intercepting, modifying, and generating wireless … con 25/def con 25...intercepting, modifying,...
TRANSCRIPT
![Page 1: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/1.jpg)
Intercepting, modifying, and generating wireless signals with SDR
Caleb Madrigal(Public) handle: metemWebsite: http://calebmadrigal.com/Twitter: @caleb_madrigalHam call sign: w0hak
![Page 2: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/2.jpg)
About Caleb:
Programming for about 18 years.
I most enjoy hacking and mathy stuff (Signal processing, Machine Learning, AI)
In general, I find it interesting to hear the "unhearable", see the "unseeable"
- to tune in to the subtleties around us.
In the computer world, everything is black and white, but the real world is
fuzzy and colorful.
Ontologically, I think the best way to describe myself is as a "Christian Mystic".
I also love Art - Literature, Music, Artsy movies, etc. I'm also an occasional and
unaccomplished poet.
![Page 3: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/3.jpg)
Possible titles for this talk:
Intercepting, modifying, and generating wireless signals with SDR
How digital data is transmitted wirelessly
Controlling wireless IoT devices via crafted radio signals
How the OSI Physical layer works and how to attack it
![Page 4: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/4.jpg)
Background on what led me to doing this stuff - came in from 3 directions:
IoT
Music theory -> Sound analysis
Wireless hacking
![Page 5: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/5.jpg)
![Page 6: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/6.jpg)
![Page 7: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/7.jpg)
![Page 8: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/8.jpg)
![Page 9: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/9.jpg)
![Page 10: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/10.jpg)
![Page 11: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/11.jpg)
![Page 12: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/12.jpg)
![Page 13: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/13.jpg)
![Page 14: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/14.jpg)
We'll be exploring the Physical layer
![Page 15: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/15.jpg)
Harness the invisible energy all around us!
![Page 16: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/16.jpg)
![Page 17: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/17.jpg)
![Page 18: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/18.jpg)
![Page 19: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/19.jpg)
IoT: +5000% attack damage to all wireless hackingskills
![Page 20: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/20.jpg)
Things that work through radio:
"Radio" (AM, FM)
TV
Cell phones
Wifi
Bluetooth
GPS
Wireless security systems
Any form of Wireless IoT device
SCADA systems / large industrial equipment
![Page 21: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/21.jpg)
![Page 22: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/22.jpg)
Software-Defined Radio (SDR)
HackRF One
![Page 23: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/23.jpg)
LimeSDR
![Page 24: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/24.jpg)
RTL-SDR
![Page 25: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/25.jpg)
In the Wizard/Sorceress metaphor, this is your wand (along with the antenna, ofcourse).
Sidenote: when using radios, your body can actually become a part of the
antenna, which is very like magical lore - THE ENERGY IS FLOWING THROUGH
YOU!
![Page 26: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/26.jpg)
Demos
![Page 27: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/27.jpg)
Unlocking Car (video)
https://www.youtube.com/watch?v=Q-OlgVLHIDs
![Page 29: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/29.jpg)
Controlling outlet (live)
python3 ask_modulate_radio_signal.py -c raw_data/outlet_c2_on.json -o/tmp/radio_signal.pcm
./transmit_signal.py -f /tmp/radio_signal.pcm -t 315000000
![Page 30: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/30.jpg)
![Page 31: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/31.jpg)
![Page 32: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/32.jpg)
![Page 33: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/33.jpg)
![Page 34: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/34.jpg)
![Page 35: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/35.jpg)
Understanding waves
![Page 36: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/36.jpg)
What are waves?
![Page 37: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/37.jpg)
![Page 38: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/38.jpg)
Interesting things about waves
They are everywhere
Epitome of change
Superposition principle (wave convolution)
Convoluted waves can be deconvoluted
Orthogonality of waves of differing frequencies
Relation to e
![Page 39: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/39.jpg)
Waves are found everywhere!
Anywhere there is circular motion or vibration, there are waves.
All wireless communication
Sounds waves
Radio waves
Infrared, microwave, etc
Motion of pendulums and springs
Light from the sun at a given place on earth
Temperature on earth
Patterns of the tides
![Page 40: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/40.jpg)
![Page 41: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/41.jpg)
Patterns of breathing
![Page 42: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/42.jpg)
All over moden physics
Quantum Field Theory posits that particles are excitations (waves) in various fields.
We know from Einstein that matter and energy are related, and since waves are theepitome of energy, this makes sense.
![Page 43: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/43.jpg)
Possibly the basis for all matter
String Theory posits that everything is made out of small VIBRATING strings
![Page 44: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/44.jpg)
Uncertainty Principle
I accidentally stumbled on the Uncertainty Principle when doing audio analysis
The more samples you take, the more certain you can be of the frequencies
contained
But the more samples you take, the less localized in time you are.
![Page 45: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/45.jpg)
![Page 46: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/46.jpg)
![Page 47: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/47.jpg)
![Page 48: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/48.jpg)
![Page 49: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/49.jpg)
![Page 50: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/50.jpg)
Application: So understanding waves helps you understand the universe!
![Page 51: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/51.jpg)
Waves are the epitome of change
Or to put it another way, "energy".
Calculus deals with change through the "derivative" - the rate of change of a function.
![Page 52: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/52.jpg)
Waves are one of the only graphs for which the derivative of the function is a versionof itself!
The other one I know of is e^x, but there's a reason for that... waves and e are
intimately related in Euler's Formula, e^ix = cos(x) + i sin(x).
More on that in a minute.
![Page 53: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/53.jpg)
Superposition principle
How can you hear many things at once?
How can there be multiple radio waves in the air at the same time which can be
tuned into?
![Page 54: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/54.jpg)
Superposition principle: waves are added together to form more complicated wavepatterns.
![Page 55: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/55.jpg)
![Page 56: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/56.jpg)
![Page 57: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/57.jpg)
Relation to radio hacking: The superposition principle is how there can be manydifferent radio signals in the air at the same time.
![Page 58: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/58.jpg)
Deconvolution is possible
Because waves of differing frequencies are orthogonal, a convoluted wave (made ofmultiple frequencies) can be broken into each of its component frequencies.
![Page 59: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/59.jpg)
This can be done with the Fourier Transform.
![Page 60: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/60.jpg)
Time domain
![Page 61: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/61.jpg)
Frequency domain
![Page 62: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/62.jpg)
Relation to radio hacking: Deconvolution is basically how we "tune into" a particularradio frequency.
![Page 63: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/63.jpg)
But how is this possible?
Say I have 10 numbers, and I "convolute" (add) them together - you couldn't breakthem back into the original numbers. So how can you do this with waves?
![Page 64: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/64.jpg)
Orthogonality of waves of differingOrthogonality of waves of differingfrequenciesfrequencies
![Page 65: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/65.jpg)
![Page 66: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/66.jpg)
You can think of the set of all waves as formingHilbert space where each frequency wave is a different
dimension.
![Page 67: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/67.jpg)
You can only deconvolute orthogonal components:
If you have 2 "components" in the same that are not orthogonal, you can't everdeconvolute them.
![Page 68: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/68.jpg)
Even if they are not fully in the same dimension, if thevectors are not orthogonal, you can't fully recover the
components:
![Page 69: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/69.jpg)
But you can fully recover the orthogonal components:
![Page 70: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/70.jpg)
And that holds for higher dimensions too:
![Page 71: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/71.jpg)
Relation to radio hacking: this is how, when you tune into a particular frequency, youdon't get tons of interference from all the other waves in the air.
![Page 72: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/72.jpg)
Relation to e
![Page 73: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/73.jpg)
Euler's Formula relates e^x to sin(x) and cos(x):
![Page 74: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/74.jpg)
This is also where we get Euler's Identity:
At x = π, sin(π) = 0, and cos(π) = -1
So e^iπ = -1 + 0
Move the 1 over: e^iπ + 1 = 0
![Page 75: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/75.jpg)
Complex sin waves
![Page 76: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/76.jpg)
Relation to radio hacking: Radio waves are actually transmitted as complex waves,not simple waves, so if we want to craft our own radio waves to control things, we'llneed to use complex sine waves.
![Page 77: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/77.jpg)
How does digital communication happen over waves?
![Page 78: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/78.jpg)
Modems
"Modem" = "MOdulator" + "DEModulator"
![Page 79: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/79.jpg)
Modulation
Modulation: manipulating a "carrier" wave to carry information.
Types of digital modulation:
Amplitude-Shift Keying (ASK)
Frequency-Shift Keying (FSK)
Phase-Shift Keying (PSK)
Quadrature Amplitude Modulation (QAM)
![Page 80: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/80.jpg)
Amplitude-Shift Keying (ASK)
![Page 81: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/81.jpg)
Used by many simpler devices
This is the type the wireless outlets I'm controlling uses
![Page 82: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/82.jpg)
Frequency-Shift Keying (FSK)
![Page 83: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/83.jpg)
![Page 84: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/84.jpg)
Phase-Shift Keying (PSK)
![Page 85: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/85.jpg)
Quadrature Amplitude Modulation (QAM)
Essentially, this is a combination of ASK and PSK
This is what modern WiFi mostly uses.
![Page 86: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/86.jpg)
Actually generating a radio signal from scratch
![Page 87: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/87.jpg)
Demo
Jupyter Notebook
Actually control the outlet
![Page 88: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/88.jpg)
Script: https://github.com/calebmadrigal/radio-hacking-scripts/blob/master/ask_modulate_radio_signal.py
Jupyter Notebook: https://github.com/calebmadrigal/radio-hacking-scripts/blob/master/radio_signal_generation.ipynb
![Page 89: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/89.jpg)
Conclusions
All wireless digital communications happens over EM waves.
And though some of the ways information is represented, all of it is still
just plain ol' EM waves.
Now you know how the fundamentals of all radio communication happens!
Including some freakin' awesome foundational math.
Be aware of the potential attack vectors that all wireless systems:
Jamming attacks - not a lot to mitigate this type of attack; but and it's
good to be aware of that. A few possible mitigation schemes:
Spread spectrum radio
Channel hopping
Active low - so if the signal goes away, consider that "triggered"
Replay attacks - make sure rolling codes are good
Brute force attacks - make sure key space is large enough and random
enough
Mixed replay+brute force?
Be wary of wireless communication, and keep this stuff in mind when analyzing
all the new IoT devices coming out!
![Page 90: Intercepting, modifying, and generating wireless … CON 25/DEF CON 25...Intercepting, modifying, and generating wireless signals with SDR How digital data is transmitted wirelessly](https://reader031.vdocument.in/reader031/viewer/2022030903/5b4279837f8b9ae3408b5b2b/html5/thumbnails/90.jpg)
Thanks!
Questions?
Caleb Madrigal(Public) handle: metemWebsite: http://calebmadrigal.com/Twitter: @caleb_madrigalHam call sign: w0hak
Link to these presentation note: http://tiny.cc/hackwave
Link to code and jupyter notebooks: https://github.com/calebmadrigal/radio-
hacking-scripts