>> I am Chris Littlebury, and this is all about automating home defense.  A little about me, I am a senior penetration tester with knowledge information group.  We are hiring, if you have skills, let us know, and I like building stuff.  Couple of pictures there, it's an Xbox Live Controller that ummm did a randomization thing on it, so you can do rapid fire and it won't be detected on Xbox Live cause it had a randomizing cadence to it, yea it's cheating, I used it once and it just sat on the shelf, but   ‑  ‑   one of my first really your own   ‑  ‑   and the other picture is swapping out the 5th gear on my car to get better mileage, anything I can do with my hands, on stuff, so   ‑  ‑  
>> A quick disclaimer.  During this talk, providing ideas, codes that worked for me, things that haven't worked, pretty much just a trial and error thing, afterwards, definitely open to questions, suggestions.  I like to hear what other folks have to say.
>> I am not getting paid to endorse anything, there's a bunch of products I will be talking about, they work well, some have strength and weaknesses, we will go over that.  Nobody is paying me to be here.  And I definitely not promising an end to burglaries especially if you live in high‑risk areas, sorry you're screwed  ‑  ‑   but you can try to stack the odds in your favor.  Definitely not advocating setting up booby traps in your house.  This is a big federal no‑  no.  A lot of people approached me, yeah, I want to build a moat and have a spike pit  ‑  ‑   and shit come flying down with spikes when you open the door when I am home alone   ‑  ‑   you will go to prison.  So please   ‑  ‑   I am not advocating that.  Please don't do it.  Don't do anything that can result in hurting other people or property damage.  It's something   ‑  ‑   doing something to somebody's car that's on your property or something, just use your head, don't break shit.
>> Lastly, a live example from my place, stuff I have done, please don't come and test my home, again, I would love to talk with folks afterwards and have you thought about this and wow   ‑  ‑   I haven't thought about this, thank you for   ‑  ‑   let's open up a cool discussion about it instead of showing up at my place at 1:00 in the morning, standing over my bed freaking me out.  Which somebody of yall deviant bastards would do such a thing.
>> So, store starts out once upon a time in South Texas.  I was living in San Antonio, below the poverty line and they like to have a great tourism, Riverwalk, nice place to visit, family affair and everything, and   ‑  ‑   completely talking trash.  Anybody here from San Antonio? 
>> Thank you.  Yes.  So anybody else from San Antonio?  I will talk shit so I apologize, I spent 10 years there, I feel adequately qualified to do so.  The crime map in San Antonio is just terrible.  Their local pastimes are DUIs and home invasions, just what they are known for.  It's bad.  So they ranked number 3, I forget what year this was, but they were like the third least safe city in America.  So   ‑  ‑   at the time I had this little Honda Civic, and again   ‑  ‑   anybody have a Honda Civic, or had a Honda Civic   ‑  ‑   keep your hands up if it was stolen.  You are my people.  Okay.  At the time it was the most‑  stolen car in America and I happened to have it.  Air conditioning, good mileage, worth about $1500, that's all I needed, right?  I came out one morning and the doors were unlocked, people had gone through my stuff but the car was still there and I was like yeah, this sucks, I would like to be able to do something.  I should be able to out‑smart them.  I like to soldering stuff   ‑  ‑   I should be able to out‑smart them.  I had an idea.
>> They have a main fuel relay up near the kick panel.  You unbolt it, it's like a  12-pin connector   ‑  ‑   you take this with you and the car completely is immobilized.  Sure, there's a chance somebody breaking in like oh gee, I happen to have one of those and I will look there, but I roll the dice.  Pretty safe bet.
>> I also got cheap alarms that pages you, so I hooked it up without sirens, lights, anything, I removed the relays in it to trigger the lights and turn signals, so I removed everything.  All it does is page you.
>> It's a car, sure, but my car, I wanted to drive it to work.  I kept it that way three months and sure enough, it worked.  Early one morning the alarm goes off and I go running down stairs and there's two respectable gentleman going to work on my steering column. I persuade them to exit the vehicle, one of them runs, the other tries to establish a kind dialogue with me. I was able to, through power of persuasion, maybe you should lay down on the ground and wait until the cops come.  I was effective in doing so, they came out, arrested him and   ‑  ‑   I was like you know what?  I think it's time to move away from the shithole, because   ‑  ‑   other neighbors, tons of anecdotal evidence that it was just a bad place.  Case in point, I found this on Reddit a year or so ago, I said that looks like a lot my old apartment complex and sure as shit, it was my old apartment complex.  So somebody got upset, set their ex's car on fire, burned down a few other things, it was terrible.  So I moved up to a nicer area.  Actually this picture is one of the three times in the history of mankind it snowed in San Antonio and I mean it just dusted a tiny bit, people were trying to sled on it. 
>> Anyway, it was a nicer place.  I moved up to the third floor, tried to get as high off the ground as possible, okay, that  ‑ ‑   you make it more difficult to get into, lock exterior doors, even sliding doors, third floor on the balcony, that kind of thing, stacking the odds in your favor.  You won't keep everybody out but, everywhere I looked, there were all these tips from cops,  and the number one thing that kept popping up was "make your home look occupied." If people come by, knock on your door, make it look like somebody is home.  Lights on timers, leave TVs on, just stuff that makes it look occupied.  You see the other stuff, lock your doors, basic stuff.
>> That got me thinking.  Everybody has seen the movie Home Alone, right?  Yeah.  So I steal off of that during this talk a little bit, so   ‑‑   I thought okay, I work a weird schedule, at night, ‑‑   during the day sometimes, all over the place, but I wanted something that would make the place look normal all the time.  At the time the cheapest automation stuff was the Extent hardware.  I am waiting to hear groans.  Anybody done that before?  It's terrible, yeah.  It's been around since the late 70s, and really cheap hardware, works off of sending data over your home power line.  What it does, included on 120‑  hertz carrier, transmits during the zero crossing, and it sucks so much that it sends the command three times every time it   ‑  ‑   it knows it's not reliable, but if you are in a small apartment complex or older house where the wiring is not that complex, it worked.
>> They had this God‑awful GUI you can program, macros, certain things, none of it worked really well but some of the timers had a cool feature, security feature you can time, say, you want everything to turn on at 5:00, every day.  They had a security feature where it would turn on anywhere between like 4:50 and  ‑‑  and it would be raining every day.  It's a cheapy company, the tech is terrible, but it's doing what I want it to do.  So eventually I moved to a house.  Excuse me. 
>> I moved to a house, started doing it with exterior lighting   ‑  ‑ So I had lights would come on at different times, some would use photovoltaic centers, some using the Extend, but it wasn't anything special, but ‑‑  is this wooden?  So knock on wood, I never had issues.  It seemed to be occupied all the time.  The neighbors got broken into but mine   ‑  ‑   I didn't have issues.
>> But, eventually, I moved away.  So I moved back to Colorado after a 10‑  year hiatus, crime is a lot better there, I will do it right this time.  So, I will do it right.
>> Of course I have to advocate, do not set up booby traps in your house.  It would be cool as shit, but, what are they going to do?  My wish list was I wanted efficient lighting.  Most of the stuff out there for doing wall switch and lighting and things are all incandescents, 60, 80, 100 watt bolts per can, the equivalent of a microwave or something.  That just wasn't cool.  I wanted efficient lighting, granular control over it, do individual zones, turn things on and off whenever I choose, have some sort of centralized way to control it   ‑  ‑   adaptive timing, not always the same schedule, randomization and things.  Again, I wanted it to look like it was lived in as much as possible.  Do some geofencing, anybody done the if-then stuff?  No?  Okay.
>> There's some if‑then geo fencing, I have read it's a 20% success rate.  You establish a geo fence on your phone and leave, once you leave certain actions happen.  Arms your security system or turns lights off, people leave their house and lights are just on until 10:00 at night.
>> I wanted to do my own that I had control over and, yes.  I wanted to be able to do defenses against wireless home automation attacks.  Everybody all around for last year's DEF CON?  The Z wave enabled door locks are encrypted.  Instead of breaking the encryption you just did a replay attack   ‑  ‑   replay the exact same thing over RF and the door was like "welcome home, buddy." Everybody was just ‑  ‑   holy shit.  Funny anecdotes, a week after that I had a dude come to my door, trying to sell that, Comcast, other places, building out home security system and have that sort of thing where it's on your smart phone, gee, I can look at cameras, know when my kid's coming home  ‑  ‑ I can spy on my baby at night with infrared cameras, straight up Skynet shit, but they love it.  I can open my garage, unlock my front door.  That seemed like a terrible thing to me.  I wanted to be able to defend it.
>> Not only that, if somebody really wants to get in it's just smash and grab.  If you have a great alarm system you have a big giant ADP sign, prominently displayed, it's like please, please, don't screw with this house.  If they really want to, they will do if anyway.  I am sure everybody in the room has friends that during the day people kick in the front door, alarm goes off, they grab stuff and take off.  That's how it is.  I wanted to be able to do something that would immediately react to that and try to mitigate what they can carry.  If they kick in the door, alarm goes off, they are freaking out and something that they have never seen before happens inside the house that might be like, you know what maybe we should GTF out.
>> That was my wish list.  One of the first things I did was Wi‑Fi enable lightbulbs   ‑  ‑   did anybody get in on the LiFX kickstarter?  No?  Awesome.  So they did, started a while back, took a while to ship the bulbs, had a bunch of regulator   ‑  ‑   regulation things to do, but in the grand scheme of things their Wi‑  Fi enabled LED bulbs, big claim to fame is they will do 1000 lumens  ‑  ‑   they are bright as shit.  They will always do full color, their full color representation is fantastic if you are into that, the picture with the blue is my living room, two of them in the ceiling, it's, yeah, cool.  Side note to that, I will talk about later, if the alarm goes off one thing it can do is the whole house can start flashing red.  So   ‑  ‑   [laughter] upstairs, down stairs, entry way, chandelier, everything, the whole damn house will just light straight out of aliens sort of thing.  Everything   ‑  ‑   if I can rig up a fog machine too   ‑  ‑   leave her alone, you bitch.  So they are great bulbs, at full power draw 17 watts, fits into their   ‑  ‑   i'm not drawing a ton of power.  And you can dim them down, do it all through software.  They recently released an API, so any Ruby fans out here?  Good.  Good.
>> No.  Anybody from Python?  You are my people.  All right.  And I will get to that with the open source, but several different libraries to work with.  The official API is in Ruby, not that bad to work with, you can port over to python, but yeah.  The down side to these bulbs is they are large.  They have some heft to them.  You can't put them in normal fixtures that sit sideways.  They will start sagging down when they come in contact with the globe   ‑  ‑   look terrible and heat up a bit.  You can't enclose them.
>> The other option is the Philips Hues ‑  ‑   really easy to work with, great API, has python, so   ‑  ‑   python people.  Even lower power consumption 8.5 watts at full brightness, a little cheaper.  Their power output is not the same.  You put three in a fixture, it will be like three 60‑  watt light bulbs, but it's a good option.  The color representation isn't as good, but if you are looking at lighting up a side room, dining room, if you want to be able to control that remotely, still have the thing flash red, freak the hell out of people, it's a fantastic choice.
>> Couple pictures.  Fourth of July at my place, the camera didn't do it justice.  The purple are actually blue and red ones are red, that was LiFx and Hue bulbs.  My living room just, messing around and   ‑  ‑   during my perfect   ‑  ‑  
>> Audience question/comment.  [Laughter]
>> We're hiring. 
>> So yeah.  Other devices out there, WeMo devices, they had vulnerabilities last year that are really not good.  Fair enough?  They had them come out last year where there was a vulnerability where if they rapidly cycled them there's a hack where you can recycle, hook up for a load, like motor or something like that, initially a really large amperage and then settles down.
>> Are we distracting you?
>> No just concerning me  ‑ 
>> To our first time speaker ‑   [applause]
>> Thank you. 
>> We have been doing this four days.  Three talks, every hour, I have lost track.
>> I really want to get me one of those little rascals.  So, the WeMo devices, you can rapidly cycle and depending on where the device is hooked up, they can catch fire and burn the place down.  It's bad.  So they have since pushed out a firmware update for them, but still not that secure   ‑  ‑   what I have read, lock down IPv6 on the routers, don't have anything else and just lock down everything you have.  With that said, they are extremely useful for if you have exterior lighting where you have CFL bulbs, like all around your house, hook up one of these, talking about 20 watts worth of draw all night, then you can switch it with one of these switches.  The problem being they have timers built in, their own app and own timers built in, both of which completely suck.  Their app is not reliable and their timers, well they work, sometimes, if you have, like say your external lights you want to turn on at 8:00 at night and keep them on until 6:00 in the morning, when it comes up on midnight they will shut off a few seconds, midnight five seconds later they will come back on and there's no rhyme or reason for it so if somebody is casing your house or whatever, it's a pretty good indicator  ‑‑   and again, yes, terrible security.  There's a link to that exploit on there too   ‑  ‑   and the slides will be available and everything.
>> So, creating a home defense server, available 24/7, low power consumption, hook up to an UPS, integrate with sensors, be able to pull your own sensor network, and integrate with your existing home security system.  It would be more of a supplement.  Can you build one on your own, and have it respond, do stuff, but I am of the mindset I like someone monitoring.  If they call the cops, the cops come out.  Whereas if I see something in a text message, hi, I am Chris, I built this Rube Goldberg system at my house, can you go check it out.  Sir, this is 911, don't ever call back.  If it supplements your home security system you at least have a little bit of clout.
>> Couple of slides integrated in, but the raspberry pi is a good choice.  And again, how many people mess with raspberry pi? they're fantastic, they're wonderful.
>> I had a little experience with pis before.  I built a Wi‑Fi enabled barbecue smoker just because, shit, I didn't know if I could.  I got some meat probes, a probe for a GE oven that I found, all the other therma probes I could find were worthless after 240 degrees.  I found one good to 400, put a rail server on there   ‑  ‑   what's that?  Sorry, ADD.  I put a rail server on the front end, I had rails experience at the time and just didn't know any better.  Any rails coders here?
>> Good.  But it worked and it was one of those proof of concepts where I could build not only the sensor portion, but have a front‑  end riding on the same hardware, all self‑  contained, on wireless and do fun stuff with it.
>> So, creating a home defense server, anybody familiar with wiring in   just regular  home systems where you have a long line of sensors and everything has to be   ‑  ‑   for it to be okay   ‑  ‑   yeah.  There's two different ways of doing it.  You can have a closed loop or open, and either way  most of the newer ones you can program them through   ‑  ‑   to do either way.  Stick the pi online with that and put it in the mix and put relay   ‑  ‑   the power you want to wire in and have it connected to its own network, say you have your own PIR sensor, or your own what‑  have‑  you.  You can then send a signal to that pi, it can trip it and fire off the security system.  Another thing you can do, they have a panic button, wireless panic buttons, take one of those apart and solder on, run transistor over that, something happens you hit that, when it goes to the alarm company it will go in as silent alarm instead of oh a motion or door alarm.  Straight across.  Silent alarm, old Betsy fell down or old Betsy is being robbed by hoodlums, whatever.
>> A lot of ways to graft it in and I highly recommend grafting it into the alarm system.  There are a lot of different open source out there for   ‑  ‑   Magic Monkey did the original version   ‑  ‑   the big giant LED bulbs, and great, great tool, only thing is it wouldn't do multiple bulbs, if you want to flash your entire down stairs red it would be one bulb, one bulb, kind of sucked.
>> And then   ‑  ‑   sorry, he was the job scripter on that and Sharp did the LiFX Python which was built off of that, later on, LiFX came out with the official API, written in Ruby, we have all been over this.  You can make it work.  It's a good API, I just have this thing against, and there is   ‑  ‑   I can't pronounce this guy’s name or project name, but they have an API for the WeMo devices and it works fantastic.  Code support and command line support.  It's great stuff.  You can control all these things just from command line or different scripts.  So from there I created a front‑end service where I wanted something like weights to control the stuff, front end.  You can do rails, rails sucks.  It's heavy.  Python has flask ‑‑  Ruby has Sinatra  ‑‑   back end services for each of the tech screen readers, their own services and on their own ports.  So if one of them fails, then just that service fails, so I don't lose everything in my house sort of thing.
>> Also, I wanted to have a database keep track of it all  ‑   I ended up put up on separate pi, really light weight, fast, and not that complicated.  I wasn't looking for giant enterprise‑  level stuff, just wanted something quick.  On a separate pi, separate room.  If you go that route I highly recommend you put external swap on, get a powered USB hub, hard drive on it and set up swab, even if you have a great SD card, you look at the log, just swapping out all the time and all those read/writes, are hell on those cards, so   ‑  ‑   finally creating a monitoring service with alerts and one of the services go down, be nice to know about it.
>> Again, all the code we are talking about here will be available on a GetHub after the conference.  I am going to do a disclaimer right now that my code is terrible.  I am not a developer.  I am a pen tester, so my code works, not pretty, for the ones that are professional Devs, like nice polished code, it may be offensive to you.  So just ‑  ‑   but it works.
>> Moving on.  I wanted to be able to determine if I am walking into a room and things happen.  I want my place to know if I am there or not.  Originally I wanted to do Bluetooth, pair to my phone and know if I am walking into a room, it will see my phone, okay, he's here, and then whatever else happens, update it in the database I am there, certain other things.  So I played around with it, it was kind of a pain in the ass.  You have to create a connection, open the device after it's been paired  ‑  ‑   while being pulled, you have to do the request for the RS   ‑  ‑   the signal strength identifier.  You do that, pull it, while being pulled say oh by the way what's the signal strength, come back with a number and from there you say oh the phone is within this amount of distance.  You put a couple of those in different rooms and you can determine where something is but if you get to aggressive with that it will break your wireless interface on your phone.  Not just Bluetooth but regular 802.11 as well.  That was a fun one to find out when I   ‑  ‑   but it worked, for a bit.
>> From there I went to do it with 802.11, your phones will   ‑  ‑   beacon every 60 seconds if you are not doing anything but as soon as you turn them on, start doing stuff your MAC address will be all over the place.
>> There's a command line utility where you can go through and parse out what MAC is being seen and what signal strength it is.  If you have neighbors and stuff that you don't care about, I will be lower signal strength and you can grit that out.  But if you have a certain set you want to keep track of, significant other, kids, whatever, a list of things that it will look for.
>> If you are really curious about it, the Tshark command on the very bottom will bust out just way more information than you will ever want to know about wireless packets and you can do all sorts of magic with it.  I did a python way with scapy and it's ugly, it's very, very ugly, but it works and so what I have been doing, I have a flat file of MAC I want to keep track of.  It fires up, starts looking for those, when it sees it, it updates the database that okay, it's been seen, what time it's been seen and a separate process goes through the database to look at time stamps, outside of certain time, okay, it hasn't been seen in this amount of time so I am not there, other rules now apply.  Lights will be turning off, at pre‑determined times, still random, that way it knows if I am home so I am not sitting watching TV and the whole living room goes dark.
>> Again, proximity monitoring looks for a   ‑  ‑   signal strength actually, I just went over all that.  Adaptive scheduling.  I created a SmartCron system  ‑  ‑   everybody familiar with weather integral   ‑  ‑   they have a fantastic API free for developers.  Every day at 1:00 my   ‑  ‑   will pull down the source schedule for the day, sunrise, sunset, that sort of thing and from there block off randomized times of, okay, I want to turn off my outside lights sometimes around sunrise, turn them on somewhere around sunset, bunch of other stuff.  It shifts every day, and things are built in, cloud cover, UV index, moves interior lights if   ‑  ‑   again   ‑  ‑  
>> So, for the fun stuff.  Defenses against wireless based attack.  You saw this last year.  Does anybody go to the fox hunting thing on Thursday?  Really early on Thursday, I went to the Wrapping 7 party before and was not able to get there.  No?  So the fox hunting is RF direction finding, really cool stuff.  The only way I can think of to defend against these sort of Z wave attacks, a replay attack or somebody trying to jam 345 Meg sensor data   ‑  ‑   newer alarm systems that use those, should be able to determine if somebody is transmitting on the band and where from.  Anybody familiar with the Doppler effect?
>> For the ones that aren't, ambulance goes by, high‑  pitched coming and regular pitch as it goes by, lower pitch as it   ‑  ‑   same with RF.  You have the signal, switch through it fast enough you can get a good idea of where it's coming from.  I have a setup that works against 345 and 900 mess   ‑  ‑   so if anything does key up, outside of a certain parameter for where it's located, I haven't actually stepped past my front door but anything outside my house will pick up  ‑‑  it uses the Agrello DF message format, whereas it's signal quality, the system I use called the picodopp  ‑‑  fixed at 7 for signal quality but I don't care, I just want to know where it is.  The text there you see is an actual output from a test I was doing  ‑  ‑   and the numbers 327, 316, 312, 319, those are all numerical bearings off the antenna array of where the signal is coming from.  I was able to sit outside with one of the sensors, one of the 345 sensors, and key it off, the system says hey, there's something coming from outside and   ‑  ‑   you can pipe that into a database as well, have that do time stamps, if it's a bunch you know somebody is jamming, it's from outside, up know somebody is trying to do a Z wave attack.  The possibilities are endless.  If you put two together, correlate the two and have real‑  time triangulation.  It's fun.
>> Lastly, again, a lot of folks want to just kick in the front door.  Alarm goes off, they don't care.  They want to steal things.  The best thing you can do is try to make it an inhospitable environment for them.  They want to be quiet, anonymous, just get in and out and nothing happen, right?  So I talked about earlier on the whole house will flash red, that's a good way to do it, especially if it's at night, the whole suburban house is horrible, you can flash exterior lights as well.  Do something that is going to be electronically activated and do something in a safe way.  Again, safe way, nobody wants to be sued.  One thing you can do is hook up a 12-volt solenoid or   ‑  ‑   for door lock, people who   ‑  ‑   car handles, these real high‑  powered solenoids you can push/pull with.  Have it set up somewhere to knock over something.  Alarm goes off, people come in, all of a sudden they   ‑  ‑   something upstairs.  What the hell was that?  It will buy you a few seconds, and don't create anything that can do harm.
>> With that said, so this is purely theoretical.  I don't want anybody to ever do anything like this, especially with doors   ‑  ‑   everybody knows, don't do this.  Don't build your own fireworks either.  You can go buy firecrackers, around the fourth of July they are very cheap.  Do not break these open or combine them into something, again, this is Chris Littlebury at DEF CON 2014 saying do not create your own fireworks.
>> So they make these things for model rockets, I have a good friend, figuring out a way to light these, dude, they are rocket igniters.  I said dude, tell me more about this.  This is the middle thing with the black   ‑  ‑   wires that come in, really thin wire at the end and spark plug material on top of it.  What happens, you put power in, shorts out, ignites the spark plug and it creates fire.
>> If you have it taped up to a bunch of firecrackers like that, it will go boom.  For the sake of argument, if I were going to do something like this I would do them one‑  on‑  one, separate channel for each one, fire one off individually, it would be like a bang, bang bang, bang, not something that sounds like the kid from home alone put something in the the thing and lit it all on fire have it sound something realistic.  But inside a closed space it will be super loud.  Your mileage may vary, may be completely illegal, do it somewhere nothing will catch on fire.  These things fly off in the air.  I have found them on the roof of my car testing them out.  It's a lot of shit.  To give you an idea   ‑  ‑   [firecracker sounds]
>> That was just 12‑volts with just that one strand that you saw before.  Again, you can do that with pi, just drive a relay and apply four volt and boom it goes.  So from here, I don't have any Z wave integration yet, it's not open‑source, shit's expensive.  I would like to be able to do that.  I would like to integrate SDR scanning into the 345 band for the wireless sensors, that sort of thing, to be able to read those on the fly, not just the hard line.  If there's any SDR guy that's know how to pull information out of 345 meg AM  ‑  ‑   signal, and actually use it, talk to me afterwards.  That would be awesome.
>> There's the 345 900 Meg receiver, transmitter that   ‑  ‑   wanted to spend time in the hacking village, see how that works out.  That came out a day before I got on the plane to come here.  I want to hear ideas from you guys.  If you have awesome stories that don't include giant pits with spikes at the bottom   ‑  ‑   no, no.  Question?
>> [indiscernible]
>> Shut the door after the   ‑  ‑   no, that may be a good idea but that also could be some sort of booby trap, that theoretic firework thing if somebody implemented such a thing, not that I would, but if it did and the door was shut, they were not able to have a timely egress outside the establishment, were to be maybe burned alive, that would be bad.
>> Anyway, I am running out of time, I apologize, any questions, there's my Twitter, e‑  mail, all that.  Come find me afterwards.  Yes.  [Applause]