DEFCON 22. Conference. Arming your pets. Fighting Pussy and dog for service failure. " Jen bransfield

Original author: Gene Bransfield
  • Transfer
Good afternoon, DEFCON! I am glad to be here. My name is Jen Bransfield, I am Tenacity's chief security engineer and really love my job, so when the weekend comes, I just can't wait for Monday morning! Today I will tell you about how to arm your cat, this is a fun story, with my victories, defeats and a whole bunch of slides.



So, why did I need to arm my pet?

It is known that 15% of the world's Internet traffic is dedicated to cats. In addition, I often make presentations about security systems to technical and non-technical experts. I noticed that the technical details bore people, they begin to get bored, roll their eyes and think about other things. To attract their attention, I began to dilute my presentations with slides with pictures of cats and tell different funny stories about them. For example, I start the presentation with the following picture:



I was just finishing one of my presentations when a man came up to me and said: “I want to give you this cat collar, there is GPS, a cellular module and you can track the location of the cat at any time, and if you are worried about her, you can send an SMS, and you will receive an answer with her GPS coordinates. ”

I wouldn’t be myself if it hadn’t crossed my mind: “It’s worth adding a small WiFi snoop to this collar and we’ll get a real Battle Pussy!”

As for service dogs, at another conference of hackers, AT Outerz0ne, I met Lady Merlin, who was walking her dog in a harness - a vest with large pockets on the sides, which made him look like a real service dog. I said that it’s cool, in my pocket, probably, is Pineapple, a hacker router that intercepts all the free traffic? She replied that no, it’s the same as using a laptop that rides on your lap, making it difficult to work, but Pineapple is a good idea!

The following slides show how service dogs are used in the army, the first shows just a working dog, and the other two dogs that find adventure on their ass when they are thrown out of the plane into the water or forced to jump in the arms of a paratrooper. Do you see that the paratrooper has an oxygen mask on his face? The dog is also masked, because the jump is carried out from a height of 30 thousand feet.







This slide shows a real fur seal. True, the U.S. Navy uses marine animals to protect harbors and search for floating mines. And if you try to quietly swim into the port to blow it up, a Flipper dolphin with a GoPro action camera on the fin will immediately emerge next to you.



In the 1960s, under the auspices of the CIA, there really were studies of the possibility of spyware on domestic cats, as shown in the next slide. This is a “wiretapping cat”, in which a microphone has been implanted, an antenna is located along the spine, and a transmitter with a power source is located on the chest. Only a person smoking something very fancy could come up with this.



I'm not joking, they received funding for this project and tested the first specimen of an acoustic cat. They brought her to a room where several guys were sitting reading aloud so that the cat could listen to them. But she ran away and disappeared, and this was the first and last attempt to use an acoustic cat. They stopped the tests, not because it was a bad idea, but because it was very difficult to work with these swivel cats. However, they found a very interesting thing, which I will return to later.

Now I will talk about the requirements that apply to my Battle Pussy.



The main requirement was not to harm the cat. I do not like cats, but I do not want to harm them.
The next condition was the comfort of the “clothes”, that is, the cat should have been comfortable both wearing and wearing its harness - vest. We did not need flashing lights and so on, which would turn our cat into an easily detectable prey.

GPS had to record route points with the corresponding date and time stamps, so that after the cat returned it was possible to track where she had been. The Wi-Fi “snoop-scanner” had to synchronize time with the GPS module and collect Wi-Fi SSID and other signals related to Wi-Fi for further analysis.

The idea was to put on a cat a collar or harness and let go for a walk around the neighborhood. The collar or harness must contain a GPS receiver and a Wi-Fi sniffer scanner to mark Wi-Fi wireless access points on the map, as is done in combat.

We also used additional tracking tools, such as the Mr Lee Cat Cam, which is mounted on a collar, Pet Tracker for pet and Garmin headset. To ensure the collaboration of all devices, you could use a GumStix laptop of a small Stix form factor about 11 cm long, but quite expensive, the Cotton Candy microprocessor of the same form factor and the miniature Rock Chip 3066 television receiver with an A9 dual-core processor that can be connected to a TV to receive streaming HD video.





So I took a can of beer and sat down to reflect on all this. I needed a small form factor, GPS, Wi-Fi and cellular. What would a similar device look like? Perhaps, like a smartphone that constantly lies in my pocket. But you needed an application that worked on Android, that is, it was required to write the appropriate code for Android and Wi-Fi.
Maybe such an application already exists? I found, downloaded and installed a cool application called WIGLE WiFi from the store of mobile applications for Android, and then I chose a volunteer cat for my tests. This is a cat of my friend Rivzi named Skitzy.



This is a hell of a big cat with a body length of 55 cm, a chest circumference of 50 cm and a neck circumference of 30 cm. Now we needed a Cat Coat, or a “cloak for a cat,” perhaps of this kind:



If you type the phrase “cat coat” on Google, you will see a whole bunch of photos of girls in a coat with the image of kitties, so this option does not work, so I began to “google” the phrase “dog coat” and found something that could suit me.



The plan was this: I put my equipment in a coat, put a coat on a cat, the cat goes for a walk, and I restore the recorded data when he gets home.

The sequence of actions is shown on the slides.





Here he looks a little scared.



Then we released the cat ...



And it ended in failure! Climbing through the fence, the cat lost his cloak, apparently, he hung on it too freely.



We caught the cat, put the cloak on it again, pulled it tight and tried again. And now we sit and wait, and wait, and wait ... we waited for him for 18 hours, and when we opened the door, we saw that the cat came back naked, without its military blankets.



We failed! We tracked the last known GPS mark, but blankets were not there. From this experiment we learned the following lessons:

  • cats are very difficult to work with;
  • always test your work before sending expensive equipment to the street;
    when making expensive purchases on Amazon, we can get a Prime account;
  • concern that the cat is comfortable in clothing leads to loss of clothing,
    you need to use a device with the same capabilities, but much smaller.

Then I talked with my friend Bill, who was fond of all sorts of engineering things, and he advised using the Arduino microcomputer, which possessed such features:

  • small form factor;
  • low power consumption;
  • does exactly what you need, no more, no less;
  • compatible with many chips and allows you to use various solutions.

I began to understand what this "Arduino" is:

  • it is an open electronic platform based on easy-to-use hardware and software, which is interesting for those involved in interactive projects;
  • there are many expansion slots for connecting sensors; Arduino boards themselves can be installed on top of each other;
  • used to create robots, remotely controlled cars, home security systems, etc.

Billy used the Ardunino chip to test food in the refrigerator, for the robotic arm, and for his video games. It has a really tiny form factor, it is an open resource and is very cheap.



Arduino's shortcomings include poor documentation, dubious quality, and the fact that it takes forever to figure it out.

This is all good, but I have never worked with Arduino, proprietary software and sets of small chips, I am not a professional encoder and can not solder. But Bill said, “Don't worry, it's easy!”

My action plan consisted of the following items:
  • Learn as much as possible about Arduino and learn basic concepts;
  • choose the most suitable form factor for the armament of our cat;
  • insert all the electronics into the collar, and then come up with something for the service dog ...

I read the book that came with Arduino Uno, and many more manuals on engineering and electronics, pulled out a bunch of LEDs to try out their work with Arduino, although I was not going to use any lights. The most amazing thing was that I discovered software libraries for Wi-Fi, GPS and SD cards.

On Jeremy Blum’s website jeremyblum.com, I found a lot of videos about designing all kinds of devices based on Arduino.

After all this, I decided that I became an expert in this matter. So, I had an Arduino Wi-Fi expansion board and a Itead Studio GPS expansion board.



I needed to give the Wi-Fi board the function of a data collector with recording to an SD card, and the GPS board - the function of a tracker, also with the ability to write data to the card, and combine them into one.

Everything went perfectly with the Wi-Fi board: the installation was easy, the drivers downloaded from the Arduino website worked, after a little fuss with the parameters and variables everything turned out as it should.

But with GPS it was not so easy. There is a line of NMEA, National Marine Electronics Association, which spells out the standards for GPS operation parameters - reception, transmission, coordinates, etc. The process of loading a module can be carried out from anywhere on the earth - you simply connect this module to a power source, and it begins to “listen” to space. The device detects 3 satellites, determines the position, and it takes from 2 to 15 minutes depending on local conditions.

The GPS expansion board also had poor documentation and there was no instruction in the kit box. It took me a week to understand why the module was not working, and in the end I found out that he needed a data rate of 34840 baud, which I still can not find anywhere.

In general, I put all the components together ... and failed.



It turned out that more than 80% of the Arduino memory is used, the number of libraries and variables is too large, and 32 KB of Arduino Uno memory is absolutely not enough - the chip simply cannot work with such a load.

Therefore, I bought an Arduino Mega 2560 microprocessor with 256 KB of memory, again connected everything together, launched it, and it worked!



Arduino Mega 2560 had:

  • more memory, which was much better;
  • more ports, which was much better;
  • larger size, which was much worse.

In search of an alternative, I surfed the entire Internet and found the Arduino Mega Mini chip from JK Devices, which was smaller than the standard Mega.



I continued searching for small platforms and found a microprocessor called Spark Core, which was a combination of two modules on one printed circuit board - there was a Wi-Fi module in front and an Arduino chip in the back.



I bought a GP-635T brand GPS chip and a SparkFun MicroSD Breakout memory card for it.



Since I was told that Arduino Mega Mini delivery would have to wait several weeks, and all other platforms were either too large or had too little memory, I opted for Spark products. The Spark Core platform had the following specifications:

  • ARM 32-bit M3 processor;
  • 128 KB memory, more than I need;
  • compatibility with SPI and I2C, that is, protocols for the interaction of the microcontroller, external components and the Internet;
  • Wi-Fi chip TI CC3000;
  • there was no compatibility with Arduino.

The last paragraph meant that although the controller uses an Arduino chip and you can connect external components to it, you cannot ensure their interaction by simply writing the appropriate code, that is, Spark and the Arduino platform are still completely different things. This did not upset me, and I again began to create my product.

It all starts with the Scratch programming language, but I found out that it does not have the libraries necessary for the operation of my device. Despite this, it was very cool, so in search of a solution I turned to the Peekay123 development team, and here is what came of it:

  • someone posted libraries for SD cards on the forum, and they came up to me!
  • someone posted a GPS library on the forum, they worked and were compatible with my GPS module!

However, with libraries for Wi-Fi it was more difficult, because Spark Core was created on the basis of the “Internet of things” principle, and Wi-Fi was a background service that could not be associated with it.

But I wanted to tie them together! There were libraries for the Adafruit CC3000 chip that could be downloaded from the Adafruit website to use it to collect Wi-Fi data, I downloaded them, installed them, and it worked!

So, I had a GPS running on Spark, an SD card compatible with Spark, a set of SSIDs running on Spark, and now I needed to connect all this stuff together. For this, soldering was needed!



How many of you can solder, raise your hands! You see - only a couple of people in the hall! Learning the art of soldering was my last lesson. At the same time, I learned a few important rules, for example, that the soldering iron should not be held by the tip, but by the handle. The second rule was that you do not need to put your hands anywhere, so as not to get a burn with a soldering iron. Rule three said that everything looks easy on the Internet, but in reality this is far from the case.

So, first I placed a GPS module and a card reader for the SD card on the circuit board and connected it all with the Spark controller. It looked good, and I decided to check how it works.



Home tests were great! I took the device with me and walked around the house - everything worked perfectly! It showed that here is my network, here is my neighbor’s Wi-Fi and so on. But when I took it with me to the car and drove a little, I failed. What was the reason?

That Spark was a bright representative of the "Internet of things", which means that he should never disconnect from the Internet! In this case, from the home Internet. I talked with the guys on the forums about what happens to the device when driving in a car. It turned out that the Spark chip must be connected to a known access point in order to start working. It turned out that while it was connected to my home Wi-Fi network, everything worked without errors, but if it was half a mile away, the device stopped working.

I could scan a unique 32-digit SSID that is used to identify my wireless LAN. So Spark can connect to it, it uses this code. Here's what happened: when the controller lost the signal of the WI-FI home network and tried to connect again, it looked for the network with this SSID, but could not find it. So, I just had to manage to delete this code from the chip’s memory so that after losing a signal from one network it could connect to other networks. After I did this, there were no more WiFi issues.

The next step was a GPS test. I drove a bit and got data on W-Fi points, everything worked fine, I drove another half mile and checked the GPS coordinates. I was on the highway, and on the map it turned out that I was in the lake. Upon returning home, I found out that the available GPS libraries could not correctly convert satellite data to coordinates on the map. It turned out that I do not have GPS libraries.

Then I got TinyGPS ++, a set of libraries that extract the NMEA data received by the GPS module, such as position, altitude, speed, date, time, course, etc., and transfer them to the Arduino chip. This was what I needed, but it did not work with Spark. I spoke with Bill, and he advised using libraries for the port of Arduino.

I again plunged into the field of space sciences. It’s like with a rocket, when you refuel it, put it on the starting position, press the red button, and it explodes. Or the rocket first takes off, and then explodes. Or, after all, it goes into space, and then you say: “Yes, this is space science”! Somewhat worse when a monkey sits inside a rocket. In general, I found out that I need to swap Arduino and Sparks to make it work. To do this, I had to deal with the coding of libraries for Sparks ports, which is no easier than space sciences. So the next specialty that I mastered was the specialty of the encoder. But at last everything finally worked as it should.

The next problem was energy consumption. It was necessary to think how to improve its characteristics. I decided to use a miniature Elite 3.7 V battery with a capacity of 500 mAh, which my friend Ricky used for his aircraft models, and started testing his work.



It turned out that the option of saving power consumption by periodically turning off and turning on the power of the entire device does not suit me. Then I made it possible to enter the main chip into deep sleep mode, while the GPS module continued to work. "Serifs" of data every 30 seconds discharged the battery for 4 hours, collecting data every 10 minutes increased the operating time to 8 hours.

Finally it's time to make a collar. It turned out that soldering parts was twice as fun, that is more difficult than soldering, and I burned a lot of all sorts of useful little things. The Internet did not help me again, but the videos on YouTube somewhat improved my understanding of the process. I asked my friend Joe what to do and he advised me to contact NovaLabs from Reston, Virginia. It was Ted, a crazy scientist and part-time evil genius who helped me learn EAGLE, and Brian, a soldering master who explained to me that the right iron needs the right soldering. They made my life much easier.
Then I started to develop the design of a cat collar. It could be done in several ways. Joe suggested stitching several tapes together and inserting my equipment between them. I went to Mike and took from him such a beautiful leopard braid that perfectly fit our cat.



Now I needed to sew them together. How many knows how to do this? This is the art of our grandmothers, so I needed a grandmother. This is my wife’s grandmother, her name is Nancy, and she is very happy to meet you.



She was glad to help us and for one dollar I sewed two collars - an external and an internal one, which was supposed to protect the electronics from damage and moisture. Spark had several flashing LEDs that I did not want to attach to the cat, so I removed them.

It's time again to turn to our volunteer cat for help. This bastard owes me a lost cell! First, it was necessary to conduct tests with an empty collar in order to check whether the cat would lose it, as happened with the harness.



In the new ammunition, the cat looked like this - on top you see a ring to which the load was attached in the form of a cartridge. It should orient the position of the collar on the cat’s neck so that the GPS receiver inside is always pointing up.



So, we inserted the electronics into the collar, dressed him on the cat and sent him for a walk. When he returned home, I took off my collar and found nothing! I checked the electronics - everything worked! We put the collar on the cat again and sent him outside. He climbed into the bushes and hung there for 20 minutes, licking himself. I told Reeves about this, he went to the bushes, began to shake them, and the cat jumped out of there.

We decided to change the technology of work in such a way:

  • take the collar outside and wait for the GPS connection for 5-10 minutes;
  • bring the cat to the collar and put the collar on the cat;
  • send the cat for a walk in a collar.

Finally, LUCK was waiting for us!



The data extracted from the collar looked like this:



Here was the date, time, latitude, longitude, name of the Wi-Fi SSID access points, the signal and its decryption.

I made a video of his movements in the received coordinates, and it turned out that all this time the damned cat did not even leave the front yard, and the first place where he was marked was the car.



We found another cat, whose name was Coco, and tested a collar on it. The data obtained were much more diverse, and the area of ​​its movements is much wider.





During her journey, she must have hunted mice. In general, our device worked perfectly, the results of the research returned where necessary.

That's how I managed to create my Battle Pussy!

It remains to solve the question of how to improve the service dog.



So, there are more service dogs on the Internet than anyone else. For them, you can use a Smoocon product called WiFi Pineapple and a remote switch for TVs in Gone based on Adafruit / Radiosnack controllers. TV device Gone is used to turn off all television sets in public places at the same time. All this can be placed in a harness vest, or a dog backpack. In order for all this to work, you need a Karma program for processing responses to queries in the Answers Probes mode, DNS Spoof, which directs everything to Pineapple, and the RandomRoll module.



The next slide shows what TV In Gone looks like, taken apart. It required my shareholder talents, as a result I got a compact module, which I modified by evaporating the LEDs.







Now all this had to be patched, God forbid anyone to do this! Cept Irina & Friends from JoAnn's Fabrics, located in Sterling, Virginia, helped me with this. So we managed to create a set of equipment called "Denial of Service Dog", that is, a "dog for service failure" with a Wi-Fi module.

I have a video showing how this works. You see that outside the harness is a block with an LED, and when I pressed the remote button, it began to blink green, indicating that the television was in progress, and then automatically turned off. Now I will show how the connection looked on the smartphone screen when I was sitting in the car. First, I find the access point to the Wi-Fi network, give it the name DEFCON and try to connect, while Karma reports that “here I am”, after which the connection is established, and I go to the Internet. Everything worked perfectly, and now we needed a volunteer dog.

We chose a Doberman pinscher, whose name was Doberman Doberman, and he rushed about 10 minutes around the yard, rejoicing that he saw so many new people. Then we pulled on a harness and he stayed in that position for 10 minutes.



This is how his backpack looked side and top.



Having risen on its paws, the dog began to shake off, which became a serious test for electronic filling, and once again I praised myself for learning to solder well.
After that we went to a restaurant. We were allowed to go there with a dog without any problems, because we said that we have a service dog (in the USA, dogs that help people with disabilities are called service dogs). I pressed the GoPro record button, but I mixed up the excitement and pressed the wrong one, there were only 2 buttons. We sat down at a table, a waiter came up to us and asked: “Why is there a dog on his vest for the denial of service”? We replied: “You know, today all day everyone comes up to us with this question, we don’t answer, they turn around and leave!”



The TVs in the restaurant were turned off, so we could not check the operation of our device and decided to go to the sports bar. There the TV was turned on there, but I did not dare to try our TV In Gone on it, because people watched the World Cup championship, the semifinal match with Argentina, and turning off the broadcast was dangerous for our health.

So if you go to a restaurant where a 50-inch TV hangs on the wall, keep in mind that it is always remotely controlled by some guy in the background, and if you visit a restaurant with one or two small TVs, then usually they don’t work at all.

Finally, we went to the supermarket, and there our dog simply ran his eyes wide, so he constantly had to be grabbed by the handle on his back and yanked. We asked the seller if it was possible to walk around the store with a service dog, and he said that it would be possible if she hadn't spoiled her anywhere. However, this happened.

We went to the section where they sold televisions, and there luck was waiting for us. As soon as I pressed the button, the image on the TVs disappeared.



As a result of the tests, we found out the following:

  • several unfortunate victims accidentally connected to Karma and their device issued a message “registration error”;
  • only one person asked why the dog says “dog for service failure” on the dog’s harness,
    most people, seeing our dog, said: “Good dog!”

The lessons I learned were as follows:

  • a technically savvy amateur without the experience of flashing devices can create a functional collar for a Battle Pussy in a relatively short time;
  • in 2014, unprotected Wi-Fi access points still exist;
  • many devices are still trial versions;
  • there is still no patch for human stupidity;
  • cats and dogs are really hard to work with!

I want to thank everyone who participated in my project and say that I am very proud to be here among you, because together we are able to do great things!


Thank you for staying with us. Do you like our articles? Want to see more interesting materials? Support us by placing an order or recommending it to your friends, a 30% discount for Habr users on a unique analogue of entry-level servers that we invented for you: The whole truth about VPS (KVM) E5-2650 v4 (6 Cores) 10GB DDR4 240GB SSD 1Gbps from $ 20 or how to divide the server? (options are available with RAID1 and RAID10, up to 24 cores and up to 40GB DDR4).

Dell R730xd 2 times cheaper? Only we have 2 x Intel Dodeca-Core Xeon E5-2650v4 128GB DDR4 6x480GB SSD 1Gbps 100 TV from $ 249 in the Netherlands and the USA! Read about How to Build Infrastructure Bldg. class using Dell R730xd E5-2650 v4 servers costing 9,000 euros for a penny?

Also popular now: