Conference DEFCON 22. "Alone at home with an automatic protection system." Chris Littlebury
My name is Chris Littlebury, I work as a senior penetration test tester at Knowledge Consulting Group, which is located in the District of Columbia. I love to design all sorts of interesting things, giving ordinary devices unusual features. For example, this XBox Live controller quickly detects a fire. I used it only once, combining with an Arduino microprocessor. The second picture shows a device for replacing the fifth gear in the gearbox of my car, which improves mileage. I love to do things with my own hands.
I create ideas, samples and codes that work for me, and answer any questions related to their subsequent use. ')
I don’t charge for any praise for any products I test. I do not promise to end the thefts, especially if you live in a house located in a criminal area. I am not campaigning for you to set traps in your homes that threaten thieves to death. This is prohibited by federal laws, so do not ask me to arrange a hidden pit in your house with peaks sticking up. If you install something like a trap from the movie “Home Alone”, when a thief opens the front door and falls into a trap, you will go to prison. I do not do anything that can hurt people or damage property, and do not use such devices to protect your car or apartment.
And I do not advise anyone to "penetrate" my home. Please do not try this! I do not want to find a stranger standing early in the morning near my bed, although I know that some of you are so insane that you would try to do it.
So let's go on to the story that I called “Once Upon a Time in South Texas”. It will be about the city of San Antonio, a famous tourist center, where many people with families come on excursions to such a wonderful place as Riverwalk. I have lived in San Antonio for almost 10 years, so I understand what I'm saying. I propose to look at the map of the criminal situation in this city. She's just terrible.
In the number of crimes, in addition to street attacks, the number of cases of illegal entry into homes is also taken into account. This city received the 3rd place in the ranking of criminal cities of America (the safest city is on the 100th place), since the number of crimes committed here significantly exceeds the average shown in the USA More than 5 crimes against the person and about 60 crimes against property per 1,000 people live annually.
At that time, I had this small 1995 Honda Civic, one of the most stolen cars in the USA. In 2009, this car took the 2nd place in the rating of hijackings. It was my thief magnet worth $ 1,500.
Do any of you have or ever had such a car? Raise your hands, who hijacked her. I see, you can give up, you are real men. My car had air conditioning and low mileage when I bought it. One morning I saw that someone had opened the door and was digging through my belongings, but did not steal the car. I thought that I had to somehow resist and outwit the thieves, because I knew how to collect all sorts of things, solder and all that, and could apply my knowledge in the field of IT.
I came up with a 12 pin connector that allowed you to disconnect and pull out the main fuel control relay for the night, fixed the lower part of the dashboard so that it could not be removed, and installed a two-way alarm with a pager alert. I specifically installed the cheapest version of the immobilizer without sound and light signaling, so as not to scare the thieves when they get into the car and want to steal it. I knew that even if they pulled out or turned off all the relays that activate the siren, turn signals, and so on, I still get a message to the pager. In fact, I got a trap car for the hijackers, but I needed it for commuting to work, so I still used it.
One day in the early morning after 3 months the alarm went off, I jumped out into the street and saw in my car two decently dressed strangers who were digging in the cab of the car with the steering column. One managed to escape, and the second tried to enter into a dialogue with me, but I laid him on the ground and passed to the police. It was a success, after which I knocked out of this shitty region, especially since my neighbors had a lot of similar cases, and even worse.
A year later, I saw a photo that depicted my residential complex and a burning neighbor’s jeep, and was glad that I had just gotten out of there.
I moved to a more decent area. In this photo, by the way, shows the snow that fell in San Antonio only three times during its existence. This snow looked like fine dust, but people were about to ride on a sled, you understand. I rented an apartment on the third floor for security reasons, because there are sliding doors everywhere, even on balconies, and a thief can easily enter the apartment on the lower floors by opening a door or window lock. One of the police tips was to use the light to imitate the presence of the hosts in the house when no one was there. That is, to install all sorts of timers that would include lights, TV, and so on, so that the person who looked in the window thought that the owners were at home. They also advised to inspect all the windows and doors before you go to bed and lock them, even if you leave the house for a short time. It was necessary to keep the garage door locked and locked on the latch.
It was also advised to regularly remove the mail from your mailbox, and when you were away, ask the postal office so that they would not deliver you the mail or that your neighbors would get it. I think that these rules were taken as the basis for the shooting of the film “Home Alone”.
I often worked at night, worked during the day, that is, my apartment looked habitable all the time. I also installed the cheapest X10 automatic device, the so-called “stupid chip”, at home. This is really a bad device, created in the late 70s, it sends data on your home electrical outlet.
It forms the carrier frequency of 120 kHz in the form of a sinusoid of 60 kHz branches intersecting the axis of zero voltage. Each time a wave crosses a zero horizontal, it transmits one bit. Home code, module control code and command consist of 4 bits of information. Waves were subject to interference, and each team needed to be entered three times. That is, it was completely unsuitable for comfortable use. But if you live in a small apartment or an old residential complex, you do not need to use a more complex device, it also works. Before use it had to be programmed.
It automatically turned the light on and off by the day of the week and by the hour, had a safety timer, made it possible to create macros and could be controlled remotely. The safety timer allows you to randomly turn the lights on and off on different days of the week at different times of the day.
Then I moved from the apartment to my house and immediately decided to do something with outdoor lighting. I wanted to automatically change the lighting, turn on and off different lights, use photo sensors based on the same X10 device, that is, nothing special. I do not know how it helped, but for all the time that I lived in this house, no one ever broke into me, although my neighbors were robbed.
Finally, after 10 years, I moved back to Colorado and began to equip my house, taking into account all the acquired experience. I was not going to turn my house into a trap, just to make housing comfortable, and made this “wish list”:
effective lighting. It would be an automatic wall switch off and a staircase lighting so that all these 60-80 W bulbs did not create the effect of "microwave".
Adjusting the lighting by zones, that is, adjusting the intensity of illumination in different parts of the house and centralized control of lighting changes;
flexible timing, i.e., entering random or constant lighting parameters;
"Smart" air conditioning system, which itself would turn on and off the air conditioners depending on the temperature in the rooms;
Internal geofense, that is, the creation of a closed zone, the input or output of which causes the application to perform any commands. This allows you to automatically activate any functions of home equipment, depending on the location of its owner. For example, when you leave home, your mobile phone gives the command to perform some events.
Protect your home from wireless automatic attacks. If you remember, one gentleman at last year's DEFCON made a report on z-waves, which can decipher the door lock code and break it;
creating a defensive response at home to external stimuli, for example, activating protection systems when breaking into or entering a home.
I did not need to install cameras everywhere in order to monitor children with a smartphone, or arrange automatic opening of entrance doors and garage doors as soon as my car approached the house, because I was afraid of all these terrible things. I just wanted to make my home protect itself.
I needed a person who wants to enter the house to be detained on the threshold. You know, many have a powerful alarm system or on the lawn in front of the house there is a shield on which is written: “Do not approach my dwelling, otherwise the alarm will work” and so on - well, if they intend to ensure their safety in this way, let do as they want. Because there have been cases when such alarms were triggered by your friends in the living room or the police detained a completely stranger in front of your house due to the incorrect operation of the security system.
I didn’t need such a thing, I wanted my alarm to really trigger a real threat, but to be hidden, without any sirens or anything else. That is, when a stranger entered the house, some unusual events would begin to occur there that attracted my attention.
The first thing I purchased was WiFi LIFX. This device is for programmable control of a color LED light bulb over a wireless connection. It was the result of the implementation of the project, which was launched on the Kickstarter portal in 2012. It was a cool light bulb with a WIFi module with a brightness of 1000 lumens, which shone like an abnormal light and at the same time consumed only 17 watts. She had a fantastic color palette, giving lighting of any color. The slide shows the blue lighting of my living room, which is provided by just two such lights mounted on the ceiling. This is really cool. So, when the alarm is triggered, your entire house starts flashing red. All the chandeliers, stair lighting, table lamps - everything starts to shine flashing red, as if aliens had flown in. If you still start the car, which produces smoke ... Imagine how this will affect the robber.
To encode this light bulb there is an API in Python, so that its work can be programmed in the mode you need. The disadvantages of these lamps are large size and weight, so you can not use them as ordinary lamps for wall lighting, besides they are well heated, so they can not be covered with a conventional lampshade or ceiling. An alternative to these bulbs can be considered lamps Philips Hue. They are much smaller, consume less energy - only 8.5 W at full brightness, a bit cheaper. Three of these bulbs correspond to the brightness of a conventional 360 watt bulb. Their disadvantages are poor color palette and low luminosity. But if you want to use such light bulbs for lighting the dining room or the hall, and at the same time be able to arrange the “red” light alert of Terrible Security, then they will become a fantastically good choice.
The following slides show the illumination of my rooms on July 4th, although the camera could not convey the real purple and blue light, which is created by a combination of 3 Philips Hue lamps and 4 LIFX LED lamps.
The next device I used in my house is called WeMo. It is produced by Belkin. This device has the following features:
creates a WLAN involving devices such as LIFX, and allows you to manage this network using a smartphone over a WiFi network. With it, you can manage powerful enough equipment, for example, motors, and depending on what devices it controls, you can even make a fire and burn your house to hell.
Uses UPnP and SOAP, automatically updates the firmware and with the help of a router can lock everything that can be locked in your home;
controls sockets and wall switches, as well as street lighting, reducing at night the power consumption of CFL bulbs to 20 watts;
inexpensive;
supports Terrible App and Terrible Security;
Sometimes it works according to your rules, because the built-in application is quite problematic and may not execute certain commands or execute them with errors.
The next slide shows the home defense server that I developed - Home Defense Server. The main requirements for its development were:
working capacity 24 hours 7 days a week;
low power consumption, allowing the use of UPS in a power outage;
compatibility with analog and digital sensors and components that allow you to connect it to your home WLAN, that is, it must be a modular system;
outputs for connecting to traditional home security systems;
open platform based on the Raspberry Pi microprocessor.
I needed the system to call me by sending videos or text messages so that I didn’t have to call the police and say, “Hey, my name is Chris, I created Rubur Goldberg’s“ clever car ”in my house, and I swear to you that someone came into my house, could you check this? ” and hear back: “Sir, this is 911, don't call here anymore!”
The next slide shows my WiFi barbecue smokehouse, which reported on the mobile phone the temperature of smoke and meat, the time remaining until fully prepared, the number of servings, and so on, based on the Raspberry Pi, so I was well versed in its amazing capabilities.
The processor was connected to the sensors via a ten-bit ADC interface and the Rails server was used for its work, because I had some experience with Ruby on Rails, this is an open source web framework.
The following site shows the Home Defense server. It is associated with existing home security systems in the form of such a local network deployed on the basis of Raspberry Pi. Independent PIR / X-band components of the touch radar, that is, relays, transistors, motion sensors, are added to the system. The server allows you to activate the alarm system using hardware or wireless alarm buttons. The hardware circuits were programmed for the contact type of operation, that is, as normally closed or normally open circuits, and fixed the movement or door opening.
To solve all these problems, I used open source software, which is listed on the next slide. For example, Magicmonkey processed LIFX light bulbs protocols, combining them into a synchronized system with flexible settings for the frequency of flashes of certain groups. The Sharph programming language is a LIFX version of the Python language, based on Magicmonkey libraries and protocols, and allows you to create stunning APIs that provide communication between WLAN and ZigBee network protocols, LIFX control lamps based on the 802.15 wireless protocol at 915 MHz.
The official LIFX Api application written in Rubi supported the simultaneous control of several light bulbs. I also used something unpronounced — iancmcc's ouimeaux — an enhanced version of Python IPI for WeMo devices with an application written on top of the official API. The system had code and linear support. After that, I attached to the network elements of the external interface and services that ensure their functioning.
On the right side of the slide, you can see what the Light Control System application looks like on the smartphone screen. For writing this application I used the lightweight frameworks Flask (in Python) or Sinatra (in Ruby). I created services for each type of technology - LIFX, Hue, WeMo. Individual services prevented system-wide failures by executing applications on individual ports, that is, if some service failed, the system continued to function. To ensure the speed of such a bulky structure, I used a lightweight database like Redis, put it on separate Pi, which were located in different rooms, and created tracking services with an alarm. I also provided each Raspberry Pi platform with my own hard drive so that there are no delays arising when accessing a shared data writing and reading device.
I note that I am not a programmer and not an expert in the field of writing codes, but only a tester, so my codes do not look elegant and rather cumbersome, but they still work well. I had to test the security system, for which I used the Bluetooth channel. , , , . , , «», , . Bluetooth CARRI , , , , . RSSI – .
Linux rfcomm/hcitool/l2ping, MAC- , RSSI-, Bluetooth . Bluetooth , , 802.11, WiFi.