so good evening balcom we have some really interesting stuff coming up for
you now but first let me ask you something new here among you
likes to eat ham and who he reminds you is a half so ladies and gentlemen is
Travis Goodspeed winter's dark bowling in amateur radio injury a date to begin
with a quick public service announcement the cat that is going around the museum
I have named Olga after the chamber folk superstar I expect all of you to call
her go while giving a little pieces of food so the chances to that for years to
come
so today we're going to be talking about two protocols in particular that are
popular on amateur radio one of them is PSK 31 and the other is ready or are
ttyl I've been playing with these protocols in a way that is not entirely
legal by amateur radio rules but is close enough so a lot of what I'm
teaching you how to do would become illegal if you just added cryptography
to it or securities in any way because cryptography is illegal
an amateur video but hypothetically if you had to say smuggled books into a
country that didn't allow books like let's say you wanted to send a book to
Germany and the Germans don't allow books that describe how to write
exploits right so you have the key uncensored edition of the bug hunters
handbook and you want to to send that to germany but you don't want to physically
go you want to send it by ham radio in this lecture I'll be showing you how to
hide extra information inside of a legitimate amateur video message 3
steganography I will also be showing you how to create public lights that are
valid as multiple digital formats at the same time for example I can combine PSK
31 and Morse code in order to have in order to have a message the talent in
both formats so that the machine can easily read the PSK 31 and human being
can interpret the Morse code now we're talking about radios here but internally
you should think of the receiver as a parser you have a software program on
the receiving computer that is interpreting the data that comes through
the air in the same way that you would interpret a file format so a lot of the
tricks that you do with a file format will also work here and these chicks are
not that hard to find of particular importance is something called a parser
differential this is a fancy way of saying that two receivers have a
different view of the same message one of the most useful things for a pressure
differential is in breaking as a cell if you can create certificate that looks as
if it represents one domain to the browser and a different domain to the
certificate authority than you can sometimes trick the certificate
authority and assigning something that it really should have the same thing
happens in radio so there is a project that song about us and I did a few years
back of Pakatan packet where we managed to smuggle in an entire radio packet
from layer 7 to the physical layer by a parsing bug on the receiver combined
with natural noise this allows us to e-mail a wifi
and have it drop out as the message is being transferred you can even do those
so that not one single by the Interior message is visible to the naked eye on
inside of the exterior message by making a packet that meaning changes when it
shifted by 1801 noble or one-half of one bit
began coming up with ways to perform this on amateur video particles and our
goal is not quite steganography in the we're not trying to hide information
although we can instead we're just trying to figure out all of the crazy
things that can be done with these protocols if in the future it becomes
necessary to sneak information you have my blessing use these techniques in that
way we're trying to do here is we're trying to create a single message that
contains both the bear which is the the public view of the message and also the
books which is a hidden interior view it sort of like Russian matryoshka doll
briefly explain how much and which first each receiver is designed for a
particular modulation height and it ignores anything that of an orthogonal
type so for example the if you have FM receiver the FM receiver will generally
ignore the amplitude of the transmission so you can do minor changes in amplitude
without distorting the audio without anyone noticing so in our case we have
the signal being modulated on top of the radio carrier wave if we change the logo
if we change the strength of the signal amplitude we get a modulation and if
instead we change the frequency the FM modulation and there's also phase
modulation this diagram is a little bit of a line to children and I get to Y and
later slide the gist is that you can encode a bit by changing the phase of
the sine wave so you're jumping back and forth between sine and cosine and with
the receiver does is it it multiplies this the current signal by a
time-delayed version of the signal and if the phase has changed it becomes
positive and if it is not changed it remains negative know when you're
viewing this on a receiver you generally look at what's called a waterfall and
inside of the waterfall the single sort of spreads around its center
mathematician things to this in whatever fancy you mathematical form from an
amateur's perspective it's more
intuitive or traditional you use what's called upper sideband which is where the
radio frequency is just down shifted to become audio and this is what most of
the digital forms of amateur radio use in short wave in international
communications and this is particularly cool because you can work with all of
your digital including as a modem written and software working on a wave
file and your radio appears to your computer as an extra sound card over USB
whatever you played that sound card gets transmitted and whatever comes in from
the radio comes into that sound interface so that all of the programming
that you have to do your doing on audio files and when you get it wrong you can
hear where you got it wrong and why this makes developing it a lot easier than
writing software defined radio code and you don't need any offensive libraries
you can implement all of this in your self in Python without having to rely on
new radio or rather fancy techniques the general chair styles used by ham radio
for this measure frequency shift keying in frequency shift keying you just have
a high frequency that salon and a low-frequency the 20 and you jump
between them to send your message on the waterfall this looks like two lines and
the data is in which phone is being used at that time on the air these are two
different radio frequencies but when you down shifted you hear them as two
different audio frequencies and that audio contains all of the information so
you implement your modem in the audio spectrum instead of the much higher
frequencies that are used on the radio this is also a low data rate because an
amateur video there isn't much space to go around all of the short wave
frequencies combined are about 30 megahertz wide which is the same as a
high-end wifi card so the entire world has as much bandwidth as your wifi card
has and in order to properly sherrit small segments are allocated to each
user or its style so for amateur radio we don't have very much bandwidth and in
order to make up for that we send very narrow signals so narrow that you can
actually have multiple signals in sight of the audio band at once so you can
hear multiple people talking and your modem can decode all of these and follow
the conversation we also use what's called a single sideband the upper
diagram here is a traditional a.m. single the AM signal you can recognize
because there's a central peep and then you have to sign loves the cum off of it
and the site loads have the same information so you can either listen to
the left or the right one and the full information is there this is wasteful so
instead amateurs and only the upper half which is called upper sideband or
they'll send only the lower half of the lower sideband in this allows them to
use half the band as a sort of like a solution to this man spreading moral
panic that the United States is going through these days in our situation we
have Allison bob we're trying to have a conversation and Eve is trying to learn
with a conversation is really about and even doing this by passive eavesdropping
so she's not taking any signals she's just recording everything and then
reading through all of the traffic analysis by my communicate with our ttyl
this is a protocol from the 1940's that was used by military teletype Riders
uses to FSK modulation and coding so there are five hits her letter
and this is the same technology that the serial port standard was originally
developed for you can describe this as five and two and that there are five
data bits no parity and to stop its her character in the same way that your
dial-up modem might have been configured as eight and one this is a picture with
the teletype writer would look like and in order to shorten your transmission
you would actually type out your message in this paper tape on the right and then
replay the paper tape in order to send your message across the air quickly a
modern operator console for this is done in software
this is a program called FL digi that allows you to control your amateur radio
and also in taxes and soft modem in order to convert your conversation so
the operator will type in his message here in this text the number at the top
left is the frequency that the radio is tuned to which is not the frequency that
the message is too new to the message is that the radio frequency plus the audio
frequency so if this is a 1400 700 megahertz and you're transmitting one
kilohertz audio the actual data signal will be centered at 14:07 one and this
is what it looks like on the spectrum the left red line with the yellow
surrounding it
that's zero bits and the right or the one dance and assorted scrolls efforts
to time it is the y axis and frequency is the x-axis operators leads and ASCII
art through this or bardot art this is a picture
Seattle Slew the horse that won the Kentucky Derby in 1974 and the alphabet
used by this is not a ski
to make things more efficient the left out support for things like case in
letters so all of these messages are an uppercase you'll also note that each
five bit code can be either a letter or it can be a number and the way that this
is implemented is that there are actually two signals called and letters
if you send figs it switches to the figures alphabet so that you can send
numbers and such and if you send letters that lets you type in letters so then
the russians wanted to use this technology so transliterated rather than
an actual Russian city water for about the first thing you learn Russian class
so you have your four letters letters if you changed the figures out of that its
exclamation mark 974 space cynical and so on the russians wanted to be able to
send across the Cyrillic alphabet show they took advantage of the null
character and on a Russian RTTY implementation sending an unknown
switches to a third alphabet and allows you to send Cyrillic alphabet here it is
in the Latin alphabet water so that if your radio does not support this really
about it will transliterated to latin and you'll still be able to read the
message and then you better get satisfied that the letters Commando is
also used as an idol town because in addition to recording your message and
then transmitting it you can also operate life in which the machine wait
for you to take the next letter if you type more slowly than the computer is
transmitting it will send the sequence of all ones and the reason why does this
is the 0 bids get put around it for the top tips and that allows the timing to
be synchronized on the receiver you can also alternate the idle time so a normal
transmitter will always how just letters is the ideal but if you do letters and
then figures and then figures in the letters no one on a computer will notice
on a physical teletype writer there will be this constant current ranking as its
switching between the alphabets but unless someone is monitoring you with
equipment from the 1940's they won't notice this change and that's you can
include extra bits during the idle portions of your conversation
this way can run through the village and they can keep some books on the backs
you can do similar things in PSK 31 which is the nineteen nineties
replacement for RTTY those of you who saw the a ham radio station in the yard
today there's a little box on top of the radio that had serial cable and audio
cables running to it that was a PSK 31 adapter
31 uses 31.25 symbols per second and the reason why is this rate is that this is
about the speed that you can comfortably type without feeling rushed so you type
a little bit faster than the mission is sending and then use the absolute
minimum amount of bandwidth to have as many conversations and personal audio
channel as possible this only takes 60 Hertz of them with this is actually in
less than the channel separation that's needed for moscow is before we had two
different lines on the spectral graph is yellow line here in PSK 31 we only have
11 vertical line and again the actual frequency is the sum of the audio
frequency and the change frequency of the radio so we're transmitting our
carrier at 14:07 one killer hurts just get 31 inverts its phase to market a
zero and there's no phase inversion demarco one so on this top sine wave
issued a sine wave is going along and then right in the middle it abruptly
reverses direction it sort of works like that in practice the volume has to be
dropped 20 at the moment of the transition if you don't do this then you
get harmonics throughout the the band and it physically hurts your ears
because as the speaker is
is wiling out where it abruptly gets yanked back by its value and that
creates a popping noise in software you implement this by switching between sine
and cosine in hardware you can implement this by turning a delay on and off and
the phases not inverted DeMarco 122 131 is just a sine wave this figure is a
little bit hard to see but the the amplitude of the greater wave gets
dropped down to zero at the moment of the transition this is done to prevent
the harmonics so the way the receiver decodes this if you remember that a
positive value times a positive value is always a positive value and a negative
value times a negative value is also always a positive value you can multiply
the signal that it's delayed self so that the result is only positive when
the phase has changed otherwise the value will always be negative and the
result of this transformation is a line that squiggle along beneath the zero
line and only jumps above it when 0 bit is encountered similar to our ttyl tsk
31 has a very cold alphabet the reason why does this is the asking is not very
efficient were English text because it assumes that every letter has to do the
same with so in PSK 31 kind of like morse code your your symbols your
letters are different sizes lower case letters are shorter than upper case
letters common letters are shorter than rare letters is a table that you can
look up inside of this table you'll see that the letter E
is just to one's a space is a single one and you'll also see the uppercase letter
he is a lot longer than the lower case letters so if you hit the caps lock key
on your Transformer
your message will begin transmitting more slowly because each letter is
significantly longer than it would be in lower case there are other rules here
jump back to the table as I read these the first rule is that every letter
begins and ends with a 12 in all of these are shown here as well as the rest
of the larger alphabet every single letter begins with a wine and ends with
the one the other rule is that no letter contains more than a single zero in a
row so none of these have more than a single 0 before the next one the third
rule is that letters are separated by two zeros so with receiver does is
whenever it sees two zeros it takes the buffer whatever came before those two
zeros and it looks like up in the symbol table and that's where the letter comes
from so their tricks that you can do it this the first trick is that you're
required to have at least 20 is between letters but you could have a lot more
than that you could have 300 400 500 you could have 5,000 so what you can do is
you can send three zeros in between letters tomorrow one and four zeros
between letters to mark 0 and used that to include one extra bit per letter in
order to hide a secondary message and the receivers will ignore all of this
other thing
31 is the illegally long letters are always ignores the author of the PSK 31
standard is British and he wanted to send the great British Pound symbol but
the great British Pound symbol is not in ASCII and it was not in the original
alphabetic constructed so the way that he added that was he just made extra
letters that were longer than all of the old ones and he defined those to the
upper half of the ASCII table but if you go further than that it remains
undefined and the receiver has to be era tolerant because there are lots of
errors on the radio so whenever it comes up with something that's not in the list
of valid characters in ignorance so you can sort of like flip the standard
around and send your entire message as money illegally long character which
will roll off the end of the receive buffer and as long as you never sent to
2008 never tries to look that up and at the very end when you do to send two
letters in 2008 find something that's not new to this and it skips over and
the rest of the message and in this way you can hide extra information they're
also physical tricks that you can do once again
31 is generated as audio here you have a laptop on the left and a ham radio on
the right and it's just chill audio cables running into the back of the
radio so I implemented 31 in Python and this is something that you can do in a
weekend with the proper documentation and you don't need any fancy libraries
or anything like that you begin with your audio rate so PSK 31 was designed
for digital signal processors they did it thousand samples per second I'm doing
it at forty eight thousand samples per second just to
giving greater precision so inside of your audio file every forty eight
thousand samples are one second of time is also a volume I want the volume to
jump up to half of the sixteen-bit sample size
the other thing I want is a divisor to choose what audio frequency and
generating my Tona in this case I just divide my audio rate by 1000 which will
give me a one killer hearthstone
centering my audio singing with the radio can best handle it and then the
length of each symbol is the audio rate divided by 31.25 this is how long a
single dad is then how we gonna throw a variable I would use my index within the
sample and that's from 0 to the length of each symbol and I have a value from
each one that I produce any phase which is 0 for sign or 14 co-sign now if you
naively I'm just abruptly switched from sign a cosine it sounds absolutely
horrible I would play it for you here except that the speakers would break and
everybody would get very mad at me and tomorrow you would have to listen to
speakers trying to yell over the crowd without amplification
would you do instead is used what's called a root raised cosine filter is it
dropped this is the city opening a wave file that might well has produced and
wherever you see the amplitude drop down to nothing that's where the phase shift
is actually occurring this whip here is actually one bit
wherever you see it drop that's a zero bit and wherever it does not drop that's
a London the difference
and spectrum you see on the one on the left is nice and smooth and narrowband
and the one on the right is just sort of sitting over the entire audio space the
one on the left is filtered and the one on the right is not filters
real PSK 31 filters only the debates the change phase and there's no filter when
the phase remains constant the one thing you can do is you can do
PSK 31 envelope ambiguity which is where you dropped the phase even at times and
you don't need to and what the receiver is looking for is any time in which the
phase was dropped in a one and that gives you one extra bit of information
her one bit that you're transmitting 0 is don't contain extra bits because they
have to be dropped and most receivers won't notice the difference at all so
when you're receiving this on on a laptop in your change the rate region it
sounds very similar and it looks identical and the computer throws away
all of the differences so in this case the message on the top is the classic
PSK 31 transmission the one on the bottom has been modified to drop the
volume in each of the one bits and proper PSK 31 receiver here is no
difference between this by doing this selectively for individual bits you can
hide information
the other thing you can do is you can realize that the PSP 31 is tolerant of
very very wide swings in amplitude if I am transmitting with a hundred watts and
some down the street is transmitting with five whites both singles will get
through so you can do is you can change the amplitude of your transmission at
each point in time that you're you're dropping down to nothing so you can use
this in order to
hide Morse code in your transmission I'm going to play to audio samples for you
now this first one is PSK 31 transmission containing a lecture that I
wrote on how to implement 31
here
that's when the amplitude is being dropped
and that's normal PSK 31 there's nothing fancy about that there's nothing special
about that this is my ham radio call sign in Morse code and also in place as
a human operator who knows Morse code you can hear the calls and some of the
dashes in this transmission line in each of the letters also contains that letter
as PSK 31 show that your receiver can identify the callsign automatically as
well as by audio this is what looks like this is the spectrum of the letter K
just got it up and the first one of the top contains it the SKA 31 version of
the letter K
this is the same letter drawn out in a city and you can see that it's the one
on the left that contains 0 bet
first contains letter que es que 31 and then the rest just contain nothing
they're there for filler you can also do escape 31 RTTY polyglot RTTY cares about
relative power so you're transmitting either on the high frequency or in the
low frequency and what matters as far as a receiver is concerned is which one is
stronger his K 31 doesn't really care which one is it only cares about the
face so we can combine the two we can have the low-frequency contain one PSK
31 transmission the high-frequency can contain a different PSK 31 transmission
and we can jump the strength of each to make one stronger for a little bit
stronger for more time and this creates a single into balance in both protocols
at the same time
polyglot
there are also some versions 31 that contain error correction so because it
has never action some of the bits on the air can be flipped without damaging the
message so what you do is you let them intentionally knowing that they will be
corrected on the other side and whether the bed is correct or incorrect hides
your extra secret information desk on presentation last year in which this was
implemented for OJT 65 which is a related video protocol and BTW 65 is a
particularly good target for this technique because it has a ton of error
correction the protocol was originally designed for reflecting a message off
meteor as its filing through the atmosphere and then catching it on the
other side and this is very unreliable so they had to put in lots of error
correction in order to sneak the message through despite the damage this
technique is also a little bit fragile in theory but in practice even though
the tools should be very easy to write to identify this they haven't been
written so what would be a useful to do is a project we need to take the audio
recordings that drop Owen Dukes published last year DEFCON and write a
tool that runs through and identifies whether the damage to them is
intentional or accidental is ian is it an honest mistake the debate came out
wrong or was it intentionally transmitted is wrong with you can do
when you have a good signal-to-noise ratio is one last check that I want to
share with you how many of you have Ethernet networks it home ok
and you know that they wifi someone can sort of here how much traffic you're
using the even though they can't necessarily know what you're sending
across when it's encrypted so madeline is a way to do that or wired Ethernet
dinner runs over the internet and we're going to suppose that the attacker can
control some of that data but not very well so that say that you're running
HTTP and you're running at over tour and I want to identify where in Novi Sad you
are and I know that you're in Novi Sad but I don't know anything more than that
what I can do is make a message in morse code that's like the client is here the
client is here and controlling the hidden service on tour I start sending
that message as Morse code in terms of how much bandwidth you're using so if
you you if I want to send did I use a lot of bandwidth for a very short period
of time i want to send and I use it for a longer period of time
sure how many of you wired your own home Ethernet yourself ok so you know how you
got the twisted Paris and you put the cap on them and you know how you're
supposed to unleash them just before you plug it into the cap and you know how
it's so much easier if you give it like five or six centimeters of unwinding and
you know how China make such awesome cheap networks which is these days and
you can just buy a cheap network switch and throw it in so
this is the letter K transmitted from what used to be my home Ethernet network
before I rewired
amateur radio this actually came out 28 121 megahertz and I was able to hear
this from an antenna on my roof and then called a friend of mine who lives down
the street and he was able to copy a Morse code message that I sent him just
three bandwidth usage and the reason why is that when you under mister peres they
leave just a little bit of radio data and when you have a combined with a
cheap wireless router at least a little bit more and the signal is something
that you can pick up with a radio receiver if you find the right frequency
so we hunt around and find the right frequency are then able to receive this
information that sexual traded out so the next part of this project is that I
want to do a wireless capture the flag project I'm going to be transmitting on
twenty metres from Philadelphia and this transition will hit most of the western
hemisphere if you have a proper antenna you will be able to receive it here in
the facade it's by upper side so you either need an amateur radio receiver or
a high-end shortwave receiver you don't need a translator and we're only doing
is only transmitting test messages that contain hidden information as a sort of
capture the flag so you can take an audio recording of it and then try and
mess with it in order to figure out what the hidden messages in each one of these
transmissions is a little bit different
the other thing that I'll be releasing this afternoon on get how is the tool
that I've been using to produce the PSK 31 samples this is in a few pages of
Python it's rather easy to read and you'll be able to use this to generate
your own
tricky PSK 31 transmissions in order to hide extra information I'll also
publishing lectures on PSK 31 in PSK 31 that you can receive with the radio
along with their capture the flag transitions and their source code to
these actresses included with the PSP 31 tool like to remind you that the digital
protocols on the error can be messed with in the same way that file formats
can be receiving radios are parsers an assembly that you can find bugs in
purses on a PC or in software on the phone you can also find bugs in the code
decoder chips you can find bugs in the protocol itself where ambiguities that
allow you to hide extra information where to send a message that can only be
received by certain software and this is a great way to get started in actually
writing radio software yourself with less and learning curve and software
defined radio would take when you start playing with softer defined radio at the
beginning it's great it's very easy to get lots of results and then you sort of
hit a brick wall where everything becomes impossibly hard an unrelated to
what was before I think that this can services or is stepping stone to work
from and to work with radio techniques but in the audio domain where bugs are
easier to find and you're able to catch up and two billion the signal processing
knowledge that will later allow you to
right software defined radio from scratch and without relying so heavily
on pre-built libraries thank you for your time and attention I think I have
time for questions or to your questions thank you can see around