what can we do with a microcontroller we find inside now previously we were talking about those clock signals the clock signal that we were using to mix with the incoming transmission on the breadboard SDR what if we and as we said it transmits as much so it receives well what if we intentionally try and transmit and see if it receives as much
that transmits so a few people have done this before Fontana was an interesting idea where you toggle a GPIO pin very quickly raspberry pi FM does a similar thing and it toggles G poke went him quickly and adjust the frequency of that and Mike Walters actually using great FET previously on off keying and so he would he would take that clock signal that we're using as a mixer and he'd just turn it on and off very quickly and he would generate on/off keyed data and so we wanted to kind of one-up in a little bit because he's a friend of ours and so we want to look at FSK data frequency shift key things and so what we do is we
grabbed a great Fett stock a instead of having that mixer come back into the into the system we just stick a wire on it and I very carefully tuned this antenna by reaching into a box of jumper wires pulling out one that was like kind of short and sticking it in the pin header and hoping that would work and it kind of does like if if your radio is as rough as this the antenna is not going to make the difference so whoo so what we want is a frequency shift 8 key data and and we have two options here one is we can take those clock generators and we can very rapidly try and reconfigure them and that that's what raspberry pi FM does but we can get it to make very clean jumps back and forward between the two frequencies that we needed and we actually had a in inside great fair we happen to have multiple clock generators there are there are three in there there's one for audio one for the CPU and one for USB so if we just resign ourselves to the fact that we don't get to use two of those things then and specifically we need the cpu so we just don't use USB in the audio we can repurpose both of those clock generators so what we do is we set one
to 315 megahertz we set one to three hundred fifteen point one and then the scu here is a system control unit all it does is decide which pins on the microcontroller which which functions of the of the processor get connected to which pins on output pins on the great set so all I do is I say this clock pin will be connected to this output pin and then when I want to change the other frequency I just reconfigure the SCO and switch which clock signals going out and that's much much quicker than waiting for a clock generator a PLL to settle and it is that simple all we do is load in the FSK data into the into the firmware I do it over USB but I've killed my USB by repurposing of clock so I build a one-time firmware load it onto the device and it immediately just repeatedly transmits my my FSK signal and so it's a super simple piece of oh you need to tap out yeah that's Ari videos don't work in PDF so it's a super simple piece of code we
captured a signal we actually used a hack RF to capture the signal and then we retry it we pulled the bits out using in spectrum loaded it into the great FET and then retransmitted it now we have a piece of demo target for this but it was kind of large and deaf comma not super enthusiastic about bringing it onstage so this is a video demo I don't know why
they didn't want us to bring our demo car so buddy there I'm I'm just like parsing it for a moment so whoo so yeah the first thing you saw was me hit a key on my keyboard and that was just loading the firmware into the my single purpose firmware into the into the great FET and then you probably want to watch the bottom bottom in the middle to the left watch my lights there they go there you go and we unload my car so it turns out
like cars use rolling codes
so to get this working correctly what we had to do was run up and down the road to get out of range of the car capture a key press with the hacker F decode it copy the bits over to the grave fare run back up the road try it and then the first time we tried that we thought it was gonna be like no there's no way this works first time so I just ran it and I went oh I'm not the car and Mike's like I haven't started recording yet and so we both like grabbed a low commitment and run back down the road we woke up was at a dog park so it was just a bunch of puppies following us as we went up and down it's the most fun and
interestingly the the target device the actual key fob that we captured a signal from has you know pretty tight frequency deviations a plus or minus 25 kilohertz and and we had a little bit of difficulty with like configuring the clock generators exactly how we wanted and and we said well hey maybe this way will work and we don't have to go through the trouble of going to the more complicated configuration we were thinking about let's just try it this way and see what happens and it turns out yes we actually had twice the frequency deviation and a considerable offset from the original target devices Center frequency and it still worked like we're within the received filter of the of the target device and and we were able to replay those signals well replay them we were able to synthesize new signals from the captured signal that we generate our that we had captured from the real original key fob right and part of that is just power as well we were I guess you saw in the pit in the video I was like sat with the great FET on I was gonna sleep on it of my car hood of my car and and so I was like you know not that far away from from the receiver which is in the dash so I'm I'm so close to it that the power levels transmitting at is it's probably gonna go through the filter pretty pretty well right yeah the closer you are the more you can get away with in terms of you know being off frequency or being route of the passband filter of the receiver there's nothing particularly soft a little delicate about any of these radios yeah so if it obsoletes like a radio in a midst like a video it's a radio and that's kind of a big part of the point of what we're doing today is is trying to show that you can build radio circus out of just about anything our next scenario is this idea that maybe maybe you're not allowed to even have analog digital converters like we've we in there in our first SDR receiver I repurposed a micro controller that had an analog to digital converter in it and an analogue to digital converter is generally considered to be the core of any software-defined radio and I wanted to see if we could build a software-defined radio receiver without an analogue to digital converter specifically can we use a GPIO input a general purpose digital input so it's just a pin on a micro controller that detects you know whether there's a high voltage or a low voltage and that's it only has one bit of dynamic range and that we can kind of think of a GPIO pin as being a one bit ADC and if we do are we able to actually build a functional software-defined radio out of it and get back the kind of a real-world motivation of this to is like when we did the previous demo with a car we captured a signal with a hack RF and and we kind of said well maybe that's cheating a little bit maybe we should actually have a demo in which we can build a radio and use it to capture the key press on the car key and that's how we could we you know find the code that we need to transmit it would be nice to be able to do that without having something like a hack RF so if you've got a hacker f you don't need to build a alright a PLL switching FSK transmitter I just used the hack RF right like I explained there so but another you know getting back to this fictional idea that analog to digital converters are restricted like if if you think that's far-fetched in any way here's something from ITAR that tells us about today export controls on analog to digital converters in this country and you can see that like if you look on the right-hand side of the page you can see 10-bit ADC s are restricted at a certain speed and 12-bit ADCs or restricted at a certain speed and so forth and you'll notice that there is no restriction for one bit ATC's so one bit IDC's are totally allowed at any speed which is pretty chill tomorrow that's one bit ABCs are allowed by Heights are at any speed so we should be able to implement a one bit ADC and and you know if you restrict GPIO inputs like you restrict all digital electronics so if any digital electronics work we should be able to improvise an ADC out of a GPIO pin that's our thinking so we've made a GPIO pin receiver and unfortunately you know one of the drawbacks of making a GPIO pin receivers that we need a fairly strong signal that we pump into it and so we actually decided to salvage an analog radio from from something that that has that's readily available like a telly screen for example and so I made this little
circuit that's using a TV tuner and this is an old analog TV tuner like you might pull out of an VCR we had VCRs in 1983 and so this is not a digital receiver at all this is just an analog radio tuner that shifts the frequency of a television signal down to a frequency that that a television is able to decode and in an analog or digital way and I connected this to a great set and I'm using a GPIO pin on the great FET to read the the input from that that tuner that analog input and I was able to do this with just one additional component so I have the tuner and I have the great bet and I one capacitor in there and this is a
circuit diagram you can see where we're picking up 315 megahertz signal from Dominic's car key and using this TV tuner that we can salvage out of some other equipment like a telly screen and that's getting converted down to about 44 megahertz it we need this one capacitor so that we can AC couple it to the GPIO input on the great fat and the first time I made this work I actually had a voltage divider there so I had two additional resistors in the design to bias that GPIO pin and there are there kind of a number of tricks going on in this design well one of them is that we need to bias that GPIO pin and the reason for that is like it if you if you give the GPIO pin a voltage near zero volts it detects that as low and if you give it a voltage that's near 3.3 volts which is its power supply level it detects that is high but somewhere in between zero and 3.3 volts there is this threshold where you can kind of twiddle the voltage by a small amount and make it and flip that bit but finding that flesh hole threshold is a little bit tricky business and so the first time I did it I like played with different resistors to make a little voltage divider - to bias it so that that pin would be at about the threshold that it needed to be but then I realized I could eliminate those two resistors from the design just by using the digital to analog converter that's on that's built into the micro controller and use that to produce an arbitrary DC voltage that I use to bias that that GPIO pin and not only does that remove two resistors from the design but it also gives me a flexible way to tune in software and find just the right threshold because that threshold may change over time and may change with temperature it may change from one microcontroller to another it's not guaranteed by the datasheet to be at any particular voltage level and so it's handy to be able to control that from software and and dynamically find the that particular threshold that I need now another trick that we're using in this and this is fundamental to the concept of using a 1-bit ADC is that we're over sampling and decimating and what does that mean it means over sampling means where we're using a sample rate that is faster than you might expect that you need and we're decimating which means we're reducing the sample rate we're throwing out some samples but we're doing in an intelligent way so here's a little simulation where I have 16 random samples in this stem plot the first one is 0 the second one is 1 and so forth they're all one bit samples they're all one bit sample size let's have 16 random values the first step in in over sampling and decimating is to then combine some of those samples and reduce the sample rate and ideally we use a some kind of a good quality low-pass filter but as a kind of crude example let's just say we average adjacent samples together so those first two samples 0 and 1 we combine those two samples into one sample that has a value that's the average of those two so it has a value of 0.5 and I'm going to do that with every pair of samples I do that then i turn my sample stream into this in the digital domain instead of having zeros and ones now I have zeros and ones and one half but I have half as many samples but if added more dynamic range there's more nuance to the vertical scale and I can keep going I can do this again I can combine two of these samples and and now I have only four samples left but out of those original 16 but each one has several different values that could take on not just a 0 or 1 so we're adding dynamic range by trading our excess sample rate so the faster we can sample the we-we the more ability we have to actually gain dynamic range and we gained a bit of dynamic range every time we divide the sample rate in half and that allows us to take a low a low dynamic range ADC and turn it into a high dynamic range ADC at a lower speed in software which means ultimately we should be able to make things work with a 1 bit ADC like a GPIO pin now interestingly Domenic I think was a first person to point out that not only are we over sampling in this demo but we are also under sampling that may be hard to wrap your head around but we are in fact sampling at a sample rate that is lower than that 44 megahertz output of the TV tuner we're sampling currently at 20 million samples per second which is quite a bit lower than the 44 megahertz intermediate frequency that we have from that TV tuner and it turns out that that works fine we were thinking we could crank up our speed and actually sample that GPO pin faster than that but it turned out the way didn't need to so we actually ended up with a demo where we are simultaneously over sampling and under sampling I think that's pretty cool so let's do our demo all right I'll
try to move this thing without dropping it good luck yeah yeah all right he's demo I've broken like wires and these demos at least twice in the last 24 hours so you know we'll see how this goes and we have my favorite antenna which is just a piece of wire stuck into the coax connector on the end of the TV tuner and I'm going to let's see I have to tune the tuner which was a little bit of a little bit of configuration there are some I squared C there's a little I squared C bus on the tuner and so we have the Great Fed actually commanding it to tune into a certain frequency which I just did and then what is the other command I do I don't but you can Elizabeth logic that's the one I want we're using this logic analyzer command which actually takes the state of multiple GPIO pins and throws them into this named pipe right now but all the other GPIO pins that it talks to our unconnected so there are all just at zero and I'm gonna run that while I turn on a new radio
flow graph to actually process that
information and so now what you can see here are the one bit samples that the top plot that's moving rapidly left to right those are just one bit sample see everything is a 0 or 1 and then Dominic is pressing the button there he goes on his key fob and you can see that we're seeing a signal down here in our waterfall plot in if you look at just the one bit samples it's kind of hard to see that there's anything different going on but if you look at the decimated samples this is after we've down sampled with and combined samples together with a filter that allows us to create more dynamic range now as he's pushing the button you can see that sinusoidal stuff it looks like a real radio signal that we should be able to analyze and in fact if we run it through an FSK demodulator I just stopped this really quick and you can see that in this the left-hand side of the screen here you can clearly see the bits that are being transmitted so sometimes it slow and sometimes it's high and when the frequency is low its transmitting a zero and the frequency is high it's transmitting a 100 or something like that the other way around perhaps but we can clearly see the digital bits that are being transmitted sufficient to decode it and we've now taken a 1 capacitor circuit and used it to interface our general-purpose microcontroller with a salvaged radio tuner and repurposed it so instead of just being a TV tuner it now is able to help us in software demodulate and decode arbitrary radio signals including the digital signal from Dominic's key fob [Applause]
all right so moving on yeah so sometimes people have asked us recently we've been we did some work earlier in the air and towards the end of last year I guess on on direction-finding and a number of people are very interested in being able to track down the the source of a radio transmitter this is amateur radios amateur radio enthusiasts want to find people who are interfering with with their radios who are people who were broadcasting illegally and so on and so forth and we're saying here that Big Brother has deployed a pseudo Doppler technique to to kind of do direction finding to track down illegal transmitters and we have managed to somehow given that we built it steal one of these direction-finding rigs and can we do anything nefarious with it in a way that subverts what the authorities are attempting to do so
let's boil oh yes
so pseudo doppler direction-finding is to know who we haven't gotten this slide and he's sat in the front row is balan oh yeah thrillers because that's where I first learned about suited oh I'm sorry about that bouncy but also did a err some work maybe 10 years ago on this yeah well he cited in the talk that is on there there you go yeah if you watched the talk the weir site thing you'll see the citation of his talk and then and that's all fine apparently so so what you do is you have a set of antennas and you want and they're spatially separated from each other and you want to rotate very quickly between them and using that rotation what you see is a shift in the phase of the signal the incoming signal and that gives you some information about which direction is coming as you as you change between them I'm not going to go into the in-depth of how that works now because that's about as much of it as I really understand and also you can look up those two talks that are referenced but what you need for this is some hardware to rapidly switch antennas so we built some
now this is called opera cake it it connects to both hacker f and great fat and it can be controlled from firmware so you can you can do various things with it one is you can do sudo da popo by attaching a number of antennas and very rapidly switching between those antennas you can also do things like have an input and output attached and switch in different kind of filters or other things loop that between the two sides and and just changing between different antennas based on which frequency receiving and things like that that's what we usually use it for but in our scenario Big Brother's using it too to find where we're transmitting from and and in doing so what they're looking for is our transmission and then they're inducing a of all they're looking for a phase shift as they switch antennas and so if we are able to somehow inject a phase shift then that will be a phase shift that they don't expect and therefore can't compensate for if it's for example pseudo-random now I was
gonna do I was gonna explain phase shift that's what I'm gonna do okay I'm trying to work out what order could remember what all of these slides weren't so so a way to get a when we talk about phase shift what we talk about is that if you think of a wave so this won't this slide
if you think about it I drew this in my hotel room because I wanted better to better explain this concept and I'm not sure it's worked but if you if you think about a wave traveling down a coax cable as you the one I've carefully drawn on the paper if you think about light traveling down and and you cut off the cable so that it's exposed and becomes a transmitter or antenna the the difference in length between these two cables gives us a different section of that wave at the same time if you inject the same wave into both of these cables simultaneously what you'll get at the antennas is a slightly different wave based on the length of the cable and the speed at which the signal propagates down them so they're sometimes referred to as delay lines so phase shift is is that difference in where we are in the in the cycle of the way relative to a to another wave so in in
this instance what we're doing is we're taking those two cables and we're switching from a shorter cable to a longer cable and with a with our standard radio input signal coming in and that's the signal from some arbitrary radio it doesn't have to be we're not generating it we're not creating a specific radio here what we've got is a radio that we're allowed to transmit with or that we are transmitting with and we are adding this phase shift on top at the end to try and make it hidden from direction-finding and the radio we've chosen is a four-dollar bluetooth dongle that I got from eBay and and we just crack the thing open and as you can see here we attached a coax cable so that we can hook it up to our radio system and it's actually on the table at the front you can get a look at it later this took three attempts a couple tries yeah applets rising this one I think I did a really good soldering job on it you can see in the lower right hand corner the live nicely you can't see it behind the cable but I've nicely cut the original antenna trace and then I've soldered the wire onto it and then afterwards it didn't work and we're like why doesn't it work and if you look closely look really closely where the mouse is right now you can see Mike melted the corner of yes and how I I just destroyed the chair just like Sean cover is missing yeah and so then we went on to round two which survived long enough for us to work on this in the lab yeah and then did not survive the journey to Vegas no and so thank you to the third one stayed up yeah thank you to the badge life folk whoo nine o'clock this morning soldered me another one with they're very precise machinery and I want to point out that this is this isn't one of these sophisticated modern Bluetooth chips that knows how to do Bluetooth and FM radio and Wi-Fi and and like Bluetooth Low Energy and all kinds of different protocols this is like a 10-year old chip or more yeah that like we were hacking on in the early days of Bluetooth hacking and like the reason we used it was because like what was it your first open source contribution yeah one one of the pieces of code I'm going to run in a minute in the demo it was my first ever open source contribution which was to enable the radio test modes in these dongles and when we were coming up with this project Mike's like do you have any 2.4 gigahertz like Hardware kicking around that we can we can hack on just kind of opened a drawer and it was like these because they're so cheap and so I have loads of them hanging around so so that's why we picked this thing because it's pretty hackable and things like that so so what we're doing is we're
taking the signal that comes out of this and we're using a direction-finding technique to try and locate it and then we're going to enable our delay lines and switching back and forward between two different lengths of cable and that will produce a phase shift in the output that does not affect the signal it makes no difference to our signal going through but it does affect the ability to direction find out I'm not sure I'd
say it does not affect our signal but it well the modulation really to be a regional waveform but if it like for example if it's an amplitude modulation should be able to just layer on arbitrary changes to the phase without
actually affecting your ability to communicate so I'm gonna play you a video demo of this one and that's gonna be the direction-finding demo okay so
this is I'm gonna pause it a few times this is just a demo we took out a table in our lab so this is my directions binding set up here and you can see I've got like four amplify for different 2.4 gigahertz antennas that are vertical and to support them structurally we are using a pint glass like everybody needs a glass full of antennas from time to time and then this is my direction-finding rig like I talked about with Skylar at shmoocon this year so I have the Opera House and I'm using some software on my laptop to do some to run some direct turn finding and I'm not finding anything right now there isn't anything transmitting but over here is about to start transmitting with his bluetooth dongle which you can see plugged into the USB cable that little blue blue blob plugged into the USB extender that's actually a little tiny USB to bluetooth adapter and that's plugged into his opera cake now his opera cake has four different wires in it I think you're only using two of them but they're there for different lengths of cable and he has the ability to from software control which cable is switched into the path between the bluetooth dongle and the external antenna so so initially you can press play yeah so initially what we can do is start transmitting from the bluetooth dongle and we're gonna leave the the path to be static so if you pause now you can see we've got a pretty reasonable this is a polar ola thank you though the plot and so you can seem got a pretty reasonable direction from our antenna array to to where this thing's transmitting like that's pretty easy at that blue dot that blue dot is you know up to the you know up and to the right of the center of that plot and so that's indicating the direction of the transmitter that it's seen I'm gonna unpause it here and so what I do is I run a script that just slowly switches back and forth between two two paths just creating a little phase shift once in a while I mean once in a while like every couple of milliseconds and and you can see it just sends this this becomes sporadic like it we have a such a wide range like our bearing to our transmitter has gone from being kind of very narrow to being somewhere around fifty percent of the direction that we're looking in and so that phase shift means that we now it's now much more hard much more harder much more difficult to locate the the transmitter than it than it previously was so we are able to subvert our own we're able to serve our own pseudo Doppler direction-finding code using our own pseudo Doppler direction-finding hardware and other code that we wrote so I'm going to call that a win
[Applause] [Music]
okay since we can introduce those phase shifts we thought as a final demo in the in the last couple of minutes that we have left what we try and do is put out is do do a phase shift key transmission so what we're gonna do is is transmit something that is phase shift keyed by not by having a radio that transmits phase shift keyed we're gonna have a clock source and then we're going to change the phase using those using the the delay lines on the on the applique poured so so so this is a picture of
those delay lines I like to call this the swampthing this so I'm just running it again from great FET because it's the microcontroller or board I have around and it it uses GPIO pins to rapidly
switch which antenna path now I'm gonna do something that's BPSK so binary PSK so I actually only need two of those for pulse but I'm using but but essentially what I do is I switch both sides simultaneously and switch in those various lengths and those lengths are off by half a wavelength from each other so halfa or a multiple of half a wavelength at the frequency that we're that we're using now because we're using a bluetooth dongle to feed this our wavelength our frequency is 2.4 gigahertz and we have a we have a little 2.4 gigahertz band pass filter in began the upper cake and the antenna and that's actually one of the nice things about using 2.4 gigahertz band for this kind of a demo is that you can get readily available low-cost and highly effective filters this technique causes a lot of spectral splatter it really is not being a very good neighbor on the spectrum so if we're able to out filter the output from it before it goes over the air that helps us be a better neighbor on the spectrum yep
and one of the things we're trying to do here is is show that we could take one type of radio transmitter and then layer another modulation on top of it to have a covert channel regardless of what the modulation of the original system is we should be able to do in some cases actually still use the original system the original modulation and then also add this covert channel on top of it that acts like some other type of radio device if you're looking up the these papers I highly recommend you google them rather than clicking on the links in our slides because we put the same link for two different papers here oh yeah how about that yes I thought I just noticed some people taking pictures of the slides don't bother with the URLs I'll try to fix that yeah hand our slides chappie Grubbs oops okay so so
when we when we when we add in the phase shift we're able to then kind of capture it with another radio and look at it in in spectrum and so this is how we work out whether or not our our transmitter is working and in spectrum lets us do a phase plot at the bottom here so at the bottom of the screen what you can see is the phase shift being created and there are very regular intervals because they are when I have a timer firing on the device in it it fires at regular intervals and and we we see a very very quick phase jump we're almost out of time yeah I'm running the demo are you running at all and running the demo okay
so we are actually now transmitting a binary phase shift keyed signal in the 2.4 gigahertz band and we were like what could we what target device could we use that uses 2.4 gigahertz and has binary phase-shift keying or QPSK and we said hey Wi-Fi so find life front couple of rows anywhere near about here you might be able to pick up a Wi-Fi beacon that we're transmitting and it says is this revolting enough for you I believe is the it's the network SSID I'd be really
interested if anyone can receive it because it's I can't receive on my phone here but I could when I ran this in my hotel room like mere hours ago it turns out doing 2.4 gigahertz Wi-Fi demos at con is still as bad nidaros it was when we first started doing this yeah but you know we're not transmitting it a particularly high power and there are a lot of different Wi-Fi networks in here that your phone or your laptop can see but probably some of you especially those who are sitting clothed can actually pick up this Wi-Fi beacon right now this 10 actually see ya there since to work somewhat better if you're using an iPhone apparently interestingly we've just had better luck with it this morning for people receiving on an iPhone but I'm guessing no one can receive it which is incredibly disappointing to me but it is definitely running yeah get it get it yet close as you can to the needs of the trend area and see if you can pick up a network there's yeah I don't say on my phone I see a lot of other networks around those so that's potentially why but I'll happily run this maybe somewhere there's a little bit more RF silent for people to try it out later but yeah essentially
what we do we can do is we can take a radio test mode that transmits a it's just a pure carrier wave into this device we can do binary phase-shift
keying and I really do promise if you do binary phase-shift keying at 11 megabits you get a 1 megabit dsss transmission out and that can be crafted to be a Wi-Fi beacon and you should be able to pick this up on your phone so thank you to all these folks whose work we have built upon and most of this stuff is is built on hardware that we've hardware designs that are in the great FET repo or the hack RF repo that's where the opera cake lives find us on Twitter and we'll we will take questions in the hallway off yonder in a couple minutes thank you very much thank you