okay high of 44 corn so this is see no
evil hear no evil
hacking invisibly and silently with
light and sound sir - Matt weak see I
lead Vaughn durability research for the
cybersecurity practice in PwC UK I also
run a research blog called the dark art
lab which looks at the more exotic and
esoteric aspects of security research
I've been at PwC for about a year or so
work on their pen test team prior to
that I worked in law enforcement in the
UK leading a technical India team so
what I'm going to cover today is four
sections part one is going to be looking
at different ways to jump air gaps using
light and sound pot - surveillance and
counter surveillance looking at laser
microphones and infrared motion
detectors part three is Bantz
so that's stuff that I've come across
over the course of this research this
amused me admittedly that's quite a low
bar as you'll see throughout this talk
but hopefully you guys enjoy that - and
then I'm just going to sum up and give
some ideas for future research as well
so a couple of disclaimers the views and
opinions in this talk are necessarily
those of PwC all the contents for
educational purposes are only be sure to
check legislation etc this presentation
isn't to do with zero days or even
vulnerabilities necessarily it's more
about manipulating the inputs and
outputs of systems that use light and
sound in order to have a desired effect
and lastly I am in absolutely no way an
electronics expert I see magic smoke so
much that it's not even magical to me
anymore
regularly kind of poke myself in the eye
with resistors and myself with soldering
lines and that kind of thing so to give
you an idea of where I am on the
dunning-kruger curve I'm about there
so as it mounts Jupiter a couple of
years ago so what I will do is I'll put
up my email address my - it's handle at
the end of the talk and if there is got
any feedback whether it's good or bad
please do get in touch okay so let's get
started so the first thing I want to
show you is this so this is an example
of life I of data transmission using
lights in this case the data is music so
this is adapted from a schematic I found
on github and the link will be and the
references slides at the end of the talk
and essentially essentially what this is
is you've got a headphone jack playing
in through a phone playing music but
instead of headphones the output is to a
breadboard of white LEDs which will
modulate according to the data stream
and then the other circuits a photodiode
connected to a speaker so that was my
reaction when that actually worked and
then I did the same thing with infrared
LEDs so exactly the same setup using
infrared rather than some white light
so that kind of concept invisibly
transmitting data got me interested in
in air gaps and jumping air gaps so I'm
going to show you three tools I've built
in house of PwC that jump air gaps using
light and sound so some caveats on any
research to do with air gaps the first
is that we always assume that the
attackers managed to infect at least one
host on that air gap network secondly
that the attack has physical or near
physical access to that compromised host
and lastly because when we're talking
about exfiltration from air gap systems
we're talking about very primitive
outputs so things like heat sound lights
RF emanations that kind of thing so it's
going to be very slow and the bits of
data we're exfiltrating going to be very
small so there's been lots of research
previously on jumping air gaps guys at
ben-gurion University in Israel we've
done absolutely loads probably starting
with a net creaking in the 70s which was
do with RF emanations on cathode ray
tube monitors but since then there's
been lots of research the guys down at
the bottom assign and others in 2013
looked at using ambient light sensors on
mobile devices to control phones that
had been affected with malware now they
were only looking at mobile devices and
their kind of attack scenario was an
attacker was able to control overhead
lighting in order to influence the
values ready and by the ambient light
sensor so I applied the same thing to a
laptop to a desktop operating system now
ambient light sensors fairly benign in
their purpose the idea is that they will
automatically change the screen
brightness depending on the amount of
ambient light and the idea is to kind of
reduce eyestrain and save battery life
that kind of thing what an ALS is is a
hardware component adjusts its
resistance according to the amount of
light that hits it so the same kind of
thing you get in night lights and they
can range from very simple to very
complex there is also a Windows API that
lets you read programmatically those
values that come in from alienness so my
plans for the first bit that's this kind
of first bit called a sense of dark lee
was to create malware that could read in
light intensity values from the ALS and
then execute different commands
according to the sequence of those
changes and the intensity of them a
couple of problems with that first off
is I needed to try and make it a covert
activity given we're talking about air
gap which it's not particularly covert
to shine a massive torch on to a laptop
to execute commands and the second was
how do I turn that into some kind of
exfiltration capability as well so
here's the video of the the first
problem solved so this is using a laser
from distance mounted on this zone this
clamp here and you'll see when I shine
the laser at the ambient light sensor
I'm able to pop character so that's with
a visible laser but you could
potentially do that with an infrared
laser as well in terms of exfiltration I
use this so this is a lighter frequency
converter this is an incredibly
sensitive light sensor they're very
cheap but they're so sensitive that they
can measure changes in light through
your hand and they can measure changes
in the bioluminescence of bacteria that
kind of thing so I've hooked up to an
Arduino here just Britt would add it out
and the idea is that the malware when
extra tracing a file will use the set
device gamma wrap APO in Windows the
reason it uses that instead of W am I to
change the screen brightness is that WMI
requires admin privileges but sickness
gamma Ram doesn't so edgy just changes
the gamma level according to whether a
bit in a file is a 1 or a 0
in actual fact what it does is when it
starts exfiltrating it takes a baseline
of the current gamma level and then it
makes very small changes in that value
depending on whether it's a 1 or a 0 so
here's an example of this working so
here's the device and there's a micro SD
module as well to save the data this is
the malware running on a victim machine
and it's just going to read in the text
file convert it to two ones and zeros
and then it's going to make very very
subtle changes in the gamma value which
you might be able to pick up so there's
one just there and if you go over to the
attackers machine
this is what's being saved to the micro
SD card you can see we've got like a
kind of wave that corresponds to those
ones and zeros that the attacker can
then take from that micro sd card and
demodulate back into the data so what
you end up with is something like this
so that the bread board is not
particularly covert either so I came up
with this so this is the same micro SD
module with an Adafruit flora board
connected to the same lights frequency
converter with conductive thread and
this is sewn into the back of its hi
it's very light that's high folds back
over it so you could essentially actual
track data just by sitting in front of a
laptop as the screen changes okay the
next thing was dread phone so dread
phone is exploring command and control
using near ultrasonic sounds so humans
theoretically have a hearing threshold
of 20 Hertz to 20 kilohertz in in
reality most adults can only hear up to
about 15 or 16 kilohertz so sounds which
are between 16 kilohertz to 20 kilos
recall near ultrasonic and actually a
standard laptop sound card is perfectly
capable of transmitting and receiving
sounds at those frequencies so there's
been previous research on using the
ultrasonic tones for command control top
stead and others in 2010 and hounds
barking Gertz in 2014 both of those
researchers and other researchers who've
looked at this previously have
experienced a problem when they've tried
to do this so here's an example so this
is a series of near ultrasonic tones so
whilst you can't hear the tones
themselves but you're actually hearing
here are the electrical clicks made by a
discharge on the sound card which
obviously make a lot less or a lot more
obvious activity so to get around that I
did this and applied multiple fade-ins
and fade-outs it's my malware so dread
phone uses 16 pre-prepared WAV files
that have had this fade in and fade out
and amplification applied to them each
tone represents a hex character
and here's an example of this so you
have the victim on the right and the
attacker on the left
so they're both monitoring the input
from the microphone notice my leaky
skills as well so what the attacker is
going to do is going to send a command
to the victim to just pop Carrick and
that's going to send a particular
sequence of those wav files which are
then gonna be picked up by the victim
who's in don't pop calc and then the
next thing I'm gonna show you is
exfiltration so I have a like a text
file on the victims laptop which just
contains a very short string and then
the attacker is going to send a command
to the victim to tell them to extra
trailer data and the attacker is going
to receive it and demodulator it back
into the original text
so if I stay with the attacker here will
you be able to see is those tears coming
back
and then you can retrieve the original
text so there was a case study of this
being used in the wild if you've heard
of a bad bios which is malware from a
couple years ago actually infected the
network of the founder of pointer owned
and whilst it did kind of a really
sophisticated tricks with the bios of an
infected machine it also allegedly
communicated with other infected hosts
in the proximity of it using their ultra
sonic tones so dread phone is fine for
kind of bits if you want to actually
trade bits and quite small pieces of
data but what if you want to export rate
something larger like an image so you
could use the same technique but it
would take a long time so I developed a
tool called spectrogram which does
exfiltration by encoding or embedding an
image as sound and this is a technique
that's been used in in popular music so
there are two examples here both from
different songs it's quite kind of an
easy thing to do but some musicians do
do it and the idea is you read in an
image you iterate through the pixels and
then you output a WAV file that contains
frequencies distributed according to
those pixel values and when you view
that audio as a spectrogram which is a
visual representation of the frequencies
in a piece of audio with frequencies on
the y-axis and time on the x-axis you
can recover the image so there are open
source tools that will do this Krag
Euler spectral adji and things like that
I came up with in examples so say you've
got an image like this which is just a
screenshot of a password you reload up
spectrogram load the image in you can
select a minimum a maximum frequency so
we're sticking with near ultrasonic
tones here and that outputs a WAV file
now if you just play that WAV file you
shouldn't be able to hear anything
because it's at near ultrasonic tones if
you use a free tool to view the the
conceptual Graham layer of that audio
then you can retrieve that image
so this could also be used for
steganography albeit it's it's almost
better than steganography because you
don't need the original file you just
need the to record the audio that's
coming out now the other thing that you
can do with spectrogram is you can also
merge that secret file with a legitimate
audio file which is what I've started to
do there so I have an image file sorry I
have an audio file here which just plays
a piece of music and what I'm going to
do is use that and merge that with my
secret WAV file that's going to write me
out another way file which when I play
it will play the legitimate audio and
then when I view that piece of audio as
a spectrogram I can still recover that
secret message
so in terms of mitigation for the the
air-gap bypasses I've showed you here
you'll be looking at things like
removing or disabling ambient light
sensors if they're not required privacy
filters for laptop screens they're a
really good job of muting screen
brightness and gamma bright gamma
changes in terms of sound you could be
looking at white noise generators
ultrasonic tone detectors or even
disabling microphones and speakers if
they're not required
okay so part two surveillance encounter
surveillance so the first things are
laser microphone I assume lots of people
in this room we've heard of laser
microphones before for those of you that
haven't they're essentially our
long-range audio surveillance device so
the idea behind them and they've been
around for a long time if you're doing
surveillance on someone across the
street and they're having a meeting
behind a window and they've got the
curtains closed you can't kind of record
what's going on let's assume you don't
have any assets in that room either no
bugs or no sources or anything and what
you can do is shine a laser at the
window as those people in that room are
talking they're making air molecules
vibrate which makes the glass in the
window vibrate as you shine the laser
beam out the window the reflected laser
beam that comes back to you will be
moving backwards and forwards you
capture the reflected laser being with
the photodiode and as that reflected
beam travels across the surface of that
photodiode it generates changes in
voltage which you can then convert back
to audio so it's allegedly been used or
was used to confirm the presence of bin
Laden and it's compound in abbottabad
and there's been various other believed
instances where it has been used so I
came up with a really cheap version of
this so on the Left what you've got is
the listener module this is adapted from
an electronics kit that was meant to do
something else what I've got at the
front of it is a photodiode
I'm very cheap and then the output is a
3.5 millimeter for a female audio
chassis and so you can plug in
headphones or speakers and on the right
I've just got a very cheap nasty laser
module so I'll show you a demo of this
working so what I've got here is the
listener module connected to speak
and the laser which is on at the moment
and at the other end of the table have a
phone that's playing music very quietly
tape to the back of the speaker on the
phone as a bit of reflective material at
the moment that reflected laser beam is
blocked by a bit of plastic and if I
remove that
[Music]
so obviously that was very cheap the
whole thing together cost about 25 to 30
quid now you can get these commercially
albeit they generally only sold to law
enforcement and intelligence agencies
but you're looking at cons of tens of
thousands of pounds because of the
stability that goes into the laser and
the audio processing and stuff like that
but you can see if you can do that with
about 25 to 30 quid if you were to
invest a couple of hundred pounds in it
you can actually make quite a viable
device there's all sorts of things you
could do to kind of clean up the audio
as well okay so moving on to infrared
signals sniffing analysing kony infrared
so it's a very similar principle to RF
signals we're only going to talk about
fixed codes fixed infrared codes but
essentially the process is the same you
need to find a way to listen to the
signal a way to analyze it and then a
way to replay it and if you're
interested in infrared exploitation
there's a really good tool by major
malfunction from DEFCON quite a while
ago now in 2005 which is about
compromising Hotel payment systems via
the infrared so in terms of sniffing the
signal you can actually use an RTOS the
arted of it because they're based on TV
tuners they do have an infrared receiver
you need the RTO IR library which you
can get from github and that will return
you raw pulse data under coded post data
if you point a remote attic you could
use a dedicated infrared receiver and an
Arduino and the nice thing about this is
if your remote uses one of the popular
consumer protocols for infrared it will
automatically decode it for you which is
the case here so this was from my TV
remote standby button and you can see
it's decoded it as the NEC protocol and
it's given me the value and the other
thing you could do is you could use a
photodiode so this is the listener from
the laser microphone so I've got an
infrared remote
[Music]
and the nice thing about that is it lets
you inspect the the wave visually so you
can actually see what's going on in
terms of replaying infrared signals if
it's a known protocol something like NEC
as he is here with my TV remote then you
can use something like the I remote
Library frauds we know and you can just
play back that value if it's an unknown
signal then you have to do something
similar to what you do with RF which
would be kind of read the the edges and
it delays into an array and then play
that whole array back so in terms of
using this practically a good example is
passive infrared motion detectives so
ports are in Smith in 2013 gave a talk
at blackhat USA on various ways you can
do this I think it was a Mythbusters
episode about how to bypass passive
infrared motion detectors as well things
like moving slowly using reflective
surfaces to mask your body heat and
overwhelming the sensor with heat like a
flame so this is an example of a passive
infrared motion detector the gray circle
the gray sphere is the actual infrared
sensor itself so that's what triggers it
the red window that you can see on the
top left that's a normal infrared
receiver for the remote so the remote
itself uses infrared which is a bit of a
weird design choice the remote can arm
and disarm the system on the right I've
got an Arduino circuit and an infrared
LED which can perform a clone and replay
attack for that remote so I just show
you an example of that so I'm gonna arm
it first then just check it works so
that works fine and then I'm gonna
activate the Arduino board and it's just
gonna go in the disarm signal now
there's nothing kind of particularly
interesting about that it's just a
really simple kind of replay attack
except it uses infrared an effect from
an attackers point of view there's two
problems with this the first is given
its infrared and its short range because
consumer infrared how can we learn the
disarm signal in the first place
we'd either have to put a device nearby
you know near the system or we'd have to
try and get hold of a remote where no
one else is around and capture the
signal and the second problem is if
you've got a device on Arduino that has
got the disarm signal programmed into it
how do you get close enough to actually
disarm it and be sure that you're not
going to set off the alarm myself so in
terms of the first problem how do you
learn the disarm signal I bought nine of
these alarms so these are all
manufactured by the same company but is
sold under three different brand names
one in the UK one in the US and one in
Australia and I sniffed the armed and
disarmed signals from each of those
remotes so each purchase you get the
system and you get on the road and I
think you'll see the problem here
so out of the box by default any remote
arm or disarm any system so all the
attacker needs to do is know that you've
got one of these and they can just go
and buy one and then they can then
disarm you alarm just to prove that's
true if I pick up a remote at random and
then if I pick up another remote
so that's the first problem taking care
of a second or second problem I guess is
kind of negated by solving the first
problem but because I had some spare
time I came up with a couple of
solutions to get around that as well so
the second problem is how do you get
close enough whilst being sure you're
not going to trigger the alarm so this
is the first instance drone to clone to
poem so the reason I've used a drone
here and specifically the parrot
ar.drone in this case this takes about
35 to 45 seconds of being in the air
before it's lithium battery gets warm
enough to set off a passive infrared
detector so what I've done here is I've
just mounted that Arduino board on top
of the drone and I've used the Peris
internal USB port to power it so I've
got the alarm in the foreground here as
you can see I've dressed up to the video
[Music]
so you can see if I try to approach it
detects me as it should so I'm going to
demonstrate my leap drone flying skills
and I don't know if you heard but that
it disarmed it while I was in the
doorway
second solution is this so this is phone
to Crone sapone so this is using a gsm
breakout board for the arduino so it has
a sim card in the back of it it has a
phone number you can text it and call it
if you wanted to and the idea behind
this is you would hide this device or
pay someone to hide this device nearly a
lot of during the day when it's disarmed
and then all you have to do from
anywhere in the world is text a
particular string to that number on that
SIM card and it then activates the
infrared LED and disarms the alarm so
this is based on Samy Kamkar digital
ding-dong-ditch if you've seen that
which did the same kind of thing with a
wireless doorbell a couple of
differences is that this doesn't use
interrupts to check messages it just
uses a loop it obviously uses infrared
rather than RF and it also deletes text
messages of the SIM card once they've
been read so as usual what I'll do is
I'll on the alarm first and just test it
it works this is the sketch that's
running on the Arduino so in this case
it's looking for a particular string and
a text message that string being a new
phone who dis and then on the next check
that message will be read the string
will be verified then it will send the
disarm signal
so just to check that if I have another
look at the Arduino sketch you can see
that the message had been opened it's
been read sent the usual signal is then
deleted it off the SIM card so you could
combine both of those techniques
together and you could phone a drone to
go into poem but that would be
ridiculous so I didn't do that okay
active in Fred motion detector so this
is a slight different kind of system you
have two parts to this a transmitter and
a receiver the transmitter is sending a
constant pulse of infrared signals to
the receiver and if those pulses are
broken then the alarm sounds and if you
permanently remove the transmitter and
then the alarm will continuously sound
so what you can do is create a device
which just clones a signal from the
transmitter and that's then kind of
accepted as the new transmitter and you
can move freely in that area so in terms
of mitigation for laser microphones and
infrared alarms in terms of laser mics
you could deliberately induce vibrations
on window surfaces you could use things
like wire screens and coverings on
windows you could try and detect
infrared lasers with unfiltered cameras
double glazing and curved glass can
cause problems with laser microphones as
well and in terms of alarms ideally
you'd want to use physical keyboard
keypads to disarm not remotes or
anything that can be quite remotely
sniffed if you are using remote you want
to go through ones which ideally use RF
and encrypted rolling code algorithms
that maybe have anti jamming as well and
kind of astonishing I have to say this
but remotes that are paired uniquely to
to a device is always a good idea okay
part three bands so the first thing I
want to show you here is delayed
auditory feedback so this is also known
as speech jamming it's a technique
that's been around since the 50s and
it's kind of based in in psychology and
neurobiology and that kind of thing it
was originally developed as a technique
to help people who stutter the idea is
that you introduce a latency between
someone speaking and
them hearing themselves speak now if you
use this on someone who doesn't have a
stutter it induces mental stress and it
basically inhibits their capability to
speak properly so a couple of
researchers tried this out in 2012 they
built a hardware version I built a
software version called doublespeak now
you might have seen videos of people
trying this out as well and they're kind
of free websites that do this as well
in terms of kind of evil applications
for an attacker it's limited but you
could do some stuff with this so you
could for instance if you're on a
network so discord in disruption by
using this on a really important
conference call or something because it
does really stress people out and to
illustrate that it stresses people out
here are some of my colleagues trying
this out so what these guys are doing is
they're reading a paragraph and website
they're wearing headphones and my script
is running on this laptop and what it's
doing is recording the sound of them
speaking and then it's playing it back
into the headphones with a delay of
about 200 milliseconds
okay so that speaks jamming the next
thing demotivating malware analysts so
this is inspired by Christopher Thomas
who gave a talk on this our econ a
couple of years ago the talk was called
psychological warfare in reverse
engineering and he created a tool that
generates working malware that when
viewed as a flow graph in a disassembler
shows an image of the attackers choosing
so in this case it's a skull and
crossbones but it could be anything and
this is actually working malware as well
so I wanted to come up with something
similar using light and sound it's not
quite as sophisticated as what Chris
came up with but let's say you're a
malware analyst and you're analyzing a
piece of malware and when it's run it
makes this sound so you'd want to know
kind of where's that sound coming from
what does it mean so you disassembly in
this case it's just a dotnet X C so very
easy to disassemble and pick out the
resource that's causing that sound which
is just a WAV file embedded in them in
the malware so you can imagine it would
be driving an analyst map trying to work
out what this wav file does what it
means you know is it trying to explore
it something is it encoded is encryption
as it some kind of communication and
then eventually it occurs to you to look
at it
as a spectrogram and you see something
like that okay next up so this is
probably the thing I'm proudest of
everything anything I've ever done
kill more Gilmore so it's give you a bit
of background on this my wife is a huge
Gilmore Girls fan she watched it when it
first came out it recently came back on
a popular streaming service a couple of
years ago and since then she's watched
season 1 to season 7 about 80 times and
in that time I've gone from kind of
passive indifference so you know it's
not really for me I can see why people
might like it to active hatred and
loathing and I hate everything about it
I can battle so if if I was in a mature
marriage we'd probably just talk about
it but instead I came up with this so
Kilmore Gilmore is two parts it's a
Python script that uses a brilliant open
source music recognition library called
deja vu and the other pot is an Arduino
device what DejaVu does is it listens to
audio coming in through the microphone
and it compares it to a fingerprinted
mp3 files in the database so it's music
recognition so what this Python script
does is it uses a DejaVu library to
listen to 10 seconds of audio every 10
seconds compares it to a song in a
database which is the Gilmore Girls
theme tune and if there's a match it
sends a byte down the serial port to
they're connected Arduino device which
has an infrared LED which clones the
standby signal for my TV so this is the
kind of upshot of that so I've been
advised that there's possible copyright
issues we playing the audio so I've got
a video without the audio and they'll
upload the full video to YouTube at some
point here you go so this is the kind of
pre credit sequence
okay so there's been 10 seconds with no
theme tune so the script assumes all as
well the theme tune kicks in so you can
actually combine that with any theme
song or song you wanted the next step
for this is is voice recognition so it's
a turn off for TV anytime a member of
the Kardashian family speaks okay and
the last thing I wanted to show you is
Astro drone
so Astro drone is disrupting drones by
echolocation jamming essentially on
their ultrasonic altimeters so I've used
the parrot to demonstrate this because I
had a parrot lying around and it's got
an ultrasonic outer meter but it's not
specific to power I'm not picking on
them specifically any drone with an
ultrasonic altimeter is likely to be
affected by this so um what these do on
a drone is they're normally on on the
base of it and they're a tool to work
out how far away the drone is from the
ground so it's basic echolocation it
sends out an ultrasonic pulse at a
particular frequency that pulse will
then hit an obstacle and the receiving
component on the altimeter will receive
that bounced ultrasonic pulse back and
then based on the pulse width and the
navigation board can infer how far away
the drone is from the ground so what you
can do with this is you can perform
echolocation jamming so you essentially
emit your own ultrasonic frequencies
aimed at the altimeter and it confuses
the drone eight times out of ten equals
it's a launch upwards at speed two times
out of ten it causes it to try and go
down through the floor because it
assumes it's either a maximum or minimum
altitude it has to adjust accordingly so
it's very similar to research published
last year by Lou and others at DEFCON
which was similar kind of attack against
Tesla s cars so you can use something as
simple as this to do it
this is an animal repellent device that
you can buy online and this has got a
passive infrared detector and the idea
is if a cat or a dog or something walks
past this then it sends out an
ultrasonic pulse at an adjustable
frequency which is meant to scare that
animal away if you use it on a drone
this is the result
and so you notice that what happened was
the drone actually kind of ignored the
land command and just kept on trying to
go up and said eventually I panicked and
you end up with a broken drone so what I
wanted to do next was try and see if I
could make this a more dramatic effect
so that was kind of fun you know for any
powerful but I want to try something
else and I also want something where the
drone didn't have to fly directly over
it could do it at an angle so I came up
with this so that's a colander because I
ran out of money and what you've got
there are four passive infrared sensors
underneath this colander is an Arduino
Uno to Arduino rooms actually and then
you've got 18 ultrasonic transducers
that are all configured to send pulses
at the same frequency as the drones
altimeter now interesting with this I've
used infrared here to detect the drone
you can also use that data of a library
from github for makuu stick recognition
on a drone so if you record the sound of
a drone flying in a particular
environment a particular model of drone
and save that as an mp3 you can then
compare incoming sound into a microphone
to that database and we'll pick up the
sound of the drone so you can also use
acoustic detection for this as well
so in terms of real-world applications
for that you could use that essentially
as a kind of driving repellent to keep
drones away from particular buildings or
events and stuff at PwC we're doing more
research on this so we're testing us out
with different kinds of drones and
different kinds of devices to emit
ultrasonic pulses the other interesting
news case is you could use this as
personal drone protection I like this
okay so to sum up then this is an
overview of the research I've done on
light and sound and you can see there's
quite a lot of links between the
different techniques and topics and you
can interpret this one of two ways
either that I was following a really
careful and comprehensive and structured
plan or that I've just cobbled this
together to give the illusion of
structure once everything's done to try
and get more research funding so in
terms of pros and cons for an attacker
using light and sound it's great for
things like physical engagement so if
you're doing secure environments that
use air gaps it's very difficult to
detect and defend against from a
defenders point of view the very little
trace left of activity once an attack
has taken place and as you could
probably infer from this talk it's very
cheap to test this stuff out you can
kind of tinkle bit staff in there and
try stuff out very cheaply on the the
downside of it you do need to be close
to targeted systems in most cases
subject to interference like
environmental interference so for
instance laser microphones are affected
by things like rain and snow and traffic
noise that kind of thing and the range
and power you generate very much depend
on the resources that are available to
you in terms of mitigation first steps
knowing that this stuff exists and that
it's possible and I guess the inputs and
outputs can be manipulated pretty easily
sorry ideally you would either block
those inputs and outputs completely or
you didn't sure that there's like a
reliable failover so the drone for
instance rather than just relying on an
ultrasonic altimeter would also use some
other kind of means to detect where it
is kind of replay takes very much that
possible and there are limitations with
a lot of security product so motion
detectors for instance it's not enough
just to say
we have a motion detector often they're
susceptible to various kinds of attacks
future research I look at exfiltration
via infrared acoustic key logging some
kind of automated solution for that some
more work on live fire and then some
more work on drawing repellents as I
mentioned so hopefully in terms of how
you feel about this presentation you on
the left rather than the right or the
music that was used in his talk was
royalty-free and acceptable for
commercial use the references slides
here so this PDF I can make available
online it's also available on the DEF
CON media server as well if you want
that or just get in touch and I can
happily supply you with these details as
well so as promised is my email address
my twitter handle thank you very much
it's been an absolute pleasure yep thank
you
[Music]