1
00:00:00,000 --> 00:00:01,876
RICKY HILL: So my name is Ricky Hill.

2
00:00:01,876 --> 00:00:04,876
I'm a wireless and SCADA security

3
00:00:04,876 --> 00:00:06,709
I work in the D.C.

4
00:00:06,709 --> 00:00:11,999
metro area, specifically my office

5
00:00:11,999 --> 00:00:14,999
I have done previous DEF CON talks.

6
00:00:14,999 --> 00:00:18,000
On a similar vain,

7
00:00:18,000 --> 00:00:22,834
with other wireless equipment

8
00:00:22,834 --> 00:00:29,999
I have done (inaudible) eight years ago

9
00:00:29,999 --> 00:00:36,999
a wireless access point and collected

10
00:00:37,542 --> 00:00:41,626
It was good, but you can't get

11
00:00:41,626 --> 00:00:43,501
in urban areas.

12
00:00:45,000 --> 00:00:49,209
The other talk I did here that I have

13
00:00:49,292 --> 00:00:51,626
They banned us.

14
00:00:51,999 --> 00:00:54,999
They didn't give us permission

15
00:00:55,292 --> 00:00:58,167
We had a balloon

16
00:00:58,167 --> 00:01:02,542
he we were going to fly

17
00:01:02,542 --> 00:01:03,959
That was five years ago.

18
00:01:03,999 --> 00:01:06,999
Unfortunately the city banned us

19
00:01:06,999 --> 00:01:11,709
So we went to church ten miles

20
00:01:11,709 --> 00:01:13,167
Hey, Rick.

21
00:01:14,626 --> 00:01:16,083
How's it going?

22
00:01:16,083 --> 00:01:17,292
RICKY HILL: What's up?

23
00:01:19,334 --> 00:01:25,417
So we have this tradition

24
00:01:25,417 --> 00:01:26,667
You all know the drill.

25
00:01:26,667 --> 00:01:29,918
RICKY HILL: No, no, no.

26
00:01:29,918 --> 00:01:32,834
However, we have it

27
00:01:32,834 --> 00:01:36,584
is a liar and he, in fact,

28
00:01:36,999 --> 00:01:38,834
And, by the way, pull the drone one.

29
00:01:38,834 --> 00:01:44,417
RICKY HILL: I changed my mind,

30
00:01:45,167 --> 00:01:50,999
Raise your hand if this

31
00:01:53,334 --> 00:01:55,667
You, the blond.

32
00:01:55,999 --> 00:01:57,667
You raised your hand, didn't you?

33
00:01:57,667 --> 00:01:59,417
I can barely see under these lights.

34
00:01:59,417 --> 00:02:00,751
I hope your hair is blond.

35
00:02:00,751 --> 00:02:01,751
Come on up.

36
00:02:01,751 --> 00:02:02,751
(applause).

37
00:02:02,751 --> 00:02:06,626
First time attendee, all right.

38
00:02:06,626 --> 00:02:10,834
RICKY HILL: Good stuff.

39
00:02:10,834 --> 00:02:18,542
Did you I'm telling you    Thank you.

40
00:02:20,334 --> 00:02:22,334
The drone gets one.

41
00:02:22,334 --> 00:02:24,083
I told you to pour one for the drone.

42
00:02:24,250 --> 00:02:29,250
RICKY HILL: It's already been

43
00:02:29,626 --> 00:02:30,959
It is fairly waterproof.

44
00:02:32,999 --> 00:02:35,751
Everybody, this is Crystal.

45
00:02:35,751 --> 00:02:37,083
Crystal, this is everybody.

46
00:02:37,250 --> 00:02:38,626
(applause).

47
00:02:38,999 --> 00:02:41,417
Let's hear it for the drones,

48
00:02:41,417 --> 00:02:42,999
at DEF CON.

49
00:02:45,999 --> 00:02:47,167
(applause).

50
00:02:50,125 --> 00:02:51,792
As you were.

51
00:02:52,501 --> 00:02:54,584
Give it to Ricky.

52
00:02:54,584 --> 00:02:56,334
Have another shot.

53
00:02:56,334 --> 00:02:57,334
It's yours.

54
00:02:57,334 --> 00:02:58,334
(applause).

55
00:02:58,334 --> 00:03:06,584
RICKY HILL: Don't blame

56
00:03:09,292 --> 00:03:13,125
Where was I?

57
00:03:13,125 --> 00:03:14,125
All right.

58
00:03:14,125 --> 00:03:16,375
So what is    (speaker

59
00:03:16,375 --> 00:03:17,999
me a bit.

60
00:03:20,542 --> 00:03:22,792
Yeah, he's got a good point.

61
00:03:22,999 --> 00:03:26,999
I don't want to cut anybody up,

62
00:03:27,918 --> 00:03:30,083
So what is this talk about?

63
00:03:30,083 --> 00:03:31,918
It's about network surveillance.

64
00:03:31,918 --> 00:03:34,375
It is not about I don't know

65
00:03:34,375 --> 00:03:40,542
about a month ago but cleaners

66
00:03:40,542 --> 00:03:42,876
And they are delivering their dry

67
00:03:42,876 --> 00:03:43,999
Guess which drone?

68
00:03:43,999 --> 00:03:45,959
That's the Phantom drone right there.

69
00:03:45,959 --> 00:03:48,999
This thing, believe it or not,

70
00:03:48,999 --> 00:03:52,125
400 grams, whatever that works out to.

71
00:03:52,501 --> 00:03:55,125
I hear beer works.

72
00:03:55,125 --> 00:03:56,667
So I haven't tried a six pack.

73
00:03:56,667 --> 00:03:57,999
I understand some guys have.

74
00:04:02,626 --> 00:04:07,584
So here on the screen is what I plan

75
00:04:08,083 --> 00:04:12,542
First, we will look at the advantages

76
00:04:12,542 --> 00:04:14,334
from the air.

77
00:04:14,334 --> 00:04:16,292
You've got line of sight to everything.

78
00:04:16,292 --> 00:04:19,584
It's a real easy way to get

79
00:04:19,584 --> 00:04:24,999
in a large area

80
00:04:24,999 --> 00:04:26,751
Next, I

81
00:04:26,751 --> 00:04:29,999
technologies have made this

82
00:04:29,999 --> 00:04:32,792
Two years ago

83
00:04:32,792 --> 00:04:38,918
on this drone would not have been

84
00:04:38,918 --> 00:04:43,459
and the size of the microelectronics

85
00:04:43,459 --> 00:04:45,959
In particular, we talk

86
00:04:45,959 --> 00:04:49,792
the Hak5 software improvements

87
00:04:49,792 --> 00:04:52,834
on it called

88
00:04:52,834 --> 00:04:57,834
basically, an USB stick which runs full

89
00:04:57,999 --> 00:05:03,501
I will cover how I built and flew

90
00:05:04,292 --> 00:05:06,542
I think you would like the video.

91
00:05:06,999 --> 00:05:09,459
You will witness some

92
00:05:09,459 --> 00:05:13,083
of our oops moments encountered

93
00:05:13,584 --> 00:05:17,125
We flew a lot of missions in June

94
00:05:20,667 --> 00:05:22,083
All right.

95
00:05:22,083 --> 00:05:23,918
So the talk is really

96
00:05:23,918 --> 00:05:26,999
of aerial wireless surveillance.

97
00:05:26,999 --> 00:05:29,501
My previous attempts have been

98
00:05:29,501 --> 00:05:31,626
As I mentioned,

99
00:05:31,626 --> 00:05:36,999
because the whole flight was, like,

100
00:05:36,999 --> 00:05:39,918
Even from 10,000 feet you are not going

101
00:05:39,918 --> 00:05:42,083
in that amount of time.

102
00:05:42,918 --> 00:05:46,626
The balloon suffered

103
00:05:46,626 --> 00:05:49,999
When you launch a balloon

104
00:05:49,999 --> 00:05:53,918
to capture the Luxor

105
00:05:53,918 --> 00:05:55,876
to ten miles.

106
00:05:56,709 --> 00:05:59,334
It is not a real good platform.

107
00:05:59,334 --> 00:06:00,334
It tends to do this.

108
00:06:00,334 --> 00:06:04,667
The video from that venture looked

109
00:06:04,709 --> 00:06:06,083
It was pretty sickening.

110
00:06:07,292 --> 00:06:09,083
Next we will talk

111
00:06:09,083 --> 00:06:11,292
what you see on the screen here.

112
00:06:12,292 --> 00:06:17,918
There was a contest how I got

113
00:06:17,999 --> 00:06:21,999
DARPA UAVForge was

114
00:06:21,999 --> 00:06:27,083
a small drone that would fit

115
00:06:27,083 --> 00:06:31,417
on his back which is why

116
00:06:33,125 --> 00:06:38,417
It was supposed to go out and land

117
00:06:38,417 --> 00:06:42,417
whatever and conduct visual

118
00:06:42,417 --> 00:06:44,459
It would have been very useful,

119
00:06:44,459 --> 00:06:48,125
if you could have had surveillance

120
00:06:48,542 --> 00:06:51,083
That was the military's purpose in this.

121
00:06:51,334 --> 00:06:54,167
The top picture

122
00:06:54,167 --> 00:06:57,876
above the competition course.

123
00:06:57,876 --> 00:07:00,709
The other attempts

124
00:07:00,709 --> 00:07:06,125
of you rather the Blackhat WASP,

125
00:07:10,876 --> 00:07:14,626
It cost about $6,000.

126
00:07:14,751 --> 00:07:18,083
The problem

127
00:07:18,083 --> 00:07:22,417
now want to fly them continuously

128
00:07:22,709 --> 00:07:25,792
When you are flying you are using

129
00:07:25,792 --> 00:07:28,918
You don't have fuel tanks like a 747.

130
00:07:28,918 --> 00:07:31,667
You are burning up battery power

131
00:07:31,709 --> 00:07:35,626
The advantage of this one, of course,

132
00:07:35,626 --> 00:07:37,626
off the motors.

133
00:07:51,834 --> 00:07:56,375
The UAVForge contest, as I mentioned,

134
00:07:56,375 --> 00:08:00,999
and progressive idea and that

135
00:08:01,999 --> 00:08:05,083
If you can land on something,

136
00:08:05,083 --> 00:08:10,542
down and conserve your battery power

137
00:08:10,542 --> 00:08:15,083
whatever other operations you want

138
00:08:15,083 --> 00:08:20,209
in the payload will use a lot less power,

139
00:08:20,209 --> 00:08:24,999
to program network surveillance

140
00:08:24,999 --> 00:08:30,292
How many of you guys

141
00:08:30,999 --> 00:08:33,083
How many of you have used

142
00:08:33,626 --> 00:08:35,876
Excellent, excellent.

143
00:08:38,792 --> 00:08:41,083
Keep in mind

144
00:08:41,083 --> 00:08:43,792
is a proof of concept

145
00:08:43,792 --> 00:08:45,876
the military wanted.

146
00:08:45,918 --> 00:08:48,709
I'm not encouraging anybody to go

147
00:08:48,709 --> 00:08:50,999
or terrorize your neighbors.

148
00:08:51,999 --> 00:08:55,375
What you learn in this talk is up to you.

149
00:09:01,083 --> 00:09:05,167
Teams competed from 153 countries.

150
00:09:05,167 --> 00:09:06,167
Guess what?

151
00:09:06,167 --> 00:09:07,167
Nobody won.

152
00:09:07,167 --> 00:09:13,125
Nobody met the criteria for perching

153
00:09:13,125 --> 00:09:15,834
and coming back.

154
00:09:15,834 --> 00:09:17,125
They did require some autonomous

155
00:09:17,125 --> 00:09:19,999
but not full autonomous operation.

156
00:09:19,999 --> 00:09:22,083
Anybody know what

157
00:09:22,083 --> 00:09:24,125
or UAS a drone is?

158
00:09:24,125 --> 00:09:25,125
Go ahead.

159
00:09:25,626 --> 00:09:27,334
Really?

160
00:09:27,334 --> 00:09:29,999
RICKY HILL: Yeah, well.

161
00:09:29,999 --> 00:09:31,334
Pilot on the loop.

162
00:09:31,334 --> 00:09:32,334
Pilot in the loop.

163
00:09:32,334 --> 00:09:37,751
RICKY HILL: Yeah, exactly.

164
00:09:37,751 --> 00:09:38,999
The keyword is autonomy.

165
00:09:39,999 --> 00:09:41,999
The Phantom

166
00:09:41,999 --> 00:09:44,876
in the fact that it will return

167
00:09:44,876 --> 00:09:47,751
without any pilot intervention.

168
00:09:48,083 --> 00:09:50,250
Otherwise, it's just like an UAV.

169
00:09:50,250 --> 00:09:51,999
It will fly with pilot control.

170
00:09:52,334 --> 00:09:56,876
Full drones autonomous operation was

171
00:09:56,876 --> 00:10:01,542
of UAVForge because things

172
00:10:01,542 --> 00:10:04,834
that weren't on Google Maps.

173
00:10:04,834 --> 00:10:06,459
Okay, well, guess what?

174
00:10:06,459 --> 00:10:07,999
It doesn't do trees well.

175
00:10:12,876 --> 00:10:16,042
So here's a review of UAVForge.

176
00:10:17,292 --> 00:10:21,709
As you can see, it

177
00:10:21,709 --> 00:10:22,709
A lot of crashes.

178
00:10:22,834 --> 00:10:25,167
Out of all these teams,

179
00:10:25,167 --> 00:10:28,542
in the final competition,

180
00:10:28,542 --> 00:10:31,000
and crash was three minutes.

181
00:10:31,918 --> 00:10:32,999
(laughter).

182
00:10:33,125 --> 00:10:36,250
It's just ludicrous and it was only two

183
00:10:36,584 --> 00:10:40,167
That's how much I want to impress,

184
00:10:41,000 --> 00:10:44,167
That's not good

185
00:10:44,167 --> 00:10:45,999
of $10,000.

186
00:10:45,999 --> 00:10:48,334
I don't think even the Army wants

187
00:10:50,751 --> 00:10:56,999
All right.

188
00:10:56,999 --> 00:11:00,459
So the Phantom just came

189
00:11:00,459 --> 00:11:04,083
I found out about it because a friend

190
00:11:04,083 --> 00:11:08,375
with was doing some Grand Canyon

191
00:11:08,375 --> 00:11:13,626
she said her cousin or whatever ran

192
00:11:13,626 --> 00:11:16,626
and other drones

193
00:11:16,626 --> 00:11:19,417
films people going down.

194
00:11:19,584 --> 00:11:24,459
The Phantom also comes

195
00:11:24,626 --> 00:11:26,417
Excellent pictures from the air.

196
00:11:26,751 --> 00:11:28,959
So that's how I got

197
00:11:28,959 --> 00:11:34,292
out and I was addicted once I saw

198
00:11:34,292 --> 00:11:36,083
I'm like, this thing is really cool.

199
00:11:36,083 --> 00:11:37,667
Look what I can do with it.

200
00:11:38,292 --> 00:11:40,417
It flies really good.

201
00:11:40,417 --> 00:11:44,834
I can't tell you how many

202
00:11:44,834 --> 00:11:46,083
I suck as a pilot.

203
00:11:48,667 --> 00:11:50,584
I suck as a pilot.

204
00:11:50,584 --> 00:11:51,584
But you know what?

205
00:11:52,501 --> 00:11:56,751
GPS and all the guts

206
00:11:56,751 --> 00:11:57,999
They are great.

207
00:11:59,083 --> 00:12:05,999
It also has other safety features built

208
00:12:08,999 --> 00:12:12,667
What that means

209
00:12:12,667 --> 00:12:17,542
if you accidentally turn on it

210
00:12:17,542 --> 00:12:20,626
like fly up inside indoors.

211
00:12:23,667 --> 00:12:26,999
One stick is easy to get out of the way.

212
00:12:26,999 --> 00:12:30,876
As you can see here, it

213
00:12:30,876 --> 00:12:33,667
It requires both hands to take off.

214
00:12:33,834 --> 00:12:35,083
Very nice feature.

215
00:12:37,334 --> 00:12:44,459
I also the return to home capability

216
00:12:44,459 --> 00:12:47,999
If for any reason your flight gets

217
00:12:47,999 --> 00:12:51,125
You can just turn off the transmitter,

218
00:12:51,125 --> 00:12:55,125
I lost communication or even

219
00:12:55,125 --> 00:12:58,626
to come back to where I took off from.

220
00:13:07,999 --> 00:13:11,751
The technological improvements

221
00:13:11,751 --> 00:13:14,999
the cotton candy computer was one.

222
00:13:15,459 --> 00:13:16,667
Let me show you that.

223
00:13:16,667 --> 00:13:17,999
I have got one right here.

224
00:13:27,292 --> 00:13:31,501
So the cotton candy

225
00:13:31,626 --> 00:13:34,125
It debuted

226
00:13:34,125 --> 00:13:35,999
in Las Vegas.

227
00:13:35,999 --> 00:13:40,999
This thing runs full Ubuntu

228
00:13:41,375 --> 00:13:45,667
It makes an excellent platform

229
00:13:45,667 --> 00:13:48,709
this wispy spectrum analyzer.

230
00:13:49,542 --> 00:13:53,417
It also does ZigBee connection.

231
00:13:59,834 --> 00:14:04,876
Move around RO, there are payloads

232
00:14:06,834 --> 00:14:08,792
Let me put my drone back up.

233
00:14:16,501 --> 00:14:20,292
I can't emphasis how many

234
00:14:20,292 --> 00:14:22,667
It is just incredible when it

235
00:14:23,918 --> 00:14:25,999
Anybody fly helicopters?

236
00:14:26,375 --> 00:14:27,834
RC?

237
00:14:27,834 --> 00:14:28,834
Okay.

238
00:14:28,834 --> 00:14:29,999
We got a few people.

239
00:14:29,999 --> 00:14:34,542
How many crashes have you had?

240
00:14:34,542 --> 00:14:35,542
(laughter).

241
00:14:35,542 --> 00:14:36,542
Okay.

242
00:14:36,542 --> 00:14:37,999
That says it all right there.

243
00:14:41,792 --> 00:14:44,417
So this is a look at the two payloads.

244
00:14:44,417 --> 00:14:45,999
Sorry the pictures are fuzzy.

245
00:14:47,250 --> 00:14:50,292
Again, the main payload reviews

246
00:14:50,292 --> 00:14:54,626
is the Hak5 Pineapple which you can

247
00:14:54,626 --> 00:14:58,999
the other one

248
00:15:00,083 --> 00:15:04,834
The Pineapple required quite a bit

249
00:15:04,834 --> 00:15:07,417
of work to get going

250
00:15:07,417 --> 00:15:09,999
a custom power supply.

251
00:15:12,999 --> 00:15:17,459
For instance,

252
00:15:17,459 --> 00:15:21,125
mats instead of regular mats.

253
00:15:21,125 --> 00:15:24,375
It literally took me a month

254
00:15:24,375 --> 00:15:28,125
and I finally got it configured

255
00:15:28,125 --> 00:15:32,459
because all the other ones,

256
00:15:32,459 --> 00:15:34,834
The CDMA,

257
00:15:34,834 --> 00:15:36,626
suck power.

258
00:15:42,792 --> 00:15:47,501
So my opinion cotton candy

259
00:15:47,501 --> 00:15:50,334
for an aerial payload.

260
00:15:51,999 --> 00:15:54,709
The trick with it

261
00:15:54,709 --> 00:15:58,626
from its USB port, once you connect

262
00:15:58,626 --> 00:16:03,083
on the helicopter,

263
00:16:03,209 --> 00:16:04,999
But there is a work around for that.

264
00:16:05,125 --> 00:16:09,959
You supply it with a LiPo battery,

265
00:16:09,959 --> 00:16:15,459
you can now detach your Bluetooth

266
00:16:15,459 --> 00:16:18,417
to go on the helicopter.

267
00:16:18,417 --> 00:16:21,876
Whatever you got running

268
00:16:22,083 --> 00:16:24,709
In my case, it's (inaudible).

269
00:16:24,876 --> 00:16:27,834
It's wispy spectrum analyzer and

270
00:16:27,834 --> 00:16:29,501
about before.

271
00:16:29,501 --> 00:16:34,125
Basically, any USB device you can run,

272
00:16:34,125 --> 00:16:36,501
You can fly

273
00:16:41,459 --> 00:16:45,999
Let me show you what

274
00:16:46,459 --> 00:16:48,999
It actually will also act

275
00:16:48,999 --> 00:16:50,709
into a laptop.

276
00:16:51,626 --> 00:16:53,709
So let's do that.

277
00:17:11,250 --> 00:17:13,834
I did pray to the demo gods.

278
00:17:13,999 --> 00:17:17,792
(speaker

279
00:17:17,792 --> 00:17:20,667
but I took two shots.

280
00:17:23,083 --> 00:17:24,626
Okay.

281
00:17:24,626 --> 00:17:26,459
Installing device driver software.

282
00:17:26,459 --> 00:17:27,459
Here we go.

283
00:17:43,417 --> 00:17:44,918
Okay.

284
00:17:45,083 --> 00:17:47,918
The goat will happen next time.

285
00:17:47,918 --> 00:17:48,918
Sorry.

286
00:17:52,334 --> 00:17:53,626
Come on.

287
00:17:53,626 --> 00:18:08,999
I will know next time.

288
00:18:08,999 --> 00:18:11,709
Do you have goats for sale?

289
00:18:35,083 --> 00:18:39,125
This is our first flight

290
00:18:39,125 --> 00:18:44,876
This is a neighborhood overlooking

291
00:18:45,334 --> 00:18:50,501
It is a cool place to fly copters

292
00:18:50,501 --> 00:18:53,209
on lakefront property.

293
00:18:53,209 --> 00:18:56,709
It is easy

294
00:18:58,584 --> 00:19:00,999
This is the collection off that.

295
00:19:02,375 --> 00:19:08,083
Approximately we flew

296
00:19:08,626 --> 00:19:11,999
This particular subdivision only had

297
00:19:11,999 --> 00:19:14,375
a 10 minute overflight.

298
00:19:14,375 --> 00:19:16,584
There is a lot of stuff on channel 9.

299
00:19:18,375 --> 00:19:20,167
Plenty of data there.

300
00:19:27,250 --> 00:19:28,709
Okay.

301
00:19:28,709 --> 00:19:30,999
So we found a lot of wireless sources.

302
00:19:30,999 --> 00:19:31,999
So now what?

303
00:19:32,083 --> 00:19:36,959
Well, the "now what" is well,

304
00:19:36,959 --> 00:19:37,959
Wait a minute.

305
00:19:37,959 --> 00:19:40,501
I want to make sure I'm not skipping

306
00:19:40,501 --> 00:19:41,667
We found 9211 sources.

307
00:19:41,999 --> 00:19:43,999
Big deal, right?

308
00:19:44,083 --> 00:19:47,542
That's when I got the idea to do

309
00:19:47,959 --> 00:19:51,125
The Hak5 Pineapple provides numerous

310
00:19:51,125 --> 00:19:53,999
and exploitation packages.

311
00:19:53,999 --> 00:19:56,501
You can even do Metasploit

312
00:19:56,999 --> 00:19:59,999
Pineapple is basically

313
00:19:59,999 --> 00:20:03,584
in the middle

314
00:20:04,459 --> 00:20:08,792
If you connect Android phones,

315
00:20:08,792 --> 00:20:13,334
of Android and Apple phones that

316
00:20:13,334 --> 00:20:16,334
I'm the man in the middle

317
00:20:16,334 --> 00:20:18,375
do anything I want.

318
00:20:21,459 --> 00:20:26,000
Again, this the payload objective

319
00:20:26,000 --> 00:20:31,999
the same as for DARPA, that

320
00:20:31,999 --> 00:20:35,501
That could be a cell tower,

321
00:20:35,999 --> 00:20:38,542
It could be, you know,

322
00:20:38,542 --> 00:20:41,250
of that's hard to get to, right?

323
00:20:41,250 --> 00:20:45,459
Conduct your operations and return

324
00:20:49,918 --> 00:20:52,876
So I'm lazy.

325
00:20:52,876 --> 00:20:54,751
I didn't want to construct

326
00:20:54,751 --> 00:20:56,292
stole Hak5's.

327
00:20:57,999 --> 00:21:00,459
Thank you, Darren and Robin.

328
00:21:00,667 --> 00:21:02,250
This is episode 1112.

329
00:21:02,626 --> 00:21:04,999
How this works

330
00:21:04,999 --> 00:21:09,250
a wireless exploitation team

331
00:21:09,250 --> 00:21:13,209
through the GSM modem

332
00:21:13,209 --> 00:21:17,292
and conduct operations

333
00:21:17,292 --> 00:21:18,334
That's how it works.

334
00:21:18,334 --> 00:21:21,918
There is a relay server that's

335
00:21:24,542 --> 00:21:28,999
Here is a short list

336
00:21:29,167 --> 00:21:34,999
As you see, URL, DNS spoofing,

337
00:21:35,083 --> 00:21:36,999
Aerial dumping runs great

338
00:21:36,999 --> 00:21:39,999
because it doesn't transmit anything.

339
00:21:39,999 --> 00:21:44,375
The only other thing I would caution

340
00:21:44,375 --> 00:21:47,292
this is 2.4 gigahertz, okay?

341
00:21:47,334 --> 00:21:51,876
You are running that with receiver

342
00:21:51,876 --> 00:21:55,709
wireless ops with the payload,

343
00:21:55,876 --> 00:21:57,334
You're in the same band.

344
00:21:57,334 --> 00:21:58,959
You may not be looking so good.

345
00:21:58,959 --> 00:22:00,999
Theoretically it is supposed to work.

346
00:22:00,999 --> 00:22:03,083
I have seen numerous blogs

347
00:22:03,334 --> 00:22:05,709
You just crashed your $700 Phantom.

348
00:22:05,709 --> 00:22:10,834
So monitor mode only in flight

349
00:22:10,834 --> 00:22:11,999
And that works.

350
00:22:47,667 --> 00:22:49,999
That sucks, sorry.

351
00:22:52,667 --> 00:22:54,999
I'm going to skip here.

352
00:22:54,999 --> 00:22:56,834
I forgot to show you this video.

353
00:22:56,834 --> 00:22:57,876
This is pretty cool.

354
00:22:57,876 --> 00:22:58,876
Watch this.

355
00:22:58,876 --> 00:23:01,250
This is the return to home feature

356
00:23:03,709 --> 00:23:05,334
(Video playing).

357
00:23:08,375 --> 00:23:12,334
RICKY HILL: Basically, what I did

358
00:23:12,334 --> 00:23:14,999
This is my last test that I did,

359
00:23:16,250 --> 00:23:19,999
I turned off the transmitter

360
00:23:19,999 --> 00:23:25,626
near my gym bag like three feet

361
00:23:25,626 --> 00:23:28,999
That's the GPS and

362
00:23:46,542 --> 00:23:47,959
All right.

363
00:23:47,959 --> 00:23:50,999
So the next mission we did was we

364
00:23:50,999 --> 00:23:55,375
and we decided the next place

365
00:23:55,375 --> 00:23:57,584
was on the beach.

366
00:23:57,626 --> 00:24:00,709
This was at Lake Hannah.

367
00:24:03,125 --> 00:24:05,834
No, we were not looking for bikinis.

368
00:24:05,834 --> 00:24:08,501
We were just looking

369
00:24:08,501 --> 00:24:12,709
Androids and other wireless devices

370
00:24:35,999 --> 00:24:40,584
Notice the pylons added to the drone.

371
00:24:40,999 --> 00:24:43,876
Worked quite well

372
00:24:43,876 --> 00:24:45,792
I know one will support me

373
00:24:45,792 --> 00:24:47,250
really cool.

374
00:24:47,250 --> 00:24:52,334
We are flying out here about like one

375
00:24:52,334 --> 00:24:55,584
at, you know, Virginia Beach.

376
00:24:55,999 --> 00:24:57,834
And we just buzzed

377
00:24:57,834 --> 00:25:00,209
is probably

378
00:25:00,209 --> 00:25:01,999
see right here.

379
00:25:04,459 --> 00:25:09,167
So down at the other end, you know,

380
00:25:09,167 --> 00:25:12,999
Thank goodness

381
00:25:12,999 --> 00:25:17,417
Probably an altitude

382
00:25:18,209 --> 00:25:21,459
And we're collecting

383
00:25:30,999 --> 00:25:35,834
I'm running low on time here so I

384
00:25:35,999 --> 00:25:37,375
Here's the landing.

385
00:25:37,375 --> 00:25:38,542
The battery went dead.

386
00:25:38,542 --> 00:25:39,542
Watch this.

387
00:25:39,542 --> 00:25:40,542
(laughter).

388
00:25:40,918 --> 00:25:42,876
It died.

389
00:25:42,876 --> 00:25:45,375
I actually had no control at that point.

390
00:25:45,375 --> 00:25:45,792
My friend, Mr.

391
00:25:45,792 --> 00:25:49,667
Nick Hopler did helicopter search

392
00:25:50,918 --> 00:25:56,501
He jumped in, held the thing

393
00:25:56,501 --> 00:25:58,584
to the boat.

394
00:25:58,999 --> 00:25:59,999
Incredible.

395
00:26:00,125 --> 00:26:01,334
Actually 100 feet.

396
00:26:04,501 --> 00:26:06,083
Thank you, Nick.

397
00:26:14,626 --> 00:26:16,209
All right.

398
00:26:16,876 --> 00:26:20,501
I had bragged to one

399
00:26:20,501 --> 00:26:25,999
the Phantom yet and we had been

400
00:26:26,334 --> 00:26:29,209
And unfortunately there were some "oh,

401
00:26:29,209 --> 00:26:31,751
will find these interesting.

402
00:26:32,083 --> 00:26:34,375
We now have moved

403
00:26:34,375 --> 00:26:37,999
aerial collection and we want to do

404
00:26:37,999 --> 00:26:42,501
to land and do collection

405
00:26:43,083 --> 00:26:47,250
The first thought let's perform

406
00:26:47,250 --> 00:26:50,209
And the second thought is let's land

407
00:26:50,626 --> 00:26:52,876
We can land on the Marriott

408
00:26:52,876 --> 00:26:56,999
out somebody's room and do

409
00:26:56,999 --> 00:26:57,999
Okay.

410
00:26:57,999 --> 00:26:59,083
We'll see how that looks.

411
00:27:05,751 --> 00:27:08,334
This is test flight number 1.

412
00:27:22,999 --> 00:27:24,584
Pan right.

413
00:27:24,584 --> 00:27:26,626
This was a stormy evening, fairly windy.

414
00:27:27,334 --> 00:27:31,584
I had only had two beers at that point,

415
00:27:31,584 --> 00:27:33,167
Oh, no!

416
00:27:33,167 --> 00:27:34,167
Oh!

417
00:27:34,167 --> 00:27:42,501
RICKY HILL: Yeah, that's

418
00:27:42,501 --> 00:27:44,542
So not so good.

419
00:27:44,999 --> 00:27:49,083
What you see here on stage

420
00:27:59,083 --> 00:28:00,334
(laughter).

421
00:28:00,334 --> 00:28:01,375
One more clip here.

422
00:28:06,709 --> 00:28:10,167
This is our balcony shot where we are

423
00:28:10,167 --> 00:28:12,334
to see if can be done.

424
00:28:14,501 --> 00:28:15,959
(Buzzing).

425
00:28:17,999 --> 00:28:20,083
Oh, no!

426
00:28:22,167 --> 00:28:25,167
RICKY HILL: About an inch short

427
00:28:25,167 --> 00:28:26,542
Damn, you are a good man.

428
00:28:26,542 --> 00:28:27,542
(laughter).

429
00:28:27,542 --> 00:28:31,918
RICKY HILL: Also Mr. Nick Hopler.

430
00:28:44,250 --> 00:28:47,999
(Video playing.)    RICKY HILL: This

431
00:28:47,999 --> 00:28:49,876
of the Phantom.

432
00:28:50,918 --> 00:28:54,334
What you see in the center there,

433
00:28:54,334 --> 00:28:56,209
very sophisticated.

434
00:28:56,209 --> 00:29:00,999
Uses GPS accelerometer and even uses

435
00:29:00,999 --> 00:29:04,083
to orient itself in space.

436
00:29:04,083 --> 00:29:08,250
I have seen advertised GPS that it's no

437
00:29:08,250 --> 00:29:11,083
to 9 feet or something.

438
00:29:11,083 --> 00:29:13,375
This thing actually does better than

439
00:29:13,375 --> 00:29:15,542
It does a space about this wide

440
00:29:15,542 --> 00:29:17,876
with that controller.

441
00:29:19,083 --> 00:29:23,209
The Phantom has no moving parts

442
00:29:23,542 --> 00:29:27,876
What you see on the end are

443
00:29:27,876 --> 00:29:29,999
They're on each thing.

444
00:29:29,999 --> 00:29:34,209
The only damage this thing had was

445
00:29:34,209 --> 00:29:40,751
you can see the end when it did that full

446
00:29:40,751 --> 00:29:43,918
so the propellor was bent.

447
00:29:46,167 --> 00:29:51,709
The hard shell is about 60 bucks

448
00:29:59,125 --> 00:30:04,459
So mission number 3 is the attempt

449
00:30:04,459 --> 00:30:06,334
That's to do a rooftop landing.

450
00:30:06,375 --> 00:30:08,792
We did quite a few rooftop landings.

451
00:30:10,125 --> 00:30:14,417
We ran Airmon ng before and

452
00:30:14,417 --> 00:30:15,709
We did some URL sniffs.

453
00:30:18,375 --> 00:30:22,000
I can tell you by virtue

454
00:30:22,000 --> 00:30:24,083
vantage points.

455
00:30:24,083 --> 00:30:28,626
When you land on somebody's roof,

456
00:30:28,626 --> 00:30:29,626
You're there.

457
00:31:17,167 --> 00:31:18,501
(Video playing).

458
00:31:18,501 --> 00:31:21,375
RICKY HILL: So the thing is, this

459
00:31:21,375 --> 00:31:22,999
This thing is pretty far away.

460
00:31:22,999 --> 00:31:25,999
The problem is if you

461
00:31:25,999 --> 00:31:29,501
on a roof, you lose the farther

462
00:31:29,501 --> 00:31:33,083
the more depth perception you lose,

463
00:31:33,459 --> 00:31:36,083
So there is an onboard camera.

464
00:31:36,083 --> 00:31:37,375
I can show you guys after.

465
00:31:37,375 --> 00:31:39,292
It is about the size of a postage stamp.

466
00:31:39,292 --> 00:31:42,542
First person view camera was I looking

467
00:31:42,542 --> 00:31:46,459
if you wonder why I'm hanging up there,

468
00:31:46,459 --> 00:31:49,334
on the platform in front

469
00:31:49,334 --> 00:31:53,999
on it that I'm wondering

470
00:31:54,292 --> 00:31:56,083
That doesn't look so good.

471
00:31:56,083 --> 00:31:57,501
Let's back up a hair here.

472
00:31:57,999 --> 00:32:01,667
So decided to abort

473
00:32:01,667 --> 00:32:04,999
for the actual platform there.

474
00:32:11,292 --> 00:32:13,751
There is the chopper going down.

475
00:32:22,334 --> 00:32:25,417
This is a clubhouse on the lake,

476
00:32:25,417 --> 00:32:28,334
There you can see their lawn chair,

477
00:32:28,334 --> 00:32:30,999
There were no people here thankfully

478
00:32:33,999 --> 00:32:38,626
Now we all held our breaths

479
00:32:38,626 --> 00:32:41,292
a few ops before this.

480
00:32:41,292 --> 00:32:43,125
The video has been clipped together.

481
00:32:43,125 --> 00:32:45,999
But we held our breaths and did

482
00:32:45,999 --> 00:32:46,999
(Music).

483
00:32:46,999 --> 00:32:47,999
(applause).

484
00:33:21,999 --> 00:33:24,125
RICKY HILL: Thanks.

485
00:33:29,083 --> 00:33:32,167
So we did encounter a couple of places.

486
00:33:32,167 --> 00:33:33,999
And what you have to worry

487
00:33:33,999 --> 00:33:36,292
or you are doing surveillance is,

488
00:33:36,292 --> 00:33:38,751
if you're doing private property

489
00:33:38,751 --> 00:33:41,334
the people might be pissed

490
00:33:41,334 --> 00:33:43,709
to collect their wireless

491
00:33:43,709 --> 00:33:46,083
outside their window, right?

492
00:33:46,083 --> 00:33:47,083
It's natural.

493
00:33:47,083 --> 00:33:49,501
I personally have shotguns

494
00:33:49,501 --> 00:33:50,501
Watch this.

495
00:33:50,501 --> 00:33:51,501
Oops.

496
00:33:51,501 --> 00:33:52,999
We're not going to stay here.

497
00:33:55,083 --> 00:33:57,334
Let's get the hell out of there.

498
00:33:57,334 --> 00:33:59,751
That thing will do 35 miles an hour,

499
00:34:07,209 --> 00:34:08,999
(Video playing).

500
00:34:16,667 --> 00:34:19,999
RICKY HILL: These are just a few

501
00:34:20,083 --> 00:34:22,209
I know they're hard to see.

502
00:34:22,209 --> 00:34:26,334
But SSL Strip, I actually hacked

503
00:34:26,334 --> 00:34:28,792
with SSL Strip.

504
00:34:28,792 --> 00:34:30,834
Basically what it does it collects.

505
00:34:31,501 --> 00:34:35,876
As man in the middle,

506
00:34:37,501 --> 00:34:40,751
Urlsnarf, the same way,

507
00:34:40,751 --> 00:34:42,584
you're going to.

508
00:34:42,584 --> 00:34:43,999
That's results there.

509
00:34:45,876 --> 00:34:50,083
We did compare ourselves

510
00:34:50,334 --> 00:34:53,999
I know they're hard to see,

511
00:34:54,083 --> 00:34:55,709
All the teams failed.

512
00:34:55,709 --> 00:34:58,334
Nobody even made

513
00:34:58,334 --> 00:34:59,751
Let's go down one here.

514
00:34:59,999 --> 00:35:03,709
One team, Team Halo, made 47 points.

515
00:35:03,709 --> 00:35:08,999
The Phantom, if we score it

516
00:35:08,999 --> 00:35:15,999
out of 12 helicopters two years ago

517
00:35:15,999 --> 00:35:20,834
avoiding obstacles and other baselines.

518
00:35:20,834 --> 00:35:22,999
If you want to see more want

519
00:35:22,999 --> 00:35:26,083
and UAVForge, go look at uavforge.net.

520
00:35:27,167 --> 00:35:29,999
It is a very interesting contest,

521
00:35:29,999 --> 00:35:32,334
a lot more crashes there.

522
00:35:38,751 --> 00:35:45,501
We proved perch and gauge

523
00:35:45,501 --> 00:35:48,667
It is a highly effective site survey tool.

524
00:35:48,667 --> 00:35:54,459
The take away from this is drones

525
00:35:54,459 --> 00:35:56,999
or bad, right?

526
00:35:56,999 --> 00:35:59,751
They can be used to peer

527
00:35:59,751 --> 00:36:02,709
They can be used

528
00:36:02,709 --> 00:36:05,209
other important places.

529
00:36:05,209 --> 00:36:08,918
Or they can be used

530
00:36:08,918 --> 00:36:11,834
They're sort of, you know it

531
00:36:11,834 --> 00:36:15,792
basically, right,

532
00:36:16,083 --> 00:36:17,999
We hope they're used for good.

533
00:36:18,542 --> 00:36:21,584
So keep that in mind

534
00:36:21,584 --> 00:36:24,125
or keeping drones flying

535
00:36:24,125 --> 00:36:26,959
is evaluating who's going to be able

536
00:36:26,959 --> 00:36:29,501
in the United States and where.

537
00:36:29,667 --> 00:36:32,999
That's due out, I believe, mid 2014

538
00:36:32,999 --> 00:36:36,417
Right now I flew

539
00:36:36,417 --> 00:36:40,999
entity sponsored me, I'm flying

540
00:36:40,999 --> 00:36:45,999
wherein I have to maintain an altitude

541
00:36:45,999 --> 00:36:51,459
If any of you guys fly, I implore you,

542
00:36:51,459 --> 00:36:57,792
the disclaimers is not fly this

543
00:36:57,918 --> 00:37:01,083
If you don't have experience flying

544
00:37:01,083 --> 00:37:03,959
with a $700 helicopter, right?

545
00:37:03,999 --> 00:37:08,334
Also, don't fly anywhere

546
00:37:08,334 --> 00:37:10,501
is not a lot.

547
00:37:10,501 --> 00:37:14,417
I was going to do before we decided

548
00:37:14,417 --> 00:37:18,792
near the Potomac river which

549
00:37:18,792 --> 00:37:20,501
and thought this was a cool resort.

550
00:37:20,626 --> 00:37:22,999
Let's do some drone operations here.

551
00:37:22,999 --> 00:37:23,999
Bad idea.

552
00:37:24,083 --> 00:37:25,834
Went out there.

553
00:37:25,959 --> 00:37:27,999
A bunch of golfers were in my balcony.

554
00:37:27,999 --> 00:37:29,167
You saw the balcony crash.

555
00:37:29,417 --> 00:37:31,999
Well, that would have been

556
00:37:32,250 --> 00:37:33,667
Think about it.

557
00:37:33,667 --> 00:37:36,083
The other thing over the Potomac,

558
00:37:36,083 --> 00:37:40,375
to Reagan National Airport which

559
00:37:40,375 --> 00:37:42,501
I thought there couldn't be any airplane.

560
00:37:42,501 --> 00:37:44,083
They will be thousands feet out.

561
00:37:44,083 --> 00:37:48,209
No, they are 800, a thousand feet,

562
00:37:48,542 --> 00:37:50,626
So bad idea.

563
00:37:50,626 --> 00:37:53,209
If you are going to fly anywhere,

564
00:37:53,209 --> 00:37:56,626
in a local RC club or whatever

565
00:37:56,626 --> 00:38:00,751
the right thing and you're not

566
00:38:00,751 --> 00:38:01,999
It is all fun.

567
00:38:01,999 --> 00:38:03,626
We had a great time doing this.

568
00:38:04,876 --> 00:38:07,542
This is one tip I have

569
00:38:07,542 --> 00:38:09,417
guys afterwards.

570
00:38:09,709 --> 00:38:11,792
It is an altimeter.

571
00:38:11,834 --> 00:38:15,083
It is just an USB stick, basically.

572
00:38:15,083 --> 00:38:17,959
You get on the elevator, punch

573
00:38:17,959 --> 00:38:20,083
until how high you got.

574
00:38:20,083 --> 00:38:23,501
It fits well in about any copter you want

575
00:38:23,501 --> 00:38:24,999
What's 400 feet?

576
00:38:25,083 --> 00:38:28,584
For the Phantom, it's about as far

577
00:38:28,584 --> 00:38:30,999
When it starts to get

578
00:38:30,999 --> 00:38:33,501
you know, you're too high.

579
00:38:33,542 --> 00:38:35,876
You're in aircraft space now.

580
00:38:37,792 --> 00:38:40,125
Again, that's about it.

581
00:38:40,125 --> 00:38:41,501
Let's see what I got here.

582
00:38:42,999 --> 00:38:46,999
Some shoutouts

583
00:38:46,999 --> 00:38:50,375
out with operations, Nick Hopler, Mr.

584
00:38:50,375 --> 00:38:54,083
Search and rescue right here.

585
00:38:54,083 --> 00:38:55,501
Thank you very much, Nick.

586
00:38:55,501 --> 00:38:56,501
(applause).

587
00:39:00,709 --> 00:39:03,584
And the hobby hangar in Chantilly,

588
00:39:03,584 --> 00:39:04,083
I have the advantage of being able

589
00:39:04,083 --> 00:39:05,959
and get parts for the Phantom.

590
00:39:05,959 --> 00:39:08,959
I will leave you here

591
00:39:08,959 --> 00:39:09,959
(applause).

592
00:39:09,959 --> 00:39:11,626
RICKY HILL: Thank you very much.

593
00:39:11,626 --> 00:39:11,626
We might fly this in the parking lot

594
00:39:11,626 --> 00:39:12,792
if we can pull that off.

595
00:39:12,792 --> 00:39:14,501
So I will try to let everybody know.

596
00:39:14,501 --> 00:39:18,918
After the scenes you have seen,