I'm Dominic's bill oh yeah this is
ridiculous radios I added some things to
it since I read slide thanks welcome it
ridiculous our radios because it's more
ridiculous at least one minute I'm on
Twitter if that's your thing that's on
it yes I'm not really on any other
social media it's like like it was so
I'll I suppose thanks like oh yeah
definitions it sorry to the camera
operator so I just want to thank some
people I'd like to I like to put thanks
up at the front because one by the end
of this talk will be rough and - I like
to make it very clear but none of this
work is I mean this work is all original
work that I've done with people across
for gadgets but it's based on a lot of
people there's a lot of historical words
related to it not everything in this is
something revolutionary that I came up
with right before this tool a lot of the
stuff is based on ideas from other
people and there is people who help me
get demos together and the one person we
won't mention on this is Alex who is the
fourth row and let me a soldering iron
this morning here's me using the
sovereign on this morning because only
of butane miles and lands he's inside so
I work for graceful gadgets always so
let's get through this night all
right
I heard I well Chris credits I write
software and things I am NOT Tim Brown
as your my bio says in the in the book
that you've all been given so if you
don't do me a solid and just cross that
line out in your booklets I trust you
all to do that I'm going to present four
different sort projects together in this
in this presentation they are two
receivers and two transmitters they're
generally radios that are designed in in
ways that can be built on top of
hardware without having to think about
radio engineering
they're fairly simple radios to design
we're not we're not building a hack RF
or or something suit
complicated a high quality radio
receiver or transmitter it's it's a sort
proof-of-concept like can we make a
thing worth once and so generally these
have all worked once and I have a I have
a demo that even when it works works
from about a foot away and given the
audience is more than a foot away that
demo is I will I'm more than happy to do
a live and but no one will be able to
see that it works you just gonna have to
go and believe me on that one so so they
start up with disclaimer you should know
and understand your local laws I'm not
saying you have to obey them that's in
target to you however thing that's
notable is that car keys character
openers that a lot of radio things that
aren't Bluetooth or Wi-Fi or or whatever
but are unlicensed and you can just have
a full 33 megahertz if you start playing
around with them you're very much in the
middle of where the UK Tetra frequencies
are etc frequencies are used for
ambulance dispatch and fire engines and
if you miscalculate and get your
frequency off quite a bit and you jam an
ambulance signal that's really really
bad so I clearly try to obey that all
when I do this stuff my my overarching
feeling on it eriously just don't be
wait don't interfere with other people
you don't get in their way
and still stick to your own stuff and
generally I prefer to build receivers
rather than transmitters anyway to snoop
on other people instead of interfering
with them and I will demonstrate at
least one of the transmitters I won't be
demonstrating today but at home video
form because it wouldn't be legal to be
transmitted effort me to demonstrate in
the UK anyway because of Amazon so start
with scenario we can get cheap
microcontrollers there are micro
controls and absolutely everything go
there or whatever there are loads and
loads of them inside every either like
train twice you have your phone has a
ton of them it's not just the processor
it's the baseband is the Bluetooth chip
is the Wi-Fi chair bits but a thing that
controls power delivery to the
both in the charger at the other end of
the cable your phone when you're
charging the phone there in I mean like
I cannot see this everything here has
microcontrollers and there's a mouse
here that's money in it probably it's
Radio packs headphones everything and
they're all running firmware most of
them running custom firmware designed
for their application and if we can
modify that firmware can we maybe get it
to do interesting things and we approach
this from the idea of things like air
gap networks if we're able to modify the
code running on our laptop can we just
use say for example your keyboard
controller to receive wireless or
transmit wireless signals now a lot of
these microcontrollers have a ton of
stuff built in it's not where it always
necessarily used but it's it's built in
anyway and these are peripherals various
things so if anyone's here for Joe's
talk earlier he gave presentation about
how you could run spy and JTAG and UART
and I squid see all of the same chip so
now someone might take that chip and
embed it in a product for the spy
functionality but they don't entirely
disable the other functionality if we
can unlock that and use that then we can
get it to do JTAG or we can get it to do
I squid C or us or whatever else we want
to do and so if we can pick up an
off-the-shelf microcontroller with an
analog to digital converter net can we
build a very simple radio receiver at
space so we call this breadboard SCR
it's using a soulfulness breadboard and
it looks like this this is on the left
hand side this is a great pet one which
is just a microcontroller breakout board
that we designed a graceful gadgets this
doesn't require that piece of hardware
the software I've written works for that
piece of public but you could go and
build this on top of other platforms as
long as it has an animal and once
digital converter there are three wires
connecting that to our other circuit
board I don't know how well you can see
that but those two components are a
diode and a resistor because we could
hopper engineers we've done second
diagram the circuit diagram shows you
the three wires
the diode and resistor and and this is a
radio this is a radio receiver when we
first tested it Mike's first comment was
WOW it transmits as much as it receives
you really shouldn't use this like this
is not a good radio this will get you in
trouble with calm but you should you you
should use this as a base like this is
essentially what most software-defined
radios are and then everything else is
just to improve the signal quality the
bandwidth the interference all these
sorts of things is what most of the rest
of the board is bought now so the way
this works is we I mean let me explain
the the circuit diagram first so the
clock signal comes out of a
microcontroller that's whatever
frequency wants to tune to we combine
that oh wow I shouldn't lean on the
buttons for so I clicking I'm sorry
Bella professional so so what we want to
do is we have a we have a frequency we
want to receive we generate that
frequency with the clock on the
microcontroller we combine that with the
signal come from the antenna goes
through a diode the diode acts as a
mixer it combines those two and and when
you mix two signals together what you
end up with is one of those signals
shifted downwards in frequency by the
other one
so what we end up doing if we put 433
megahertz in to the clock we get
whatever we receive over-the-air shifted
down by 433 makers we stopped with an
ADC and then we put it into can you
radio has anyone used a new radio before
going to some quick show of hands okay
this this is typically rated flow graph
I'm more than happy to talk people
through it individually later but it's
probably not all that interesting as a
group exercise essentially what this
does is to take the analogs digital
converter samples and turns them into
audio and in FM t modulates them and
does various data conversion things
throttling speed and stuff like that and
what you end up with is a is a graph
coming out on the left hand side here
you can see on the top section of these
two plots it's what we're most
interested in on the left hand side this
there's silence and on the right hand
side you can see FM audio being
modulated there and the the the
amplitude there is the is the audio that
we're receiving and if you light up in
in the spectrum thanks Mike you can see
and try and point at this and see if
this works this will not come out well
of the video you can see audio here so
this is we we sample the the red line
which is where our signal is on the top
and on the bottom plot we're looking at
FM demodulation of that and one of the
things that gives us a way is we
transmitted this with a little handheld
ham radio and in the end of the
transmission when you let go of the
button it sends out a pilot time and the
pilot tone is just a sine wave and you
can see that right in the far right hand
side you have a very regular signal
being transmitted and that's a good sign
that we got the signal that we wanted
and wait I have to do a microphone thing
[Music]
that work hey can you still hear me Wow
I think it's not one providing feedback
because it works but we'll see we shall
see what happens okay I should be able
to load up this flow graph breadboard
SDR narrowband FM this is the same flow
graph you just saw but it's loading from
file because I can't transmit in the UK
I don't have a license so I'm not not
demonstrating the transmitter I'm just
demonstrating and all that it was safe
the data as as we received it and
hopefully I've just realized I need
audio out benign so
so Mike and I were able to transmit with
this ham radio and then with a
microcontroller that costs I think the
chip itself costs about ten ten pounds
something like that and we were able to
then take two of them two components and
build a radio that we can receive
hammering it with so that that's a good
start
all right you want something and also
maybe this should be full screen okay so
if you're building a radio in software
you guys we don't need multiple one we
can build very very simple radios we can
build a radio that receives data with
only two components so if you can
smuggle a diode and a resistor into your
air-gapped Network we can probably build
a receiver on that end I want to find
software without having to smuggle in a
hack RF or a thing that looks like a
radio to anyone else also our antenna
was just a piece of wire you'll see
throughout this presentation we're not
super picky about the antennas to be
used for this mostly because we're
working in a lab environment we're
working in a in the mountains outside
Denver in Colorado there's not as much
radio noises there would be if you were
doing it here and we generally trying to
be good citizens about it and not
transmit too much but we're doing
everything super low power so scenario
two we got we've got data into a device
that is not we've got radio signals
received by a device there's no
traditional radio can we transmit them
back out let's say we we're in again I
got Network can we use a microcontroller
to transmit things so cause of clock
signal transmitters his basement of
people's work Mike Walters who's sat in
the third row did this back in 2016 at
security I think I mean not as a
presentation because it's at a room
somewhere playing around but he was able
to turn on
remote-controlled light bulb using just
turning on and off the clock signal on
sweetie has done a fun tenor which was a
hacker but I think it's disco point
phone and they they were able the group
who didn't were able to toggle like
along a very long trace on the PCB so
that they could transmit data and
Raspberry Pi at home works in a slightly
different way so sorry with our cut
people trying to get photos outside
before I skipped it I will publish the
slides afterwards as long as your photos
you it's fine so again Lee this is this
is my transmitter again I'm using the
the great Fed board because I have one
on my desk as well use it and I wrote
the solver for it so it's a lot easier
to know what I'm doing that is my
antenna now again this antenna was
picked in the same way we picked the
previous antenna which was I reached
into a box of wires and pulled one out
and then I plugged into the board and it
worked so I didn't replace it if it
hadn't worked
I may have replaced it with one of the
different lengths but you can do you
know math but why do maths when it works
first time so how's this work I like to
turn up the game from from what my
walters did so instead of doing on/off
King I did a frequency shift keying I
want to do it 315 megahertz which is why
I can't demo in the UK because that's
not an unlicensed band here but it's
really common in the US and in fact it
is it's very common for all those things
Carlos garage door openers those sorts
of things now one thing I could do is
what Roderick yfm does I could just
modify the clock generator on the fly
that's a bit complicated and seem like a
lot of effort and code but the nice
thing about my microcontroller is having
multiple clock generators so PLL is a
facelock boots just a fancy word for a
clock generator for the purposes of this
talk is much fancier than that but they
say that I could use two of them as long
as I just say what my USB interface so I
did that I couldn't give me here the
device but I could generate two signals
one at 305
because on one or three hundred fifteen
point one and then I use the seu the SCU
is just a pin matrix it just decides
which which functionality inside the
chip is connected to outside if you
remember Joe talking about things
earlier he talked about how sometimes
JTAG is not available on chip because
they're using those pins of something
else that's what the seu is it - not
almost any microcontroller of a
reasonable complexity you just don't
have enough pins around the chip for the
functionality that you want to produce
so you use this matrix to switch things
pins on up so the the SC you just decide
which pin is connected to the output and
now I can switch back and forth between
two frequencies just by changing the
sust you just points to which pin is
connected so I just change which clock
is put out at the given time and I can
send frequency shift key later so this
is my car I load the code and if you
look at the front curve it unlocks this
actually works so well that Mike had not
started filming this when I ran it the
first time and because my car uses
rolling coves we then had to get cat for
another code you have to be away from
the car when you do it so this resulted
in Mike and Mike Horstman a night
running up and down the road outside our
our office building to get out the frame
to my car to capture a couple of key
presses then decode them visually using
in spectrum and then load that into
firmware and then running back to the
car to running again so we did that
about three or four times but but we
find the gutter now one thing is
interesting about this is that my car my
car center frequency the frequency is
expecting to see the signal on is 315
point zero zero five bill I can
configure my clocks back easily
again like it seemed like a lot of
effort to try and skim it by that much
so I put a 350 point zero five that's 45
kilohertz off the frequency deviation
between the binary one and zero is only
25 kilos so I'm outside of the range
that it's expecting for its original
signal plus I couldn't configure it to
get the 25 kilohertz range
I got plus and minus 50 kilohertz it
does not care it absolutely works and
part of the reason is it's a bit like
lock-picking if you go and talk to
people that lock-picking they say the
only reason you can pick locks is
manufacturing tolerances we can't
manufacture a lot so perfect that you
can't you know nudge the pins and things
like that it's the same deal why build a
radio that is so carefully and precisely
controlled that I can't transmit - it's
slightly off frequency into my car
you've already got rolling codes for
security you want it to work when my
battery's low you want it to work in
weird conditions once it's work in the
presence of noise so you can build a
radio as cheaply as possible and that
means that you don't have super perfect
filters you don't have you know
rejection of those signals that are just
slightly out of bound and as long as my
my signal is powerful enough and like
look how far away I am from the receiver
then it still works and I can still
unlock my car I guess the other reason I
can't do this is what I know is my car
is thousands of miles away and it'd be
tricky to get get it here and into this
building for a very very quick and dull
demo okay so so our learning is like not
only can we build it in software and we
don't need much hardware but if it
oscillates like a radio as a clock
signal does and then it emits as a radio
when we plug a wire into that pen then
it's a regular just because the
microcontroller calls their clock signal
and it's designed to share the clock
with other chips on the same circuit
board doesn't mean it's not a regular
it's still able to transmit where it's
still able to use later you use it to
transmit data so this one's gone to a
third scenario in terms of time yeah
wait let me go make it so the scenario
is that there will be regimes they'll be
governments around the world where they
do not allow us to help us animals
Dishman versus the first radio relied on
us having a cheap analog to digital
converter inside a radio inside a
microcontroller sorry so we could use
flow record but
there might be regimes around the world
that limit access to animals digital
converters and I know everyone's
thinking who would possibly do that and
here's a page out of the US government
regulations on Export Control and they
limit access to analog to digital
converters and in fact they live in
access to high precision analog Sutra
converters because they can be used for
advanced radio systems and things like
that all sorts of all sorts of things
require kind of converting data between
London Digital tonight and admittedly
these are incredibly high high precision
and we're looking at a resolution of 12
bits or more that's an output rate of
200 million words per second so it's 12
bit 200 megahertz ABC that is quite far
and away higher spec than we have on any
of the pub consumer st oz out there but
it is something to consider that we
might not have access to it is not
beyond the realms of possibility that we
might have a microcontroller that
doesn't have any so can we use a digital
i/o then we come to the GPIO pin the
receiver so we're going to build a
receiver that works instead of using
analog data uses digital data and this
is where we get a bit messy okay so
there's some very here and there are not
a whole lot of people in the room so I'm
going to delve into it but don't worry
if you get a bit lost
it's probably the my explanation is bad
and I will happily try again in front of
a white board with pallet paper later
this is the first generation that we
built and this the the silver box you
can see the back is a TV tuner it's
ripped from like an old video recorder
and you can just pull that out and it
will it will give you a good RF front
end so instead of using those two
components that we used on the the first
fret board SDR
we're we're taking in a higher quality
radio and it's got an amplification in
there and it's got some good filtering
in there and so we're getting a better
quality radio simple answer and I would
have liked a demo this and this is
actually how we captured the key presses
for my from my keyboard however a piece
of hardware landed on my desk last week
and I thought I couldn't give this
presentation
without trying to sneak an additional
thing into it so this has not been we
have spoken about this publicly yeah we
only got it working last week I only go
to working with my laptop yesterday and
I'm going to attempt a live demo and it
may go wrong quits so we we know a lot
of our experimental boards off some
flowers quince is a flowering plant
don't Matt me this board is a comparator
and a comparator just says is this
signal greater than or lower than a
threshold and it currently connects to
the RF content on hack RF now admittedly
this has been using an RF to build up
low great radio by bypassing the good
bits of hack RF but this is because it's
a prototype so in the future the Quinns
board will have a whole lot on this
basically where it says Queens it will
have a whole lot of additional circuitry
to do kind of analog analog electronics
to shift for supercool gigahertz range
down to base bounce so that we can solve
it but right now we're using the hacker
app for that so the hacker app will
change the 2.4 gigahertz and then we
connect to the expansion header on a
carafe and we solve that with the great
fat there's no rotation transfer
happening on that a correct we're just
using as a as a tuner so we're only
using the analog exception of that was
no SDR happen at all on the Quinns board
what we're doing is we're sampling using
a digital pin it is either on or off
there is no analog component to this and
that means we sample one bit
now conversion a problem we're going to
meet more than one bit of dynamic range
to look at our signals this is really
common in SDR you want a lot of dynamic
range she wants as much as possible
people talk about 12 bay DC's ain't bad
DC's is ain't there enough for this than
the other and things so we thought the
the best solution to show that 8 bits of
ADC in a prep is more than enough for
anybody would be to build a radio that
decode
with one bit of ABC one bit of dynamic
range and see how that works so we're
gonna use a technique called over sample
and decimate this thing it works in one
direction and this is where the sort of
maths comes in and I'm not going to talk
about the maths I'm just gonna show some
graphs but what we do is we take 16
samples like this and for every pair of
samples we average them to get one in
the middle now if you're averaging two
numbers so these are all 0 or 1 on bit
values if you're averaging those those
values you gain a bit of dynamic range
you can have half values if you do it
again you can have more values and so
now we have four different values
clusters there on the one I guess that's
it anyway
we have more values that we can have and
if you keep doing this and keep doing
this you gain for every time you have
your sample rate you gain one bit of
dynamic range if it's bit more
complicated than that but roughly now
this means if we saw pull if we have a
very narrow signal and we sample way way
wider than we need to
we can then decimate to just gain our
sample a signal back and we get more
dynamic range still work in the other
direction you can't get more bandwidth
by sampling a higher range and then
working the other way it only works this
way so it looks like this this is a
slightly more complicated flow graph but
essentially this is doing a a it's doing
a lot but but this is this is the main
domain book that we care of here is the
vs. we put a at the top to kind of read
them from from where you are but the top
two on the right we have a
the decimates and we have a rational
resource law but also decimates and so
what we gain there is dynamic range as
we lose as we we lose bandwidth but we
don't care about that with because what
we're looking at is a 1 megahertz signal
now what we're going to solve lat
because it's a dis why open digital
opens a useful fast binary interfaces so
we can solve 100 mega Hertz so we can
hunter makes office a second but we only
need one mega sample second so we can
decimate and we gain a number of bits of
dynamic range in order to receive things
so using one bit sampling and substitute
determine switch much fun together
ok I've only run this once I've only had
this work once so everyone hope they
worked for me sure I want I've got a
copy and paste the command so I'm just
tuning the hack RF at first to you a
freaking thing it's just gonna dump
songs into a file somewhere I'm not
going to use that file for anything then
what I'm going to do is use the the
great fit that's attached and I'm just
going to use the logic analyzer function
of it to stomp all those pins as quickly
as possible right now I have a
limitation of Pi USB and my firmware
that means I only get 17 mega mega
Sophos a second I just need to do some
tracking to get out to 100 and then I
should be able to go wait yes then I
turn on a device that should be next to
my phone and what we're using here
connect excellent and then I'm just
going to very briefly generate some some
traffic ok so that
that's generated some traffic and it's
all being saved to this quince for not
that far so let's kill it off let's go
to our complicated flow graph now what
this is going to read is that file but I
just broke it so give me turn my
headphones off that's gonna read this
file that we just wrote and it's gonna
output to a file called temp D mod so
I'm just gonna run this now what you'll
see is in the top graph hopefully
creatively hopefully there you go this
is doing what's called burst tagging
it's finding packets in the data so if
you see these all look fairly regular
these are all the packets that were
transmitted that I was able to pick up
these are Bluetooth packets so what I'm
doing is simultaneously I am able to
receive 17 megabytes of data and then
take that one bit value and convert it
to enough bits to pull a Bluetooth data
but because that's done in the filter
because that's done for a specific
frequency I'm able to do it 17 times one
stage Bluetooth Channel in that 70
megahertz chunks once again it's up to a
hundred megahertz I'll be able to do it
for every Bluetooth channel
simultaneously and be able to sniff all
Bluetooth connections within range
simultaneously just using one bit ADC
software so and just to hopefully prove
if I run I output my data into a file
format that is accepted by bluetooth
tools because I happen to know a
developer or both because it's me and
what you'll notice is I was able to pull
out all these Bluetooth packets and this
el ap is the address is the MAC address
of my bluetooth headphones and I'm going
to pull all these packets out now the
channel information and verus on the
clock information is all wrong at the
moment because it's just a proof of
concept but I was able to accurately
receive and decode Bluetooth packets but
I was only using a digital i/o pin and
no animal to digital converter at all so
we don't even need an analog to digital
converter to digitize radio husband
excellence wait enough to go back
and keep the weight off right away
[Music]
all right Howard it's time all right
Oh interesting we might sleep over us
seize the function of my music so I'm
going to have to use the old method so
one bit diagram is more than enough for
anybody
everyone can stop complaining about
8-bit eighty-six okay final scenario
there's a thing called pseudo Doppler
direction-finding there are there are a
piece of hardware called the use for
finding radio signals so they are the
idea of them is that they are you want
to be able to track down people who are
transmitting now in general mostly that
you want to track down our people who
are interfering with you ham radio
operators use them a lot generally if
you transmit on a ham radio band
accidentally because without a license
ham radio operators will track you down
because it anyone else they are I mean
oh they're so good at it because they
care very passionate about it rationally
so might developed a pseudo topper
direction-finding rig we call an antenna
switching board it's also known as an
opera cake because we want food so can
we find some way to subvert it so I'm
calling this direction pointer to
direction fighter because I couldn't
think of a better name than better love
and hider and I even wrote the word so
I'm gonna say I can make my phone be
mine quickie thing again
okay that's France all right sit up top
the direction pointing not only am I not
good enough explaining things to get out
and at the time I have but it's already
been done by my husband and Skylar
actually got a couple years ago there's
a link on this slide go watch their
video and they'll explain how super
Doppler works and how it was with our
board and how we were able to attempt to
find things but but essentially huh this
is
your keyboard it's just a bunch of ports
and it switches antennas so you can have
an input coming in and it switches to an
antenna and you can electronically
switch your signal between antennas it's
really really useful for
direction-finding it's also useful for
light if you set up a ham radio rig and
your ones herb switch between antennas
that you're using and give them
frequency or you want to switch in
different filter banks and things like
that so let's talk about radio again if
we have to face shifting so does anyone
know about different has ever studied
radio things different forms of
modulation phase shifting any of the
stuff hands up okay well I'm gonna try
and say things that you understand and
I'm not very good about so you should
look the top of a textbook if you really
want to understand that and I can
recommend some textbooks to look
properly understand it and understand
the maths or anything like that really
don't want to put mass into my
presentation so I didn't phase shifting
is where you take a signal and instead
of changing the frequency of the
amplitude signal to change where you are
in the way for a given time so phase
shift keying works by making rate jumps
in the signal jumping from one point of
the signal to another when we're doing
Direction finding what we do is we take
multiple antennas and we switch between
them rapidly and usually in a circle and
that gives us a phase shift based on
where you're coming from
so essentially what happens is where you
are on the waveform is different at the
two antennas at the same time so you
don't want the size of your array to be
about the distance across already out of
third of your wavelength and that means
that if you rapidly switch from one end
to the other you'll see the same signal
but you'll see it just slightly off from
where it was and you can use that to try
and calculate the direction but we can
make that happen too we can induce a
phase shift
and they're there for the diffraction
point in triggers that think it sees a
patient but it's actually what we
control so this is a diagram I made in
the hotel room
at the time I thought it explained it so
implements time space shifting out right
but essentially like if you have if you
have two different lengths of cable or
two different placed antennas you will
be waveform that electricity that you're
transmitting electromagnets in the in
transmitting will reach them at
different times and therefore different
parts of that wave cycle and so what we
can do to introduce a phase shift in
something is have two different lengths
of cables these are often called delay
lines I spoke to someone about this
earth about a year ago and they said oh
yeah use delay lines I used to work in
fiber-optic we used to just run bounce
data between Silicon Valley and Los
Angeles to just conducive to lay into
the data because that's long enough for
it to ley line at the speed of light or
just like 30 kilometers of coiled
fiber-optic just as a delay loop in that
lab but we don't with RF we didn't have
to climb hooking at us and therefore a
quarter of a wavelength is about three
centimeters and therefore these four
cables that hook up to my upper cake are
all all centimeters all for each other
three centimeters off from each other
and that means I can induce a phase
shift by cycling through them so Oh
openly preventing response was that this
video would work and we shall see what
happens so this is a direction-finding
rig this is one we set up the 2.4
gigahertz you can see in the glass the
four antennas they are at four different
locations and then they're separated by
roughly a third full wavelength and that
feeds into the applicator which feeds
into a Corral we just attach to my
laptop what's the slope I thought so
that's Mike laptop he's running his
direction-finding code on it already
this is my laptop this is my transmitter
and I have went too late lines on it but
I'm not using
I'm just gonna start transmitting just
some data just gonna send some dates
around and I didn't pause it quite the
right moment but you'll see on Mike's
display in the top right corner there's
a sort of baby bath fuzzy blue dog that
gives us a direction from his direction
pointing really to my transmitter and we
are able to kind of use that and if you
calibrated properly he knows what the
transmitter is so what I want to do is
make it so his software mobile the
receives it correctly so what I do is I
just start looping through those four
different tables at different lengths
and you'll see we now have almost my
tenders with bouncing around all over
the place so we now don't have any idea
of the direction of the of the
transmitter so we're able to use the
exactly the direction finding rig that
he's using to detect us to subvert this
detection so you see it's jumping all
over the place oh that's really not what
I want to see there we go so adding a
phase shift certainly men sitting over
low now this is really gonna destroy
your signal if your signal relies on pay
shifts and things like that but if
you're using on/off key the frequency
shift then it's not you can you can get
away with it so and this is going to be
very quick because I'm running out of
time and this is the demo that only
works from about a foot away so I'm not
going to do it because Graham's already
his give is till next but since we can
modify the phase to support a direction
finding can we take a signal that is
being transmitted and has no face
component that we care about and add a
covert channel over the top of it
can we add on a face shift key signal to
an existing radio so I'm not even
talking about like building an SDR and
talking about taking taking our
operative board which looks like this
and a microcontrollers controller and no
radio or just take an existing radio
that we do not care about could be a
handheld ham radio device it could be
any radio that could be a Wi-Fi device
it
also the a Bluetooth number so this is
my transmitter this is a a like $3
Bluetooth Don what picked up from Amazon
we cut the trace to the to the antenna
on so ordered we just sold on the cable
and then we called out one of the test
functions that they left in the firmware
and the thing and got it's just trust me
transmit signal on a single channel and
so this was my my transmitter and so all
I'm doing is transmitting a 2.4
gigahertz carrier out of that and then
externally I'm just taking the Aquacade
board and I'm adding that phase shift so
this is in spectrum again grateful for
this sort of work and you can see this
is a face plots of the bottom of the
signal you see the top and these just
shows that these drums that are
happening and these are kind of
instantaneous these dots right here here
here and so we're able to create
instantaneous base jumps by switching
between different different lengths of
table on your paper so we have 2.4
gigahertz we have we can add phase shift
keying we can actually switch these 11
million times a second if we want to
that's how quickly our switches work
that's what faster than that but 11
million is going to be really convenient
in direct sequence spread spectrum is
actually just really really fast phase
shift keying so we could generate the
DSM s signal at 2.4 gigahertz and 11
megabits now does anyone know what let
me make a bit dsss signalized gram it is
Wi-Fi Wow
there you go so we're able to produce a
completely fictional Wi-Fi network from
a bluetooth dongle an antenna and two
lengths of antenna cable that are
different off by a half wavelength
between the two and switch back and
forth between them 11 megahertz using
antenna switching board had a
microcontroller
to generate a Wi-Fi network that never
existed it is completely pointless but
it's really good fun to do these sorts
of things this works from guaranty a
distance of about a foot and it really
really does not work at conferences when
everyone's got Wi-Fi and Bluetooth going
so it is not possible while I was able
to transmit from my phone to my
headphones and receive receive Bluetooth
packets in the middle for some reason
this is just not powerful enough to
really get two phones but we have
managed to pick it up in quiet
environments in our office and you can
see one of these is my phone one of
these is my boss's phone I explained and
we were to receive these the same the
same network on both so external
modulator or lanterns which you can have
a Coco channel to any existing radio if
you can connect it at you your coma
channel does not interfere with the
existing underlying radio signal again
thanks to all these people who are
involved thanks to Alex for lending his
soldering on this morning even though I
didn't run the demos I needed to solder
this morning so that was potentially a
waste of time and I will not take
questions because a pretend to and grant
probably wants to scare set up for his
talk but I would say questions outside
or just find me around I'm very
approachable just come and ask me
questions if you have them you can find
me on Twitter or great spark edits and
Twitter and all of the code should be on
one of close two repositories to
implementing of these so if you want to
go ahead and implement these radios
yourself do it legally do it safely
don't interfere with ambulances and have
fun with breakfast thank you very much