This presentation is an outgrowth of work done under contract to the - - PowerPoint PPT Presentation

▶
this presentation is an outgrowth of work done under
SMART_READER_LITE
LIVE PREVIEW

This presentation is an outgrowth of work done under contract to the - - PowerPoint PPT Presentation

Mar 03, 2023 182 likes •1.97k views

This presentation is an outgrowth of work done under contract to the Institute for Telecommunication Sciences and does not represent the views or policies of the United States federal government. Mystery Mystery Signal Signal Challenge!

slide-1
SLIDE 1
slide-2
SLIDE 2

This presentation is an outgrowth of

work done under contract to the Institute for Telecommunication Sciences and does not represent the views or policies of the United States federal government.

slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13

Mystery Mystery Signal Signal Challenge! Challenge!

slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17
slide-18
SLIDE 18
slide-19
SLIDE 19
slide-20
SLIDE 20
slide-21
SLIDE 21
slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25
slide-26
SLIDE 26
slide-27
SLIDE 27
slide-28
SLIDE 28
slide-29
SLIDE 29
slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33
slide-34
SLIDE 34
slide-35
SLIDE 35
slide-36
SLIDE 36
slide-37
SLIDE 37
slide-38
SLIDE 38
slide-39
SLIDE 39
slide-40
SLIDE 40
slide-41
SLIDE 41
slide-42
SLIDE 42
slide-43
SLIDE 43
slide-44
SLIDE 44
slide-45
SLIDE 45
slide-46
SLIDE 46
slide-47
SLIDE 47
slide-48
SLIDE 48
slide-49
SLIDE 49
slide-50
SLIDE 50
slide-51
SLIDE 51
slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54
slide-55
SLIDE 55
slide-56
SLIDE 56
slide-57
SLIDE 57
slide-58
SLIDE 58
slide-59
SLIDE 59
slide-60
SLIDE 60
slide-61
SLIDE 61
slide-62
SLIDE 62
slide-63
SLIDE 63
slide-64
SLIDE 64
slide-65
SLIDE 65
slide-66
SLIDE 66
slide-67
SLIDE 67
slide-68
SLIDE 68
slide-69
SLIDE 69
slide-70
SLIDE 70
slide-71
SLIDE 71
slide-72
SLIDE 72
slide-73
SLIDE 73
slide-74
SLIDE 74
slide-75
SLIDE 75
slide-76
SLIDE 76
  • C. R. Johnson, Jr. and W. A. Sethares.

Telecommunication Breakdown: Concepts of Communication Transmitted via Software- Defined Radio.

http://eceserv0.ece.wisc.edu/~sethares/telebreak.html

slide-77
SLIDE 77

The GSM Software Project

http://wiki.thc.org/gsm

slide-78
SLIDE 78

Max Moser and Phill Schrödel. 27Mhz based

wireless security insecurities.

http://www.remote-exploit.org/advisories.html

slide-79
SLIDE 79

Dominic Spill and Andrea Bittau. BlueSniff:

Eve meets Alice and Bluetooth.

http://www.usenix.org/event/woot07/tech/full_papers/spill/

slide-80
SLIDE 80

Henryk Plötz. RFID Hacking.

http://events.ccc.de/congress/2006/Fahrplan/events/1576.en.html

slide-81
SLIDE 81
  • lleB. Mobitex Network Security.

http://cansecwest.com/csw08/csw08-olleb.pdf http://www.toolcrypt.org/

slide-82
SLIDE 82

Daniel Halperin, et al. Pacemakers and

Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses.

http://www.secure-medicine.org/icd-study/icd-study.pdf

slide-83
SLIDE 83

GNU Radio: the gnu software radio.

http://gnuradio.org/trac

slide-84
SLIDE 84

The Universal Software Radio Peripheral

(USRP). http://www.ettus.com/

slide-85
SLIDE 85

High Performance Software Defined Radio. http://hpsdr.org/

slide-86
SLIDE 86

baudline signal analyzer. http://www.baudline.com/

slide-87
SLIDE 87

MATLAB. http://www.mathworks.com/

slide-88
SLIDE 88

GNU Octave. http://www.gnu.org/software/octave/

slide-89
SLIDE 89
  • OP25. A software-defined analyzer for APCO

P25 signals.

http://sedition.org.au/op25

slide-90
SLIDE 90 1

Software Radio and the Future of Wireless Security Michael Ossmann Institute for Telecommunication Sciences

slide-91
SLIDE 91 2 This presentation is an outgrowth of

work done under contract to the Institute for Telecommunication Sciences and does not represent the views or policies of the United States federal government.

slide-92
SLIDE 92 3

My name is Michael Ossmann. I work for the Institute for Telecommunication Sciences at the Boulder Labs in Colorado.

slide-93
SLIDE 93 4

ITS is part of the National Telecommunications and Information Administration.

slide-94
SLIDE 94 5

The NTIA is part of the United States Department of Commerce.

slide-95
SLIDE 95 6

I work primarily on public safety wireless communication security, and my work is funded by the Office of Law Enforcement Standards of the National Institute of Standards and Technology.

slide-96
SLIDE 96 7

NIST is also part of the Department of Commerce.

slide-97
SLIDE 97 8

NIST's funding for my work comes from the Department of Homeland Security's Office for Interoperability and Compatibility.

slide-98
SLIDE 98 9

DHS gets its money from these guys

slide-99
SLIDE 99 10
slide-100
SLIDE 100 11

in the next hour

what is software radio? why is software radio taking over the world? what does this mean for the future of wireless security research? demos how can I get started with software radio tools today? (radio for software people)

slide-101
SLIDE 101 12

not in the next hour groundbreaking vulnerabilities specific wireless protocols

slide-102
SLIDE 102 13

Mystery Mystery Signal Signal Challenge! Challenge!

slide-103
SLIDE 103 14
slide-104
SLIDE 104 15
slide-105
SLIDE 105 16
  • 1. what is software radio?
slide-106
SLIDE 106 17

analog signals surround us

sounds images radio waves tides heart rhythms seismic waves anything that changes over time

slide-107
SLIDE 107 18

digital signals

a digital signal is simply a sequence of values analog signals can be sampled to produce digital signals

slide-108
SLIDE 108 19
slide-109
SLIDE 109 20

the digital audio revolution

  • nce upon a time, all sound was analog:

vinyl records analog tape analog synthesizers analog effects Plain Old Telephone Service

slide-110
SLIDE 110 21

the digital audio revolution

the revolution began slowly: Digital Audio Tape (DAT) Compact Discs (CDs) digital synthesizers digital effects digital telephone switches individual digital components replaced traditional analog components professional equipment used by professionals

slide-111
SLIDE 111 22

the digital audio revolution

then the explosion: hard disc recording home recording studios MP3 peer to peer (Napster, Skype, etc.) analog modeling digital synthesizers personal computers delivered professional audio tools to the masses today: many of today's hits are recorded in home studios

  • ld school record labels struggle to compete with new distribution

channels VoIP services challenge incumbent telephone companies

slide-112
SLIDE 112 23

why the explosion?

digital audio circuitry had existed for many years personal computers enabled wide distribution of software-based digital audio processing digital audio brought incremental change, but software audio was the true revolution

slide-113
SLIDE 113 24
slide-114
SLIDE 114 25

digital radio

nearly every recent radio technology is digital: 802.11 HD radio and TV mobile phones Bluetooth

slide-115
SLIDE 115 26

software radio

a signal is a signal (if it can be done with audio, it can be done with radio) personal computers are now fast enough for many radio processing functions

slide-116
SLIDE 116 27

ideal software radio receiver

antenna -> ADC -> CPU

slide-117
SLIDE 117 28

ideal software radio transmitter

CPU -> DAC -> antenna

slide-118
SLIDE 118 29

practical software radio

RF front end (analog circuit) is typically required frequency conversion amplification filtering bias

slide-119
SLIDE 119 30

software radio products

more and more closed source commercial devices use software (or firmware) radio techniques amateur radio equipment WiMAX equipment mobile phone base stations a few mobile phones several commercial software radio products for PCs most are RF front ends for sound cards

slide-120
SLIDE 120 31
slide-121
SLIDE 121 32

The Universal Software Radio Peripheral (USRP) http://www.ettus.com/

  • pen source design

can receive and transmit multiple RF front end daughterboards ADC/DACs FPGA USB GNU Radio interface

slide-122
SLIDE 122 33
slide-123
SLIDE 123 34
  • 2. why is software radio taking
  • ver the world?
slide-124
SLIDE 124 35

advantage: flexibility

software radios can have many operating modes without many circuits software radios can perform like multiple radios simultaneously

slide-125
SLIDE 125 36

advantage: reconfigurability

software radios can implement new software at any time new protocols adaptive filtering new frequencies bug fixes hacks! with open source, new radio functions can easily be shared online

slide-126
SLIDE 126 37

advantage: cost

two ways to build a sophisticated radio device: lots of expensive analog components (and often some digital stuff too) a few cheap analog components plus a computer consider Moore's Law software can make up for deficiencies in the analog circuitry

slide-127
SLIDE 127 38

the future

consider the commercial advantages of software radio consider the current emergence of open source mobile phones and hand-held platforms (OpenMoko, Android, etc.) consider that mobile phones using (closed source) software radio technology are starting to arrive we will all have hackable software radio platforms in our pockets all (okay, most) radios will be software radios new wireless protocols will include software reference implementations during development all wireless security tools will be software radios

slide-128
SLIDE 128 39
  • 3. what does this mean for

wireless security?

slide-129
SLIDE 129 40

the Wi-Fi lesson

802.11b shipped with severe vulnerabilities vulnerabilities were ignored until practically demonstrated practical attacks were made easy by cheap, ubiquitous, hackable hardware: monitor mode raw frame injection

slide-130
SLIDE 130 41

what if every new wireless technology arrived with inexpensive hardware capable of monitor mode and raw frame injection?

slide-131
SLIDE 131 42

GSM http://wiki.thc.org/gsm

USRP/GNU Radio decoded GSM signals related project: A5/1 decryption

slide-132
SLIDE 132 43

27 MHz keyboards

http://www.remote-exploit.org/advisories.html sound card with RF front end decrypted keystrokes

slide-133
SLIDE 133 44

Bluetooth

http://www.usenix.org/event/woot07/tech/full_papers/spill/

USRP/GNU Radio single channel sniffing and decoding

slide-134
SLIDE 134 45

RFID

http://events.ccc.de/congress/2006/Fahrplan/events/1576.en.html

USRP/GNU Radio decoded low frequency RFID signals iPod replay

slide-135
SLIDE 135 46

mobitex http://www.toolcrypt.org/

sound card with RF front end decoded mobitex signals

slide-136
SLIDE 136 47

medical devices

http://www.secure-medicine.org/icd-study/icd-study.pdf USRP/GNU Radio active and passive attacks against implantable cardioverter defibrillators

slide-137
SLIDE 137 48
  • 4. demonstration
slide-138
SLIDE 138 49
  • 5. radio for software people
slide-139
SLIDE 139 50

software radio topics

–

Fortunately only a small subset of this knowledge is required to get started using software radio for useful security tasks:

slide-140
SLIDE 140 51

RF basics

radio waves are electromagnetic radiation in the range of about 3 Hz to 300 GHz (wavelengths of 100,000 km to 1 mm) most practical applications are between 30 kHz and 30 GHz (wavelengths of 10 km to 1 cm)

slide-141
SLIDE 141 52

antenna basics

most jobs don't require an optimal antenna longer wavelengths require bigger antennas it's better to go too big than too small low frequency applications (like 125 kHz or 134 kHz RFID tags) require loops

slide-142
SLIDE 142 53

Goldilocks and the Three Bands

kHz: These wavelengths are too long! antennas are unwieldy bandwidth is limited GHz: These wavelengths are too short! propagation is poor short range, LOS, or directional applications only MHz: These wavelengths are just right! manageable antennas reasonable bandwidth good propagation

slide-143
SLIDE 143 54

modulation

there are only three basic types of modulation: amplitude modulation frequency modulation phase modulation there are many combinations and variations of these three digital modulations are often referred to as “keying”

slide-144
SLIDE 144 55
slide-145
SLIDE 145 56

symbols

a symbol is the shortest segment of a signal that represents a discrete value of the digital data being transmitted example: Binary Frequency Shift Keying (BFSK) uses

  • ne frequency for “0” and another for “1”

the symbol rate (or “baud rate”) is the number of symbols transmitted per second

slide-146
SLIDE 146 57

remember the Fourier transform?

taught in Calculus courses essential for DSP important principle: any waveform can be precisely represented as a sum of sinusoidal components Fast Fourier Transform (FFT) is the common digital equivalent invertible function

slide-147
SLIDE 147 58

“bandwidth”

the word “bandwidth” is overloaded but has a particular meaning in the RF/DSP world: the width (in Hz) of the range of frequency components of a signal wider bandwidth signals have greater channel capacity (they can carry more bits per second) spread spectrum technologies intentionally squander channel capacity in exchange for resistance to interference

slide-148
SLIDE 148 59
slide-149
SLIDE 149 60

aliasing

frequency components of sampled signals are ambiguous example: a 150 kHz sinusoid sampled at 192 ksps is indistinguishable from a 234 kHz sinusoid sampled at 192 ksps (both are 42 kHz away from the sample rate) anti-aliasing filters must be present in the analog domain

slide-150
SLIDE 150 61
slide-151
SLIDE 151 62
slide-152
SLIDE 152 63

sampling theory

in order to capture a signal, your sampling rate must be at least twice the bandwidth of the signal example: to capture a 25 kHz wide analog FM transmission, your ADC must acquire no less than 50,000 samples per second

slide-153
SLIDE 153 64

hardware options

USRP HPSDR sound card with RF front end anything with ADC/DAC DAQ boards TV tuners video cards hack off-the-shelf software radio equipment you can even get started without hardware!

slide-154
SLIDE 154 65
slide-155
SLIDE 155 66

convolution

a simple and useful operation best illustrated by example: convolve [1,1,1] with [0,1,2,3,2,1,0,1,2,3,2,1]:

[1,1,1] * 0 = [0,0,0] [1,1,1] * 1 = [1,1,1] [1,1,1] * 2 = [2,2,2] [1,1,1] * 3 = [3,3,3] [1,1,1] * 2 = [2,2,2] ... sum up: [0,1,3,6,7,6,3,2,3,6,7,6,3,1]

slide-156
SLIDE 156 67

convolution as a filter

The convolution of [1,1,1] with [0,1,2,3,2,1,0,1,2,3,2,1] is a moving average and can be thought of as a filter: [0,1,2,3,2,1,0,1,2,3,2,1] is the signal [1,1,1] is a crude low pass filter “low pass” means that it filters out high frequency components but allows the low ones to pass through low pass filters result in smoother, rounder, waveforms

slide-157
SLIDE 157 68

FIR filters

convolution of a signal with a static sequence is called a Finite Impulse Response (FIR) filter the elements of the static sequence are called the coefficients of the filter FIR filters can be used to emphasize arbitrary frequency components or remove others High pass, low pass, and band pass are common, but more complex shapes are possible FIR filters can be fast (SIMD, DSP chips, etc.) common routines are available to “design” (produce the coefficients for) filters based on the required shape in the frequency domain (the filter's “frequency response”) always test filters

slide-158
SLIDE 158 69

visualize, visualize, visualize

GNU radio gnuplot various audio tools my favorite: baudline (free but closed source)

slide-159
SLIDE 159 70
slide-160
SLIDE 160 71

software re-use

GNU Radio and other frameworks include code for: filters filter design functions resampling frequency conversion modulation demodulation and much more

slide-161
SLIDE 161 72

a good book

http://eceserv0.ece.wisc.edu/~sethares/telebreak.html

slide-162
SLIDE 162 73
slide-163
SLIDE 163 74

be a good neighbor

know your laws don't transmit anything over the air without being sure

  • f what you are doing

you can often use cables instead (but don't forget attenuators) common transmission mistakes: failure to filter noise outside of the intended signal bandwidth failure to filter aliases

slide-164
SLIDE 164 75
slide-165
SLIDE 165 76
  • C. R. Johnson, Jr. and W. A. Sethares.

Telecommunication Breakdown: Concepts of Communication Transmitted via Software- Defined Radio.

http://eceserv0.ece.wisc.edu/~sethares/telebreak.html

slide-166
SLIDE 166 77 The GSM Software Project

http://wiki.thc.org/gsm

slide-167
SLIDE 167 78 Max Moser and Phill Schrödel. 27Mhz based

wireless security insecurities.

http://www.remote-exploit.org/advisories.html

slide-168
SLIDE 168 79 Dominic Spill and Andrea Bittau. BlueSniff:

Eve meets Alice and Bluetooth.

http://www.usenix.org/event/woot07/tech/full_papers/spill/
slide-169
SLIDE 169 80 Henryk Plötz. RFID Hacking. http://events.ccc.de/congress/2006/Fahrplan/events/1576.en.html
slide-170
SLIDE 170 81
  • lleB. Mobitex Network Security.

http://cansecwest.com/csw08/csw08-olleb.pdf http://www.toolcrypt.org/

slide-171
SLIDE 171 82 Daniel Halperin, et al. Pacemakers and

Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses.

http://www.secure-medicine.org/icd-study/icd-study.pdf
slide-172
SLIDE 172 83 GNU Radio: the gnu software radio.

http://gnuradio.org/trac

slide-173
SLIDE 173 84 The Universal Software Radio Peripheral

(USRP). http://www.ettus.com/

slide-174
SLIDE 174 85 High Performance Software Defined Radio. http://hpsdr.org/
slide-175
SLIDE 175 86 baudline signal analyzer. http://www.baudline.com/
slide-176
SLIDE 176 87 MATLAB. http://www.mathworks.com/
slide-177
SLIDE 177 88 GNU Octave. http://www.gnu.org/software/octave/
slide-178
SLIDE 178 89
  • OP25. A software-defined analyzer for APCO

P25 signals.

http://sedition.org.au/op25