📜 ⬆️ ⬇️

Conference DEFCON 22. “Arming Your Pets. Fighting Kitty and Dog for denial of service. " Jen Brensfield

Good afternoon, DEFCON! I am pleased to be here. My name is Jen Bransfield, I’m Tenacity Chief Security Engineer and I really love my job, so when the weekend comes, I just can't wait for Monday morning! Today I will tell you how to arm your cat, this is a funny story, with its victories, defeats and a whole bunch of slides.



So, why did I need to arm my pet?
')
It is known that 15% of global Internet traffic is devoted to cats. In addition, I often give presentations about security systems to technical and non-technical specialists. I noticed that technical details tire people, they start to get bored, roll their eyes and think about other things. To get their attention, I began to dilute my presentations with slides with pictures of cats and tell different funny stories about them. For example, I start a presentation with this picture:



I was just finishing one of my presentations when a person approached me and said: “I want to give you this cat collar, there is a GPS, a cellular communication module and you can track the cat's location at any time, and if you are worried about it, then you can send an SMS, and you will receive an answer with its GPS coordinates. ”

I would not be myself if the thought hadn't occurred to me: “It’s worth adding a little WiFi snoop into this collar and we will get a real Battle Puss”!

As for service dogs, at another hacker conference, AT Outerz0ne, I met Lady Merlin, who was walking her dog in a harness - waistcoat with large pockets on the sides, which made him look like a real service dog. I said that this is cool, in your pocket, probably, lies Pineapple, a hacker router intercepting all free traffic? She replied that no, it’s like using a laptop that jumps on your lap, making it difficult to work, but Pineapple is a good idea!

The following slides show how service dogs are used in the army, the first shows just a working dog, and two other dogs who find adventures on their ass when they are thrown from the plane into the water or forced to jump on the hands of a paratrooper. Do you see that a paratrooper has an oxygen mask on his face? The dog is also in a mask, because the jump is carried out from a height of 30 thousand feet.







This slide shows a real fur seal. It is true, the US Navy uses marine animals to protect harbors and search for floating mines. And if you try to sail unnoticed into the port to blow it up, a dolphin of Flipper with a GoPro action camera on a fin will immediately come up next to you.



In the 60s, under the auspices of the CIA, there was indeed research into the possibility of spying using domestic cats, as shown in the next slide. This is a “cat-wire”, in whose ear a microphone is implanted, an antenna is located along the spine, and a transmitter with a power source is located on the chest. Only a person who smokes something very stingy could think of such a thing.



I'm not kidding, they received funding for this project and tested the first instance of an acoustic cat. They brought her to the room where several guys sat reading aloud so that the cat could listen to them. But she ran away and disappeared, and this was the first and last attempt to use an acoustic cat. They stopped testing, not because it was a bad idea, but because it was very difficult to work with these fidgety cats. However, they found a very interesting thing, to which I will return later.

Now I will talk about the requirements that were imposed on my combat pussy.



The main requirement was not to harm the cat. I do not like cats, but I do not want to harm them.
The next condition was the comfort of the “clothes”, that is, the cat should have been comfortable in both wearing and wearing its harness — the waistcoat. We didn’t need flashing lights and stuff that would turn our cat into easily detectable prey.

The GPS had to record route points with the appropriate date and time stamps, so that after the cat returned, it could be tracked where it had been. "Snoop-scanner" Wi-Fi had to synchronize the time with the GPS module and collect Wi-Fi SSID and other signals related to Wi-Fi, for further analysis.

The point was to put a collar or harness on the cat and let him walk around the neighborhood. The collar or harness should contain a GPS receiver and a Wi-Fi sniffer scanner to mark wireless Wi-Fi access points on the map, as is done in combat conditions.

We also used additional tracking tools, such as the Mr Lee Cat Cam camera, which is mounted on a collar, Pet Tracker pet tracker and Garmin headset. To ensure the joint operation of all devices, the GumStix laptop of a small form factor Stix about 11 cm long, but rather expensive, a Cotton Candy microprocessor of the same form factor and a miniature TV receiver Rock Chip 3066 with a dual-core A9 processor, which can be connected to a TV, could be used to receive streaming HD video.





So I took a can of beer and sat down to reflect on all this. I needed a small form factor, GPS, Wi-Fi and cellular. How could a similar device look like? Perhaps, like a smartphone that constantly lies in my pocket. But you needed an application that would work on Android, that is, you had to write the corresponding code for Android and Wi-Fi.
Maybe such an application already exists? I found, downloaded and installed a cool application called WIGLE WiFi from the mobile app store for Android, and then I chose a volunteer cat for my tests. This is my friend Rivzi's cat named Skitzi.



This is a damn big cat with a body length of 55 cm, a chest girth of 50 cm and a neck girth of 30 cm. Now we needed a Cat Coat, or a “cat coat”, perhaps of this type:



If you type the phrase “cat coat” in Google, you will see a whole bunch of photos of girls in a coat with a picture of cats, so this option does not fit, so I began to “google” the phrase “dog coat” and found something that could fit me.



The plan was this: I put my equipment in a coat, put a coat on the cat, the cat goes for a walk, and I restore the recorded data when he returns home.

The sequence of actions is shown on the slides.





Here he looks a little scared.



Then we released the cat ...



And it ended in failure! Crawling through the fence, the cat lost his cloak, apparently, he was hanging on it too loosely.



We caught the cat, put a cape on it again, tightened it tightly and tried again. And here we sit and wait, and wait, and wait ... we waited for him for 18 hours, and when we opened the door, we saw that the cat was back naked, without its fighting blankets.



We suffered a failure! We tracked the last known mark of GPS, but the blankets were not there. From this experiment we learned the following lessons:


Then I spoke with my friend Bill, who was fond of all sorts of engineering things, and he advised to use the Arduino microcomputer, which had the following features:


I began to understand what this “Arduino” is:


Billy used the Ardunino chip to test the products in the refrigerator, for the robotic “hand” and for his video games. It has a really tiny form factor, it is an open resource and is very cheap.



The disadvantages of "Arduino" include poor documentation, dubious quality and the fact that it takes an eternity to figure it out.

This is all well and good, but I have never worked with Arduino, proprietary software and small chipsets, I am not a professional coder and I don’t know how to solder. But Bill said: “Don't worry, it's easy!”

My action plan consisted of the following items:

I read a book that came bundled with the Arduino Uno, and many more engineering and electronics manuals, pulled out a bunch of LEDs to try out their work with the Arduino, although I wasn't going to use any light bulbs. The most amazing thing was that I discovered software libraries for Wi-Fi, GPS and SD cards.

On the Jeremy Blum website at jeremyblum.com I found a lot of videos about the design of all devices based on the Arduino.

After all this, I felt that I had become an expert in this matter. So, I had an Arduino Wi-Fi expansion card and an Itead Studio GPS expansion card.



I needed to give the Wi-Fi card the function of a data collector with recording to the SD card, and the GPS card - the tracker function, also with the ability to write data to the card, and combine them into one.

Everything went perfectly with the Wi-Fi card: the installation was easy, the drivers downloaded from the Arduino site worked, after a bit of trouble with the parameters and variables everything worked out as it should.

But with GPS it was not so easy. There is a NMEA string, the National Marine Electronics Association, which sets the standards for GPS operation parameters — reception, transmission, coordinates, and so on. The process of loading a module can be done from any place on earth — you simply connect this module to a power source, and it begins to “listen” to space. The device detects 3 satellites, determines the position, and it takes from 2 to 15 minutes depending on local conditions.

The GPS expansion board also had poor documentation and there was no instruction in the box with the kit. It took me a week to understand why the module was not working, and in the end I found out that it needed a data transfer rate of 34840 baud, which I still cannot find anywhere else.

In general, I put all the components together ... and failed.



It turned out that more than 80% of Arduino’s memory is used, the number of libraries and variables is too large, and the 32KB of Arduino Uno memory is absolutely not enough - the chip simply cannot work with such a load.

Therefore, I bought an Arduino Mega 2560 microprocessor with 256 KB of memory, again I connected everything together, I launched it, and it worked!



Arduino Mega 2560 had:


In search of an alternative, I climbed the entire Internet and found the Arduino Mega Mini chip from JK Devices, which was smaller than the standard Mega.



I continued to search for platforms of small size and found a microprocessor called Spark Core, which was a combination of two modules on one printed circuit board - the Wi-Fi module was in front and the Arduino chip in the back.



To him, I bought a GP-chip GP-635T chip and a SparkFun MicroSD Breakout memory card.



Since I was told that the Arduino Mega Mini deliveries would have to wait several weeks, and all other platforms were either too large or had too little memory, I opted for Spark products. The Spark Core platform had the following specifications:


The last point meant that although the controller uses the Arduino chip and external components can be connected to it, it is impossible to ensure their interaction by simply writing the appropriate code, that is, Spark and the Arduino platform are completely different things. This did not upset me, and I again began to create my product.

It all starts with the programming language Scratch, but I found out that it does not have the libraries necessary for the operation of my device. Despite this, he was very cool, so in search of a solution, I turned to the Peekay123 development team, and this is what came out of it:


However, with libraries for Wi-Fi was more difficult, because Spark Core was created on the principle of "Internet of things", and Wi-Fi was a background service that could not be associated with it.

But I wanted to tie them up! For the Adafruit CC3000 chip, there were libraries that could be downloaded from the Adafruit website to use it for Wi-Fi data collection, I downloaded them, installed them, and it worked!

So, I had a Spark-based GPS, a Spark-compatible SD card, a Spark-based SSID set, and now I needed to put all this little detail together. For this you need a ration!



Who of you can solder, raise your hands! You see - only a couple of people in the hall! Learning the art of soldering was my last occupation. At the same time, I learned a few important rules, for example, that the soldering iron should be held not by the sting, but by the handle. The second rule was that you do not need to lay your hands anywhere, so as not to get burned by a soldering iron. Rule three stated that everything looks easy on the Internet, but in reality this is far from the case.

So, at first I placed a GPS module and a card reader for the SD card on the circuit board and connected it all to the Spark controller. It looked good, and I decided to check how it works.



Home tests have been great! I took the device with me and walked around the house - everything worked perfectly! It showed that here is my network, here is my neighbor's Wi-Fi and so on. But when I took him with me into the car and drove a bit, I was a fiasco. What was the reason?

That Spark was a prominent representative of the “Internet of Things,” which means that it should never be disconnected from the Internet! In this case, from the home network Internet. I talked with the guys on the forums about what is happening with the device when driving in a car. It turned out that the Spark chip must be connected to an access point known to it in order to start working. It turned out that while it is connected to my home Wi-Fi network, everything works without errors, but it is worth driving for half a mile, the device stops working.

I could scan a unique 32-digit SSID that is used to identify my wireless LAN. So Spark can connect to it, it uses this particular code. What happened was this: when the controller lost the signal of the home WI-FI network and tried to connect again, it looked for the network with this SSID, but did not find it. So, I just needed to have time to remove this code from the chip’s memory so that after losing the signal of one network it could connect to other networks. After I did this, there were no more WiFi problems.

The next stage was the GPS test. I drove a bit and got data on W-Fi points, everything worked fine, I drove another half mile and checked the GPS coordinates. I was on the highway, and on the map it appeared that I was in a lake. Returning home, I found out that the existing GPS libraries could not correctly convert satellite data to coordinates on the map. It turned out that I do not have GPS libraries.

Then I got TinyGPS ++, a set of libraries that extract NMEA data received by the GPS module, such as position, altitude, speed, date, time, course, etc., and transmit them to the Arduino chip. It was what I needed, but it didn’t work with Spark. I spoke with Bill, and he advised using libraries for the port of Arduino.

I again plunged into the field of space science. It's like with a rocket, when you refuel it, put it on the starting position, press the red button, and it explodes. Or the rocket takes off first and then explodes. Or does it go into space, and then you say: “Yes, this is cosmic science”! Somewhat worse when there is a monkey inside the rocket. In general, I found out that you need to swap Arduino and Sparks to make it work. To do this, I had to do library coding for ports Sparks, which is no easier than space sciences. So the next specialty I mastered was a coder specialty. But finally everything worked as it should for me.

The next problem was power consumption. It was necessary to think about how to improve its performance. I decided to use a miniature Elite 3.7 V battery with a capacity of 500 mAh, which my friend Ricky used for his model aircraft, and started testing his work.



It turned out that the option of saving power consumption by periodically turning off and turning on the power of the entire device does not suit me. Then I made it so that you can enter into the deep sleep mode the main chip, while the GPS module continued to work. Data “scratches” every 30 seconds discharged the battery in 4 hours, data collection every 10 minutes increased the operation time up to 8 hours.

. , , , , . , YouTube . , , NovaLabs , . , , EAGLE, , , , . .
. . . , .



. , ? , . , , .



1 – , . Spark , , .

-. ! , , , .



– , . , GPS- .



, , . , ! – ! . 20 , . , , , .

:


- !



, , :



, , , , Wi-Fi SSID, .

, , , , , .



, , . , .





. , , .

!

, .



, , - . Smoocon WiFi Pineapple TV Gone Adafruit / Radiosnack. TV Gone , . -, . , , Karma Answers Probes, DNS Spoof, Pineapple, RandomRoll.



, TV Gone, . , , , .







, - ! Cept Irina & Friends JoAnn's Fabrics, , . «Denial of Service Dog», «c » Wi-Fi.

, , . , , , , , , . , , . Wi-Fi , DEFCON , Karma , « », , . , -.

-, , 10 , , . , 10 .



.



, , , , .
. , , ( , ). GoPro, , , 2 . , : « c »? : «, , , »!



, . , TV Gone, World Cup, , .

, 50 , , - , , .

, , , . , , , , . , .

, , . , .



:


:


, , , , !


, . ? ? , 30% entry-level , : VPS (KVM) E5-2650 v4 (6 Cores) 10GB DDR4 240GB SSD 1Gbps $20 ? ( RAID1 RAID10, 24 40GB DDR4).

Dell R730xd 2 ? 2 Intel Dodeca-Core Xeon E5-2650v4 128GB DDR4 6x480GB SSD 1Gbps 100 $249 ! . c Dell R730xd 5-2650 v4 9000 ?

Source: https://habr.com/ru/post/352968/


All Articles