1
00:00:08,542 --> 00:00:12,542
And I always thought that my first talk would be on some amazing bug

2
00:00:12,542 --> 00:00:16,501
they found, but all my bus are under MDA unfortunately, so I'm here

3
00:00:16,501 --> 00:00:19,167
to talk about something else that I discovered

4
00:00:19,167 --> 00:00:22,083
not even working if info sec, but it stuck with me

5
00:00:22,083 --> 00:00:27,792
for several years and now we're here to talk about its security implications.

6
00:00:30,125 --> 00:00:34,334
And how many of you were at the talk with Jen Savage talked

7
00:00:34,334 --> 00:00:38,209
about having a toy bunny that's a webcam?

8
00:00:39,792 --> 00:00:43,042
That reminded me of something that happened when I was

9
00:00:43,042 --> 00:00:45,125
6 or 7 years old.

10
00:00:45,125 --> 00:00:47,375
My father had gotten a radio scanner for listening

11
00:00:47,375 --> 00:00:51,083
to the emergency radio, the police and the fire and he was messing

12
00:00:51,083 --> 00:00:53,292
around with it and he accidently tuned

13
00:00:53,292 --> 00:00:55,751
in to something that was not the police or

14
00:00:55,751 --> 00:00:58,792
at least you hope it wasn't the police because it was

15
00:00:58,792 --> 00:01:03,209
a woman screaming for mercy and a man threatening to kill her.

16
00:01:03,292 --> 00:01:05,999
He had tuned into a baby monitor and he called the cops and

17
00:01:05,999 --> 00:01:10,125
they came and they saved her and there was a happy ending.

18
00:01:12,501 --> 00:01:13,417
[APPLAUSE]

19
00:01:13,417 --> 00:01:19,667
The thing is a baby monitor is an intentional emission.

20
00:01:20,083 --> 00:01:23,125
It's really easy to forget that it's broadcasting

21
00:01:23,125 --> 00:01:25,959
to the entire neighborhood.

22
00:01:25,959 --> 00:01:27,167
I bet you a dollar that man never thought

23
00:01:27,167 --> 00:01:29,250
for a moment that was a bug broadcasting

24
00:01:29,250 --> 00:01:33,834
to that neighborhood in the room as he threatened to kill his wife.

25
00:01:34,125 --> 00:01:36,334
It's a good thing he didn't remember that.

26
00:01:36,334 --> 00:01:39,167
But it's a good thing for all of us to remember in general.

27
00:01:42,542 --> 00:01:46,501
So we are here to talk about unintentional radio emissions.

28
00:01:46,501 --> 00:01:48,999
The one that it doesn't say on the box it is doing.

29
00:01:48,999 --> 00:01:51,250
And the spoiler alert?

30
00:01:51,292 --> 00:01:54,792
Every device that you own is screaming its name

31
00:01:54,792 --> 00:01:59,334
into the infinite void on the magical waves.

32
00:02:02,751 --> 00:02:06,542
And the whole slide show doesn't have an animated background.

33
00:02:06,542 --> 00:02:07,542
I promise.

34
00:02:08,209 --> 00:02:10,292
My name is Melissa.

35
00:02:10,334 --> 00:02:14,751
I do binary analysis.

36
00:02:14,751 --> 00:02:15,792
I'm accused of destroying info sec

37
00:02:15,792 --> 00:02:18,709
because I bring too much pink and glitter.

38
00:02:19,999 --> 00:02:23,209
I don't have pink hair in real life.

39
00:02:23,209 --> 00:02:25,584
Some people have told me should remedy this.

40
00:02:30,999 --> 00:02:34,626
So what are we actually talking about?

41
00:02:34,626 --> 00:02:38,083
We're talking about how you without about formal training

42
00:02:38,083 --> 00:02:42,083
or expensive equipment can learn how to check what sort

43
00:02:42,083 --> 00:02:45,876
of noise your devices are generating.

44
00:02:47,584 --> 00:02:50,584
Radio emissions, they're magic.

45
00:02:50,918 --> 00:02:53,999
If you actually need to know how they work, talk to a physicist.

46
00:02:53,999 --> 00:02:54,999
I'm an engineer.

47
00:02:55,501 --> 00:03:00,626
But all of your electronics are naturally generating them.

48
00:03:00,626 --> 00:03:01,959
They're everywhere.

49
00:03:01,959 --> 00:03:03,083
They are filling the air.

50
00:03:03,501 --> 00:03:07,083
There are people who believe that they infiltrate their head and tell them

51
00:03:07,083 --> 00:03:08,999
to do bad things.

52
00:03:09,083 --> 00:03:11,083
That's an open question of science.

53
00:03:12,999 --> 00:03:17,167
Fortunately, we have an area in West Virginia reserved for them.

54
00:03:18,459 --> 00:03:22,667
There's no cell phone towers and no FM music stations.

55
00:03:22,667 --> 00:03:23,667
There is nothing.

56
00:03:23,667 --> 00:03:25,999
It's a horrible place for a teenage girl to be.

57
00:03:26,083 --> 00:03:30,918
That's where I went to learn about radio astronomy.

58
00:03:30,918 --> 00:03:32,209
I will talk about that later.

59
00:03:32,792 --> 00:03:36,167
48 hours straight with no access to the internet at all.

60
00:03:38,501 --> 00:03:42,083
And these are the devices we're going to be using.

61
00:03:42,209 --> 00:03:45,209
You can get these for as little as $10 and yes it runs

62
00:03:45,209 --> 00:03:48,626
on Linux and yes it runs on raspberry pie.

63
00:03:49,167 --> 00:03:51,999
There are radios that have a wide tuning range and dump

64
00:03:51,999 --> 00:03:54,334
the raw signal to software processing so you can

65
00:03:54,334 --> 00:03:55,999
process it.

66
00:03:57,125 --> 00:04:02,125
You really don't need ton anything about radio engineering.

67
00:04:02,459 --> 00:04:05,834
I had become a radio engineering script kitty.

68
00:04:05,834 --> 00:04:08,999
It's like wow.

69
00:04:08,999 --> 00:04:12,334
I don't anything well, I know a little bit about radio science.

70
00:04:12,959 --> 00:04:18,250
But you have ten bucks and you want to order from China

71
00:04:18,250 --> 00:04:22,417
if you're not you have 20 bucks.

72
00:04:26,999 --> 00:04:29,584
There are python bindings.

73
00:04:29,584 --> 00:04:31,375
I wrote a script that's really easy and anyone

74
00:04:31,375 --> 00:04:35,209
with basic technical knowledge can get into it.

75
00:04:41,250 --> 00:04:44,876
The chip set they would recommend is called the RTL 2832 U.

76
00:04:44,876 --> 00:04:48,083
And they are mass produced forward tuning into television

77
00:04:48,083 --> 00:04:51,083
and various countries, which is why they have such

78
00:04:51,083 --> 00:04:53,334
a broad tuning range.

79
00:04:53,334 --> 00:04:56,792
They have no intelligence on the chip, which is why they're $10.

80
00:05:01,584 --> 00:05:03,125
And if there's anyone who has

81
00:05:03,125 --> 00:05:06,542
a problem with the word radio dongel, I am sorry I am going

82
00:05:06,542 --> 00:05:09,459
to be saying dongel several times.

83
00:05:09,459 --> 00:05:10,999
[APPLAUSE]

84
00:05:10,999 --> 00:05:20,626
These what are they look like on the inside.

85
00:05:20,626 --> 00:05:21,709
They're very simple.

86
00:05:21,709 --> 00:05:22,999
They're very easy to fry.

87
00:05:22,999 --> 00:05:24,459
May my first one rest in peace.

88
00:05:26,876 --> 00:05:30,834
It met its demise when I plugged it in.

89
00:05:44,292 --> 00:05:48,250
So there are different models and they have different ranges,

90
00:05:48,250 --> 00:05:52,417
but on general, they go from around 50, 60 megahertz all the way

91
00:05:52,417 --> 00:05:54,751
up to 2.2 gigahertz.

92
00:05:54,959 --> 00:05:59,125
So, this is a huge range and a huge value for a $10 radio.

93
00:05:59,125 --> 00:06:01,083
A couple of years ago, it would not have been accessible

94
00:06:01,083 --> 00:06:03,417
with quite an investment.

95
00:06:03,999 --> 00:06:08,375
You can bulk order them from ally express.

96
00:06:08,751 --> 00:06:10,167
It's a little bit shady, but I have gotten

97
00:06:10,167 --> 00:06:12,292
all my packages so far.

98
00:06:14,125 --> 00:06:17,918
They have a pal female connector, by the way, not very common

99
00:06:17,918 --> 00:06:20,751
in the states, but your Radio Shack should carry

100
00:06:20,751 --> 00:06:25,209
connectors and plug in bunny ears like grandma used to have.

101
00:06:27,501 --> 00:06:30,083
And why do we care?

102
00:06:30,375 --> 00:06:32,999
I think the MSA might care.

103
00:06:33,459 --> 00:06:34,834
You heard of tempest?

104
00:06:35,334 --> 00:06:36,999
That's real.

105
00:06:38,459 --> 00:06:40,959
They've been doing this for decades.

106
00:06:41,083 --> 00:06:43,501
This is courtesy one Mr. Snowden.

107
00:06:45,459 --> 00:06:49,125
It says communications and other information that's not

108
00:06:49,125 --> 00:06:53,083
communication such as equipment emanations.

109
00:06:53,542 --> 00:06:57,167
Maybe they have a secret meaning, but I think that sounds

110
00:06:57,167 --> 00:07:00,626
like radio emissions of devices.

111
00:07:00,876 --> 00:07:02,999
Sounds like they're storing them.

112
00:07:02,999 --> 00:07:04,999
If anyone in the MSA would like to tell me different,

113
00:07:04,999 --> 00:07:08,083
I would be glad to discuss that with them.

114
00:07:12,999 --> 00:07:13,083


115
00:07:13,083 --> 00:07:13,792
[INAUDIBLE]

116
00:07:13,792 --> 00:07:16,459
MELISSA ELLIOTT: Another common misconception

117
00:07:16,459 --> 00:07:19,542
is that tempest only applies to CRT.

118
00:07:24,459 --> 00:07:28,584
The first example of tempest was a tele typewriter.

119
00:07:28,584 --> 00:07:30,959
A typewriter that could recover the letters that was being where I went

120
00:07:30,959 --> 00:07:32,834
from across the street.

121
00:07:32,834 --> 00:07:34,459
You can still do this.

122
00:07:34,999 --> 00:07:39,292
In 2009, I can not pronounce French names.

123
00:07:39,292 --> 00:07:40,292
Please forgive me.

124
00:07:40,292 --> 00:07:43,375
They released a paper eavesdropping

125
00:07:43,375 --> 00:07:48,999
on normal USB keyboards getting full plain text recovery

126
00:07:48,999 --> 00:07:53,292
from across the office building.

127
00:07:53,626 --> 00:07:54,999
So, this is real.

128
00:07:54,999 --> 00:07:56,667
This is an actual problem.

129
00:07:56,667 --> 00:07:58,250
It's not purely theoretical.

130
00:07:58,250 --> 00:08:00,584
And you deserve to know that.

131
00:08:00,626 --> 00:08:02,959
You deserve to be able to evaluate your devices

132
00:08:02,959 --> 00:08:07,959
for how susceptible they are to it and this is a lot of fun for $10.

133
00:08:08,876 --> 00:08:13,083
And you probably aren't break anything laws, maybe.

134
00:08:13,667 --> 00:08:19,792
So about that, there are a lot of laws about radio tuners.

135
00:08:19,792 --> 00:08:21,292
They vary from place to place.

136
00:08:21,292 --> 00:08:24,083
They are basically arbitrary limitations on certain frequencies if you want

137
00:08:24,083 --> 00:08:25,999
to check them out.

138
00:08:26,709 --> 00:08:29,751
Just tuning in to things that is mostly passive and mostly difficult

139
00:08:29,751 --> 00:08:31,083
to detect.

140
00:08:31,083 --> 00:08:33,584
You want to check out the slides goes

141
00:08:33,584 --> 00:08:38,959
to graduate students detecting passive tuners.

142
00:08:38,959 --> 00:08:40,918
So they're not entirely passive at all.

143
00:08:41,167 --> 00:08:43,083
But play it safe.

144
00:08:43,375 --> 00:08:44,667
Obey all laws.

145
00:08:44,999 --> 00:08:49,250
For example, one that applies here in America, scanning receivers

146
00:08:49,250 --> 00:08:53,999
and frequency converters marked for use with scanning receivers shall

147
00:08:53,999 --> 00:08:55,876
be incapable.

148
00:08:56,083 --> 00:08:59,417
And it goes on to say do not tune into areas reserved

149
00:08:59,417 --> 00:09:04,083
for cell phones unless you are an actual cell phone.

150
00:09:05,542 --> 00:09:07,626
So don't do this.

151
00:09:07,876 --> 00:09:13,751
Do not type the number 824 and hit enter.

152
00:09:13,751 --> 00:09:32,501
You have a lot of fans.

153
00:09:38,501 --> 00:09:41,709
So wind it's your first time speak at DEF CON.

154
00:09:41,709 --> 00:09:43,292
MELISSA ELLIOTT: This is true.

155
00:09:43,292 --> 00:09:47,083
How would you like your Jack Daniels?

156
00:09:47,417 --> 00:09:49,999
MELISSA ELLIOTT: I'm afraid I cannot drink, sir.

157
00:09:50,083 --> 00:10:01,792
Is your husband in the audience?

158
00:10:01,792 --> 00:10:03,417
MELISSA ELLIOTT: Right there.

159
00:10:03,417 --> 00:10:04,417
Do you drink, sir?

160
00:10:04,417 --> 00:10:05,417
Yes, I do.

161
00:10:05,417 --> 00:10:06,959
Get your butt up here then.

162
00:10:06,959 --> 00:10:09,292
Has he been to DEF CON before?

163
00:10:09,584 --> 00:10:13,999
MELISSA ELLIOTT: No.

164
00:10:13,999 --> 00:10:15,125
Your first DEF CON?

165
00:10:15,167 --> 00:10:16,209
Yes.

166
00:10:16,209 --> 00:10:19,834
You have to do a double because you're both    Oh, that's fine.

167
00:10:25,209 --> 00:10:26,083
[Laughter]

168
00:10:26,083 --> 00:10:27,000
[APPLAUSE]

169
00:10:27,000 --> 00:10:33,751
By the way, we have decided to brand this little exercise.

170
00:10:33,751 --> 00:10:34,999
You heard of spot the fed.

171
00:10:34,999 --> 00:10:35,999
This is shot the n00b.

172
00:10:37,000 --> 00:10:39,584
There will be t shirts next year.

173
00:10:40,375 --> 00:10:42,999
To everybody that's new at DEF CON, cheers.

174
00:10:42,999 --> 00:10:43,999
Cheers.

175
00:10:43,999 --> 00:10:43,999
[APPLAUSE]

176
00:10:43,999 --> 00:10:44,999
Have a nice talk.

177
00:10:44,999 --> 00:10:53,918
MELISSA ELLIOTT: Thank you, sir.

178
00:10:53,918 --> 00:10:59,834
I was afraid I was going to get van there for a second.

179
00:11:02,918 --> 00:11:05,083
I swear that's just as gift.

180
00:11:05,083 --> 00:11:06,584
I drew it by hand.

181
00:11:06,584 --> 00:11:08,584
I never actually typed that number in.

182
00:11:11,167 --> 00:11:14,959
But no one's ever gone to jail for incrementing an integer.

183
00:11:15,167 --> 00:11:16,667
We're safe.

184
00:11:21,918 --> 00:11:24,999
So, I manage to go most of my life not knowing that

185
00:11:24,999 --> 00:11:29,834
all my electronics were leaking all of the signal that details what they're

186
00:11:29,834 --> 00:11:33,876
getting up to in their private electronic lives.

187
00:11:33,999 --> 00:11:38,334
The reason I found out is because I went to play with this.

188
00:11:39,834 --> 00:11:40,834
[APPLAUSE]

189
00:11:40,834 --> 00:11:41,834
[Cheering]

190
00:11:41,834 --> 00:11:45,999
This is the green bank telescope.

191
00:11:45,999 --> 00:11:49,501
It is considered the largest mobile object in the world.

192
00:11:49,501 --> 00:11:51,834
Ships don't count because they get to float.

193
00:11:52,083 --> 00:11:55,876
It is the size of a football field that tilts from horizon.

194
00:11:56,250 --> 00:11:58,959
They use it to listen to outer space.

195
00:11:59,667 --> 00:12:04,334
So they only let me play with the 40 foot dish, but I bet none

196
00:12:04,334 --> 00:12:09,209
of you have a 40 foot dish.Y is what I learned while I was there

197
00:12:09,209 --> 00:12:13,125
is their biggest challenge to gettings science done

198
00:12:13,125 --> 00:12:17,959
is the very electronics that they need to measure and process

199
00:12:17,959 --> 00:12:21,459
the signal because those same electronics blast

200
00:12:21,459 --> 00:12:24,459
the signal out of the sky.

201
00:12:24,459 --> 00:12:27,959
Just to give you an idea, they had to get a special budget approval

202
00:12:27,959 --> 00:12:30,125
to have a micro wave oven.

203
00:12:30,125 --> 00:12:31,999
They have a microwave oven.

204
00:12:32,751 --> 00:12:38,918
Inside another faraday cage and inside the room, another faraday cage.

205
00:12:38,918 --> 00:12:41,918
That's how much they had to shield things to heat up their pizza

206
00:12:41,918 --> 00:12:43,459
at 2:00 a.m.

207
00:12:48,417 --> 00:12:51,959
I was with a girl who had a panic attack because it feels

208
00:12:51,959 --> 00:12:55,083
like you're being locked away forever.

209
00:12:55,626 --> 00:13:01,334
You go in and there's another door and you are sealed in this copper room.

210
00:13:04,876 --> 00:13:08,999
Everything is self contained and then, yeah.

211
00:13:08,999 --> 00:13:10,334
I couldn't blame her.

212
00:13:14,542 --> 00:13:18,999
And speaking of noisy electronics, I have brought my little friend.

213
00:13:19,250 --> 00:13:22,709
If you follow me on Twitter, you might have seen it before.

214
00:13:23,375 --> 00:13:29,918
This is the $50 network from China which I caught on fire.

215
00:13:33,999 --> 00:13:36,999
We will not discuss how it caught fire.

216
00:13:36,999 --> 00:13:37,999
It's not relevant.

217
00:13:39,250 --> 00:13:44,250
However, what's relevant is that it has no shielding.

218
00:13:44,250 --> 00:13:49,751
I'm pretty sure this violates FCC from rule 1 to the last.

219
00:13:49,999 --> 00:13:52,792
They have a conniption if they knew I imported it.

220
00:13:56,334 --> 00:14:01,999
This is the part where we get to the live demo.

221
00:14:02,083 --> 00:14:06,918
And in the front row, he's not going to turn on his hack RF.

222
00:14:17,999 --> 00:14:22,083
So I'm going to tune to an FM radio station.

223
00:14:22,083 --> 00:14:23,751
Let's see what's here in Vegas.

224
00:14:27,834 --> 00:14:30,876
I don't want that too loud on you.

225
00:14:43,999 --> 00:14:46,334
So that's what music looks like.

226
00:14:50,999 --> 00:15:00,709
I have no idea what I just tuned into.

227
00:15:00,709 --> 00:15:09,999
[ Music ]

228
00:15:09,999 --> 00:15:19,083
oh, no.

229
00:15:19,083 --> 00:15:25,751
What are those blue lines?

230
00:15:36,667 --> 00:15:41,334
So, do you see those little spikes that weren't there like a minute ago?

231
00:15:45,501 --> 00:15:48,292
I was afraid that the contrast might not be very good,

232
00:15:48,292 --> 00:15:50,834
but there are lots of spikes that weren't there

233
00:15:50,834 --> 00:15:52,999
until I turned this on.

234
00:15:52,999 --> 00:15:53,999
And there.

235
00:15:58,501 --> 00:16:00,125
How's that?

236
00:16:05,083 --> 00:16:09,918
Those, if you zoom in, there's lots of natural jitter, but they are

237
00:16:09,918 --> 00:16:13,209
between 32 and 33 kilohertz apart.

238
00:16:13,584 --> 00:16:15,999
Does anyone know about anything that has

239
00:16:15,999 --> 00:16:19,792
a clock speed about a natural clock.

240
00:16:20,125 --> 00:16:30,209
So a natural clock sorry.

241
00:16:35,584 --> 00:16:42,999
A realtime clock has a freak wins usually of about 32.7 68.

242
00:16:46,751 --> 00:16:50,125
I had to screen shot all of this because I was convinced I was going

243
00:16:50,125 --> 00:16:53,501
to set it on fire again, which didn't happen.

244
00:16:54,459 --> 00:16:56,959
I am afraid the charger isn't working anymore

245
00:16:56,959 --> 00:17:00,167
as of an hour ago when I plugged it into a strip I found lying

246
00:17:00,167 --> 00:17:02,125
around at DEF CON.

247
00:17:04,834 --> 00:17:08,667
So this may be the terrible laptops last stand.

248
00:17:11,542 --> 00:17:12,209
So there's

249
00:17:12,209 --> 00:17:12,999
[INAUDIBLE]

250
00:17:12,999 --> 00:17:15,709
and not dancing around.

251
00:17:15,918 --> 00:17:19,626
So the realtime clock that's probably what I'm picking

252
00:17:19,626 --> 00:17:25,667
up and it just blasts its existence all over my radio FM radio stations.

253
00:17:28,250 --> 00:17:30,209
So okay.

254
00:17:30,209 --> 00:17:31,459
It has a realtime clock.

255
00:17:31,459 --> 00:17:32,667
That's amazing.

256
00:17:32,667 --> 00:17:33,667
Everything does.

257
00:17:33,999 --> 00:17:36,417
How about something a little more interesting.

258
00:17:36,584 --> 00:17:38,667
How do you look for interesting things your electronics

259
00:17:38,667 --> 00:17:40,292
are giving off?

260
00:17:40,292 --> 00:17:41,542
It's mostly guess work.

261
00:17:41,959 --> 00:17:45,542
And a good place to start is by randomly multiplying numbers

262
00:17:45,542 --> 00:17:48,999
together, which worked out really well.

263
00:17:50,542 --> 00:17:56,501
So, the screen on this little thing is a stunning 800 by 480.

264
00:17:56,999 --> 00:18:02,542
Pixels, they're three bytes, 24 bits per pixel.

265
00:18:02,918 --> 00:18:06,501
They're being given a ribbon cable inside.

266
00:18:06,999 --> 00:18:11,459
If you add all those numbers up, you get about nine megahertz.

267
00:18:11,459 --> 00:18:14,209
That's a little bit below what my radio can tune

268
00:18:14,209 --> 00:18:19,999
into and there's another factor and that's the refresh rate.

269
00:18:23,501 --> 00:18:26,083
I don't actually know the things refresh rate.

270
00:18:28,876 --> 00:18:32,083
It does not report the refresh rate.

271
00:18:32,083 --> 00:18:33,792
It is pirated.

272
00:18:38,375 --> 00:18:41,999
But I haven't seen an LCD lower than 75.

273
00:18:42,999 --> 00:18:48,375
That gives a range of 150 megahertz to SIFT through.

274
00:18:49,501 --> 00:18:53,542
There are several places I can pick up the signal, but I will show you

275
00:18:53,542 --> 00:18:56,083
the one that I think is best.

276
00:19:26,334 --> 00:19:29,375
Does that look like something?

277
00:19:38,417 --> 00:19:40,125
I'm logging in.

278
00:19:40,125 --> 00:19:41,709
I'm sure it's really secure.

279
00:19:43,083 --> 00:19:45,209
Oh, did it change?

280
00:19:49,999 --> 00:19:52,083
You will have to trust me.

281
00:19:52,083 --> 00:19:53,999
It was a very bland log in screen and now it has

282
00:19:53,999 --> 00:19:56,709
a very lovely Pokeymon wallpaper.

283
00:19:58,125 --> 00:20:00,417
You will see the color change because I have a very,

284
00:20:00,417 --> 00:20:02,167
very small antenna.

285
00:20:02,167 --> 00:20:04,375
It's the free one that came with my radio.

286
00:20:04,667 --> 00:20:06,999
So, ah, I'm sure the people you actually need

287
00:20:06,999 --> 00:20:10,709
to worry about do not have the free 4 inch antenna that came

288
00:20:10,709 --> 00:20:12,999
with their $10 radio.

289
00:20:19,292 --> 00:20:23,999
I think I will go to some word processing.

290
00:20:31,876 --> 00:20:34,918
And the signal went actually very flat.

291
00:20:34,918 --> 00:20:36,501
It's mostly gone.

292
00:20:36,501 --> 00:20:38,834
I will go to pirate PowerPoint.

293
00:20:55,876 --> 00:20:57,959
So, thank you.

294
00:20:57,959 --> 00:20:59,042
I do have other antennas.

295
00:21:11,959 --> 00:21:13,834
[Laughter]

296
00:21:13,834 --> 00:21:20,501
You gave me a loose connector.

297
00:21:25,250 --> 00:21:30,292
All the pal female connectors don't stay together.

298
00:21:30,334 --> 00:21:39,959
Good enough.

299
00:21:41,125 --> 00:21:43,918
But I have the word processor open.

300
00:21:44,083 --> 00:21:47,209
It's not very exciting.

301
00:21:47,292 --> 00:21:49,542
Mostly white screen.

302
00:21:54,417 --> 00:21:57,083
And this thing is slow as heck.

303
00:21:57,083 --> 00:22:00,959
So office presentations.

304
00:22:09,999 --> 00:22:12,918
Yes, I would like to restore this.

305
00:22:12,918 --> 00:22:14,792
I may have cut the power.

306
00:22:17,626 --> 00:22:20,999
And, gee, that looks different.

307
00:22:23,501 --> 00:22:28,209
I have a nice checkerboard affect going on my Powerpoint.

308
00:22:36,709 --> 00:22:40,083
It goes ah way and the presentation.

309
00:22:40,751 --> 00:22:42,375
You cheated me.

310
00:22:43,083 --> 00:22:45,999
So the touch pad on this thing is very treacherous,

311
00:22:45,999 --> 00:22:49,375
so treacherous it ruined one of my demos.

312
00:22:49,375 --> 00:22:51,876
I found a frequencies that when you touch

313
00:22:51,876 --> 00:22:55,918
the touch bad, you hear buzz, buzz, buzz.

314
00:22:55,999 --> 00:22:58,125
I come here to Las Vegas and it's gone.

315
00:23:00,083 --> 00:23:02,250
I have no idea.

316
00:23:02,999 --> 00:23:06,542
I will talk it up to it being so dry.

317
00:23:06,542 --> 00:23:09,083
That's what seems to be the excuse for everything.

318
00:23:18,751 --> 00:23:20,250
So now the full screen has

319
00:23:20,250 --> 00:23:25,999
a checkerboard pattern and my signal has broken down to very discrete lines.

320
00:23:26,959 --> 00:23:30,334
Now, you can recover the screen from this?

321
00:23:30,334 --> 00:23:30,918
I'm pretty sure you K.

322
00:23:30,918 --> 00:23:34,999
unfortunately, my radio sample rate is not very high.

323
00:23:35,334 --> 00:23:38,751
But again, I have a $10 radio.

324
00:23:43,292 --> 00:23:46,083
So there's my back up.

325
00:23:46,375 --> 00:23:48,999
What we're seeing is the signal transitions

326
00:23:48,999 --> 00:23:52,334
on the cable that feeds the screen.

327
00:23:52,334 --> 00:23:56,584
I took this to one of my engineer co workers at home.

328
00:23:56,584 --> 00:23:58,501
You say how would you explain there?

329
00:23:58,501 --> 00:24:02,999
Oh, you're seeing when you get zeros and ones.

330
00:24:02,999 --> 00:24:04,334
That's why when the signal is sail one color,

331
00:24:04,334 --> 00:24:07,584
your signal goes away especially like black, it is zero, zero, zero,

332
00:24:07,584 --> 00:24:09,083
zero, zero.

333
00:24:09,083 --> 00:24:10,083
Very exciting.

334
00:24:10,542 --> 00:24:13,667
So very specific patterns will create very noticeable

335
00:24:13,667 --> 00:24:15,584
signal patterns.

336
00:24:16,999 --> 00:24:20,209
It is there when the screen is off as long as the security

337
00:24:20,209 --> 00:24:24,751
is off because I'm reading the cable that runs into the LCD.

338
00:24:29,709 --> 00:24:33,083
Does that look like a checkerboard?

339
00:24:33,125 --> 00:24:34,999
I think it looks like a checkerboard.

340
00:24:44,584 --> 00:24:46,709
So that was the best I could manage

341
00:24:46,709 --> 00:24:48,834
with my toy radio.

342
00:24:49,334 --> 00:24:54,999
Wrote a python script, wrote out to their clotting API.

343
00:24:54,999 --> 00:24:56,417
Maybe I'm doing it all wrong.

344
00:24:57,501 --> 00:24:57,876
So if

345
00:24:57,876 --> 00:24:57,999
the

346
00:24:57,999 --> 00:24:58,667
[INAUDIBLE]

347
00:24:58,667 --> 00:25:01,751
would like to file a request for their alga rhythms

348
00:25:01,751 --> 00:25:06,459
of reconstructing screens, I'm sure they figured all this out.

349
00:25:08,209 --> 00:25:11,999
So as I said, it's not just screens.

350
00:25:11,999 --> 00:25:13,999
It's I picked up touch screen capacitive fields,

351
00:25:13,999 --> 00:25:17,834
which they decided to stop working in vision.

352
00:25:17,834 --> 00:25:20,250
As you can pick up buttons like the keyboards that

353
00:25:20,250 --> 00:25:23,959
the gentlemen were scanning earlier.

354
00:25:23,959 --> 00:25:27,792
The color of lights.

355
00:25:28,083 --> 00:25:31,792
So you have green light, red light on your secret machine that's

356
00:25:31,792 --> 00:25:33,501
locked away.

357
00:25:34,918 --> 00:25:35,999
Yeah.

358
00:25:35,999 --> 00:25:36,999
I don't do that.

359
00:25:37,584 --> 00:25:40,792
Micro phones obviously especially wireless ones, ah,

360
00:25:40,792 --> 00:25:41,375
[INAUDIBLE]

361
00:25:41,375 --> 00:25:44,334
at the source box in conference.

362
00:25:44,334 --> 00:25:45,125
I was running around recording people

363
00:25:45,125 --> 00:25:48,751
from across the building and then surprising them.

364
00:25:50,292 --> 00:25:52,083
You weren't in my talk.

365
00:25:52,083 --> 00:25:53,083
How did you get that?

366
00:25:57,083 --> 00:25:59,999
You can sometimes 56 up RAM.

367
00:26:00,167 --> 00:26:04,083
So when I figured out I could see RAM, I hooked the antenna

368
00:26:04,083 --> 00:26:08,125
around my neck and went around the office.

369
00:26:08,125 --> 00:26:10,083
Popped into offices with all this equipment hanging

370
00:26:10,083 --> 00:26:12,999
off my neck and said excuse me, sir.

371
00:26:12,999 --> 00:26:15,334
You can tell me what model book that is?

372
00:26:15,334 --> 00:26:18,083
Be like thank you.

373
00:26:25,501 --> 00:26:27,999
What is she doing.

374
00:26:30,584 --> 00:26:34,959
Basically you can pick up everything to some extent.

375
00:26:42,667 --> 00:26:46,876
So like this tablet that I'm presenting on, it has 1600 megahertz RAM

376
00:26:46,876 --> 00:26:50,334
and I couldn't find it at 1600 megahertz and then I found it

377
00:26:50,334 --> 00:26:55,667
at 800 megahertz and I thought maybe that's because it is dual channel.

378
00:26:56,542 --> 00:26:59,999
I've had people explain what that means.

379
00:26:59,999 --> 00:27:05,584
I had I think 2003 was the last time I actually put RAM

380
00:27:05,584 --> 00:27:08,417
into a computer.

381
00:27:08,918 --> 00:27:12,709
All of the ones I bought since then have been tablets.

382
00:27:12,709 --> 00:27:13,918
I know, right?

383
00:27:18,250 --> 00:27:21,125
So this one is interesting because I don't actually know what's

384
00:27:21,125 --> 00:27:22,999
being picked up.

385
00:27:22,999 --> 00:27:26,626
This is my Mac book error opening Chrome from which it hasn't already

386
00:27:26,626 --> 00:27:29,083
been owned and has in RAM.

387
00:27:30,459 --> 00:27:34,334
I get the very interesting sports from across the room.

388
00:27:34,918 --> 00:27:36,792
Sports being the technical term.

389
00:27:37,292 --> 00:27:40,334
So across the room with my little 4 inch antenna I can pick it

390
00:27:40,334 --> 00:27:42,918
up that it was open in Chrome.

391
00:27:42,999 --> 00:27:44,751
It must be the processor and I ran

392
00:27:44,751 --> 00:27:48,709
a benchmark distressed test in the processor.

393
00:27:49,083 --> 00:27:52,083
It must be the hard drive loading all the cache files.

394
00:27:52,167 --> 00:27:55,834
So I don't actually know what's causing it.

395
00:27:56,417 --> 00:27:57,999
But it's there.

396
00:28:02,083 --> 00:28:04,334
This is a like phone.

397
00:28:04,334 --> 00:28:05,501
I don't remember who this is T.

398
00:28:05,501 --> 00:28:07,999
might be in this test now.

399
00:28:08,999 --> 00:28:11,999
But this was someone talking at source Boston.

400
00:28:12,083 --> 00:28:14,999
When I say there was informed consent, I mean everyone knew I was

401
00:28:14,999 --> 00:28:16,876
up to something.

402
00:28:20,959 --> 00:28:21,334
[Laughter]

403
00:28:21,334 --> 00:28:25,626
I maintained I was not violating Massachusetts wiretapping laws.

404
00:28:25,626 --> 00:28:27,501
When I accidently tuned into the Blue Man Group,

405
00:28:27,501 --> 00:28:29,626
that was an accident.

406
00:28:35,876 --> 00:28:40,417
This is my iPhone when I'm connecting to Twitter.

407
00:28:40,417 --> 00:28:42,417
I was able to find this tell tale signal.

408
00:28:43,959 --> 00:28:46,584
The network here is really unstable.

409
00:28:54,999 --> 00:28:59,083
A few megahertz up from my phone.

410
00:28:59,292 --> 00:29:00,999
I turned off the wireless.

411
00:29:00,999 --> 00:29:02,542
It is 3G.

412
00:29:02,542 --> 00:29:04,167
Connect to Twitter and then for exactly

413
00:29:04,167 --> 00:29:09,834
the duration that little spinning icon was on my phone, this was on the air.

414
00:29:11,417 --> 00:29:14,334
I can see when an iPhone was actually

415
00:29:14,334 --> 00:29:16,792
downloading data.

416
00:29:16,792 --> 00:29:20,459
Now, hopefully my 3G connection with Verizon is encrypted.

417
00:29:20,626 --> 00:29:21,999
If not, we need to talk.

418
00:29:24,667 --> 00:29:29,083
But even if it's encrypted, I can still see what's happening.

419
00:29:29,083 --> 00:29:31,792
Can I still see there's someone connecting over from Verizon

420
00:29:31,792 --> 00:29:33,709
on a cell phone.

421
00:29:33,876 --> 00:29:36,209
So different types of devices can be profiled

422
00:29:36,209 --> 00:29:40,083
for their activity and after you know exactly what they do,

423
00:29:40,083 --> 00:29:42,459
you can detect them.

424
00:29:42,959 --> 00:29:44,999
You can see them through walls and tri annual them

425
00:29:44,999 --> 00:29:46,999
through outer space.

426
00:29:46,999 --> 00:29:50,999
Almost like transmitters because they are.

427
00:29:52,083 --> 00:29:56,083
So it's trivial to distinguish when one of the machines is idle and

428
00:29:56,083 --> 00:29:58,167
about it is active.

429
00:29:58,167 --> 00:29:59,918
If you study it, you can distinguish it

430
00:29:59,918 --> 00:30:02,834
through all kinds of active states.

431
00:30:10,417 --> 00:30:15,167
So what aye been carrying around the convention, an iPhone 4S,

432
00:30:15,167 --> 00:30:17,292
a nexus 7, a Nintendo 3D S.

433
00:30:17,292 --> 00:30:20,999
Do you know if anybody else has that combination

434
00:30:20,999 --> 00:30:22,959
of gadgets?

435
00:30:23,459 --> 00:30:25,918
If you do, we should probably be friends.

436
00:30:28,167 --> 00:30:33,542
So, if someone knew exactly what my brand preferences are and

437
00:30:33,542 --> 00:30:39,501
they could pinpoint me in the crowd if they had all the equipment set

438
00:30:39,501 --> 00:30:43,501
up ahead of time, which is again we're talking

439
00:30:43,501 --> 00:30:48,042
about the adversary, the NSA I mean China.

440
00:30:52,999 --> 00:30:53,542
[Laughter]

441
00:30:53,542 --> 00:30:58,042
So even if I turn off Wi Fi and blue tooth, this is still possible.

442
00:30:58,042 --> 00:31:00,999
They say turn off blue tooth so they can't see your phone.

443
00:31:01,292 --> 00:31:02,501
It helps.

444
00:31:02,501 --> 00:31:05,584
You're no longer screaming at top of your lungs that your phone is there,

445
00:31:05,584 --> 00:31:08,459
but you're saying my phone is here.

446
00:31:08,459 --> 00:31:09,999
My phone is definitely here.

447
00:31:10,584 --> 00:31:13,999
And this has been proven to work in the real world.

448
00:31:14,250 --> 00:31:18,292
Now, this uses Wi Fi because that's the same across all guys.

449
00:31:18,292 --> 00:31:21,542
It is loud and reliable.

450
00:31:21,999 --> 00:31:25,375
The screen shot is of a system tracking people following

451
00:31:25,375 --> 00:31:29,999
the Wi Fi beacons that their phones are giving off.

452
00:31:29,999 --> 00:31:32,999
The phone can core laid to the person

453
00:31:32,999 --> 00:31:36,167
by the phone's Wi Fi signal.

454
00:31:36,999 --> 00:31:42,542
You supply heard that Nordstrom trialed this and people found it creepy

455
00:31:42,542 --> 00:31:44,959
and they stopped.

456
00:31:44,999 --> 00:31:48,876
It is implemented and it works.

457
00:31:54,334 --> 00:31:56,334
They said they stopped.

458
00:31:56,334 --> 00:31:57,334
Gosh.

459
00:31:57,334 --> 00:31:59,083
That's what I get for trusting them.

460
00:31:59,584 --> 00:32:02,375
So, this is why the paranoid types are like take

461
00:32:02,375 --> 00:32:04,501
out the battery.

462
00:32:04,501 --> 00:32:05,999
Don't just turn off the phone.

463
00:32:05,999 --> 00:32:07,751
Take out the battery because they're worried

464
00:32:07,751 --> 00:32:10,083
about this sort of thing.

465
00:32:10,083 --> 00:32:13,834
So I'm going to take out the battery on my IM.

466
00:32:13,834 --> 00:32:14,834
Oh, wait.

467
00:32:14,834 --> 00:32:16,999
My iPhone doesn't have a removable battery.

468
00:32:19,542 --> 00:32:23,542
So what I can do is make like a shop lifter

469
00:32:23,542 --> 00:32:26,999
and get some booster gags.

470
00:32:26,999 --> 00:32:28,083
Not suspicious at all.

471
00:32:28,999 --> 00:32:31,167
You can find them on the internet labeled

472
00:32:31,167 --> 00:32:33,584
as cell phone blockers or some blue column

473
00:32:33,584 --> 00:32:37,417
like cell phone etiquette wrappers because your cell phone won't ring

474
00:32:37,417 --> 00:32:39,125
during dinner.

475
00:32:40,292 --> 00:32:44,709
You can use tin foil, but I found that grocery store tin foil

476
00:32:44,709 --> 00:32:47,375
I had to wrap around like 6 or 7 times

477
00:32:47,375 --> 00:32:51,834
before my iPhone even lost its wireless signal.

478
00:32:51,834 --> 00:32:55,999
I would recommend getting this stuff advertised for blocking this stuff

479
00:32:55,999 --> 00:32:59,501
and you can get the radios to test if it's working and

480
00:32:59,501 --> 00:33:02,709
they didn't sell you shiny cloth.

481
00:33:05,876 --> 00:33:08,501
So what can you do?

482
00:33:08,959 --> 00:33:11,626
You need have a completely private talk.

483
00:33:11,959 --> 00:33:13,834
Empty everyone's pockets and put everything

484
00:33:13,834 --> 00:33:15,999
in your microwave oven.

485
00:33:15,999 --> 00:33:17,834
Do not run it.

486
00:33:19,459 --> 00:33:20,999
And close the door.

487
00:33:21,999 --> 00:33:24,792
A microwave oven is not 100% effective,

488
00:33:24,792 --> 00:33:28,417
but it makes a pretty good difference considering it

489
00:33:28,417 --> 00:33:33,083
is 40 bucks and you already have one or two or three.

490
00:33:33,459 --> 00:33:35,999
But they're only rated to shield you

491
00:33:35,999 --> 00:33:40,209
from certain frequencies enough so it's not dangerous; however,

492
00:33:40,209 --> 00:33:45,999
it works pretty well if you put an FM radio and then close the door.

493
00:33:45,999 --> 00:33:48,167
You should lose your signal and not hear whatever music that was

494
00:33:48,167 --> 00:33:49,999
we were hearing.

495
00:33:50,999 --> 00:33:55,334
And snips off the cable off the back of a microwave should include it's

496
00:33:55,334 --> 00:33:57,083
faraday page.

497
00:34:00,167 --> 00:34:03,292
I did not test this, but it should work.

498
00:34:05,334 --> 00:34:10,459
But I did learn if you want to put a device in a faraday cage

499
00:34:10,459 --> 00:34:15,250
and then run either for power or internet, keep that cable

500
00:34:15,250 --> 00:34:17,999
as short as possible.

501
00:34:18,292 --> 00:34:22,751
So which I first hear I want to go test my like wave to make sure

502
00:34:22,751 --> 00:34:26,667
if works, I put my radio in there and closed door and

503
00:34:26,667 --> 00:34:30,375
the signal barely drops a little bit.

504
00:34:32,501 --> 00:34:35,999
I finally realized I had a 6 foot USB cable dangling

505
00:34:35,999 --> 00:34:38,626
out of the microwave oven.

506
00:34:39,626 --> 00:34:41,375
It's a shielded cable.

507
00:34:41,375 --> 00:34:44,834
It says so on the wrapper, but I could still pick

508
00:34:44,834 --> 00:34:49,876
up my local radio stations loud and clear inside a faraday cage

509
00:34:49,876 --> 00:34:55,834
because I had a six foot cable on the outside feeding into it.

510
00:34:55,834 --> 00:34:58,999
I wrapped it all up and moved the microwave closer

511
00:34:58,999 --> 00:35:01,876
to my computer so it was now six inches

512
00:35:01,876 --> 00:35:05,792
outside and suddenly I lost the signal.

513
00:35:08,250 --> 00:35:09,542
Yeah.

514
00:35:09,542 --> 00:35:12,667
Those wires hanging out of the cage, they're antennas.

515
00:35:14,999 --> 00:35:18,167
And also when something says it is shielded, it means it

516
00:35:18,167 --> 00:35:21,999
is shielded enough not to break, not shielded enough to not pick

517
00:35:21,999 --> 00:35:24,626
up your local radio station.

518
00:35:25,999 --> 00:35:30,959
So you can use the $10 SDRs to check.

519
00:35:30,999 --> 00:35:32,375
Okay.

520
00:35:32,375 --> 00:35:35,999
Is this faraday wrapper for my phone actually working?

521
00:35:36,083 --> 00:35:39,918
Is my phone giving off weird signals?

522
00:35:40,083 --> 00:35:43,292
I wrote a python script to scan and look through signals

523
00:35:43,292 --> 00:35:46,834
like when it was in the faraday cage.

524
00:35:47,083 --> 00:35:48,999
I, I can improve it quite a bit.

525
00:35:50,709 --> 00:35:55,334
How am I doing on time?

526
00:35:55,375 --> 00:35:56,375
Okay.

527
00:35:56,375 --> 00:35:57,375
Great.

528
00:35:57,709 --> 00:36:00,125
And in the process, you will learn that there are trillions

529
00:36:00,125 --> 00:36:04,083
of devices broadcasting weird things in your neighborhood.

530
00:36:04,542 --> 00:36:06,999
You will start to lose sleep over them.

531
00:36:06,999 --> 00:36:10,709
What is that thing that goes beep, beep every three minutes.

532
00:36:10,709 --> 00:36:11,751
I don't know.

533
00:36:15,999 --> 00:36:19,999
So, this is what my highly scientific set up looks like.

534
00:36:20,250 --> 00:36:21,999
It says it's legit.

535
00:36:26,083 --> 00:36:31,083
A microwave oven and as little USB cable as possible.

536
00:36:34,999 --> 00:36:42,501
I recommend you use SDR sharp for this for MacIntosh and Linux.

537
00:36:42,751 --> 00:36:46,083
GQRX, I don't know what that stands for anyway.

538
00:36:48,167 --> 00:36:50,501
The first one is probability GANU.

539
00:36:50,999 --> 00:36:52,999
After that, I'm lost.

540
00:36:53,999 --> 00:36:57,542
And these are based on the command line utilities,

541
00:36:57,542 --> 00:37:02,999
the RTL US library and you can use this directly or write things that uses them

542
00:37:02,999 --> 00:37:07,083
and they have pretty simple python bindings.

543
00:37:07,083 --> 00:37:09,999
I assume they are and I don't own a computer

544
00:37:09,999 --> 00:37:14,334
of a CD drive for about five years now.

545
00:37:26,792 --> 00:37:29,209
You can find them on WIKI media.

546
00:37:30,999 --> 00:37:32,999
There's also the French and the German that have their

547
00:37:32,999 --> 00:37:34,709
own guidelines.

548
00:37:35,209 --> 00:37:41,751
But their key take away is core laid emissions are bad.

549
00:37:41,751 --> 00:37:44,375
Core laid emissions means it changes when something

550
00:37:44,375 --> 00:37:49,834
on the machine changes that leaks information you don't want that.

551
00:37:49,999 --> 00:37:54,083
So, ask your landlady about copper plates for your bedroom.

552
00:37:54,083 --> 00:37:55,999
I'm sure it will go over really well.

553
00:37:58,250 --> 00:38:05,292
So my co worker said I had to throw in the store relating to LEDs.

554
00:38:06,083 --> 00:38:07,667
List play.

555
00:38:08,459 --> 00:38:10,709
Come on.

556
00:38:12,125 --> 00:38:13,334
No.

557
00:38:13,334 --> 00:38:14,334
Go back.

558
00:38:14,709 --> 00:38:17,292
It shows the lights changing at work.

559
00:38:17,292 --> 00:38:18,709
We have a rainbow tree.

560
00:38:24,167 --> 00:38:27,999
It goes through the patterns and I like under it at work because it

561
00:38:27,999 --> 00:38:30,999
is like your own private discode.

562
00:38:31,083 --> 00:38:35,876
Shortly after I got my radio and I was delighting and discovering

563
00:38:35,876 --> 00:38:40,876
things around the office, I sat under that tree and my signal is just

564
00:38:40,876 --> 00:38:43,918
like (make noises) oh, cool.

565
00:38:48,083 --> 00:38:52,501
I can hear what color is on the tree playing.

566
00:38:52,501 --> 00:38:54,834
So I am sitting there thinking whoa.

567
00:38:54,834 --> 00:38:59,250
Somebody walks by and say what are you doing?

568
00:38:59,709 --> 00:39:01,459
I'm listening to the tree.

569
00:39:02,959 --> 00:39:05,167
I can hear the colors.

570
00:39:05,167 --> 00:39:06,542
[Laughter]

571
00:39:06,542 --> 00:39:08,751
[APPLAUSE]

572
00:39:08,751 --> 00:39:14,417
She's finally cracked.

573
00:39:15,167 --> 00:39:16,999
We always knew she would.

574
00:39:16,999 --> 00:39:17,999
She's cracked.

575
00:39:19,999 --> 00:39:25,417
And so, ah, if this hasn't left you feeling a little more paranoid,

576
00:39:25,417 --> 00:39:30,083
I don't know what else I can say to scare you.

577
00:39:31,626 --> 00:39:35,417
So, ah, if security research all seems a bit twitchy, this

578
00:39:35,417 --> 00:39:40,501
is why because we think of this stuff at 3:00 in the morning.

579
00:39:40,667 --> 00:39:42,999
Oh, no, what if they come for me?

580
00:39:43,751 --> 00:39:47,751
I accidently tuned in to the Blue Man Group's radio

581
00:39:47,751 --> 00:39:53,584
and it slightly violated Massachusetts law enforcement that was creepy when

582
00:39:53,584 --> 00:39:57,167
I tuned into their walkie talkies.

583
00:39:58,999 --> 00:40:01,918
All I insure all right, Nancy.

584
00:40:01,918 --> 00:40:02,999
Stand there, get down on your knees

585
00:40:02,999 --> 00:40:05,209
and hold that position.

586
00:40:05,209 --> 00:40:09,959
I'm like what I did just hear?

587
00:40:10,459 --> 00:40:13,375
And then I figured out I was hearing their lighting group

588
00:40:13,375 --> 00:40:16,250
practices, you know, like when we need dramatic lighting

589
00:40:16,250 --> 00:40:17,999
at this spot.

590
00:40:19,209 --> 00:40:22,292
It is like oh, okay.

591
00:40:23,083 --> 00:40:26,125
Okay.

592
00:40:26,334 --> 00:40:29,501
And I'm not even positive it was the Blue Man Group.

593
00:40:29,501 --> 00:40:31,667
But I could see their sign from the window.

594
00:40:31,667 --> 00:40:33,709
So that's probably who I tuned into.

595
00:40:34,999 --> 00:40:40,751
Walkie talkies, radios, wireless phones, baby monitors, those are

596
00:40:40,751 --> 00:40:43,167
all in the clear.

597
00:40:45,417 --> 00:40:48,417
Please radio usually in the clear.

598
00:40:50,292 --> 00:40:53,542
I heard some interests things here the other night.

599
00:40:53,542 --> 00:40:57,292
It's not surprising at all.

600
00:40:59,999 --> 00:41:02,999
But those are all intentional emissions.

601
00:41:02,999 --> 00:41:03,999
They're supposed to do that and people don't even

602
00:41:03,999 --> 00:41:05,999
remember they're doing that.

603
00:41:05,999 --> 00:41:08,834
So people are not going to remember their device are leaking

604
00:41:08,834 --> 00:41:10,999
all this information.

605
00:41:10,999 --> 00:41:12,667
Journalists should take note.

606
00:41:13,083 --> 00:41:15,083
Whistle blowers should take note.

607
00:41:15,250 --> 00:41:19,999
All of you innocent people who never do anything legal should take note.

608
00:41:22,334 --> 00:41:27,999
And you can take steps, very simple steps, wrap it in the foil,

609
00:41:27,999 --> 00:41:32,292
take the $10 radios and give it a spin.

610
00:41:32,292 --> 00:41:36,083
See what you can find and you might even find something really interesting

611
00:41:36,083 --> 00:41:40,751
on a really good device that's effective less zero day.

612
00:41:40,751 --> 00:41:41,751
You know?

613
00:41:41,751 --> 00:41:43,375
Someone down the street can get information

614
00:41:43,375 --> 00:41:45,999
and reach out to this device.

615
00:41:45,999 --> 00:41:45,999
Do we see

616
00:41:45,999 --> 00:41:46,125
[INAUDIBLE]

617
00:41:46,125 --> 00:41:47,125
for that device?

618
00:41:47,125 --> 00:41:48,125
I don't know.

619
00:41:49,959 --> 00:41:53,334
And, ah, I have brought with me a few of these radios

620
00:41:53,334 --> 00:41:55,751
because I got a whole crate of them

621
00:41:55,751 --> 00:41:59,999
from China and I don't plan finding all of them.

622
00:42:00,876 --> 00:42:03,250
I will give one to the first person who comes

623
00:42:03,250 --> 00:42:06,501
up to me and tells me what my favorite color is and I hear

624
00:42:06,501 --> 00:42:09,375
all of you shouting the wrong one.

625
00:42:09,709 --> 00:42:11,709
(shouts).

626
00:42:11,999 --> 00:42:17,959
MELISSA ELLIOTT: Who said orange?

627
00:42:21,083 --> 00:42:21,584
[Laughter]

628
00:42:21,584 --> 00:42:24,083
Larry cached dollar, I know that's you.

629
00:42:24,083 --> 00:42:25,083
That's cheating.

630
00:42:25,083 --> 00:42:27,375
Boring!

631
00:42:27,876 --> 00:42:29,125
MELISSA ELLIOTT:

632
00:42:29,125 --> 00:42:30,167
[Laughter]

633
00:42:30,167 --> 00:42:35,584
But I'm probably going to head across to the Q&A room

634
00:42:35,584 --> 00:42:39,999
if I can figure out where that is.

635
00:42:39,999 --> 00:42:42,334
I almost didn't find the speaker room earlier.

636
00:42:42,334 --> 00:42:43,751
I'm really good with maps.

637
00:42:44,167 --> 00:42:47,167
Maybe you can come say something intelligent and thought provoking, I

638
00:42:47,167 --> 00:42:49,626
will give you one of my radios.

639
00:42:49,626 --> 00:42:50,626
Thank you.

640
00:42:50,626 --> 00:42:50,626
[APPLAUSE]

641
00:42:50,626 --> 00:42:52,584
So we actually don't have a Q&A room.

642
00:42:52,584 --> 00:42:53,999
MELISSA ELLIOTT: What?

643
00:42:53,999 --> 00:42:54,999
That's what I was told.

644
00:42:54,999 --> 00:42:57,999
I was told a lot of things too, but they're still not true.

645
00:42:57,999 --> 00:42:59,999
So anyway, just letting you know that.

646
00:42:59,999 --> 00:43:03,626
MELISSA ELLIOTT: I was apparently lied to just like the Easter bunny.

647
00:43:03,626 --> 00:43:05,459
I can't believe I tell my mother that.

648
00:43:05,459 --> 00:43:07,083
Thank you, everyone, for coming.

649
00:43:07,083 --> 00:43:07,083
[APPLAUSE]

650
00:43:07,083 --> 00:43:07,083
I forgot to show you the Nintendo 3D S.

651
00:43:07,083 --> 00:43:07,083
It makes a certain signal so you can detect

652
00:43:07,083 --> 00:43:08,250
all the Nintendos DSs.

653
00:43:08,250 --> 00:43:09,709
It is very, very dangerous.

654
00:43:09,709 --> 00:43:09,709
Even a very accurate counted of how many 9 year olds in the area,

655
00:43:09,709 --> 00:43:10,709
even my husband.

656
00:43:10,709 --> 00:43:11,709
You're funny.

657
00:43:11,709 --> 00:43:13,167
MELISSA ELLIOTT: Thank you.