Ready when you are.
I mean, we're waiting for some flag or something.
I think that's a wave.
I think we're good to go.
Alright, alright.
So, welcome to this lecture.
Today we will be talking about the physical layer.
And I don't mean that we're going to be talking about breaking down doors and picking locks.
I mean the physical layer of radio.
We're going to show you some nifty tricks that you can do at the file layer.
Many of which were previously believed to be impossible.
We're going to be showing you how an attacker who only controls layer 7 data can inject a layer 1 packet without having a radio.
You can email a Wi-Fi beacon.
And this works.
We will also be showing you ways of fingerprinting radios by behavioral differences.
I will be apologizing to Sergey for calling fingerprinting boring.
Because it turns out that you can get weaponized attacks out of it.
And generally, Phi is considered something of a black box, right?
Something that belongs in engineering rather than computer science.
So there is this mystery hanging over it.
And we're going to show that there is no mystery.
That it's built of simple mechanisms layered on top of each other.
So there are many layers to the Phi.
And we're going to try for demystifying it, pardon the pun.
And then we're going to talk about dialects of Phi.
So whenever you talk about dialects, you have this image of the Tower of Babel and the diversion of languages.
Well, here is another image also dealing with Babylon.
So think of this beast with many heads as the beast of Phi.
Now all of these heads are ugly, but they're ugly in slightly different ways.
So here's how this started.
We were having a discussion at a recon one night.
And I was trying to convince Travis to do link layer fingerprinting.
And I said, fingerprinting is boring.
And then we had some more discussion.
And then somehow I managed to convince Travis that, no, it's not boring, it's worth trying at least.
And so it went from there.
And then it really got us quite a bit of pwnage.
And it got Travis the pony.
And so what brought me to that boat was Wright's principle, which I actually helped phrase after I heard it in Joshua Wright's talk about Killer Bee, the tool to exercise the 8215.4 ZigBee Phi.
And Wright's principle reads, security won't get better until tools for practical exploration of the attack surface are made available.
What does that mean?
We need to be able to inject raw frames.
We need to be able to inject raw frames with ease, such as, say, with Python.
So we went ahead and wrote, in addition to Killer Bee, the Scapey Python .15 D4 library that allowed you to stuff all the fields of that frame as you see them.
And of course, if you looked at the standard, it actually looks like this.
And then if you look at the interdependence of those fields, it looks more like this.
So of course you want some help with generation of those frames.
But you want to generate them with a few lines of Python, and now you can.
So then of course we need to play with that particular Phi, so we need radios.
A bunch of those radios exist.
There is a specialized development from Atmel called RZUSB Stick.
There is a variant of the Arduino called the Frigduino Chibi.
There is a packet analyzer, a sniffer, a bunch of them.
And around our lab, we had a whole bunch of T-modes, TELUSB T-modes, which are again a chip and a microcontroller on the same PCB.
I actually planned to go into software-defined radios as well, but this is where Travis said, no, we are not going to do that.
Not every neighbor can afford $1500 for a software-defined radio.
So at the time that we began this, there were no cheap software-defined radios.
Now there are, but there is still good reason to avoid them in this style of research.
Because you want your attacks in the end to work by pure software on the normal hardware that speaks these protocols.
If you have a software-defined radio, then you are implementing everything from scratch.
And you rely on a situation in which all of that custom hardware and custom software is available.
What you would much rather have is a single packet that can run over an ordinary network using the existing radio, rather than having to introduce your own.
Basically, you want your own device for injecting raw frames to be something that you can bring around.
And if it goes bad, then hey, you can just take another one.
So by the end of it, we actually built our own, which we called APMode Beta.
And in retrospect, the pun is not very visible.
You see the little B there?
That's from the latent APIS, the B.
Well, yes, Zigbee Killer B, that sort of thing.
No one gets it, and neither do I.
Whatever possessed us to call it that.
But here you go, this is the APMode.
The microcontroller in the center is an MSP430, Travis's favorite chip.
The chip on the right, sitting in this little square, is the Chipcon 2420.
Again, our favorite chip for Zigbee.
And of course, it's sitting in the middle of some radio components, which turned out to be quite tricky to debug.
Otherwise, this is what you would know as a good effect.
And so you can see the FTDI chip to the left.
So this is the sort of radio that you would find in an electronic thermostat or an electronic weather monitor.
These are used in home security systems, in smart electric meters.
So the same principles that you discover when researching with this hardware can be ported to run inside of that other hardware.
You can take an attack that you write for the APMode, and you can rewrite it to run inside of a thermostat.
This can transmit packets that the thermostat will receive, or that a home security system will receive.
This can implement the same cryptography that those devices support in hardware.
So whatever you develop on this custom research hardware can be directly ported to run on scavenged hardware.
Or hardware that already exists within your target environment.
Because most likely they will be using this or a similar chip.
So the reason we're describing this is that I have some of those for you to take home if you're interested in ZigBee.
And it's more or less a standard GoodFET with a radio front end.
So ChipCon 2420.
You can talk to it over USB.
You can talk to it in Python.
And there are some options for powering it from a battery if you care.
And also, there are many places that you would find ZigBee.
If you take one of those cards and use our ZigBee scan software to sniff, you would probably see building, monitoring, building energy control systems.
ZigBee is also quite popular in manufacturing automation.
So if there is a factory nearby, maybe you can talk to the robots.
So this is the stuff that we're going to play with.
And then, of course, the question is, what is that phi?
And what is phi in general?
So somewhere there exists a wave, this electromagnetic oscillation in the air.
And somehow it becomes a packet.
So actually, my wife asked me quite a long time ago, well, how does it know where the packet starts and ends?
And I mumbled something scientific.
And she was right.
I did not understand how the heck it works.
So, you know, magic happens, right?
A good fairy waves her wand and suddenly you get a frame, you know, with those fields, a frame control data sequence, MAC addresses and such like.
So this is the level of understanding of phi that we have.
It's sort of the business plan, right?
You know, somehow one thing becomes the other.
And, well, this is the magical abstraction, which is what I must have mumbled back then.
But in reality, you know, in order to get all of those tasty little fields, you know, you have to decide that you are actually in the frame.
There is always noise.
Noise is typically indistinguishable from a weak signal, right?
And so the magic has to work twice.
First, you need to know that you are in the frame.
And then you need to know that the frame here, the frame ends, right?
Yeah, and then things turn to pumpkins and all the other...
If you could jump back one slide.
So the thing to notice here is that, you know, you as a user of this network, you just want the packet.
But as an attacker against this networking protocol, you need to understand every piece of the packet.
Including the ones that aren't normally shown to the operating system.
These yellow parts, the beginning and the end, this noise that surrounds the packet, exists because this packet comes through a radio channel that has background static.
And the beginning of the packet, where you see the frame check and that sort of stuff, the exact point at which the arrow is, there is actually a couple of bits there that exist to mark where the packet begins.
And this gets stripped off before the packet is sent up to the operating system.
You can place these same bits inside of your message.
And when you do that, all sorts of strange things happen.
Because the receiving radio isn't quite sure at which of multiple points the packet began.
Well, and so, you know, what the phi layer is, is really a collection of various simple mechanisms, such as those that provide that magic.
So, this is what the frame actually looks like.
So, we're going to guide you through a succession of lies.
You know, there is this profession, liar to children, otherwise known as teacher.
So, we're going to guide you through a collection of fairy tales, which have their uses.
And this is the first one of them, right?
So, there are symbols.
Your magical chip somehow knows how to extract symbols out of the air.
And then your frame starts with eight symbols of zero.
And then, there is a sink field, which starts the frame.
And this field is not shown to your operating system or your wire shark.
Then, following that sink field, which is two symbols, is the length, which is again two symbols.
And that's how long the packet is.
And so, what follows next is what you actually see as the body of the frame.
So, each of these symbols is four bits wide.
So, wherever you see a byte, the byte is a pair of two symbols.
The preamble is zero repeated, which would normally be a bad choice.
But it works out here for the reason we'll get to later, which is that each of these symbols, that represents four bits, beneath the hood is actually thirty-two ones and zeros long.
They're not really the same thing as bits, because not all combinations of the thirty-two are valid.
These are used to only represent the sixteen combinations of four bits.
And you know, it's very easy to see bytes here, but in fact they are not there.
All those boundaries between bytes and actually between symbols even, exist entirely in your head.
And this is a sort of free your mind kind of exercise.
Stop seeing those boundaries.
So, if you understand what's beneath the symbol, you can create different symbol combinations that mean the same thing.
Then, of course, in physical reality, the chip gets those symbols out of the air and then sends them over some communication channel, such as a serial bus, to a microcontroller, which then does something with it.
Say, decodes a frame or passes it on to the OS.
So, this is the part of the standard where they talk about the preamble, the start of frame delimiter, and the frame link, the shaded region.
But, again, we are talking about fields and all of those boundaries that you see, all of those neat vertical lines.
But let's ask ourselves, why?
I mean, say, why the preamble, right?
What is it even?
What is it for?
And forget the actual bytes, right?
Forget the actual symbols.
They are somehow encoded, modulated, and extracted.
But can we even agree on time between the receiver and the transmitter?
Because, you know, all of those things are ultimately sine waves, modulated one way or another.
You know, if all you have is radio, then sine wave is your hammer and nail and everything else.
And you just twist it a little bit here and there, and so you transmit your information.
But our clocks drift, right?
And at the resolution that you need to parse those sine waves, your clocks drift between different devices significantly, even within a frame.
And we're not talking about, like, speed of light, quantum theory, clock drift.
This happens for much simpler reasons.
The quartz crystals that are used to provide the clock in these chips, there are manufacturing differences between them.
So some are a little bit faster and a little bit slower.
When the circuit gets hotter, the oscillators begin to oscillate faster.
So it believes that time is going faster than it actually is.
And when the device gets cold, the opposite happens.
It begins to slow down a little bit.
And these differences are enough that the two radios can't naturally agree on where one symbol ends and the next begins.
So what they do instead is they send a repeating pattern from the transmitter to the receiver.
And this is called the preamble.
And the only purpose of this pattern is to share the transmitter's clock with the receiver.
The receiver then has a mechanism called a phased-locked loop, or a PLL.
And this phased-locked loop will copy the clock of the transmitter into the receiver, so that for the remainder of the message, the receiver is using the clock of the transmitter instead of its own clock.
And so then the question is, how many of these repeated symbols are actually enough to synchronize?
So the standard says eight.
But in fact, the chip has a register where you can set the preamble length and control how many of those you would actually send.
And that could be anywhere from none to eight.
And of course, depending on temperature, the amount of the preamble needed is varying.
But what if you vary it purposefully?
And here you already start seeing interesting things.
So look at this graph.
We are sending beacon requests and getting beacon responses from the target.
And the targets are a T-mode, a Zigduino, and a RZ-USB stick.
So a ChipCoin versus an Atmel variation for those.
And you see, when you send zero preamble, T-mode sometimes hears this packet and answers.
If you start with two symbols, T-mode, the ChipCoin chip, answers always, no matter how many you send, so long as you send two.
Then the RZ-USB stick is actually the pickiest.
It starts receiving only when you start with six or seven.
So already you have a fingerprinting behavior of the receiver.
And think of what it might do, right?
You can send a packet that is heard by some, but not others.
And this has nothing to do with signal strength.
Isn't that interesting?
So you can transmit a packet that the thermostat will interpret, but a wireless intrusion detection system, or a packet sniffer, based upon a different brand of the radio chip, would not detect.
So isn't that interesting?
But we'll come to that later.
So then comes the start-of-frame delimiter, right?
Why is that?
So we know about the preamble now.
The sink is this magical value, A7.
And the machinery in the chip is a shift register that matches those two symbols from the continual stream that is being pulled out of the air.
So when you lock on and you receive A7, that's when you start accumulating bytes and checksumming them.
And then when you have received so many of them, as the link tells you, then you check the checksum and you throw that byte away, that frame away, if it doesn't fit.
Or you pass it up if it does fit.
So before the A7, when you're in the preamble, as far as the radio is concerned, there is no packet yet.
The radio takes whatever comes in and feeds that into the phase-blocked loop to adjust the clock.
But it's not actually reading those bytes or those symbols as bytes and symbols.
It just sort of naturally passes them through to get a feel for the timing of whomever might be transmitting.
It's at the moment that the sync field arrives, which is also called the SFD, or the start of frame delimiter.
At that moment, the receiver begins to treat the incoming data as a packet.
It no longer recalibrates its clock, and it begins collecting the bytes that come after into a buffer to send to the host operating system.
And so then, of course, the next question arises.
What if the start of frame delimiter is in the symbol set?
Those symbols that are being pulled out of the air, are they the same for the payload and for the SFD?
And it varies by protocol.
For 80215.4, the answer is yes.
For 80211B, the answer is also yes for the older versions of the protocol.
For G, the answer is kind of.
That is unfortunate.
But G is such a backward-compatible mess with B that you can't possibly make much sense of it.
So for a whole bunch of other protocols, this is a different symbol, which never occurs in the payload.
So the trick that we're going to show you next would not work for those protocols.
And those protocols include PCI Express, the packet radio, and everyone's favorite, the Ethernet.
But in case you think that you can't mess with the PHY of the Internet, Andrea Borisani and Daniele Bianco have proven you wrong.
They've built a card that allows you to inject arbitrary payloads for PHY into Ethernet.
So Sergey and I came up with an attack called Packet-in-Packet.
The idea behind Packet-in-Packet is that in many protocols, you can include the start of frame delimiter inside of a message.
Also, in many networking protocols, an attacker will be given control of layer 7 data, but he wants layer 1 data.
So, for example, you might be able to control a cat picture that's on a website at layer 7.
But what you really want to do is to inject your own raw traffic at layer 1 to spoof a message from another host or to do other nasty things.
And then you look at this simple mechanism for matching the frame.
And you ask yourself, what happens if this A7 turns into a pumpkin, gets damaged by noise, and is not heard by the receiver?
Then the sequence of symbols will continue.
And the receiver will actually just go on receiving the preamble that's actually in the payload and then receiving the sync.
That's when it says, ah, this must be a frame.
So you can't really tell the payload symbols from the SFD symbols.
And you can embed a full frame, just like that, and hope that noise is going to kill that SFD.
And you know what?
There is always noise.
So, the cool thing about this packet, if you look at all of these bytes, this packet has two different valid starting locations.
This packet either begins at the A7 that's at the beginning, or it begins at the A7 that's in the middle.
And when you have a wireless network, particularly at 2.4 GHz, you have packets colliding with each other.
My cell phone uses both Wi-Fi and Bluetooth on the same band.
It will happily transmit a Bluetooth packet while someone else is trying to speak Wi-Fi.
And it will happily transmit a Wi-Fi packet when someone else is trying to use Bluetooth.
So, when that happens, the beginning or the end of the packet gets destroyed.
If the end of the packet gets destroyed, it's no big deal.
Because the checksum is wrong and the packet will be dropped.
But if the beginning of the packet is damaged, if that first A7 becomes anything else, becomes A6 or B7, then the receiver skips over all of the header data, thinking that it's garbage, just background noise, until it finds the interior A7, which it recognizes as being a valid packet.
And then it reads the bytes after it, which it treats as a packet.
And it reads the last of those bytes as a checksum, which is the correct checksum.
And it forwards that packet all the way up the host to a host operating system that has no way to know that this packet is not real.
So the boundaries of the frame that you see in the nice diagrams, they are entirely imaginary.
And you imagine them to be there, but the reality will turn around and bite you.
Remember the fly beast?
It has many ways to bite you.
But you see, you can't send a PHY frame without a radio, and that's the first of the surprising fairy tales of PHY.
And noise is always there, so we were seeing one of those packets in 6 or 800.
And we wrote a paper about this.
And this is old.
This is a pony that Travis presented at Wood.
And that was interesting, because no one noticed.
It's like, here's a huge break in the protocol.
And that protocol is presumably valuable.
So we had to go and spread the word elsewhere.
So a bit later, there was a follow-up paper that a student wrote.
I believe he was from Canada.
And he decided that he could make a defense for packet-in-packet.
Because, as I showed you earlier, I'm injecting the packet by placing A7 inside of the message.
He thought that he could just escape that.
So wherever you see A7, instead have some 2-byte pattern.
And if a 2-byte pattern needs to be there legitimately, you can escape that with a different 2-byte pattern.
So it's kind of like PHP magic, right?
And inserting escaping symbols and extra quotes.
Guess how well that works?
So that doesn't work, actually.
And the reason why it doesn't work is that the boundaries between symbols are also imaginary.
So here is the first lie revealed.
Symbols are, in fact, not ones and zeros, right?
They are not bits.
They are sequences of chips.
So when, in the previous slides, we showed you a 1 or a 2 or a 7 or an F, they were actually these long sequences.
So when we told you that the preamble pattern consisted of eight zeros, it actually consists of eight copies of 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, and so on.
And if you look at these, these chips line up to each other.
The reason why they have so many of these is that when there are small errors on the radio, the radio can look for the nearest match.
So if you damage up to seven of the bits in the sequence, the closest symbol, by Hamming distance, will always be the correct one.
And then you can ask yourself, well, what's below that?
What are those ones and zeros?
And yes, those ones and zeros will be pieces of the sine wave.
So if you look at these numbers and you ask where they came from, the official standard document will tell you that they are random.
But they're not.
What they actually are, are two different random numbers that were left shifted.
So if you take zero, and you take the four bits from the far right, and you move them to the left, you get a 1.
And if you repeat this, you get a 2.
And if you repeat that, you get a 3.
This goes all the way up to 7, and then 7 goes back to 0.
The same thing happens with 8 to F.
So if you left shift or right shift these little chips, then you get a different message.
All of your symbols go off by one.
This is a bit easier to see in hexadecimal.
The E goes to the left to make a 0 into a 1.
And the 2 goes to the left to make a 1 into a 2.
And if you look vertically, you see that the same nibble is repeated.
So what this means is that we can take a message that does not use any blacklisted bytes, and we can make that message become the message that we really want to send, when it is shifted by one-eighth of a symbol in time.
So remember those sequences of symbols that we put on the slides?
Those don't exist.
Instead, you are dealing with these chips in hexadecimal notation.
Well, then of course the question is, how do you know when a chip code starts?
And the answer is that you don't.
So in our original attack, we used the sequence that was a bunch of 0's followed by a 7.
What we found out is that you can also have a packet that begins with a bunch of 1's, followed by B0.
And that over the air, this will automatically be corrected by the receiver to become the 0's and the A7.
But the firewall software that was written as a defense against this attack would never notice it, because the actual translation happens as the packet is going over the air.
So notice that this scheme is possible because the starter frame delimiter is matched after the chips are in.
So you have this weird interplay between the layers, and as a result, you can send a frame and receive a frame that shares no symbol with the sent frame.
Think about this, right?
You think of the file layer as something that, well, you send this thing and either it's damaged by noise and not received, or it is received exactly as transmitted.
Turns out that you can actually receive a frame that had no symbol in common with the frame that was sent.
Isn't that interesting?
So we're going to step back for a moment and review chip modulation.
And then we're going to show you some really cool tricks that you can do by modulating one style with a different one.
When you have your symbol itself that you want to put out on the radio, you would traditionally either use AM or FM.
In AM, you change the signal strength of the transmitter.
So you pump more power into the transmitter when the volume is higher.
And you reduce the strength in order to make it lower.
And this reproduces the sound on the receiver.
There's also FM.
And FM works by keeping the same strength coming out of the transmitter, and varying ever so slightly the frequency of the transmitter in order to share the volume of the original signal.
Remember, if you are a radio engineer, then your world basically consists of sine waves.
So all you can do is do something to them.
You can change the amplitude.
You can change the frequency.
Or you can change the phase.
And 8215.4 actually uses a shifted phase.
But other protocols use modulations of AM and FM.
So the simplest style of modulation is on-off keying.
This is also called CW modulation.
Or Morse code.
So the photograph here is from a beacon that is in the city of Philadelphia in the United States.
And it begins with a short burst and two long bursts.
Which is di-da-da, which is W.
And then it has di-di-di-da-da, which is a 3.
And then there is da-di-da-di, which is a C.
And the entire message can be spelled out this way.
Someone who is skilled in using Morse code can understand this transmitter from the audio without having to write anything down.
So you can do the same thing with packets over Wi-Fi.
So if you have a quiet Wi-Fi channel and you have, man-in-the-middle, an SSL encrypted session.
You can't really change any of the data inside the SSL connection.
Unless you have a bug, as frequently you do.
But if you don't have a bug, one of the things that you are still allowed to do is to change the time at which the packet arrives.
Because packets get delayed on the internet all the time, it's not really suspicious for one to come a bit sooner or a bit later.
So what you can do is you can cluster up all of the packets and send them at times to produce a Morse code message.
And then you can listen for that Morse code message coming out of the transmitter.
So then, even when you have another layer of encryption, let's say that there is encrypted Wi-Fi, this still works.
And then you can drive around the town listening for the Morse code signal in order to figure out which wireless network in that city is accessing the web server that you control, knowing nothing else along the route.
Which is to say, you don't need to use the native hardware to speak Morse code.
You can use Wi-Fi hardware to speak Morse code.
The funny thing about modulations is that they nest.
With many of them, you can emulate another.
And isn't that fun?
The same is true with frequency shift keying.
Frequency shift keying is sort of like the FM equivalent of Morse code, if Morse code is AM.
In frequency shift keying, you have a couple of very closely spaced frequencies.
Let's say that you have two of them.
The higher frequency will be a 1, the lower frequency will be a 0.
If we wanted to send 0, 1, 0, 1, 0, 1, 0, we just send the low frequency wherever we have a 0, and we send the high frequency wherever we have a 1.
One of the things that we found was that there is a ghosting effect.
If you have an FSK radio tuned to channel 8 transmitting, and you have a receiver on channel 7, you see the original message with all of the bits flipped.
Because the receiver on channel 7 is only looking at the signal strength on its two little sample points.
And the higher frequency for channel 7 is the lower frequency for channel 8.
So all the bits come in flipped.
The same thing would happen if you received on channel 9.
Which means that wherever a particular sequence is blacklisted in FSK, you can just invert all of the bits and transmit on the wrong channel, and allow the receiver to flip them again to become what they used to be.
So you see, you hear ghost voices.
Remember how LPs and then cassette tapes were supposed to contain some satanic message if you play them back, you know, back to front?
Well, this is sort of like it.
But this just shows how frequency shift keying actually works.
And then, of course, there is the phase shift keying, which means that the pieces of the sine wave do not change frequency, it's the same frequency, but you receive those pieces shifted in phase.
So, you know, now it's a sine, and now it's a cosine.
And you can have two phases or four phases, or you can actually have a combination of amplitude and phase.
Those are interesting modulation schemes.
Long story short, 80215.4 uses QPSK with four phases.
So when earlier we showed you those sequences of 32 ones and zeros, that was also sort of a lie.
Those bits come in pairs, and each pair of them gets transmitted at a time as part of a subsymbol.
So there are multiple intermediate layers at which you can think of a packet and do crazy things to the packet.
And whichever layer of abstraction you choose, it's going to be a little bit wrong in one way or another.
You can always go a bit lower.
So the protocol beast, it has many heads.
It might be a song, right?
The protocol beast, it has many heads.
On the magic school bus.
He does it to me every time, you know.
Every time I presumably carry a tune, I carry like one of the same tune.
I don't know.
He says that it's a Soviet children's song, but...
God knows what it is.
Anyway, so PHY harbors many surprises.
And a zero is a zero, and a one is a one, except when they aren't.
So, now that we can vary our transmissions along all those lines, you ask yourself a question.
Do radios have dialects?
And we already saw that with the variable preamble, but now we have the machine for exploring that question.
And that machine is the AP mode.
And the ChipCon 2420 chip has a register where you can set the SFD to something else.
Apparently, the manufacturers wanted to accommodate proprietary networks, which are sort of following the standard, but not really.
And it includes preambles.
Now, if we set the SFD on the transmitter to something which is not A7, then by sending packets with our packet-in-packet payloads, we can get them through every time.
Because the receiver, of course, would be looking for the real SFD, not the bad value that we are using.
And we choose that value to be as far away as possible from the A7.
So now we can send any number of symbols in preamble, anything between the preamble and the SFD, and anything for SFD, and so on and so forth.
And we did active fingerprinting of 8215.4 chips by sending them a beacon request, so-muched.
And if we got back a beacon response, then we knew that we spoke a compatible dialect.
And if we consistently didn't get back a beacon response, then apparently that was not the case.
So what does this tell you, really?
It's a WiDS evasion.
It's an evasion of a wireless intrusion detection system.
Unless the wireless intrusion detection system has all the chips and hears all the dialects.
Isn't that interesting?
And so we come to this.
You know, fingerprinting.
Everyone has been fingerprinting senders before.
And I don't really like that, because that sort of attribution kind of thing is, well, you know, why do I want to do that?
It's interesting, but not very.
And then you have the trivial statement that all radio chips are different.
And in fact, people have fingerprinted specific chips with expensive radios due to slight differences in their manufacture.
So you can tell what sender is sending by small variations in modulation and in other parts of the signal.
But that sort of kept it obvious, right?
Except when we're thinking about what to call our fingerprinter, which fingerprinted receivers, we came up with this analog, right?
So there are isotopes.
Some atoms have a bit more neutrons than others.
And that doesn't make it a different element.
It's still, you know, whatever it is, well, except uranium has this interesting difference between the isotopes 238 and 235.
And this difference is called the chain reaction, colloquially known as a nuke, right?
As a nuclear bomb.
So we decided to call our fingerprinting code isotope with the subtle hint to this fact, just how small differences can be actually very important.
And so here are three methods that we used.
The one we called the Cumberland Gap.
That's a part of Travis's native geography.
The Cumberland Gap, historically, is the break in the Appalachian mountain range that settlers would come through when fleeing the oppression of North Carolina.
In our case, we took the preamble, that as you recall is supposed to be all zeros, and we preceded it with a bunch of apps in order to slightly break the standard.
This breaks the standard in a way that many receiving radios will still allow through.
And if you're wondering what the whiskey has to do with it, the song goes, drink a little whiskey, take a little nap, it's 15 miles to the Cumberland Gap.
There's also the Franconian notch.
Well, this is a part of my native geography.
Well, as native as I am to New Hampshire.
We're sort of like Team Appalachia, right?
Southern Appalachia, Northern Appalachia.
Yay.
So, in fact, you can walk the Appalachian Trail from his mountains to my mountains.
And it's this one big unbroken trail.
If the bears don't get you.
So, Franconian notch is another feature of our mountains.
So here, the same trick is applied differently.
We use a variable size of preamble and replace the remaining zeros in the preamble with Fs.
So, we are breaking the preamble ever so slightly.
And then we send the real SFD.
So, will the preamble be enough to synchronize in the presence of this little bridging garbage that separates the preamble and the SFD?
And we have two different kinds of that bridging.
One bridging is when we replace the zeros of the preamble with Fs.
And the other variant is when we take the full preamble and then insert a few Fs between the preamble and the SFD.
And you know what?
It works.
So, packets are still heard despite the Fs being there as this little bridge where there shouldn't be a bridge.
So, those Fs sort of slightly knocked the clock out of skew.
But depending upon how the clock is designed, it might be resilient enough to ignore them.
Yeah, so we go through a bunch of stimuli packets that we sent.
Just like this, sometimes consuming the entire preamble.
And what do we see?
So, here is a chipcorn in our AP mode.
And here is the Atmel chip in the RZUSB stick.
And if you send the preamble with two zeros replaced by Fs, RZUSB hears all of those, whereas chipcorn hears none.
So, this allows you to create a shaped charge.
A packet that will only be heard by one brand of receiver.
In order to allow your attack to hit your intended target, but evade any wireless intrusion detection system or any packet sniffer that might be nearby using a different chipset.
So, isn't that interesting?
And then the same thing in Wireshark basically confirms... well, not in Wireshark as it were, this is a different sniffer.
You see the preambles getting through on one chip and never getting through when munged on the other chip.
Again, here we go.
A clean slate heard on one and all of the interesting ones heard on another.
So, you can experiment with that and you can build your own dialects.
So, this is weaponizing those receiver characteristics.
Weaponizing the receiver dialects.
Isn't that interesting?
So, there is pwnage in PHY.
PHY is not monolithic.
PHY is not a black box.
PHY can be had in many ways and in fact you should never really trust your particular implementation of PHY because there are so many ways to get around it.
And obviously the bypasses are on every layer.
All the symbol boundaries, all the byte boundaries that you see in the standards are imaginary.
And you can actually shift those boundaries if you play with the signal.
And also, you are trained to expect magic.
You are trained to expect that the complex packet with all of those different fields and all of their subtle relationships, right?
All of that is supposed to come from the wireless interface intact.
But no, those are really simple machines.
They don't do validation.
They are parsers.
As parsers go, these are easily fooled because they are very simple parsers.
They know nothing of sender's intent.
So, we are calling you to continue this kind of research.
And I remind you that layers of abstraction become boundaries of competence.
And we should not allow them to become so.
Just as in software, when the Java developer who doesn't pay attention to the functioning of the C libraries beneath his code creates accidental vulnerabilities.
Or when the PHP developer who doesn't understand the interaction between his PHP script and his SQL server creates vulnerabilities.
The same thing happens inside of a microchip as the layer 2 designer does not quite understand what's going on at layer 1.
Whereas the layer 1 designer doesn't quite understand what's going on at layer 0, or negative 1, or negative 2, or each of the layers as these go down.
And so we find ourselves in Babylon.
And now you've met the beast of Phi.
And it might become your friend.
Thank you kindly.
Enjoy Babylon.