#308 – An Interview with Samy Kamkar

Samy Kamkar: This is the Up Hour Podcast. Recorded July 20th, 2016. Episode 308. An interview with Sammy Kamkar.

Chris Gammell: Welcome to the Amp Hour. I'm Chris Gammell of Contextual Electronics. And I'm Sammy Kamkar, an independent security researcher, aka hacker. Hacker. They're so in vogue right now. And yeah, so we're sitting in Sammy's place. And as is often awkward for me, I'm looking at the person I'm talking to. So thank you for having me here. Yeah, thanks for coming. This is awesome. Thanks for having me on. So it's always nice. There are some really cool people like you in LA when I'm traveling. I get to meet. And why LA for you? I don't actually.

OpenGL: Yeah, that's a good question. I was born in Pittsburgh. Me too.

Chris Gammell: Awesome. Upper St. Clair. Sweet. And now, speaking of security, now people know our security passwords. Oh, man, our security passwords. Shit.

Dave Jones: Hey, so Sammy, just wondering out of, what's your mother's maiden name? So, okay, I'll go on a tangent.

OpenGL: I'll go on a quick tangent. I built an app, and I haven't released it. But it's just like a fun app, and it's a Facebook game. And it's basically how to see who are your best friends. And what it does is it asks all your friends all these questions about you to see, do you rank as one of the top friends? Right, right, right. You're compatible. Yeah. And also, now I know your dog's name. What's their dog's name? What's the mother's maiden name? That's great. Where were they born? What's their first car? What was the street they grew up on? Yeah. You are their best friend. Oh. You know everything, and now I do, too. So, I think that's going to be a great app one day. But, yeah, born in Pittsburgh, moved around a lot. And then around 13, I think my mom was just like, do you want to move to L.A.? I just lived with my mom. And I was like, okay. And we got in a car. We got in our car and literally drove to L.A. That's awesome. Yeah, we stopped actually in Arcadia. I lived there for like two years. Near Pasadena. Oh, okay. Yeah, yeah. So, near you guys. Yep. And then, yeah, I was there for about two years. And around 15 or 16, I just dropped out of high school. And then I started doing software. I just started programming.

Chris Gammell: Yeah, I was reading. I mean, obviously, I've hung out with you before. But I was reading some of. You have a lot of press about you. People can go to your site, and there's a lot of press and stuff like that. But it was for Counter-Strike or something like that? It was like a game company?

OpenGL: Yeah. Around the same time? Yeah, I started doing press. Actually, it was in Pittsburgh that I went to my first conference. I went to YAPC, yet another Pearl conference. This was like 16 years ago. It was like Pearl 4? That's a good question. I think it was still Pearl 5. Okay. But, yeah, it was a while ago. Yeah. And that was really cool. And I was learning Pearl at home and just messing around with it. It seemed really powerful. And, yeah, I started getting into, like, I moved to LA, and I started playing Counter-Strike. And I remember I was playing Counter-Strike, and I would play Winamp in the background to just listen to MP3s. And if a song was playing that I didn't like, we didn't have those keyboards with the, like, media keys that you could skip the song. Right, right. So, you had to alt-tab out of Counter-Strike into Winamp, which would then mess up your screen half the time when you go back into Counter-Strike. Like, I don't know whether the OpenGL drivers were weird or whatever, but, like, the colors would be all off. And then I'd get headshot while I'm in Winamp changing the song. I'm like, there's got to be a way that I can maybe hook the keyboard and allow me to change the song from Counter-Strike. And, unfortunately, I couldn't hook the keyboard, so I was learning that I had to inject memory into Counter-Strike in order to also listen to the keyboard. Because Counter-Strike takes over the keyboard. It hooks everything. So, once I did that, I was like, well, now I'm writing code, and I'm essentially overwriting some of the functions within Half-Life. Can't I do other things? And that's when I realized, well, I can control, like, OpenGL. I can control anything within Counter-Strike. So, if someone's like, if I hear footsteps, and I heard footsteps going from my left speaker to panning to my right speaker, then that means there's positional information about the person, let's say the enemy, who's walking behind me. And I can't see them normally, but if there's footsteps with positional information, I can then draw that on the screen with OpenGL. So, then I would draw where everyone was because all of their information was getting sent in packets, and I could read it from within memory. And then I just started building cheats. And that just became, like, that's where really, I think, that's where I learned a lot of reverse engineering. Yeah. Was probably building cheats for Counter-Strike.

Chris Gammell: Yeah. That's interesting. So, if you don't mind me asking, I mean, dropping out of high school, what?

OpenGL: Oh, you know, Counter-Strike was a lot more fun than high school, I found. Yeah, sure. So, I played. I just kept doing that. I just really wasn't interested in the stuff at school. Uh-huh. Um, I wasn't very good at a lot of classes, so I just kind of, like, I would kind of sit and, like, I just wanted to code. And, um, so I just did that.

Chris Gammell: It wasn't for any good reason. Yeah. I mean, I make no judgments. I don't think anyone else listening would either. But I just, I wonder, so what that leads into for me is wondering, you know, because me and Dave talk about it a lot, too. And, Dave, sorry you couldn't make it, but, um, uh, we talk about, you know, like, how the difference between education and application and, you know, like, how that kind of stuff plays into it. Uh-huh. So, I'm just kind of wondering for you, like, what resources were you using to, as you move forward then, like, what were, I mean, we can go through some of the other stuff that kind of led you towards where you are now. Sure. What, uh, what were your resources then and as you went forward?

OpenGL: Um, you know, I was really fortunate to have the internet at, like, a young age. So, I think it was when I was, like, 10 or 11 that my mom, yeah, probably around 10, that, um, my mom spent all of our money to get me a computer. And that was the first, I mean, call it resource I had. Yeah. It was the computer itself. Yeah. Um, but that's kind of limited unless you have, like, a lot of information. Um, but she let me get the internet. I was like, can I get the internet? And I'm like, and she's like, okay. Um, and I got the internet. And that was, that was pretty incredible. And it was actually, it was actually the first day that I got the internet that I really got into. I wanted to be a hacker. Um, I was, I went to, I found websites about, like, the X-Files. I was just, I really like the X-Files. And I found websites and I found WAV files you could download. Just, like, playing the clips. Um, but then I wanted to travel people. Yeah, yeah. I was just like, clips on Yahoo. I was like, I don't know why, but. So many money Python clips and everything.

Dave Jones: Right? Yeah.

OpenGL: Uh, and I went into a message board and I just have to click refresh waiting for someone to respond. Like, there's gotta be a faster way to chat with people. And I finally found chat room, um, on IRC. I downloaded MIRC. I went onto a network. It's my first day on the internet. And I'm like, hey, he wants to chat. Um, about the X-Files. And someone's like, get out. I was like, no. And he's like, get out. You have 10 seconds. I was like, okay, whatever. Uh-huh. I'm not going to. Just, like, sat around. I was like, anyone else want to chat about the X-Files? And 10 seconds later, I got a blue screen of death. My computer crashed. Uh. Like, the computer my mom had just bought. And spent all of her money on. And I, like, I freaked out. Right, right. Yeah. And I, like, pulled the power from the computer. And then I just waited. Because I figured if you wait longer, like, maybe the bad things will come out of the computer. I'm not sure. Because I had no idea what happened. I plugged it back in. 30 minutes later, turned it on. Everything was okay. But at that moment, I was like, I want to do that.

Chris Gammell: I see. So, like, a lot of these formative triggers of having control over the machine. That kind of thing.

OpenGL: Yeah. I was just blown away that this person could do that to me. They don't know anything about me. They didn't, like. I'm kind of blown away. What the hell was it? So, I later learned, you know, after, like, searching and trying to find hackers. And I found that was called WinNuke. WinNuke 95. So, it was a denial of service. It was an out-of-band NetBIOS packet, I believe. Yeah. A single packet could cause that. Could cause a blue screen of death.

Chris Gammell: Oh, man. I remember. Yeah. I remember those days, too. There was, like, those panels you could get where it had, like, these different scripts that were running, basically. I didn't have to know anything about them. But I remember I got them. Yeah.

OpenGL: Yeah. Yeah. So, I downloaded that. I was like, oh, my God. You know, it took me a while to find it and learn about it. And then I was like, awesome. And then Microsoft released a patch. They released, like, Windows 95, you know, Service Pack 2. And that fixed it. And I was like, well, whoever, someone made this. Like, maybe there's another thing you can do. Right. And that, I started learning about, like, the basics of programming at that point.

Dave Jones: Hmm.

Chris Gammell: So, well, another famous thing for you that people will obviously read about is the MySpace thing. Yeah. Some of it. I think, I was thinking back. I think I, you may have been my hero as well. But you want to explain that as well?

OpenGL: Sure. So, I'd say that's probably what I get a lot of, a lot of people know about that. And when I was 19, so this was 2005, I was messing around on, at the time, this was the number one site on the internet. It was MySpace.com. It still is, right? I think so. Yeah. Yeah. Yeah. It's still my homepage.

Dave Jones: Thanks, Rupert Murdoch. Rupert Murdoch. What a great purchase. Oh, jeez. Poor guy.

OpenGL: And I was just, I mean, I was just, I was 19 years old. I was messing around. All my friends had MySpace. I was just messing around. What can I do on here? And I found it, like, really, really limiting. Like, I could, you could upload 12 photos, but that was it. Like, be limited to 12 photos. I thought it would be really cool if I could upload a 13th. And I figured out a way to do that. And ultimately, I think I was just messing around. And, yeah, I wanted to, like, change some text on my profile that they wouldn't let you to change. And I was like, the only way I could change this is relationship status. And I wanted, it said in a relationship. I wanted to say in a hot relationship. The only way to do that, because it's a dropdown of selectors that are ID-based, was to change text on the page. And I was like, I could do that with JavaScript. So then, you know, they prevented JavaScript execution, but I found a way to execute JavaScript. And I was like, oh, cool. Not only can I change the page, I can make the person do things. I can make them, I don't know, add a comment or add me as a friend. It was like, so I made them, whenever someone visited my profile, they would add me as a friend and then add the text, but Sammy is my hero to their profile. It's like, that's kind of funny. But it wasn't, like, really traveling. It wasn't hitting anyone. So it was like, how do I make it spread faster? Well, if someone can add me as a friend and add me as a hero, I could have it copy the code to their profile. So if someone visited their profile, they would add me as a friend and add me as a hero.

Chris Gammell: Right. And then that kind of spread because of the viral nature of each person having it, each of them having all the friends.

OpenGL: Exactly. So I figured in a month I'll get, like, 100 friends. And I, like, released it one night. And the next morning I had 10,000 new friends. And throughout the day that increased to about a million. And then MySpace crashed. And that, yeah, six months later I got raided by the Secret Service. Right. And that's the scene, like, in Hackers where, uh.

Chris Gammell: Exactly. Tommy? Is that his name? It was Crash Override. No, it wasn't Crash Override. It was the kid. Oh, yeah. I think you're right. The kid that, like, chain smokes, you know? Yeah, he's in the shower or something. Yeah, yeah, yeah. Yeah, he's wearing, like, headphones with, like, plastic screws. That's what it is.

OpenGL: Such a good movie. It really wasn't. Oh, man. It's one of my favorites. Yeah. That was the only accurate scene in the movie. Yeah. Well, it wasn't getting raided by, like, a dozen people.

Chris Gammell: So you mean you didn't throw a disc in the trash and hack the planet, hack the planet? Hack the planet, yeah.

Dave Jones: They're trashing our rights. They're trashing our rights.

Chris Gammell: Yeah, I was talking, are you going to Hope? I'm not. I'm not. Yeah, I was talking to some of the Hackaday folks that are going out to Hope. Awesome. I didn't realize that the 2600 folks had kind of, so that's, like, the magazine, they were consultants on that movie. I didn't realize. Oh, really? Yeah. Oh, I didn't know that. Yeah. That's pretty cool. Yeah. So that's, like, a pretty classic magazine, but I never really. Yeah.

OpenGL: You know, that's another thing that I guess I picked up when I was a kid, 2600, right? I go to the book. It's amazing that you can get them at bookstores. I was, like, really pleased that you could find a hacker, like, magazine in a bookstore. Probably a computer peripheral magazine of digital publishing. Yeah.

Dave Jones: Yeah.

Chris Gammell: Exactly. Yeah. Hmm. That's good.

OpenGL: So, well, then was there a fallout from that then? So, yeah. Actually, you know, it was really interesting. MySpace didn't come after me. It was the government. It was the Los Angeles District Attorney. And I kind of fought with them for six months. And ultimately, I agreed to a plea agreement where I couldn't touch a computer for three years. Three years. Three years. I was working on a company at that time. And I just want to, like, focus on that. Man, spending six months not knowing what my fate was going to be, it was like, it's much easier. I really just wanted to know my fate more than anything. Yeah. It was really interesting. That whole experience was really interesting in that it was not knowing what would happen next was the worst feeling in the world. Right. It was like, can I just... Like lack of control. Yeah. And I was like, I'd rather know I'm going to prison than just not know. Yeah. Yeah. Right. And just, like, pushing it out. And it kept getting pushed out. And I was just like, I need something that seems somewhat reasonable. And I was like, I'll take that. That's good. And yeah, for three years, I didn't touch the computer. And I just kind of, I worked. And... Yeah, I really did. Really? Really? Yeah, yeah. Really? Totally.

Dave Jones: To snatch you up? I don't know.

OpenGL: Irrelevant. I mean, I just didn't, I didn't touch one. Yeah. It just wasn't worth the risk to me. Well, I get that. I'm just saying that, like, damn, like... But I just, you know, I thought it was, I thought it was interesting. You know, for me, who had, I'd always been behind a computer. You know, yeah, when I was like 16, I moved out. And I started doing programming for a company. And I moved to San Diego. Like, I was on the computer all the time.

Chris Gammell: Yeah.

OpenGL: And I just thought it was like, you know, it was really interesting for me. It was, it got me to do other things with my time. Yeah, of course. Of course. It's not like I sat at home depressed, like, wishing I had a computer. I just went and doing things. Well, I mean, like, but like these days, well, I guess what, so this 05 to 08. Yeah. Yeah. So the judgment probably happened in like 2006. It was like iPhone came out around the time, I think I got back, since 2007 or 2008. Yeah. But I would say, yeah, I mean, the hardest, the only, I'd say the hardest part was just not having Google Maps.

Chris Gammell: Yeah.

OpenGL: It's like having to use actual map.

Chris Gammell: Well.

OpenGL: On paper. That was rough.

Chris Gammell: That happened before too, but yeah. Yeah. And it wasn't as good then either.

OpenGL: It was a couple of years back. Yeah, but it was short, but it was still something.

Chris Gammell: True. Yeah. And Google Maps was actually pretty new. I would say just Google in general. I mean, like, that's, that's the other thing is just so much of our, our, you know, these days, especially you can pull a phone out and be like, oh, well, you know, what is, what did Sammy work on? You know, like, and then look at, like on the ride over here, I was watching, I was looking at some of the articles about you and stuff like that. Like, I just, you know, that, that kind of thing wouldn't have been possible. Yeah. So. Hmm. Well, that's interesting. Uh, so. Well, let's see, where are we at then? That's 2009.

Dave Jones: Yeah. Yeah. Around there.

Chris Gammell: And then you're back into security.

OpenGL: So, so I come, uh, yeah, I guess I'm a lot such computer again. Um, I go and buy like a Mac, not a Mac book, I guess power book. I think it was.

Chris Gammell: Yeah.

OpenGL: Um, and like, yeah, you know, I had some ideas of, of exploits. I wanted to test when I got back and I got a little bit more back into it and yeah, it sort of got back into, um, security and writing, um, security software and hacking software and demonstrating, uh, proof of concepts. Um, and then a few years later I got, uh, started getting into hardware. Yeah. Um, I had always been afraid of hardware. Like. Yeah. So let's talk about that.

Chris Gammell: I mean, so, so what got you started in the first place? I mean, so you were doing, you were doing security stuff and I think that that's interesting because that, that is a trend that I keep seeing over. I mean, obviously a lot of our guests as well, but, um, that there's money there, you know, like Dimitri was on recently. We were talking about him before. Mike Austin has been on a bunch. Um, but why, why is there any hardware insecurity in the first place? You know what I mean? Like that's, that's what always kind of gets to me is like, there's so many, like the software level is so crucial. Why do you see is hardware coming, coming into this in the first place? Well, why do I see hardware coming into the security realm or. Yeah.

OpenGL: I mean like, it seems like, well, why is it becoming more and more prevalent? I guess that's the real question. Um, you know, for me, yeah, I can say just personally, it was, I wanted to do hardware stuff. It was like there, it seems like I could do some interesting things with hardware. I just didn't understand it at all. And I was really afraid of it. I was afraid like that it would be very difficult for me to learn. Um, it still is. Every time I try something new, it takes me a lot longer than, you know, I hope it would. Um, but I think at some point I realized, I guess I tried something and learned that you really think thanks to Arduino being so accessible, I was able to do something. And I was like, wow, this is, at least this little thing I did was a lot easier than I thought it would be. It wasn't, you know, years of training to granted, you know, make, make some lights blank. Um, but I think that was, that scared me off for a while. And then the, the fact that hardware controls everything, you know, I know that I'm, I'm, I often think of ideas limited to what I know. And the more I learn about something, um, it allows me to expand and use that to build better and cooler and more interesting things to me. Um, so hardware has always been really attractive to me just because I feel like I could build really cool, interesting tools that otherwise don't exist.

Chris Gammell: I see. I see. Yeah. So like basically building out like a workshop based on the things that you need, kind of that longing for that thing you didn't have yet. Right. Yeah.

OpenGL: Yeah. And I also think, uh, I want to get outside of the computer, right? I've always been building software and it's always on a computer. It means, um, it means I'm behind my desk and, uh, I think it'd be cool to be exploiting hardware out in the real world. I think when I started messing with like a RFID, uh, I was doing some RFID stuff. It's like, man, there's RFID out in the world. I don't want to have to sit here with my laptop all the time. Right. That was another thing. So portability. I think I really, I really like, I'm, you know, almost all my tools are fully portable. Uh, like, uh, if it's, if it's not a computer software, then it's probably a portable battery powered device that you can use anywhere and like stick in your pocket or backpack. Mm-hmm.

Chris Gammell: Well, okay. So just to step back to the software piece for a second though. Um, so, so you were allowed to start using computers again and you're doing, um, you're doing some software security type stuff. What did that look like for you? Like what kind of applications was it? Was it like penetration testing or was it other things around that?

OpenGL: So I pretty much, I just do, um, all of my research is kind of on my own and, and then I would just release as open source and free. So, um, I mean, one of the projects that I had a lot of fun doing was called ever cookie. Um, it was, uh, essentially a, you know, this was, I don't know, 2011. Um, I'd kept hearing about flat people worrying, worried about flash cookies because if you delete your normal cookies in a browser, flash cookies can still track you. And I was like, that's, and people started developing tools to leave flash cookies. And I thought, well, there are probably other mechanisms in the browser that you can store data. I found, I don't know, maybe done the other dozen locations you could stuff data into. Um, so I created the ever cookie, which just demonstrated that. And it was, uh, you could go to my website, which was, uh, just special website that I had set up and it would store an ever cookie in your computer. And if you deleted 11 of those 12 cookies, they would all proliferate and respawn. And essentially you could, it was literally impossible to delete it on some operating systems because some of the mechanisms, there was no method to delete without resetting. Like on iPhone Safari, you couldn't get rid of it. Literally. You could not. You had to reset entirely your iPhone just to get rid of this cookie that tracked you. Wow. Um, and it's just interesting because companies started using, companies started using like technologies like this.

Chris Gammell: And this was kind of saying, right. So it kind of shines the light on and says, Hey, this is a real thing. Yeah. If you think this is important, someone should go fix this. But yeah, absolutely.

OpenGL: And, and fortunately I think within maybe within a few months, um, a bunch of browsers started putting all of the privacy settings in one area. And before that it, it was definitely, it was all split up. You'd have to delete your history in one place, your cookies in another place. Um, your cache somewhere else. Like they were all totally separate, but really they're all data that's stored on your locally, you know, that can be used to track you. That should all be in one place. So you can manage it if you want for people who care.

Chris Gammell: Right. Right. For when you're, uh, what does Chrome say? When you're shopping for Christmas presents, you don't want, you don't want, you don't want, you don't want someone to, uh, see what you were shopping for. Yeah. It's Christmas all year for some people. For some people they're going to many explicitly Christmas sites. Very Christmas. Yeah. Good for them. Uh, uh, yeah, no, that's interesting. So, okay. So, but maybe that kind of gets to the, the thing that I'm curious about, like, sounds a bit brusque, but what's the profit motive there? I mean, like, Oh, I mean, like, yeah.

OpenGL: So, but this is just like, really, this is, this stuff is fascinating to me. But is this in addition to like, like work as well? Okay. So like, what, what am I doing to make money? Uh, okay. Um, so I started a voice over IP company when I was 19, uh, a couple of guys, um, called Finality and we're doing a voice over IP phone system. Okay. Which is really, really cool is we did it based off, uh, it still exists today. We have tens of thousands of company, uh, companies who use it as a business phone system. Uh, um, I no longer work there. Uh, I left, uh, I don't know, six years left after create, after, you know, creating with my friends. And, um, we took open source software, uh, voice over IP software, asterisk. I know that one. Yeah. I was trying to, I was going to do that for the amp hour servers. Oh, awesome. And it was way too complicated. So we made it not complicated. We put, you know, we made, we built like a awesome web-based UI and a desktop software for communication and just added a bunch of autumn, you know, automatic, like, right. Right. You made it friendlier and you made it friendly. So you wouldn't even ever like know that there's some unit, you know, links in the back.

Dave Jones: Gotcha.

OpenGL: Um, so just enable businesses to at a low cost to like use this. So, uh, because of that company, I had a little, I had some savings that I could kind of mess around for a little bit.

Chris Gammell: Um, so it was like almost like fun employment, but then that also led into your security stuff, which then leads in like, excuse me. It's like, it seems like the people that I know that do that kind of thing, it's like at first it's a fun thing. And then it's like, people are like, Oh, well, Hey, you're doing this thing. Can you consult for me for this? You can tell me. And then it kind of naturally rolls into the next thing because you're already interested in doing stuff like that.

OpenGL: Yeah. So for the most part, I'd say it's like, you know, I'm developed, I developed something, you know, I, I spend time in an area that I think is really fun. Um, I developed something I'll release. Okay. I'll, I'll develop. I try to make things and I'd say like one out of a hundred succeed and then I release it.

Chris Gammell: Yeah.

OpenGL: Um, and then if I'm fortunate, uh, you know, I'm fortunate enough that people will be like, Hey, can we purchase a license where you kind of modify it for our company? As long as that I think they're doing good things and they're not like a malicious player in any way. Um, then, and it seems like an interesting project. I'll work with them.

Chris Gammell: That's good. That's good. Okay. And so that same kind of thing started happening. So then, so let's get back to that switch over from, I mean, it's not really a switch over. It's almost like a melding into, right? Because it's, you're never doing just hardware. You're doing hardware, software, firmware, right? Everything basically, it kind of becomes this productization of, of interesting ideas. Yeah. So, um, what were some of the early ventures into that?

OpenGL: Um, sure. I'll, I'll tell you the first, the first one I had, which was, which was my, like dipping my feet into hardware. And it was, um, it's these, uh, you, you listeners can't see, but it's these, these, these lights up here. Yeah. Right. So they're like, they're kind of cycling through. Yeah. It's like a rainbow cycle, you know, rainbow cycle. Um, it's like 50 LEDs. And at this time, or at the time that I bought them, there were no WS2812 or like, uh, you know, simply easily controlled LEDs. Um, and also LEDs were really expensive, right? Um, RGB LEDs were really expensive, especially addressing them. Um, and I had found these like Christmas lights that were, that were, it was after Christmas and these Christmas lights that had, that looked like they did a bunch of RGB stuff. Um, but they only had like three modes and they were in a bin in like an after Christmas bin. So they're really cheap and I bought them and there was a box and you could control it with a remote and change the color, change the color scheme to different, like red and green and like some other. So like full, the full string was all red or all green or blinking.

OpenGL: And blinking between stuff. And I was like, Oh, clearly each one can do something independent. Um, and that was, so then I was like, can't I like make a computer talk to that thing? Um, and that's when I learned about a logic, logic analyzer. Um, and these are some proprietary LEDs, LEDs from some company. So I learned about a logic analyzer. Uh, I borrowed that from a friend and then cut it and figured out the data stream and then learned that I could use an Arduino to, to communicate this, make that communication. Um, and then drove a proprietary led string and, uh, still up today. So I think that was my, that was like, Oh, I can like, I can look at data that someone else didn't really want you to do or look at some sort of, some data that people are trying to prevent you to otherwise doing. Right. There was no other way to communicate with it. Right. There's no documentation on it. There's no documentation. They're not, you know, yeah, just proprietary. Um, so I think that was like, Oh wow.

Chris Gammell: Like another enabling piece where it's, uh, it's, uh, you're realizing that you could change the world, but now it's not software. Now it's in the real world kind of thing. Yeah. Yeah. And I think that's probably a very common, uh, common emotion for people that are listening to of like, at least for me personally, when I was like first got my first PCB back, it was just like, Oh shit, I made this thing, you know, like this thing, especially, well, not even just the PCB, but also the, the stuff when I actually, you know, just making the light blink, you know, like that still, still has that magic to it because. Totally. You're changing your environment. Yeah. And, um, and it's a little bit more, I mean, not that there's not interesting things at the computer, but there's more humans are made for the physical.

OpenGL: Yeah. Yeah, definitely. I really feel that. And that, that's why I really wanted to get out of just the computer. Um, there's more, more physical stuff you can do. You can like interact with other people in a different way other than that screen. Yeah. Yeah. That's good. That's good.

Chris Gammell: So, okay. So what from there then? So start with LEDs. Yeah. Start with LEDs. But you started obviously pulling this into the security side of things too. So.

OpenGL: Yeah. Um, I guess I, I think maybe the next big project was, um, I remember Amazon coming out and saying that they were going to use drones.

Chris Gammell: Oh yeah.

OpenGL: And I was like, uh, that's a really cool idea. And like, I love Amazon. I have Amazon everything.

Chris Gammell: Yeah. Um, actually some listeners to the show have, have since pinged me about if I, if I knew anyone that's looking, so maybe they'll, they're, they're looking to hire people. Nice. Nice. Maybe you too.

OpenGL: Have they contacted you about it? Yeah. Um, uh, I, I've been contacted a few times. Um, yeah, they're, they're doing, they're always doing awesome stuff. And, uh, I was, but they said they were going to use drones and I was like, man, I love drones. Like they seem really cool, but I don't think they should be flying down my street. All right. Yeah. So technically they'll probably be flying over your house. You know, they're going to be using the, you know, the traffic lanes. Sure. Right. Right. Yeah. Um, and I was like, I wonder if there's security in the drones that we have. So I went out and I bought a drone that day and I was like, well, is this secure? Yeah. Um, that was a pair of AR. That was a pair of AR and it wasn't. Yeah. So I was like, there's gotta be a way I control this over wifi. Um, yeah. So I had just gotten a Raspberry Pi and was looking for a project to do. Yeah. Um, so yeah, I used a Raspberry Pi and an alpha, a what, AWS card, um, to basically kick off the owner. So you can, uh, deauthenticate. Yeah. Deauthenticate. Yeah. Uh, deauthenticate them, connect as the owner. Um, and then I put it all on a Raspberry Pi, mounted it to my own drone and my drone would fly around seeking the wireless signal of any other pair of AR drone. Yeah. Yeah. Disconnect it, send the video back my way. And then their drone would follow my drone. So it would just create a swarm of zombie drones. Right.

Chris Gammell: Yeah. I remember when that came out, that was, that was very cool. Um, so, so the deauthentication for that kind of thing, right? So that, so that was all off the shelf or what? Yeah.

OpenGL: It was pretty off the shelf. It was like, you know, I used air crack, um, which had the deauthentication stuff. I don't know what that is. Sorry. Oh, air crack. Um, it's an open source, uh, software toolkit for, uh, wifi and 802.11 penetration testing, vulnerabilities, exploitation, cracking, et cetera. Uh-huh. Um, so it had a deauthentication attack built in. Um, and then I guess actually powering, I had to figure out, I learned a little bit about power because I couldn't power everything with the, the Raspberry Pi like doesn't give enough juice to the USB ports. Yeah. So I had two wifi controllers, one that I could connect to and then one that was taking over other drones. Um, and it was pulling too much power. This was the Raspberry Pi, the first one. Yeah. Right. Yeah.

Chris Gammell: Cause those things are not really built. They, they always need like 900 milliamp like supplies too. They couldn't do it just off a straight 500 milliamp. Yeah.

OpenGL: USB. So I had to, so I, I just had a learning how to like power these USB devices separately, but then keeping everything really low weight so that they would fly on the drone because the drone couldn't carry much of a payload.

Chris Gammell: Yeah.

OpenGL: Um, so just a little, you know, learning very small amounts of little more electronics there. Um, and yeah, trying to combine that stuff. Um, and then I got, yeah, then I just started messing around more with Raspberry Pi. Um, uh, started getting into RF.

Chris Gammell: Yeah. So you've been doing more RF stuff too. I've seen. Um, so before we move on to the next one though, because as people can go and view and help link as well, that like you've got tons of projects on there, but it, it's going to sound silly again. It's like, you're not scared about any of these things. Like, I mean, like so many of these things, it's like, it's just like, it seems like you pick this stuff up and you just jump right into it. Now, I know that there's also that, you know, you kind of condense it down because you, we see the video at the end. We don't necessarily see the struggle. Yeah. But lots of struggle. There is struggle. Oh man. I struggle all the time. But like, so what, what are you using then? What are your resources then? Because it seems like you're kind of like, like you said, I mean, you're, you're even the power stuff. You're just kind of getting through it. Is it all, do you have special search methods or using IRC channels? What do you, what are your resources?

OpenGL: I mean, I'm really good at learning that when magic smokes comes out, you don't do that again. Actually, I'm not that good at learning that. Yeah. So I, I resources, you know, I would say, man, Google is your friend, right? That's my number. That's my go-to. And a lot of it's testing that I would say, I would say if there's anything that I'm, I've learned to fail, like I've learned just to fail and fail and fail. And that's, you know, I'd also say that I have so many, so many, so many unfinished projects and it sucks and I feel like unhappy about them a lot. And I feel like some of it's just, yeah, I just, I hit a wall and it's really hard to get past. And I'd say the one thing that, another thing that I think is really helpful to me is that when I hit a wall, I do research and I try to like figure it out. And if I don't, if I'm just depressed that I can't like figure it out, I move on to another project. And then I learned a bunch of things in that project and then I hit a wall and move on to another project. And like after a couple of projects in, I'm like, oh, whoa, I think I have learned enough to actually solve a problem. Just randomly, I had learned enough about one area that actually will help me solve a problem in the initial project that I started. Yeah. And I can, yeah, and I can just jump back to that and I can get a step further. So I'd say it's, it's the fact that I, I don't complete so many things because I hit so many walls, but in all of that learning process and that research, I learned these little things that are really useful for other things that, and I never finished that project that I learned something.

OpenGL: Okay. So are you, are you documenting this stuff for yourself or is it more just in your head or what? It's mostly in my head. I mean, if I'm writing code or building something, I'm physically building something and I have a bunch of like, you know, project boxes of unfinished project boxes. But for the most, yeah. And then if I feel like there's some commands or software, if I'm writing software, I'm writing software. Right.

Chris Gammell: Sure.

OpenGL: Yeah.

Chris Gammell: Stuff like that. Right. Yeah. Interesting. So, yeah. Cause I wonder about that. Maybe, maybe, maybe Sammy's secret here is start so many projects that you can't possibly miss the thing that you were stuck on. Right. Cause eventually. Yeah. I mean, there, there are themes, right? I mean, everything has like every, if you're stuck on the power piece and you move on to the next thing, you're going to maybe trigger a lot about it kind of thing.

OpenGL: Yeah. So, you know, I love Hackaday. I learned a ton from Hackaday. And that was definitely, I think maybe an inspiration was going to Hackaday. This was a couple of years ago. I was reading, I started reading Hackaday projects. Like, these are so cool. Like, I wish, I wish I could have something on here. Um, and just reading those projects, I learned, you know, I didn't understand most of it. I still don't understand a lot of it because everything, for one thing in electronics, the thing that like I was just so annoyed at is that everything is just a number. It's just like, oh, 8051. LM, like whatever, you know, 8705. 2N2222, right.

Dave Jones: I'm like, what kind of names are these people? Um, and now it's- Did anyone think to call this Linear Regulator 1? Yeah. Right? Linear Regulator 5 Bolts. Yeah. Oh, are you using a lot of TI, you a-holes? Are you using a 7812 on that?

OpenGL: Like, why can't you just call it, give it a name that means something? Um, it's like, from now on, I'm just going to call my electronics projects like 8. 8. Right? 9,543.

Dave Jones: Welcome to my Defton Talk. 8. 8. Yeah.

OpenGL: Uh, 801. 802. Yeah. Uh, we'll skip 803 for no reason.

Chris Gammell: Yeah, right, right. Um, I don't know. Well, if you're like me, I actually, I've skipped just a couple shows. I just name them wrong, and they just- Nice. They've disappeared in the ether, so. Yeah. It's funny when people go look. I forget what we're talking about, but- Mm, something about electronics. Something about electronics, I guess. No, no, it's- I mean, like, so yeah, you were saying, though, like, the- That you've started a lot of projects, they trigger each other. Yeah. I mean, how many- How many are- How many dormant projects do you have right now?

OpenGL: I mean, so- So I keep, like, a- I mean, since I started projects, there's going to be hundreds. Right. I probably have 20 or 30, I would say, solid, like, ideas that I think would be really, really cool that I've put some significant amount of effort into that are incomplete, and I only have, like, two on the horizon that I think- Actually, I'm working on two pretty actively. Uh-huh. One will be, I hope, to release pretty soon, and one that's, like, much harder, and one of those things that I keep having to switch because it's-

Chris Gammell: Yeah, that's challenging. No, but that's interesting because I think about- Again, I only have my own experience here, but I think that when I get frustrated like that, I'll put it down, and I'll walk away, and I'll come back, but I'll get stubborn about it, and I'll be, like, on that same one.

OpenGL: Mm-hmm.

Chris Gammell: You know, and it's kind of just kind of keep running your head into the wall and that kind of thing. And so where are you sourcing these ideas from? I mean, like, so to have 30, you know, somewhat active projects, that's a lot of ideas. So where are you sourcing these ideas for new projects from?

OpenGL: I mean, you know, every project I have always starts very small, very simple. Like, I have a simple idea for something that I think I maybe can exploit, or maybe something I think it's not exploitable at all, and it's just, like, it's just a cool thing. Mm-hmm. And I've learned that I kind of- sometimes I want to release something, and I find the elements that I like for me is, like, A, to release this, I have to, A, have learned something new.

Dave Jones: Mm-hmm.

OpenGL: B, it should, like, demonstrate something that's just fun. And to me, I think a lot of exploitable things are fun, so that typically checks the box for me. Right. I'd say those are, like, yeah, it has to, like, be fun for me, and I have to learn something.

Dave Jones: Okay.

OpenGL: So I think- but typically when I start something, it's not like that. It's like, I have an idea, and maybe I can do this. So I have a new project coming out, and I was on a plane, and this is actually- this is- I don't know why this is really interesting to me. Like, more and more I'm thinking, I really want to be more creative, I want to have better ideas, and one of those things that you keep hearing about, or at least I keep hearing about is, you need to get a lot of sleep. And- Oh, interesting, yeah. Um, I sleep a lot, but I was traveling for something. Wait, define a lot. Like, nine hours, ten hours. It's healthy, yeah. I mean, well, maybe not healthy, but it's a lot, yeah. It's a lot, yeah. And I don't like sleep. Like, it's just that I'm groggy. I mean, if I wake up at eight, I'm just not going to get up. I'm just going to go back to- I'm just going to nap there.

Dave Jones: Mm-hmm. Yeah.

OpenGL: To sit and stare at the ceiling. Um, which, I wish I didn't. I wish I- I wish I could just get five hours and, like, be up. Oh, yeah.

Chris Gammell: Yeah, you read these stories about, like, Edison and stuff like that, like, or Tesla or whatever,

Dave Jones: and it's just like, oh, yeah, they slept, like, two hours a day. It's like- Yeah. Like, what are you- Screw you guys, you know?

OpenGL: I wish I- I wish I could do that. Yeah. Um, and maybe I can, but I'm not going to do it happily. Coffee. Yeah, right? Uh, so, I've been trying to get a lot, you know, good sleep, and I was on a plane, and I was, like, really, really tired, and, uh, this idea for a project came into my head. I was like, wait a second, like, I think this is a good idea, and I think I found a way to, you know, at that moment, I believe I found a way to exploit a locked computer, a computer that has a password- that's password protected. Mm-hmm. I think I can exploit it via USB somehow, and I went- after I got home, I was traveling, so I was like, I had to wait until I got home. I got home, and I tested it, and it worked, and I was like, oh, that's really cool. I'm gonna- I should do a project around this. Mm-hmm. So, it's this one thing that by itself is- is neat, but it's not really enough to, like, release, or interesting enough to release, I think. Um, so, now I've been building something using a Raspberry Pi Zero with it, um, and trying to combine it into, essentially, a tool that you use to attack locked computers. Um, because I've built something, or, like, I used a Teensy last year. I asked a year ago to- and created a- uh, actually, a combination of things that you plug the Teensy into a computer, it takes over, um- Is that the thing you were around your neck? Yeah, yeah, right. You- it presents- it emulates an HID keyboard, so you plug it into a computer, it starts typing, um, and it basically opens the terminal. It's cross-platform, so it works on Windows and OSX now, um, and Linux. Uh, it actually evades your firewall if you have one. It can replace sudo. It'll take your root password, um, if you're on OSX, it'll-

Chris Gammell: Yeah, okay, wait, hold on. Back, back, back, back, back. Yeah, yeah. So I read about it, I didn't actually see this, but- Okay. Uh, so I knew about the HID keyboard. Uh-huh. That's just a built-in thing on the Teensy, right? Sure. Just automatically- Super easy. Yeah. Yeah, it's great. It's a great plugin that Paul- Paul wrote or something- Yeah. I'm guessing Paul wrote it. Paul, yeah. Um, but then what is it that this one does? The, the, evade the firewall, that kind of stuff?

OpenGL: Oh, so that's part of that. That was part of that project. So essentially what it does is, so if you're on OSX and you have a little snitch, it'll say, hey, do you want to allow this connection out to this server? So I also install, I install a backdoor in Crontap. It's a reverse shell, so it makes an outbound connection to my server. So when you plug this in, when you plug in the Teensy, first it types on a, let's say OSX. It'll type command space, which opens Spotlight or Alfred or Quicksilver. Then you, it types terminal. Enter. So it opens a terminal.

Chris Gammell: Oh, so it's all the shortcuts that get you to get to a terminal. Exactly. Right. So in Windows, it's Windows R. Yeah, it's like, yeah, exactly. Yeah. And then it runs command. Yeah, yeah.

OpenGL: Um, so it gets you to your terminal. And then I did find an exploit in OSX where I could, I could also open system preferences and open the network settings because you can't change DNS server from the command line without the password, without the root password. Right. Because it does like the password keeper thing, right? Yeah. Yeah. But for some reason, if you can use your mouse, there's a way to get around it. And in the OSX network preferences, which has elevated privilege already, you can change the DNS server. So I have it change the DNS server. But the problem is you can't hit enter. You can't hit like tab in that window. Yeah. They require you to use the mouse. So then I actually use the terminal to move where the system preferences is. And then I move the mouse to the top of the screen. So you're like zero, zero. Yeah. Yeah. Exactly. Zero, zero. Yeah. And I move it back. And you can see this in a YouTube video I have of USB. It's called USB drive-by.

Chris Gammell: Okay. Yeah.

OpenGL: So basically, then I can change your DNS server. And it changes it to my DNS server in the cloud. And I also release the software so you can run on your own. But now you can spoof any host. So you can say, you know, Google.com will actually go to your website. Or BankofAmerica.com will go to your IP. Right. It just happens to still look like BankofAmericas.com. Yeah. Yeah.

Chris Gammell: And you already know my dog's name and my mother's maiden from the Facebook app.

OpenGL: Yeah. So it just does all of that stuff for you in a couple of seconds. Because it's typing. And then it closes all of the windows. And then you pull the thing out. And you walk away. And oh, and if you have Little Snitch running, which is a firewall for OSX, Little Snitch pops up a really helpful thing that says, hey, this thing is trying to make an outbound connection. Do you want to allow it? Well, my thing uses the keyboard and says yes. It says yes. Allow this connection forever and never ask again. So now it's allowed a back door that runs every five minutes in crontab that makes the connection out to me. So you don't have to have any ports open on your network.

Chris Gammell: That's still there. I cannot believe I came over to your house with my computer. I think it's been in my possession the whole time. You're good. You're good. Luckily, I have nothing. Luckily, I have been shopping for Christmas presents nonstop. Awesome. Yes. Haven't we all? Yeah. Yeah.

OpenGL: So, but yeah, I guess a lot of my projects, you know, that project didn't start like that. It started like, oh, this is really cool. I can type as a keyboard. Yeah. With using the teensy. I see. What else can I do?

Chris Gammell: Right. And so you see that you have these characteristics of like, oh, well, if I had this, then I could do that. But then there's this next roadblock on my way. Yeah. That kind of thing, huh?

OpenGL: Yeah. And like I had the little snatch. I was like, oh, that prevents my back door from working. Yeah. And yeah, just step by step. And then over time, and finally when I'm at a point that I'm just like, I'm tired of working on it. And I feel like it's good. You know, it's interesting enough to me. And then I'll release it.

Chris Gammell: Yeah. It's almost that there's like, so like on the security side, there's almost power in the standardization, right? So like for a long time, it seemed like that was just having Windows in general. Like everybody's on Windows. There's the same platform. It's easy to attack because there's only so many ways you can do things. And I mean, even still with Mac and Linux as well, like there's better security in general, I think. But there's still only so many ways you can do certain things. So. Right. So then how does that play in the real world then? I mean, like, so is it kind of a mass market thing that allows you security vulnerabilities? So like the car thing you did. Okay. Is that kind of, I was reading about it and you can explain what it is, but it seemed like it worked across a lot of car models.

OpenGL: Yeah.

Chris Gammell: Is that because they all use the same chipset? Is like, is there, is there power in the fact that there is the same chipset being used a lot of places?

OpenGL: Um, uh, man, yes and no. Uh, you know, there's one chipset that I found that, uh, so like one of the car things I worked on that I think you're talking about is Roll Jam. Yeah. Yeah. Yeah. So this is a tool that allows, uh, you basically put it on a car. It uses a TNC and two, um, TI CC 1101, um, sub gigahertz RF. It was like 900 megahertz stuff. Um, it's, it's down from like two 50 to like nine, nine 30 or so. Oh. So it's actually a full, like almost full sub gigahertz range. Um, and actually some people like Michael Ossman and Travis Goodspeed and, um, some people found that you can actually extend the range. Like there were, there were different kind of ISM bands that you can access in it. Um, and they found that you can actually go further outside of those bands.

Chris Gammell: Oh, wow.

OpenGL: Um, and actually it was Michael Ossman's, uh, he, he made a spectrum analyzer. Using a toy, using a girl's toy that got me into it.

Chris Gammell: Yeah. The I am me. The I am me. Yeah. I remember seeing that. I remember the first time I met Travis, he had one. Oh, awesome. And then, uh, Mike showed me a two and that's got, that's got a nine, it's got like a 900 megahertz standard band chip. Right.

OpenGL: But so it's the same chip. Yeah. Oh, it is the same. It's the same chip. Um, but that one's tuned for 900 because I think that's what they used. Yeah. Right. So yeah. Cause there's like a spec, there's like open spectrum in there that you can play around with. Right. Yeah. Um, so, you know, those guys really got me into it. Uh, I think when I saw Mike's spectrum analyzer and I was like, this is so cool and started learning about that. Um, and then I ended up using the I am me as a, as a platform for a garage hacking tool that I created called open sesame. Um, and it was actually based off your name, by the way, it was actually Michael Osman's name. Um, so he created something called open sesame and it was a, it was a great on off King, like, uh, ask, uh, demonstration to open his garage. I was like, Oh, this is so cool. So if you have a fixed code garage, you can use this. Um, and I started playing with my own and, uh, I found like, Oh, I don't know. I was like, what if I just brute force it? Cause it's only like 12 bits. Right. That's nothing. It's 4,000 combinations. Yeah. If you have enough time, I could do it in, I don't know, a couple hours or something. Yeah. Um, and I was messing around and I found that there's no preamble. There's no like additional data. It's just, what if I sent two, like, how can I, how fast can I brute force it? Can I send two of these strings of bits in a row without any weight before or, uh, in between? And that worked. And I was like, how does it know where one at where one starts and one ends? So then I prepended a couple of bits that were incorrect and then it's still open. It was like, it doesn't matter where in the stream of bits your password is. Oh, so it's just a state machine. Yeah. Yeah. So basically it's like feeding a shift register, I guess. Right. Yeah. And as long as, you know, it doesn't matter where you are. So at that point I was like, I can probably send a very short amount of bits and cover the entire range. Right. Um, exhausting the key space without actually sending every possible combination. Um, and I looked into this and I found there's a mathematician named De Bruyne and he created, uh, uh, I guess the De Bruyne sequence or algorithm. And basically it's a formula for producing every possible combination of, but overlapping, uh, like a string of bits. And I use that to essentially send the string of bits to cover every, you know, virtually every fixed code garage.

Chris Gammell: So it'd be like, if I could just step in there, sorry. If it was like you had the code was 011, but you were trying also 101. 1011. Right. And so, yeah, you would send one, zero, one, one, one.

OpenGL: Yeah. And that would, that would cover both of them. Right. Exactly. Exactly. Yeah. So one, zero, one, one would cover both one, zero, one and zero on one. Right. So instead of sending six bits, you only sent four. Right. And the more, the longer it is, the actually the, the better, uh, the smaller it becomes. The, the, Oh, Oh, really? So yeah. So that was like, uh, what is that? That was, you know, how many saved, how many savings that two out of six?

Chris Gammell: Yeah.

OpenGL: Um, so, okay. So one third, so 33% savings. So yeah, just, it kept becoming a bigger and bigger savings. Um, so it got down to under 10 seconds to open any fixed code rush.

Dave Jones: Wow.

OpenGL: Uh, so I implemented in the open, in the, in the, I am me and then call, and then I stole Mike's off, Mike Osmond's name. I was like, Hey man, you, you have a really good, great name. I hope I can use it. Too late. Um, but, uh, I mean, you kept this in your garage and, uh, well, I got it. So, and actually thanks to him. I mean, he now has this, uh, the yardstick one, which uses the same chipset. So it actually uses a slightly, basically the, it uses the same radio. Um, the, and he uses CC 1111. Uh, and that's an awesome tool that I use for actually a lot of my, you know, radio RF research.

Chris Gammell: Hmm. So are you building, I mean, are you building, uh, hardware with like RF stuff now? Like I started, yeah. I finally started doing some stuff. Did you watch that video that he did at the super con? Yeah. Yeah. It was great. Yeah. That was, I mean, I recorded it and edited that, but it was just like sitting there. It was like, Oh shit. It's like, this is totally doable. Yeah. And like, and that's honestly like, so like you and Mike and everybody in the security field, it just seems like for, for me, you know, I, I came from, I won't say academic, but like it felt like so much of this stuff was so out of the realm of possibility. And, and that's the, the really refreshing thing is just that all those security people are just like, no, just go do it. You know, like I got this problem. It's in front of me. I'm going to solve it. And did you just get through it? And that's, that's actually what I really like about this stuff. It's so, uh, what, what do you, what do you build? I mean, are you building, you're building like small boards to, um,

OpenGL: yeah, so, so I've built like a, I haven't released anything, but I built, um, a small board that, uh, it's basically a meant as an RF penetration testing platform, a portable RF penetration testing platform. And the idea is that you actually just use your mobile device, um, and use that to look at the spectrum around you. And so say you're out at, I don't know, I find myself at like restaurants where these, those pagers, um, to like let you know when you're, when your table's ready. Uh, I think it would be cool to be able to just pull out your phone in a small device, sniff that out, uh, automatically, you know, figure out the baud rate, automatically figure out, uh, any modulation, um, and anything, anything else, the frequency and just show the stream of bits and allow someone to flip them, you know, or brute force them and just do it on your phone, click a couple of buttons.

Chris Gammell: Yeah. Um, so I've been working on that, which is pretty fun. That's great. Yeah. No, I saw, um, I saw something kind of similar, but they were doing like the full system, the, um, you know, Edis, Edis research. Yeah. So those guys were doing it where they, they actually brought one of their, you know, it was like, they had like the USRP maybe. Yeah. It's like, it's not a full rack mount. It's like that they have, cause I think they're like in the crap. What's that? The pixie format, I think the like the NI pixie, you know, they're like little, like it's like a smaller kind of thing. I think they brought that with them, but they had a full laptop and then they were making their servers very upset with them.

OpenGL: Probably like probably balance severe. He does a ton of awesome USRP stuff. Yeah. Yeah. Um, yeah.

Chris Gammell: Well, that's cool. So, sorry. Are you finding that a lot of your stuff is shading towards RF now? I mean, so you've done the, you've done the RF projects, the roll jam, you've done this

OpenGL: open sesame, open sesame. Um, yeah. RF stuff. Uh, I have like a secretive RF project I've been working on, which is pretty fun. Um, I have this penetration testing platform I'm working on. Um, yeah, lately, lately just, you know, I did some RFID stuff. I developed a lot of stuff for the Proxmark, um, RFID penetration test testing toolkit. Proxmark. Um, but that was many years ago that I did, didn't wrote a lot of that code, uh, or the code for that. Um, but yeah, lately, you know, more and more stuff is RF. The IOT stuff is really interesting. You know, more and more stuff is IOT. How are you feeling about that? Uh, I'm excited. I can't wait for all these vulnerable products. Honey pots everywhere. Yeah. I love it. Um, so I think that that's, that's pretty cool. Yeah. People are just stuffing chips into, yeah. IOT is going to be a huge security mess. Um, and I'm super excited about that.

Dave Jones: Shit show, I believe is the term.

OpenGL: Yeah. Uh, you know, I, I think it's awesome. Like there are some really cool products that are coming out. A lot of them aren't. Yeah. Great. And people are just stuffing Bluetooth chip and whatever they want, uh, whatever they think needs it or doesn't need it. Um, but, but you know, some cool stuff will come out of it and, uh, the problem is upgrading, right? It's really hard to upgrade these. So if there's a vulnerability, it's going to, it's going to be tough.

Chris Gammell: Yeah.

OpenGL: Um, yeah. With like roll jam. So roll jam allows, you know, it's a small device. I can put it on a car and I can essentially steal codes to unlock their vehicle. Right.

Chris Gammell: Um, and so what, what's the basics of that? It's like, if I remember correctly, it's, I hit the little clicker for my car that sends a code, the code supposed to roll it over to the next code. Right. But what you do instead is you capture that code. It looks like it doesn't work or you jam it out so that it doesn't actually transmit. And then the next time you transmit the last code that was sent and then you capture

OpenGL: the next one. Yeah, exactly. So, so if you send, you know, the, the key is rolling. So every time you press the button, it rolls to the next code. So, and if you capture the code once, but the car heard it and locked unlocked, it's, it's never going to listen to that code again. Right. It knows that's, that, that was already used. Right. So yeah, I jam the signal essentially. Um, so whenever I see a code coming out, I'm jamming, but with the CC one, one, oh, one, I can listen to a really tight frequency and, and not see the jamming of my jammer. So I have some one chip jamming, another chip that's just listening for the code. And now it heard it clearly.

Chris Gammell: Yeah. Yeah.

OpenGL: So then it does it again. The user like goes up to their car and they hit unlock. It doesn't work. So what do you do? You hit unlock again.

Chris Gammell: Yeah, of course.

OpenGL: So now you've sent two rolling codes and I re, and then I stopped jamming, replayed the first one. Yeah. And now I have a future code. Yeah. It appears to be a code in the future that I can use at my leisure to then unlock their vehicle. Right.

Chris Gammell: So it only, uh, you're only able to use that code once they walk away. And yeah.

OpenGL: So the idea is, you know, it's $30 in hardware. You just leave it under, underneath their car. So you go to their car at any time. It always has the latest code. Right. Cause it only needs to, it only needs to intercept them once and then it can just roll, roll with them. Yep. Always sending the last one by taking, taking their new one.

Chris Gammell: Yeah. That's interesting.

OpenGL: And, uh, how did, how was that received? Um, I mean, it was, I think it was, it was a really cool demonstration, uh, just because virtually every car out there is vulnerable. Um, I've tested, I've never found a model that's not vulnerable to the stack.

Chris Gammell: Um, okay. So let's get into the, this is actually good. This is a good point because you also mentioned the IOT. And I think that again, people listening, uh, they maybe are shaking in their boots, but probably more interested. They're just more, more, more of them are just interested. So what would, how would you fix this? How would, how would that actually, what's a good way to fix that kind of thing?

OpenGL: Um, so there are a couple of ways you can do it. Um, one is with a challenge response. So kind of like, um, you could send a challenge to the key or the, yeah, you'd send a challenge to the key and then the key would have to respond. So let's say you want to unlock the vehicle. You hit the unlock button. It sends, it says to the car, Hey, I want to unlock you. So the car sends back, which would now this would increase the price of the, of both the key and the car, because now the key is not, is not just a transmitter. It also has to be a receiver. So now it's a transceiver. Um, another option is to actually have like a real time clock in there and instead do something timing based.

Chris Gammell: Like RSA token type of thing.

OpenGL: Yeah, exactly. So that you're only, so that the key that the rolling code that you send is also bound to a time. But then when you change out the battery, so when you change out the battery, your key thing is dead. Your key thing is dead. Uh, however, a lot of the, a lot of the vehicles do have something that can like resynchronize. So if you've ever like press the button on your key too, too many times, it'll actually stop working until you go into your car and like turn the key. Oh, okay. And it actually resyncs with the key. Um, usually there's like a, a trans transponder in there, an RFID, uh, transponder. Okay. So like close, close, close, close range. Yeah. Okay. Like an inch.

Chris Gammell: Yeah. That makes sense.

OpenGL: Um, so, you know, there are techniques that you can do and yeah, it will increase the price like a little bit. Um, but the newer, the newer keys actually have LF, uh, receivers in there because they, you can go up to your car. So if you have like a Prius, you can walk up to it and the light will turn on. It detects your key. So it's sending, uh, it's sending LF communication to your key and then your key response actually on, uh, UHF. Um, and there's a challenge response that's done there, but that's, that's what should happen. There should be a challenge and a response. So there's, sorry, can you explain what a challenge is? Sure. Sure. So, so the way it would work is you would have, uh, the challenge, you would send a token and it would be a totally random token. Let's say one, two, three. And let's say that, you know, the response, you know, you both, both parties know that the response will always be, you know, it's some algorithm, but you'll, let's just say plus three. So if the car says one, two, three, you know to respond one, two, six. Um, but if I record that, let's say I'm an attacker and I like jam and then I record that and it doesn't work. So then you hit it again and now the car will send five, five, five. And I don't know what to respond because if I, as an attacker, I would just replay one, two, six. Right. That's, that does, is not five, five, five plus three. Uh huh. So assuming I can't deduce the algorithm, which I shouldn't be able to do if it's using, let's say like a, a legit, a legit algorithm. Plus three, is it? Yeah.

Dave Jones: Plus three, is it?

OpenGL: Oh, they cracked a code again.

Dave Jones: Right.

OpenGL: Then, so that's how the challenge response would be. Every time you try to unlock, there were, a challenge would be sent and then you would have to respond to that challenge. And now it would only be good for a short period of time. Call it a second or even a minute. Right. Yeah. Probably a second. There's no reason that it should take more than a second for you to add three.

Chris Gammell: Uh huh. Um, and so why, why is rolling codes in there now? Is it just because that was. So rolling, rolling codes are in there to prevent actually a replay attack.

OpenGL: Right. So roll GM is essentially a more advanced replay attack. Um, that I guess people didn't plus one. Right. Didn't really consider. Yeah. So the, yeah, the replay attack is like what open sesame, the garage door opener thing does is I can, if I sniff your code out, I can replay it anytime. Right. What is the code?

Chris Gammell: Every code's one, two, three. It's always one, two, three.

OpenGL: Always one, two, three. If you, if you have one of those garage door openers with the dip switches inside, open it. That it's sending that code every time. Um, it never changes. So car manufacturers got smart to this and said, we can't have that in our cars or maybe they're getting broken into so easily. So then they created rolling codes so that it would change and the car would never accept a code that was used before. Um, so that fixed a lot of the, that fixed code problem. However, uh, you know, the roll GM was essentially a new technique that, um, I think people have talked about it. No one has ever really demonstrated it. So I want to see, is this possible? So how do you, how do you defeat a challenge? Um, uh, how to defeat, like if they implemented a proper challenge response system? Uh, I'm not sure. I mean, assuming they're, they're using, uh, good techniques. I mean, I would, I would probably try a brick through the window. That would be my next attempt. Yeah. Um, I would probably look at other things as well to exploit at that point. Right. Okay. So basically it's all about, so actually, okay.

Chris Gammell: I mean, here's, here's off the cuff.

OpenGL: That's the only way we operate. I, uh, then I would just, uh, I would amplify the attack. So to use kind of what's known as an amplification or a relay attack where I would be able to, I would have, you and I would both be carrying devices that we created and they would communicate over, let's say, um, long, long distance RF, say Laura or something. Yeah. Yeah. Um, and we could be a few miles away from each other. You'd be standing next to the person with the key. I'd be next to the car. I'd pull on the door. It would send an LF challenge. My device would pick up that LF challenge, send it to you over, you know, UHF a mile away. Your device would get it, pick it up over UHF down, uh, you know, uh, down converted to LF, transmit it a feet, a foot away to the key. The key would be like, Oh, I got a challenge and send the response. And same, same process happens. Man in the middle.

Chris Gammell: Same as always. Long distance, man in the middle. Interesting. Oh, so it's, you're just saying, so the key fob's out of range of the car. That's interesting. Most cars have that feature now. Oh. That's like, do you ever hear that, uh, that urban myth where it's like, if you ever need to, you can hold up the, the key fob to your phone and it'll transmit through your phone. Like, uh, I've heard the, uh, put it on your like, yeah. Like the echo chamber of your, your, your, your head, your cranium, whatever. But no, I remember someone saying that if you play it through your phone, you know, another person holds up their phone and it's like, that'd be awesome.

Dave Jones: That's not how, that's not how waves work people.

OpenGL: Unless you have like an ultrasound, uh, car key, which would be cool. Right. Yeah.

Chris Gammell: Yeah. Okay. I, yeah, that's, that's a good idea. I mean like, but so what I'm, what I'm getting at is it seems like there's a, uh, there's a toolkit, like a mental model for a lot of these things, like man in the middle is a common one and the replays are, you know, it seems like there's kind of pattern matching and then trying a lot of these similar things. Definitely.

OpenGL: There's definitely like a, you know, I think as you learn more techniques, there's definitely a kind of maybe a core, you could break it down into like core concepts like relaying and replaying and, um, man in the middle and man in the middle seems like it's a huge one where it's flipping and yeah. What's that one? Um, just being able to like flow, just flip a bit to change something. Um, well, it's interesting in a couple of ways for one, like encrypted, a lot of encrypted communication, you can flip a bit and as long as they're not checking that there's no checksum on there, you can change the communication. Um, so you might be a man in the middle and two people will feel really secure because they're using encryption to communicate and send data back and forth. But maybe I can, if I'm the man in the middle, I may not have any idea what that stuff is saying because it's all encrypted. If I can flip one bit that may cause something else to happen, then I can. Oh, it's like trial and error kind of stuff, right? Yeah. Trial and error. Yeah. Right. I can learn more about that information by flipping that bit. Right. And eventually you might be able to reverse to infer the key, which is ultimately what you're trying to get, right? Yeah. Infer the key or cause some action to happen that, you know, maybe. Just like randomly? Yeah. Maybe the information is like, lock the door, lock the door. And actually this, this is, this is another attack I did with my car. I believe it's hold the door. Uh, too soon. Uh, on my car, it was, uh, it sends a rolling code, but it also sends, uh, the action, which is like open the trunk or unlock the door, lock the door. And on my car, it sends lock the door. So I found that I can actually, let's say someone hits lock the lock button and I intercept that and I jam it. Now, if I replay it, it's just going to lock the door. And that's not really useful to me as an attacker, but the rolling code was not attached in any way to the message, to the action. So I use the same rolling code. As long as I intercepted the lock, someone locked their car and they walked away. Well, I jammed it and now I have this rolling lock, this rolling code and the lock signal, but I can flip a bit and say unlock instead because the rolling code had nothing to do with the message or the action. The rolling code in that case is just the thing that says, this is a legit action. This is a legit action. Okay. But it wasn't authenticating the action. Um, so, uh, in any way. So the rolling code was simply just a, they had a rolling counter and just said, this is a legit action, whatever the action may be.

Chris Gammell: Right. So you, so you might be able to keep inferring the next rolling code, but you would only be relocking the door each time. So you'd have, you'd be flipping a bit to try and try other things with the next rolling code and the next rolling code. Right.

OpenGL: Well, the thing is with that, if I jammed, if I prevented the car from hearing that rolling code, I could then use that rolling code and change the bit from lock to unlock. So there was like a two bit action where it was unlock, lock, open the trunk and something out, alarm. So you would already know what these bits are basically. Yeah. So, so if I had like, if I had looked at a preview, if I had looked at all the cars, right. All the, let's say I make a model, they all communicate exactly the same. It's just different rolling code. Um, so if I've looked at that car before, or I found a data sheet on how the chip worked, um, a lot of the chips actually don't provide data sheets, but in my testing, I've public, publicly, but just by proof, just by testing so many cars, I found that most of them work almost the same. And I could, in some cars, I can just change a bit and change it from lock to unlock. And what's cool is that I could potentially do that, um, when they're, when they're doing that. So like, let's say they, they're hitting lock. I could jam it, change the bit, replay it right there. So they still hear the car make an action. Right. So like honks the horn or something. Yeah. Right. Now it's unlocked. It's still unlocked. Right. And they think they locked the car because they hit the lock button. Wow. But I flipped a bit, replayed it. And, uh, so yeah, there's just like all sorts of dacks.

Chris Gammell: Um, so I wanted to talk about the, the mag spoof thing. Sure. So what is, what is the method of, of doing what's, what's the method there?

OpenGL: So yeah, so mag spoof, super simple device. Um, uh, essentially what it does is I'm using like an AT tiny, uh, and a coil, just a coil that I made with magnet wire, um, and a driver, a motor driver. And essentially, yeah, I'm, I'm, I store in the AT tiny, uh, the code for my credit card and I can go up to any credit card, any point of sale system, even if it's not NFC, you know, RFID, just a regular, you know, mag stripe reading device. And I can press a button inches away and emulate my credit card. And the device thinks I'm swiping a card, even though there's nothing to swipe.

Chris Gammell: Right. Because the idea is that the way the mag stripes work in the first place, I, I, that's the thing. I never think about these things. Like, it's like, Oh yeah, it's just like ones and zeros, man. Yeah. It's like, Hmm.

OpenGL: I didn't know anything about mag stripes until I started that project. Um, and, uh, I think, I think I just want to know what, I don't know. I was, I got this like mag stripe reader. And I was like, Whoa, you can, there's data on here. What is this data? Um, and I started playing around and I was like, it'd be really cool if I could emulate, uh, this data. Um, and then I found all sorts of attacks just on credit cards in general around that time. It was actually cause I got an, I got an Amex and I found that like I'd been, I've been a loyal Amex customer for a long time. And I'm like, this is like the same number I had last time. And I found that many of the digits were the same. And then I looked up, I save all my credit cards and I looked up all the numbers and it was a very simple algorithm to produce the next card. Oh really? So then I like, I canceled my card and I predicted my next card without receiving it and then put it in this device. I made the device, put it in and then went and bought something. I was like, Oh my God, I haven't even received the next card and I already know what the number is. And I asked a bunch of friends, I'm asked a bunch of people if they would share their Amex and their replaced Amex cards and every single one matched. So I could predict your next Amex card if you had, if it were lost or stolen, for example. Right. So you just have to trigger the cancellation and then you can spoof the next one, right? I wouldn't even need to. Right. So let's say, let's say I found your credit card or I stole your credit card. I would use it up until it stops working. As soon as it stops working, I know you're like, Oh, they must've called. I'll just hit a button and now it goes to the next one. Oh man. So the second you cancel, I can use your next credit card. And around that same time, when I'm messing, when I'm messing with this stuff, I also found that, you know, ever since like target got breached, now every target has chip readers. So you have to use your chip if you have a chip card, right? Even if you try swiping your card, it'll say you must insert chip. So I found that part of the mag stripe actually has information about whether this is a mag, whether this has a chip or not, whether it has a pin or not. Right. I was like, what if I change this service called the service code? What if I say I don't have a chip? Right. I had a chip card. Right. It was, it was a chip card. And I went and I put, or I played it with the normal thing and it said, you must insert the chip. And you can't replay the chip with, uh, right. Because that actually has a challenge basically. Right. Exactly. Yeah. Yeah. There actually is a challenge in there. Yeah. So, uh, I then disabled that bit on the credit card. I emulated it with mag spoof and it said, great. And it took my credit card. Um, so I turned a chip card, which the whole point that we have all this security is to prevent someone from taking, stealing your card and using it. Yeah. Uh, and I disabled the chip. Um, so the point of sale system believed that there was no chip on the card and accepted the month and accepted the number. It's crazy.

Chris Gammell: Um, and you actually use this in like stores and stuff. Yeah. I took video of it. So I have, okay. This video. Yeah. Of course. Yeah. On your site. Yes. Of course. We'll point people back to your site. No, but people can say, you didn't even need to be on here.

Dave Jones: Why are we even talking? Come on.

OpenGL: People will see video, um, on my YouTube channel, uh, of, of me going into different stores. Subscribe now. Subscribe now. Yeah. Applied hacking YouTube channel. Yes.

Chris Gammell: That's right.

OpenGL: Um, yeah. So you can see video and actually I show a really cool thing where I took, take a credit card and I dip it in iron oxide filings and then I pull it out and you can see the bits of the credit card with the naked eye. You can literally read off the bits with your eye. Right. You actually don't need any like special, you know, equipment.

Chris Gammell: Right. Right. And, uh, yes, that's also the same reason you shouldn't carry your credit card next to your cell phone speaker. Learn that one the hard way. Yeah. Definitely wipe my card. Happens. Uh, yeah. Well, uh, yeah, that's really, so, uh, and you have some recently released news. About this project as well that we were mentioning before the show. Um, the, uh, that is now in popular, popular media.

Dave Jones: Oh yeah. Yeah.

OpenGL: I was, oh man, I was so excited. Um, you know, one of my favorite shows, uh, Mr. Robot, uh, they, they reached out to me and, and were like, yeah, wanted to use Max Booth. Um, so, you know, I talked to one of the writers, really, really knowledgeable guy. Um, and, uh, the, they're good. I think, I hope, I think.

Chris Gammell: Well, we'll find out.

OpenGL: It hasn't, yeah, it hasn't been out yet. But yeah, I read it. I read it on an article where they said they're, they're actually going to use or have used Max Booth. So I'm pretty excited about that. That's pretty awesome. Yeah.

Chris Gammell: I mean, I was pretty much geek. And so people haven't watched it. I mean, like it's, I think it's a fantastic show. I actually avoided it for a while. It was Mike from Hackaday that got me into it. And, um, and it's funny. It's just weird. You know, it's weird seeing like, oh, like Arduinos.

Dave Jones: Yeah.

Chris Gammell: It's so cool. And it's, it's like, yeah. But like, I, it's weird to us because we've seen this stuff before, but you have to imagine that like to the general public, like, Ooh, yeah. Whoa. You know? Yeah.

OpenGL: I mean, yeah, it's not often enough. It's not that often that you see a Raspberry Pi anyway. Right. In any, unless you're hanging out with geeks. Right. Yeah. So do you think it would actually work too?

Chris Gammell: I don't know if this is a spoiler. What's that? This is a possible spoiler. Yeah. You said, you said, you've seen all these parts of the season, right? But like, spoiler, spoiler alert, spoiler alert, uh, where they put, they put a Raspberry Pi on the ethernet that controls all the HVAC system. Hmm. And that's what they're, but like all these skaters, like the, it's like Target got breached,

OpenGL: right? Target got breached through, well, not maybe through Raspberry Pi, but through their HVAC. Oh, I didn't know that. Yeah. So I think maybe they're copying real life there.

Chris Gammell: Oh, interesting. Okay. Yeah. I didn't realize that. Um, yeah, I was talking to someone that I too, about, uh, we were talking about the egg minder. I actually saw a talk that was that quirky pro. So remember quirky, the, the company shut down recently. Well, sort of shut down. They were, they were like the social product thing where like people suggested ideas and they would make these connected products and they had the wink hub and they got bought by Flextronics and now they're, it's, it's kind of going away. But they had this, I remember I was at Defcon two years ago and there was a talk about the egg minder, which is their silly, it was like a $70 web connected egg tray that basically told you how many eggs you had and how long they had been in there. That's great. But someone put wire shark on it. Like they, they put wire shark on that thing. So it's sitting on your network now just watching all the traffic and sending it back.

OpenGL: That's great.

Chris Gammell: Yeah, sort of. But like, but I mean, that's the thing, like there's so much, it's not the right word, but it's like cognitive excess. You know, people are throwing so much hardware at problems these days that now it's enough to have like, you know, full stacks on top of it that you could mess with.

OpenGL: Yeah. I mean, there's a, you know, there's a fridge or smart refrigerator there that, you know, you could essentially steal Gmail credentials out of Google credentials because it would email you when, you know, certain things needed to happen. So you had to authenticate the fridge or something or. Yeah. And so it was, well, you would, I think you would type it in so it could like access your calendar and send email. But you type your password into the fridge. Yeah. That sounds like a bad idea. Cause like it had a screen on it. Yeah. Yeah. Yeah. Uh, so, and then people figured out how to hack it and extract your password, your Gmail password. Yeah. Um, it's crazy from a fridge and yeah, I mean, I just love, I love the, I love the fact that everything's being, becoming connected and, um, that there's like microphones and cameras and everything and that everything's talking to everything else. So, you know, maybe something itself isn't only has a small vulnerability that isn't that interesting by itself, but it's now connected to everything else in our home. Everything has to be perfect or your company. Right. So there's so many holes there. There's so many things that you can do. If I can just get onto your network through your, you know, smart fridge or your smart TV or your door lock or something, I can now, you know, ARPS boot for DNS boot full of your traffic. Right. Once you're plugged in internally, there's like no security. So it's as if I'm, Oh, cause you already passed the, uh, the router fire. I passed your router. Yeah. Yeah. Right. Once I'm past your router, it's all trusted and to escalate privilege is very easy. Hmm. Well, that's fun. So I think, yeah, I just think this stuff is really exciting. Um, and I'm not, I don't know why, but it's always been exciting to me. And I think what's really cool is for me is also the open source and open hardware. Yeah. Um, that's why I open source everything I do. And, uh, I've, that's how I learned as a kid. So like the day I needed, you know, my mom told me I had to get a job because it's like 16 and we didn't have, you know, she lost her job. And it was because I learned from other open source projects, how things worked and could then write my own stuff and get a job and program. And, um, so I'm always looking for more people to just join in and like work on stuff. Um, and also the, uh, just know that you just work on anything and you'll, you'll get something done. Yeah. And, or if you don't, that knowledge will be used, uh, really well in another project.

Chris Gammell: Yeah. That's great. That's great. So are you, um, you doing the circuit this year too, or are you going to Defcon? Not this year.

OpenGL: Uh, yeah, I did, did the kind of the circuit last year. Um, you know, I, I travel for some conferences here and there, so maybe once a month I'll do it, but it's usually international and it's just, it's rough on my sleep. Uh huh. Right. We got like shut up. Um, but I hope, yeah, I'm just working on some projects. So I do have hope to have a project or two out soon.

Chris Gammell: So what do you, what do you see as the challenges? Like, so from the hardware perspective, what are you, what are you running into? Like, what are the, what are the projects that are sitting kind of waiting for those answers in your mind?

OpenGL: Um, so I mean with the one thing, like, like you said, you know, everyone's just throwing hardware at everything. Um, and it's hard. It's security is hard. It's way easier to hack something than it is to make something secure. Um, if I were that smart, that's nice to say actually. I mean, I think that that's, that's legit. Oh, it's way easier. You know, if I were that, if I were that smart, then, you know, if I were really smart, I would be securing things. All right.

Chris Gammell: It's like an entropy thing, right? It's like easier to, everything wants to become more, uh, have more entropy, right?

OpenGL: Yeah. Yeah. Every time I do, I try to design something as secure, it takes a lot of thought. It takes a lot of thought. You know, it's only one hole that you need to find to exploit an entire system. Yeah. Um, so there's a huge gap there. Um, but I think, man, the IOT stuff is really interesting. Uh, I think, um, how different radios are being connected. So you might have like Bluetooth that, uh, a device that has both Bluetooth and wifi. Um, I think the exploitation of one protocol, you know, in order to access another protocol is really interesting. Yeah. Um, and I don't know. I mean, microcontroller just, you know, dumping, stealing secrets, stealing secrets from microcontrollers and flash. I think that's really interesting. So a lot of the glitching that's happening, um, you know, doing a lot of stuff with chip, chip whisper, which is super fun. Counseling. Yeah. Yeah. Um, the fact that you can take secrets from, uh, a device is, is really cool. So like when you're looking for secrets, what would it, would you be looking for like keys and stuff like that? Yeah. Yeah. So, uh, let's say an encryption key of a, of a device, um, or, or even just, you know, being able to dump the flash and understanding how something encrypts something. So if there are any flaws in the encryption methods, right. So like you could jump out of a routine or something that, yeah. Um, I think side channel, side channel attacks are super interesting. Uh, a lot of people out of like, I think it's the university of Tel Aviv keep on coming out with these awesome, like side channels where they're using a sound of a CPU or this resistors and capacitors around it to detect the instructions that are executing because of the different amount of power that's required. And they can, they can deduce a PGP key while encrypting an email just by having a smartphone nearby by listening and listening to the computer. That's incredible, right? They're extracting a key from sound, um, that a computer makes. Uh, also, I mean, RF, I think there's going to be a bunch of cool RF stuff. I'm trying to work on some stuff as well.

Chris Gammell: Yeah.

OpenGL: Um, in the RF side channel attack area.

Chris Gammell: Mm-hmm.

OpenGL: Um, so I think side channel attacks and the fact that everything is leaking information constantly.

Chris Gammell: Right. Right. Yeah. Yeah. That's, and it's so much stuff where I think for such a long time, people just kind of got a, got away with, or they still do. I mean like just getting away from getting away with, um, you know, just what's the phrase security by obscurity kind of thing of just like. Yeah. Yeah. Absolutely. Didn't have to think about it. Nobody had the tools for it. Yeah. Yeah. And now you can do a lot of things.

OpenGL: So. Yeah. Yeah. You know, I'd say, I'd say even a lot of things that like, I think part of hacking is being able to also understand that you might not have the tool available to you. And I think, uh, it's really cool to, it's really cool to have people like Mike, Mike Osman and creating like low cost tools for, for, for hacking and, uh, vulnerability, um, research. And, but I think a lot of it's really cool because if you just learn the basics of how something works, you can do it with no money at all. It's like with the max booth, I can show you how you take a credit card. You don't need a mag stripe writer reader. You can just dip it in like iron oxide. You can take a magnet and like just break it with a hammer, like one of the cheap maggots. Um, and just put it on a credit card and read the bits off. Yeah. That's all he needs to do.

Chris Gammell: Hmm. Yeah. That is pretty nuts.

OpenGL: So, yeah. So I think like being able to find, you know, low cost solutions, I think that's, that's the interesting stuff to me. So, um, if I find something that might be a costly attack, I always try to reduce it. I see. I think we can use low cost tools for so much cool stuff.

Chris Gammell: Yeah. Okay. So let's, let's end on, on that too, because what are, what are some of your go-tos? I mean, I'm obviously staring at some of the tools behind you, but what are, what are some of your essential tools day to day that you couldn't get away with and some that you're just, they're nice to have for, for doing some of this stuff?

OpenGL: Sure. Um, I mean, I'd say, uh, the things, you know, I love my CELIA logic analyzer. That's, uh, what got me into the LED stuff. I borrowed my friends. Um, and then I found, you know, bought one, bought a, bought one. Um, I love, uh, you know, Mike Osman's yardstick one and hack RF. I use yardstick one a lot. Um, it's great for sub gigahertz RF stuff. Um, proxmark for RFID stuff. Uh, you mentioned that one already. So that's software that's, that's hardware. I mean, both. It is both. It's hardware. Yeah. It's a custom board. Okay. Maybe a couple hundred bucks and allows really low level RFID, um, testing. So you can kind of communicate in any way, you know, any modulation. You can do whatever you want. Got it. That's kind of really test stuff. Yeah. Uh, and it's a transceiver.

Chris Gammell: So you can do receive in. That's correct.

OpenGL: That's correct. On LF and HF. So like one 25 kilowatts, one 34 kilowatts and 13.5 megahertz. Uh, that's cool. Yeah. And I would say like a lot of the stuff now, now, I mean using a, just a teensy or Arduino and then a, any other chips I need.

Chris Gammell: Yeah.

OpenGL: Just cause I really like my stuff to be portable. So, or rather if I need Linux, I'll throw, you know, throw a Raspberry Pi or Buglebone. Yep. Um, and then, yeah, my newest project would be a Raspberry Pi zero. And actually I was using like a, I was using a more expensive, um, name escapes me now. It was like a hundred dollar USB thing, but then I moved it all to the Raspberry Pi zero cause that'd be really cool to show this attack on a $5 dongle rather than a hundred dollar, you know. Right, right, right, right. A little bit more, more capable.

Chris Gammell: Yeah. Oh, and you said you're starting to do FPGA stuff too. Yeah. Yeah. I'm starting to do FPGA stuff. That's good. I think that's going to be, yeah, that, that kind of stuff for like being able to parallel stuff is really interesting. Yeah. It's a, that's a good one to know.

OpenGL: Yeah. Um, a friend of mine, David Halden has always been doing like FPGA stuff that like, uh, Pico computing up North. Oh, cool. And he always do like, ever since we were kids, he was building like these insane cracker, cracking machines. Right. Yeah, exactly. And he, I mean, he's, he's incredibly talented. So his stuff is always super more, more efficient than anyone else's that I would find. But, um, yeah. Brilliant guy.

Chris Gammell: That's cool. Yeah. That's great. Well, Hey man, thanks for having me over.

OpenGL: Thanks for, thanks. Thanks for having me on. Talking about this stuff. Yeah. That's great.

Chris Gammell: Where can, where, where can people find out more?

OpenGL: Oh, awesome. Um, yeah. If people want to see videos, um, my, uh, YouTube channel, it's called applied hacking, um, or visit my website, uh, Sammy.pl that's S A M Y.pl. Um, and I'd say I'm on Twitter at Sammy cam car. You can find it from my site or YouTube or the show notes. We'll have all this stuff. Awesome. Awesome. Thanks. All right. So fun. Yeah. Thanks man. Cool.

OpenGL: Cool.

Speaker ?: Cool. Thank you.